could someone explain to me how it works, how do you specify which key to query when it only asks for the hive.
Printable View
could someone explain to me how it works, how do you specify which key to query when it only asks for the hive.
Code:RegQueryInfoKey
The RegQueryInfoKey function retrieves information about a specified registry key.
LONG RegQueryInfoKey(
HKEY hKey, // handle to key to query
LPTSTR lpClass, // address of buffer for class string
LPDWORD lpcbClass, // address of size of class string buffer
LPDWORD lpReserved, // reserved
LPDWORD lpcSubKeys, // address of buffer for number of
// subkeys
LPDWORD lpcbMaxSubKeyLen, // address of buffer for longest subkey
// name length
LPDWORD lpcbMaxClassLen, // address of buffer for longest class
// string length
LPDWORD lpcValues, // address of buffer for number of value
// entries
LPDWORD lpcbMaxValueNameLen, // address of buffer for longest
// value name length
LPDWORD lpcbMaxValueLen, // address of buffer for longest value
// data length
LPDWORD lpcbSecurityDescriptor,
// address of buffer for security
// descriptor length
PFILETIME lpftLastWriteTime // address of buffer for last write
// time
);
Parameters
hKey
Handle to a currently open key or any of the following predefined reserved handle values:
HKEY_CLASSES_ROOT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
Windows NT: HKEY_PERFORMANCE_DATA
Windows 95 and Windows 98: HKEY_DYN_DATA
lpClass
Pointer to a buffer that receives the key's class name. This parameter can be NULL.
lpcbClass
Pointer to a variable that specifies the size, in characters, of the buffer pointed to by the lpClass parameter. This size should include the terminating null character. When the function returns, this variable contains the length of the class string stored in the buffer. The count returned does not include the terminating null character. If the buffer is not big enough, the function returns ERROR_MORE_DATA, and the variable contains the size of the string, in characters, without counting the null character.
If lpClass is NULL, lpcbClass can be NULL.
Windows NT: If the lpClass parameter is a valid address, but the lpcbClass parameter is not (for example, it is NULL), the function returns ERROR_INVALID_PARAMETER.
Windows 95: If the lpClass parameter is a valid address, but the lpcbClass parameter is not (for example, it is NULL), the function returns ERROR_SUCCESS instead of ERROR_INVALID_PARAMETER. To ensure compatibility with other platforms, verify that lpcbClass is valid before calling the function.
lpReserved
Reserved; must be NULL.
lpcSubKeys
Pointer to a variable that receives the number of subkeys contained by the specified key. This parameter can be NULL.
lpcbMaxSubKeyLen
Pointer to a variable that receives the length, in characters, of the key's subkey with the longest name. The count returned does not include the terminating null character. This parameter can be NULL.
lpcbMaxClassLen
Pointer to a variable that receives the length, in characters, of the longest string specifying a subkey class. The count returned does not include the terminating null character. This parameter can be NULL.
lpcValues
Pointer to a variable that receives the number of values associated with the key. This parameter can be NULL.
lpcbMaxValueNameLen
Pointer to a variable that receives the length, in characters, of the key's longest value name. The count returned does not include the terminating null character. This parameter can be NULL.
lpcbMaxValueLen
Pointer to a variable that receives the length, in bytes, of the longest data component among the key's values. This parameter can be NULL.
lpcbSecurityDescriptor
Pointer to a variable that receives the length, in bytes, of the key's security descriptor. This parameter can be NULL.
lpftLastWriteTime
Pointer to a FILETIME structure. This parameter can be NULL.
Windows NT: The function sets the members of the FILETIME structure to indicate the last time that the key or any of its value entries was modified.
Windows 95: The function sets the members of the FILETIME structure to zero. This is because the system does not keep track of registry key last write time information.
Return Values
If the function succeeds, the return value is ERROR_SUCCESS.
If the function fails, the return value is a nonzero error code defined in WINERROR.H. You can use the FormatMessage function with the FORMAT_MESSAGE_FROM_SYSTEM flag to get a generic description of the error.
Remarks
The key identified by the hKey parameter must have been opened with KEY_QUERY_VALUE access (KEY_READ access includes KEY_QUERY_VALUE access).
hKey
Handle to a currently open key or any of the following predefined reserved handle values: ??
how do you get the number, the only number i know how to get are the hive names.
where and how do you declair the FILETIME part of the function