如何将本地(NT)注册表键名转换为Win32名称?

huangapple go评论64阅读模式
英文:

How can I convert a native (NT) registry key name into a Win32 name?

问题

调用NtQueryKey并使用KeyNameInformation选项返回的结果以Native格式呈现如下:

\REGISTRY\MACHINE = HKLM
\REGISTRY\USER\<SID> = HKCU
\REGISTRY\USER = HKU
\REGISTRY\MACHINE\SYSTEM\ControlSet<Current>\Hardware Profiles\<CurrentID> = HKCC
\REGISTRY\USER\<SID>_CLASSES = HKCR (用户的)
\REGISTRY\Machine\SOFTWARE\Classes = HKCR (系统)

如何可靠地将这种NT格式转换为Win32注册表键

英文:

Calling NtQueryKey with KeyNameInformation returns result in the Native format like so:

\REGISTRY\MACHINE = HKLM
\REGISTRY\USER\<SID> = HKCU
\REGISTRY\USER = HKU
\REGISTRY\MACHINE\SYSTEM\ControlSet<Current>\Hardware Profiles\<CurrentID> = HKCC
\REGISTRY\USER\<SID>_CLASSES = HKCR (User's)
\REGISTRY\Machine\SOFTWARE\Classes = HKCR (System)

How can I reliably convert such NT format to the Win32 registry key?

答案1

得分: 0

主题已解决。
似乎没有直接的API来进行转换。
要使其可靠,只需打开HKCR、HKCU、HKCC => 使用NtQueryKey + KeyNameInformation检索实际的NT名称(对于已知和静态路径的HKU、HKLM已知) => 然后按特定顺序应用相反的自动替换以获取所需的NT路径。

英文:

Topic is solved.
It seems they're no direct API to do the conversion.
To make it reliably, just open HKCR, HKCU, HKCC => retrieve the actual NT name using NtQueryKey + KeyNameInformation (for HKU, HKLM that's already known and static paths) => than apply vice versa auto-replacement for the desired NT path in a specific order.

huangapple
  • 本文由 发表于 2023年5月22日 06:56:30
  • 转载请务必保留本文链接:https://go.coder-hub.com/76302254.html
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定