Just getting stuck with reading registry values like a string in sztext
Take for instance the key:

HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemPartition

I want to read the string value stored in 'SystemPartition' which isnt a subkey, but a key of type REG_SZ.... and im getting problems..
tried using RegQueryEx and stuff.. it returns 2 in eax.. and no value thats in the key i selected..

basically just to read values of a specific key in the registry.
not the whole key directory if possible.
Posted on 2005-02-06 05:14:42 by pwn
this might be usefull:



comment /
;Valuename=NULL returns default value type and data

invoke SetRegString, HKEY_LOCAL_MACHINE,
chr$("Software\MASM\Registry Test\"),
chr$("StringKeyName"),
chr$("aaa")

invoke SetRegDword, HKEY_LOCAL_MACHINE,
chr$("Software\MASM\Registry Test\"),
chr$("DwordKeyName"),
4500

invoke GetRegString, addr szBigBuffer,
HKEY_LOCAL_MACHINE,
chr$("Software\MASM\Registry Test\"),
chr$("StringKeyName")

invoke GetRegDword, HKEY_LOCAL_MACHINE,
chr$("Software\MASM\Registry Test\"),
chr$("DwordKeyName"),
addr dwValue
invoke Reg_Delete_Value,HKEY_LOCAL_MACHINE,
chr$("Software\MASM\Registry Test\"),
chr$("DwordKeyName")
/

SetRegString proto :dword, :dword, :dword, :dword
GetRegString proto :dword, :dword, :dword, :dword
SetRegDword proto :dword, :dword, :dword, :dword
GetRegDword proto :dword, :dword, :dword, :dword
Reg_Delete_Value proto :dword, :dword, :dword

.data

.code

SetRegString proc reg_HKEY:dword, lpszKeyName:dword, lpszValueName:dword, lpszString:dword
local Disp: dword
local pKey: dword
local dwSize: dword
invoke RegCreateKeyEx, reg_HKEY,
lpszKeyName, NULL, NULL,
REG_OPTION_NON_VOLATILE,
KEY_ALL_ACCESS, NULL,
addr pKey, addr Disp
.if eax == ERROR_SUCCESS
invoke lstrlen, lpszString
mov dwSize, eax
invoke RegSetValueEx, pKey, lpszValueName,
NULL, REG_SZ,
lpszString, dwSize
push eax
invoke RegCloseKey, pKey
pop eax
.endif
ret
SetRegString endp

Reg_Delete_Value proc reg_HKEY:dword, lpszKeyName:dword, lpszValueName:dword
local Disp: dword
local pKey: dword
invoke RegCreateKeyEx, reg_HKEY,
lpszKeyName, NULL, NULL,
REG_OPTION_NON_VOLATILE,
KEY_ALL_ACCESS, NULL,
addr pKey, addr Disp
.if eax == ERROR_SUCCESS
invoke RegDeleteValue,pKey,lpszValueName
push eax
invoke RegCloseKey, pKey
pop eax
.endif
ret
Reg_Delete_Value endp

; -------------------------------------------------------------------------

GetRegString proc lpszBuffer:dword, reg_HKEY:dword, lpszKeyName:dword, lpszValueName:dword
local TType: dword
local pKey: dword
local dwSize: dword
mov TType, REG_SZ
invoke RegOpenKey, reg_HKEY, lpszKeyName, addr pKey
invoke RegQueryValueEx, pKey, lpszValueName, NULL, NULL, NULL, addr dwSize
invoke RegCreateKeyEx, reg_HKEY, lpszKeyName, NULL, NULL, REG_OPTION_NON_VOLATILE,
KEY_ALL_ACCESS, NULL, addr pKey, addr TType
.if eax == ERROR_SUCCESS
mov eax, REG_DWORD
mov TType, eax
inc dwSize
invoke RegQueryValueEx, pKey, lpszValueName,
NULL, addr TType,
lpszBuffer, addr dwSize
push eax
invoke RegCloseKey, pKey
pop eax
.endif
ret
GetRegString endp

; -------------------------------------------------------------------------

SetRegDword proc reg_HKEY:dword, lpszKeyName:dword, lpszValueName:dword, lpdwValue:dword
local Disp: dword
local pKey: dword
local dwValue: dword
push lpdwValue
pop dwValue
DW_SIZE equ 4
invoke RegCreateKeyEx, reg_HKEY,
lpszKeyName, NULL, NULL,
REG_OPTION_NON_VOLATILE,
KEY_ALL_ACCESS, NULL,
addr pKey, addr Disp
.if eax == ERROR_SUCCESS
invoke RegSetValueEx, pKey, lpszValueName,
NULL, REG_DWORD_LITTLE_ENDIAN,
addr dwValue, DW_SIZE
push eax
invoke RegCloseKey, pKey
pop eax
.endif
ret
SetRegDword endp

; -------------------------------------------------------------------------

GetRegDword proc reg_HKEY:dword, lpszKeyName:dword, lpszValueName:dword, lpdwValue:dword
local Temp: dword
local pKey: dword
local DWordSize: dword
DW_SIZE EQU 4
mov DWordSize, DW_SIZE
invoke RegCreateKeyEx, reg_HKEY,
lpszKeyName, NULL, NULL,
REG_OPTION_NON_VOLATILE,
KEY_ALL_ACCESS, NULL,
addr pKey, addr Temp
.if eax == ERROR_SUCCESS
mov eax, REG_DWORD
mov Temp, eax
invoke RegQueryValueEx, pKey, lpszValueName,
NULL, addr Temp,
lpdwValue, addr DWordSize
push eax
invoke RegCloseKey, pKey
pop eax
.endif
ret
GetRegDword endp
Posted on 2005-02-06 08:04:10 by diablo2oo2
nice code very helpful easy crackmes thx.
Posted on 2005-02-06 15:48:12 by pwn