Results 1 to 11 of 11

Thread: [RESOLVED] Registry Name from Handle

  1. #1

    Thread Starter
    PowerPoster Elroy's Avatar
    Join Date
    Jun 2014
    Location
    Near Nashville TN
    Posts
    6,314

    Resolved [RESOLVED] Registry Name from Handle

    Can we get the registry location key "name" from a hKey that has the registry entry open?

    You might ask, "how did we get it open without knowing its name?" But, that's easy. It's another API call that opens the registry entry without knowing its name, specifically SetupDiOpenDevRegKey (and there are probably others as well).

    So again, if we've just got hKey, is there a way to get the key's name?

    Thanks,
    Elroy
    Any software I post in these forums written by me is provided “AS IS” without warranty of any kind, expressed or implied, and permission is hereby granted, free of charge and without restriction, to any person obtaining a copy. Please understand that I’ve been programming since the mid-1970s and still have some of that code. My contemporary VB6 project is approaching 1,000 modules. In addition, I have a “VB6 random code folder” that is overflowing. I’ve been at this long enough to truly not know with absolute certainty from whence every single line of my code has come, with much of it coming from programmers under my employ who signed intellectual property transfers. I have not deliberately attempted to remove any licenses and/or attributions from any software. If someone finds that I have inadvertently done so, I sincerely apologize, and, upon notice and reasonable proof, will re-attach those licenses and/or attributions. To all, peace and happiness.

  2. #2
    Fanatic Member
    Join Date
    Feb 2003
    Posts
    925
    Several projects of mine that used to be posted here can now be found at: https://github.com/PeterSwinkels

  3. #3
    VB-aholic & Lovin' It LaVolpe's Avatar
    Join Date
    Oct 2007
    Location
    Beside Waldo
    Posts
    19,233

    Re: Registry Name from Handle

    Maybe RegQueryInfoKey? or SHQueryInfoKey?
    https://docs.microsoft.com/en-us/win...stry-functions

    edited: Peter beat me to it
    Last edited by LaVolpe; Jul 29th, 2020 at 02:25 PM.
    Insomnia is just a byproduct of, "It can't be done"

    Classics Enthusiast? Here's my 1969 Mustang Mach I Fastback. Her sister '67 Coupe has been adopted

    Newbie? Novice? Bored? Spend a few minutes browsing the FAQ section of the forum.
    Read the HitchHiker's Guide to Getting Help on the Forums.
    Here is the list of TAGs you can use to format your posts
    Here are VB6 Help Files online


    {Alpha Image Control} {Memory Leak FAQ} {Unicode Open/Save Dialog} {Resource Image Viewer/Extractor}
    {VB and DPI Tutorial} {Manifest Creator} {UserControl Button Template} {stdPicture Render Usage}

  4. #4
    PowerPoster
    Join Date
    Feb 2017
    Posts
    2,383

    Re: Registry Name from Handle

    Another possibility might be NtQueryKeyType.

  5. #5

    Thread Starter
    PowerPoster Elroy's Avatar
    Join Date
    Jun 2014
    Location
    Near Nashville TN
    Posts
    6,314

    Re: Registry Name from Handle

    Ok, I'm a bit preoccupied with some other stuff right now, but this looks like good stuff. I'll report back later on whether or not I got this working.
    Any software I post in these forums written by me is provided “AS IS” without warranty of any kind, expressed or implied, and permission is hereby granted, free of charge and without restriction, to any person obtaining a copy. Please understand that I’ve been programming since the mid-1970s and still have some of that code. My contemporary VB6 project is approaching 1,000 modules. In addition, I have a “VB6 random code folder” that is overflowing. I’ve been at this long enough to truly not know with absolute certainty from whence every single line of my code has come, with much of it coming from programmers under my employ who signed intellectual property transfers. I have not deliberately attempted to remove any licenses and/or attributions from any software. If someone finds that I have inadvertently done so, I sincerely apologize, and, upon notice and reasonable proof, will re-attach those licenses and/or attributions. To all, peace and happiness.

  6. #6
    New Member
    Join Date
    Sep 2019
    Posts
    6

    Re: Registry Name from Handle

    Here's an example I used some time ago. I also stumbled over the Stackoverflow answer Eduardo referenced.

    Note: Calling the function for the opened key "HKEY_LOCAL_MACHINE\Software\Microsoft" returns "\REGISTRY\MACHINE\SOFTWARE\Microsoft". Using the HKEY_CURRENT_USER hive instead returns "\REGISTRY\USER\<your SID here>\Software\Microsoft".

    Sanity checks omitted for brevity.

    Code:
    Private Declare Function NtQueryKey Lib "ntdll.dll" ( _
      ByVal KeyHandle As Long, _
      ByVal KeyInformationClass As Long, _
      ByVal KeyInformation As Long, _
      ByVal Length As Long, _
      ByRef ResultLength As Long _
    ) As Long
    
    Private Const STATUS_SUCCESS          As Long = &H0&
    Private Const STATUS_BUFFER_TOO_SMALL As Long = &HC0000023
    
    Private Function GetKeyNameFromHandle(ByVal hKey As Long) As String
      ' now that we've got a handle, let's try to resolve it by calling NtQueryKey
      ' this will retrieve a KEY_NAME_INFORMATION struct which looks suspiciously like a BSTR
      ' typedef struct _KEY_NAME_INFORMATION {
      '   ULONG NameLength;
      '   WCHAR Name[1];
      ' } KEY_NAME_INFORMATION, *PKEY_NAME_INFORMATION;
    
