울랄라베베 페이지

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegistryPath)
{
    OBJECT_ATTRIBUTE oa;
    InitializeObjectAttributes(&oa, RegistryPath, OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE, NULL, NULL);
    HANDLE hKey;
    status = ZwOpenKey(&hKey, KEY_READ, &oa);
    if (NT_SUCCESS(status))
    {
    ...
    ZwClose(hKey);
    }
}



UNICODE_STRING valname;
RtlInitUnicodeString(&valname, L"ImagePath");
size = 0;
status = ZwQueryValueKey(hKey, &valname, KeyValuePartialInformation, NULL, 0, &size);
if (status == STATUS_OBJECT_NAME_NOT_FOUND || size == 0)
 <에러 처리>

size = min(size, PAGE_SIZE);
PKEY_VALUE_PARTIAL_INFORMATION vpip =
 (PKEY_VALUE_PARTIAL_INFORMATION) ExAllocatePool(PagedPool, size);
if (!vpip)
 <에러처리>

status = ZwQueryValueKey(hkey, &valname, KeyValuePartialInformation, vpip, size, &size);

if (!NT_SUCEESS(status))
 <에러처리>
<vpip->Data 에 대한 작업>
ExFreePool(vpip).