A forum for reverse engineering, OS internals and malware analysis 

Ask your beginner questions here.
 #17346  by myid
 Sat Dec 22, 2012 3:00 pm
Is query some ValueKeys on one time, or query ValueKey called "MultipleValueKey"?
I have researched it on the internet, but i can't find an example.
 #17347  by EP_X0FF
 Sat Dec 22, 2012 3:12 pm
1. http://msdn.microsoft.com/en-us/library ... s.85).aspx
2. h[url]ttp://msdn.microsoft.com/en-us/library/windows/hardware/ff554214(v=vs.85).aspx[/url]
3.

val_list - Supplies a pointer to an array of structures, one each value to be queried.
num_vals - size in bytes of the val_list array.
Code: Select all
Status = NtQueryMultipleValueKey(hKey, (PKEY_VALUE_ENTRY)val_list,  num_vals, 
                                         lpvalueBuf,  ldwTotsize,   &RequiredLength);
4. http://www.codeforge.com/read/125747/native.c__html

Experiment it.
 #17348  by myid
 Sat Dec 22, 2012 3:29 pm
EP_X0FF wrote:1. http://msdn.microsoft.com/en-us/library ... s.85).aspx
2. h[url]ttp://msdn.microsoft.com/en-us/library/windows/hardware/ff554214(v=vs.85).aspx[/url]
3.

val_list - Supplies a pointer to an array of structures, one each value to be queried.
num_vals - size in bytes of the val_list array.
Code: Select all
Status = NtQueryMultipleValueKey(hKey, (PKEY_VALUE_ENTRY)val_list,  num_vals, 
                                         lpvalueBuf,  ldwTotsize,   &RequiredLength);
4. http://www.codeforge.com/read/125747/native.c__html

Experiment it.
OK. I try to read them. Thank you.