Print Page - Reading and writing to a loaded registry hive

Title: Reading and writing to a loaded registry hive
Post by: Andy on February 09, 2011, 05:49:15 AM

Hi,

As you can see i'm doing a lot of work on the windows registry.

But I have got a question if anyone can help:

I log on to my user account, then I load another user's registry details (called a hive).

I can do this by running cmd.exe and typing
reg load HKU\new c:\Users\new\ntuser.dat - the other user is called 'new'

This loads new's HKEY_CURRENT_USER's registry settings into HKEY_USERS key.

I can edit it with regedit - no problem
I can edit it with the reg add ...... command - no problem

But I cannot edit it with the registry.inc file, I get a return error of 6 ?

Think this is access rights problem, but have checked the registry permissions, they are ok, I have tried to run my program as Administrator - still no luck.

Anybody have any idea whats wrong ?

Running on Windows 7 32 bit, will test this on xp tomorrow.

Thanks to krypt for helping me with the latest registry.inc file which I ported over to Ebasic.

Thanks,
Andy.

Title: Re: Reading and writing to a loaded registry hive
Post by: sapero on February 09, 2011, 08:49:53 AM

Andy, probably you did not read MSDN ;)

Code Select

$include "windowssdk.inc"

HANDLE hToken
TOKEN_PRIVILEGES tp[2] ' make space for two LUID_AND_ATTRIBUTES

if (!OpenProcessToken(GetCurrentProcess(),TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, &hToken))
	_MessageBox(0, "OpenProcessToken failed")
else
	if (!(LookupPrivilegeValue(NULL, SE_RESTORE_NAME, &tp.Privileges[0].Luid) _
	and LookupPrivilegeValue(NULL, SE_BACKUP_NAME, &tp.Privileges[1].Luid)))
		_MessageBox(0, "LookupPrivilegeValue failed")
	else
		tp.PrivilegeCount = 2
		tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED
		tp.Privileges[1].Attributes = SE_PRIVILEGE_ENABLED
		if (!AdjustTokenPrivileges(hToken,FALSE,&tp,0,NULL,NULL))
			_MessageBox(0, "AdjustTokenPrivileges failed")
		endif
	endif
	CloseHandle(hToken)
endif

LONG errorcode = RegLoadKey(HKEY_USERS, "keyname", "c:\\Reg_Machine_System")
if (errorcode)
	_MessageBox(0, "RegLoadKey failed")
else
	' do your changes, close all handles
	_MessageBox(0, "key loaded to HKEY_USERS\\keyname\nHit OK to unload")
	RegUnLoadKey(HKEY_USERS, "keyname")
endif

Title: Re: Reading and writing to a loaded registry hive
Post by: Andy on February 10, 2011, 05:38:40 AM

Hi Sapero,

Yes you were correct again - thanks!

Thought it was access rights, as for MSDN, it's a great site but I can't always find what I want on it.

Once again, many thanks,
Andy.

IonicWind Software

IWBasic => General Questions => Topic started by: Andy on February 09, 2011, 05:49:15 AM