      Dim lLength As Long
      '3 = KeyNameInformation from the KEY_INFORMATION_CLASS enum
      If NtQueryKey(hKey, 3&, 0&, 0&, lLength) = STATUS_BUFFER_TOO_SMALL Then
        'now let's prepare a buffer with the correct size ...
        GetKeyNameFromHandle = Space$(lLength \ 2)
        '... and call the API again
        If NtQueryKey(hKey, 3&, StrPtr(GetKeyNameFromHandle) - 4, lLength, lLength) = STATUS_SUCCESS Then
          'possible TODO: format returned string
        End If
      End If
    End Function

  7. #7
    PowerPoster
    Join Date
    Feb 2006
    Posts
    21,184

    Re: Registry Name from Handle

    Shouldn't:

    Code:
    GetKeyNameFromHandle = Space$(lLength \ 2)
    be:

    Code:
    GetKeyNameFromHandle = Space$((lLength - 4) \ 2)
    Instead?

    I'd probaby define and use KeyNameInformation too instead of a hard-coded magic number.

  8. #8
    New Member
    Join Date
    Sep 2019
    Posts
    6

    Re: Registry Name from Handle

    Yes, the length field shouldn't be part of the string content. Thanks for pointing that out!

    You're right about using magic numbers too. I'd definitely do that in production code.

  9. #9

    Thread Starter
    PowerPoster Elroy's Avatar
    Join Date
    Jun 2014
    Location
    Near Nashville TN
    Posts
    6,314

    Re: Registry Name from Handle

    Ok cool, I just reduced it to the following, and it works perfectly.

    Code:
    
    Option Explicit
    '
    Private Declare Function NtQueryKey Lib "ntdll.dll" (ByVal KeyHandle As Long, ByVal KeyInformationClass As Long, ByVal KeyInformation As Long, ByVal Length As Long, ByRef ResultLength As Long) As Long
    '
    
    Public Function KeyNameFromHandle(ByVal hKey As Long) As String
        Const STATUS_SUCCESS            As Long = &H0&
        Const STATUS_BUFFER_TOO_SMALL   As Long = &HC0000023
        Const KeyNameInformation        As Long = 3&
        '
        Dim lLength                     As Long
        Dim lStrPtr                     As Long
        '
        If NtQueryKey(hKey, KeyNameInformation, 0&, 0&, lLength) <> STATUS_BUFFER_TOO_SMALL Then Error 5&
        KeyNameFromHandle = Space$((lLength - 4&) \ 2&)
        lStrPtr = (StrPtr(KeyNameFromHandle) Xor &H80000000) - 4& Xor &H80000000
        If NtQueryKey(hKey, KeyNameInformation, lStrPtr, lLength, lLength) <> STATUS_SUCCESS Then Error 5&
    End Function
    
    
    Thanks Everyone,
    Elroy

    EDIT: Made it LARGEADDRESSAWARE compatible.
    Last edited by Elroy; Aug 2nd, 2020 at 09:17 AM.
    Any software I post in these forums written by me is provided “AS IS” without warranty of any kind, expressed or implied, and permission is hereby granted, free of charge and without restriction, to any person obtaining a copy. Please understand that I’ve been programming since the mid-1970s and still have some of that code. My contemporary VB6 project is approaching 1,000 modules. In addition, I have a “VB6 random code folder” that is overflowing. I’ve been at this long enough to truly not know with absolute certainty from whence every single line of my code has come, with much of it coming from programmers under my employ who signed intellectual property transfers. I have not deliberately attempted to remove any licenses and/or attributions from any software. If someone finds that I have inadvertently done so, I sincerely apologize, and, upon notice and reasonable proof, will re-attach those licenses and/or attributions. To all, peace and happiness.

  10. #10
    PowerPoster
    Join Date
    Feb 2006
    Posts
    21,184

    Re: [RESOLVED] Registry Name from Handle

    The only thing iffy remaining is doing signed arithmetic in a pointer expression. That's really rarely an issue though in a normal VB program without LARGEADDRESSAWARE linking.

  11. #11

    Thread Starter
    PowerPoster Elroy's Avatar
    Join Date
    Jun 2014
    Location
    Near Nashville TN
    Posts
    6,314

    Re: [RESOLVED] Registry Name from Handle

    Quote Originally Posted by dilettante View Post
    The only thing iffy remaining is doing signed arithmetic in a pointer expression. That's really rarely an issue though in a normal VB program without LARGEADDRESSAWARE linking.
    I went ahead and fixed that.
    Any software I post in these forums written by me is provided “AS IS” without warranty of any kind, expressed or implied, and permission is hereby granted, free of charge and without restriction, to any person obtaining a copy. Please understand that I’ve been programming since the mid-1970s and still have some of that code. My contemporary VB6 project is approaching 1,000 modules. In addition, I have a “VB6 random code folder” that is overflowing. I’ve been at this long enough to truly not know with absolute certainty from whence every single line of my code has come, with much of it coming from programmers under my employ who signed intellectual property transfers. I have not deliberately attempted to remove any licenses and/or attributions from any software. If someone finds that I have inadvertently done so, I sincerely apologize, and, upon notice and reasonable proof, will re-attach those licenses and/or attributions. To all, peace and happiness.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  



Click Here to Expand Forum to Full Width