Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>Use <code>LoadLibrary</code> and <code>NtQueryKey</code> exported function as in the following code snippet.</p> <pre><code>#include &lt;windows.h&gt; #include &lt;string&gt; typedef LONG NTSTATUS; #ifndef STATUS_SUCCESS #define STATUS_SUCCESS ((NTSTATUS)0x00000000L) #endif #ifndef STATUS_BUFFER_TOO_SMALL #define STATUS_BUFFER_TOO_SMALL ((NTSTATUS)0xC0000023L) #endif std::wstring GetKeyPathFromKKEY(HKEY key) { std::wstring keyPath; if (key != NULL) { HMODULE dll = LoadLibrary(L"ntdll.dll"); if (dll != NULL) { typedef DWORD (__stdcall *NtQueryKeyType)( HANDLE KeyHandle, int KeyInformationClass, PVOID KeyInformation, ULONG Length, PULONG ResultLength); NtQueryKeyType func = reinterpret_cast&lt;NtQueryKeyType&gt;(::GetProcAddress(dll, "NtQueryKey")); if (func != NULL) { DWORD size = 0; DWORD result = 0; result = func(key, 3, 0, 0, &amp;size); if (result == STATUS_BUFFER_TOO_SMALL) { size = size + 2; wchar_t* buffer = new (std::nothrow) wchar_t[size/sizeof(wchar_t)]; // size is in bytes if (buffer != NULL) { result = func(key, 3, buffer, size, &amp;size); if (result == STATUS_SUCCESS) { buffer[size / sizeof(wchar_t)] = L'\0'; keyPath = std::wstring(buffer + 2); } delete[] buffer; } } } FreeLibrary(dll); } } return keyPath; } int _tmain(int argc, _TCHAR* argv[]) { HKEY key = NULL; LONG ret = ERROR_SUCCESS; ret = RegOpenKey(HKEY_LOCAL_MACHINE, L"SOFTWARE\\Microsoft", &amp;key); if (ret == ERROR_SUCCESS) { wprintf_s(L"Key path for %p is '%s'.", key, GetKeyPathFromKKEY(key).c_str()); RegCloseKey(key); } return 0; } </code></pre> <p>This will print the key path on the console:</p> <blockquote> <p>Key path for 00000FDC is '\REGISTRY\MACHINE\SOFTWARE\Microsoft'.</p> </blockquote>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    3. VO
      singulars
      1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload