Software & Application Miscellaneous: ZwQueryValueKey

  • anonymous / 205 / Sat, 30 Jan 2010 07:47:00 GMT / Comments (8)
  • Hello,

    I'm trying to query the computer name from the following registry key:
    L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ComputerName\\Act
    iveComputerName
    The key is:
    ComputerName

    I can successfully pull this value out of the registry. However, it is in
    the following format:
    Name[0] = J 0x4a
    Name[1] = \0 0x0
    Name[2] = I 0x49
    Name[3] = \0 0x0
    .
    .
    .
    Name[n-1] = \0 0x0
    Name[n] = \0 0x0

    I want to convert this unicode string to a regular string. However, when I call RtlUnicodeStringToAnsiString, I get an NTSTATUS error indicating that I have a buffer overrun.

    Here is my call to RtlUnicodeStringToAnsiString:
    RtlUnicodeStringToAnsiString((PANSI_STRING) lHostname, (PUNICODE_STRING) valueInfoP->Data, FALSE);

    I have done an ExAllocatePoolWithTag for the lHostname variable. Why doesn't this successfully convert to a regular string though?

    I've tried everything (well, obviously not everything). Any help would be greatly appreciated.

    Thank you,
  • Keywords:

    zwqueryvaluekey, software, application

  • http://software.itags.org/software-application/240749/«« Last Thread - Next Thread »»
    1. Why do you use PANSI_STRING and PUNICODE_STRING casts? It looks like
      lHostname and/or valueInfoP->Data are not valid pointers to valid
      ANSI_STRING and UNICODE_STRING structures. You need to intialize all members
      in both structures.

      "John Thompson" <johnthompson1...hotmail.com> wrote in message
      news:4106c732$1...news.xetron.com...
      > Hello,
      > I'm trying to query the computer name from the following registry key:
      > L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ComputerName\\Act
      > iveComputerName
      > The key is:
      > ComputerName
      > I can successfully pull this value out of the registry. However, it is in
      > the following format:
      > Name[0] = J 0x4a
      > Name[1] = \0 0x0
      > Name[2] = I 0x49
      > Name[3] = \0 0x0
      > .
      > .
      > .
      > Name[n-1] = \0 0x0
      > Name[n] = \0 0x0
      > I want to convert this unicode string to a regular string. However, when
      > I
      > call RtlUnicodeStringToAnsiString, I get an NTSTATUS error indicating that
      > I
      > have a buffer overrun.
      > Here is my call to RtlUnicodeStringToAnsiString:
      > RtlUnicodeStringToAnsiString((PANSI_STRING) lHostname, (PUNICODE_STRING)
      > valueInfoP->Data, FALSE);
      > I have done an ExAllocatePoolWithTag for the lHostname variable. Why
      > doesn't this successfully convert to a regular string though?
      > I've tried everything (well, obviously not everything). Any help would be
      > greatly appreciated.
      > Thank you,
      > -- John
      >

      nospam | Tues, 20 May 2008 08:03:00 GMT |

    2. How to CAST from PUNICODE_STRING to PANSI_STRING?
      <nospam...cristalink.com> дÈëÏûÏ¢ÐÂÎÅ
      :ukxoyZCdEHA.3016...tk2msftngp13.phx.gbl...
      > Why do you use PANSI_STRING and PUNICODE_STRING casts? It looks like
      > lHostname and/or valueInfoP->Data are not valid pointers to valid
      > ANSI_STRING and UNICODE_STRING structures. You need to intialize all
      members
      > in both structures.
      > "John Thompson" <johnthompson1...hotmail.com> wrote in message
      > news:4106c732$1...news.xetron.com...
      > > Hello,
      > >
      > > I'm trying to query the computer name from the following registry key:
      > >
      L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ComputerName\\Act
      > > iveComputerName
      > > The key is:
      > > ComputerName
      > >
      > > I can successfully pull this value out of the registry. However, it is
      in
      > > the following format:
      > > Name[0] = J 0x4a
      > > Name[1] = \0 0x0
      > > Name[2] = I 0x49
      > > Name[3] = \0 0x0
      > > .
      > > .
      > > .
      > > Name[n-1] = \0 0x0
      > > Name[n] = \0 0x0
      > >
      > > I want to convert this unicode string to a regular string. However,
      when
      > > I
      > > call RtlUnicodeStringToAnsiString, I get an NTSTATUS error indicating
      that
      > > I
      > > have a buffer overrun.
      > >
      > > Here is my call to RtlUnicodeStringToAnsiString:
      > > RtlUnicodeStringToAnsiString((PANSI_STRING) lHostname, (PUNICODE_STRING)
      > > valueInfoP->Data, FALSE);
      > >
      > > I have done an ExAllocatePoolWithTag for the lHostname variable. Why
      > > doesn't this successfully convert to a regular string though?
      > >
      > > I've tried everything (well, obviously not everything). Any help would
      be
      > > greatly appreciated.
      > >
      > > Thank you,
      > > -- John
      > >
      > >
      >

      sean | Tues, 20 May 2008 08:04:00 GMT |

    3. You cannot "cast" but you can "convert" with RtlUnicodeStringToAnsiString().
      You have to properly initialize parameters for
      RtlUnicodeStringToAnsiString(), which are structures, not pointers to
      zero-terminated strings. Can you feel the difference?

      Copy-paste from ddk\src\wdm\videocap\atiwdm\atishare\registry.cpp:

      char g_DebugComponent[]="Long long long output buffer";
      ANSI_STRING stringDriverName;
      UNICODE_STRING unicodeDriverName;

      RtlInitAnsiString(&stringDriverName, g_DebugComponent);
      RtlInitUnicodeString(&unicodeDriverName, L"Unicode string to be coverted");
      RtlUnicodeStringToAnsiString(&stringDriverName, &unicodeDriverName, FALSE);

      "sean" <sigang...mti.xidian.edu.cn> wrote in message
      news:ce76t4$a07$1...mail.cn99.com...
      > How to CAST from PUNICODE_STRING to PANSI_STRING?
      > <nospam...cristalink.com> дÈëÏûÏ¢ÐÂÎÅ
      > :ukxoyZCdEHA.3016...tk2msftngp13.phx.gbl...
      >> Why do you use PANSI_STRING and PUNICODE_STRING casts? It looks like
      >> lHostname and/or valueInfoP->Data are not valid pointers to valid
      >> ANSI_STRING and UNICODE_STRING structures. You need to intialize all
      > members
      >> in both structures.
      >> "John Thompson" <johnthompson1...hotmail.com> wrote in message
      >> news:4106c732$1...news.xetron.com...
      >> > Hello,
      >> >
      >> > I'm trying to query the computer name from the following registry key:
      >> >
      > L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ComputerName\\Act
      >> > iveComputerName
      >> > The key is:
      >> > ComputerName
      >> >
      >> > I can successfully pull this value out of the registry. However, it is
      > in
      >> > the following format:
      >> > Name[0] = J 0x4a
      >> > Name[1] = \0 0x0
      >> > Name[2] = I 0x49
      >> > Name[3] = \0 0x0
      >> > .
      >> > .
      >> > .
      >> > Name[n-1] = \0 0x0
      >> > Name[n] = \0 0x0
      >> >
      >> > I want to convert this unicode string to a regular string. However,
      > when
      >> > I
      >> > call RtlUnicodeStringToAnsiString, I get an NTSTATUS error indicating
      > that
      >> > I
      >> > have a buffer overrun.
      >> >
      >> > Here is my call to RtlUnicodeStringToAnsiString:
      >> > RtlUnicodeStringToAnsiString((PANSI_STRING) lHostname,
      >> > (PUNICODE_STRING)
      >> > valueInfoP->Data, FALSE);
      >> >
      >> > I have done an ExAllocatePoolWithTag for the lHostname variable. Why
      >> > doesn't this successfully convert to a regular string though?
      >> >
      >> > I've tried everything (well, obviously not everything). Any help would
      > be
      >> > greatly appreciated.
      >> >
      >> > Thank you,
      >> > -- John
      >> >
      >> >
      >>
      >

      nospam | Tues, 20 May 2008 08:05:00 GMT |

    4. Thanks guys,

      I think I'm getting closer. This is what I have now:
      ANSI_STRING lHostname;
      UNICODE_STRING lUniHostname;
      PKEY_VALUE_PARTIAL_INFORMATION PValueInfo;

      RtlInitAnsiString(&lHostname, "Bla");
      RtlInitUnicodeString(&lUniHostname, (PCWSTR) PValueInfo->Data);
      // PValueInfo holds the value returned from the call to ZwQueryValueKey

      status = RtlUnicodeStringToAnsiString(&lHostname, &lUniHostname, FALSE);
      DbgPrint("ANSI = %s\n", lHostname.Buffer);

      The DbgPrint seems to print out the first three letters of the computer's
      name. However, status is still equal to:
      0x80000005
      This is still indicating a buffer overrun. Any other ideas?

      Thanks again,
      -- John

      <nospam...cristalink.com> wrote in message
      news:Orf29mFdEHA.3632...TK2MSFTNGP11.phx.gbl...
      > You cannot "cast" but you can "convert" with
      RtlUnicodeStringToAnsiString().
      > You have to properly initialize parameters for
      > RtlUnicodeStringToAnsiString(), which are structures, not pointers to
      > zero-terminated strings. Can you feel the difference?
      > Copy-paste from ddk\src\wdm\videocap\atiwdm\atishare\registry.cpp:
      > char g_DebugComponent[]="Long long long output buffer";
      > ANSI_STRING stringDriverName;
      > UNICODE_STRING unicodeDriverName;
      > RtlInitAnsiString(&stringDriverName, g_DebugComponent);
      > RtlInitUnicodeString(&unicodeDriverName, L"Unicode string to be
      coverted");
      > RtlUnicodeStringToAnsiString(&stringDriverName, &unicodeDriverName,
      FALSE);
      >
      > "sean" <sigang...mti.xidian.edu.cn> wrote in message
      > news:ce76t4$a07$1...mail.cn99.com...
      > > How to CAST from PUNICODE_STRING to PANSI_STRING?
      > > <nospam...cristalink.com> дÈëÏûÏ¢ÐÂÎÅ
      > > :ukxoyZCdEHA.3016...tk2msftngp13.phx.gbl...
      > >> Why do you use PANSI_STRING and PUNICODE_STRING casts? It looks like
      > >> lHostname and/or valueInfoP->Data are not valid pointers to valid
      > >> ANSI_STRING and UNICODE_STRING structures. You need to intialize all
      > > members
      > >> in both structures.
      > >>
      > >> "John Thompson" <johnthompson1...hotmail.com> wrote in message
      > >> news:4106c732$1...news.xetron.com...
      > >> > Hello,
      > >> >
      > >> > I'm trying to query the computer name from the following registry
      key:
      > >> >
      > >
      L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ComputerName\\Act
      > >> > iveComputerName
      > >> > The key is:
      > >> > ComputerName
      > >> >
      > >> > I can successfully pull this value out of the registry. However, it
      is
      > > in
      > >> > the following format:
      > >> > Name[0] = J 0x4a
      > >> > Name[1] = \0 0x0
      > >> > Name[2] = I 0x49
      > >> > Name[3] = \0 0x0
      > >> > .
      > >> > .
      > >> > .
      > >> > Name[n-1] = \0 0x0
      > >> > Name[n] = \0 0x0
      > >> >
      > >> > I want to convert this unicode string to a regular string. However,
      > > when
      > >> > I
      > >> > call RtlUnicodeStringToAnsiString, I get an NTSTATUS error indicating
      > > that
      > >> > I
      > >> > have a buffer overrun.
      > >> >
      > >> > Here is my call to RtlUnicodeStringToAnsiString:
      > >> > RtlUnicodeStringToAnsiString((PANSI_STRING) lHostname,
      > >> > (PUNICODE_STRING)
      > >> > valueInfoP->Data, FALSE);
      > >> >
      > >> > I have done an ExAllocatePoolWithTag for the lHostname variable. Why
      > >> > doesn't this successfully convert to a regular string though?
      > >> >
      > >> > I've tried everything (well, obviously not everything). Any help
      would
      > > be
      > >> > greatly appreciated.
      > >> >
      > >> > Thank you,
      > >> > -- John
      > >> >
      > >> >
      > >>
      > >>
      > >
      > >
      >

      john | Tues, 20 May 2008 08:06:00 GMT |

    5. Whoops. Thank you no spam. :-) It's times like these I feel like I forgot
      my brain. I just initialized the ANSI_STRING to a bigger buffer (hence the
      buffer overrun), and now it works.

      Thanks again,
      -- John

      "John Thompson" <johnthompson1...hotmail.com> wrote in message
      news:4107a358$1...news.xetron.com...
      > Thanks guys,
      > I think I'm getting closer. This is what I have now:
      > ANSI_STRING lHostname;
      > UNICODE_STRING lUniHostname;
      > PKEY_VALUE_PARTIAL_INFORMATION PValueInfo;
      > RtlInitAnsiString(&lHostname, "Bla");
      > RtlInitUnicodeString(&lUniHostname, (PCWSTR) PValueInfo->Data);
      > // PValueInfo holds the value returned from the call to ZwQueryValueKey
      > status = RtlUnicodeStringToAnsiString(&lHostname, &lUniHostname, FALSE);
      > DbgPrint("ANSI = %s\n", lHostname.Buffer);
      > The DbgPrint seems to print out the first three letters of the computer's
      > name. However, status is still equal to:
      > 0x80000005
      > This is still indicating a buffer overrun. Any other ideas?
      > Thanks again,
      > -- John
      >
      > <nospam...cristalink.com> wrote in message
      > news:Orf29mFdEHA.3632...TK2MSFTNGP11.phx.gbl...
      > > You cannot "cast" but you can "convert" with
      > RtlUnicodeStringToAnsiString().
      > > You have to properly initialize parameters for
      > > RtlUnicodeStringToAnsiString(), which are structures, not pointers to
      > > zero-terminated strings. Can you feel the difference?
      > >
      > > Copy-paste from ddk\src\wdm\videocap\atiwdm\atishare\registry.cpp:
      > >
      > > char g_DebugComponent[]="Long long long output buffer";
      > > ANSI_STRING stringDriverName;
      > > UNICODE_STRING unicodeDriverName;
      > >
      > > RtlInitAnsiString(&stringDriverName, g_DebugComponent);
      > > RtlInitUnicodeString(&unicodeDriverName, L"Unicode string to be
      > coverted");
      > > RtlUnicodeStringToAnsiString(&stringDriverName, &unicodeDriverName,
      > FALSE);
      > >
      > >
      > >
      > > "sean" <sigang...mti.xidian.edu.cn> wrote in message
      > > news:ce76t4$a07$1...mail.cn99.com...
      > > > How to CAST from PUNICODE_STRING to PANSI_STRING?
      > > > <nospam...cristalink.com> дÈëÏûÏ¢ÐÂÎÅ
      > > > :ukxoyZCdEHA.3016...tk2msftngp13.phx.gbl...
      > > >> Why do you use PANSI_STRING and PUNICODE_STRING casts? It looks like
      > > >> lHostname and/or valueInfoP->Data are not valid pointers to valid
      > > >> ANSI_STRING and UNICODE_STRING structures. You need to intialize all
      > > > members
      > > >> in both structures.
      > > >>
      > > >> "John Thompson" <johnthompson1...hotmail.com> wrote in message
      > > >> news:4106c732$1...news.xetron.com...
      > > >> > Hello,
      > > >> >
      > > >> > I'm trying to query the computer name from the following registry
      > key:
      > > >> >
      > > >
      >
      L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ComputerName\\Act
      > > >> > iveComputerName
      > > >> > The key is:
      > > >> > ComputerName
      > > >> >
      > > >> > I can successfully pull this value out of the registry. However,
      it
      > is
      > > > in
      > > >> > the following format:
      > > >> > Name[0] = J 0x4a
      > > >> > Name[1] = \0 0x0
      > > >> > Name[2] = I 0x49
      > > >> > Name[3] = \0 0x0
      > > >> > .
      > > >> > .
      > > >> > .
      > > >> > Name[n-1] = \0 0x0
      > > >> > Name[n] = \0 0x0
      > > >> >
      > > >> > I want to convert this unicode string to a regular string.
      However,
      > > > when
      > > >> > I
      > > >> > call RtlUnicodeStringToAnsiString, I get an NTSTATUS error
      indicating
      > > > that
      > > >> > I
      > > >> > have a buffer overrun.
      > > >> >
      > > >> > Here is my call to RtlUnicodeStringToAnsiString:
      > > >> > RtlUnicodeStringToAnsiString((PANSI_STRING) lHostname,
      > > >> > (PUNICODE_STRING)
      > > >> > valueInfoP->Data, FALSE);
      > > >> >
      > > >> > I have done an ExAllocatePoolWithTag for the lHostname variable.
      Why
      > > >> > doesn't this successfully convert to a regular string though?
      > > >> >
      > > >> > I've tried everything (well, obviously not everything). Any help
      > would
      > > > be
      > > >> > greatly appreciated.
      > > >> >
      > > >> > Thank you,
      > > >> > -- John
      > > >> >
      > > >> >
      > > >>
      > > >>
      > > >
      > > >
      > >
      > >
      >

      john | Tues, 20 May 2008 08:07:00 GMT |

    6. Don't use a string constant to initialize ANSI_STRING (and UNICODE_STRING)
      if you plan to modify this string. It may be placed to read-only memory.

      "John Thompson" <johnthompson1...hotmail.com> wrote in message
      news:4107a358$1...news.xetron.com...
      > Thanks guys,
      > I think I'm getting closer. This is what I have now:
      > ANSI_STRING lHostname;
      > UNICODE_STRING lUniHostname;
      > PKEY_VALUE_PARTIAL_INFORMATION PValueInfo;
      > RtlInitAnsiString(&lHostname, "Bla");
      > RtlInitUnicodeString(&lUniHostname, (PCWSTR) PValueInfo->Data);
      > // PValueInfo holds the value returned from the call to ZwQueryValueKey
      > status = RtlUnicodeStringToAnsiString(&lHostname, &lUniHostname, FALSE);
      > DbgPrint("ANSI = %s\n", lHostname.Buffer);
      > The DbgPrint seems to print out the first three letters of the computer's
      > name. However, status is still equal to:
      > 0x80000005
      > This is still indicating a buffer overrun. Any other ideas?
      > Thanks again,
      > -- John
      >
      > <nospam...cristalink.com> wrote in message
      > news:Orf29mFdEHA.3632...TK2MSFTNGP11.phx.gbl...
      > > You cannot "cast" but you can "convert" with
      > RtlUnicodeStringToAnsiString().
      > > You have to properly initialize parameters for
      > > RtlUnicodeStringToAnsiString(), which are structures, not pointers to
      > > zero-terminated strings. Can you feel the difference?
      > >
      > > Copy-paste from ddk\src\wdm\videocap\atiwdm\atishare\registry.cpp:
      > >
      > > char g_DebugComponent[]="Long long long output buffer";
      > > ANSI_STRING stringDriverName;
      > > UNICODE_STRING unicodeDriverName;
      > >
      > > RtlInitAnsiString(&stringDriverName, g_DebugComponent);
      > > RtlInitUnicodeString(&unicodeDriverName, L"Unicode string to be
      > coverted");
      > > RtlUnicodeStringToAnsiString(&stringDriverName, &unicodeDriverName,
      > FALSE);
      > >
      > >
      > >
      > > "sean" <sigang...mti.xidian.edu.cn> wrote in message
      > > news:ce76t4$a07$1...mail.cn99.com...
      > > > How to CAST from PUNICODE_STRING to PANSI_STRING?
      > > > <nospam...cristalink.com> дÈëÏûÏ¢ÐÂÎÅ
      > > > :ukxoyZCdEHA.3016...tk2msftngp13.phx.gbl...
      > > >> Why do you use PANSI_STRING and PUNICODE_STRING casts? It looks like
      > > >> lHostname and/or valueInfoP->Data are not valid pointers to valid
      > > >> ANSI_STRING and UNICODE_STRING structures. You need to intialize all
      > > > members
      > > >> in both structures.
      > > >>
      > > >> "John Thompson" <johnthompson1...hotmail.com> wrote in message
      > > >> news:4106c732$1...news.xetron.com...
      > > >> > Hello,
      > > >> >
      > > >> > I'm trying to query the computer name from the following registry
      > key:
      > > >> >
      > > >
      >
      L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ComputerName\\Act
      > > >> > iveComputerName
      > > >> > The key is:
      > > >> > ComputerName
      > > >> >
      > > >> > I can successfully pull this value out of the registry. However,
      it
      > is
      > > > in
      > > >> > the following format:
      > > >> > Name[0] = J 0x4a
      > > >> > Name[1] = \0 0x0
      > > >> > Name[2] = I 0x49
      > > >> > Name[3] = \0 0x0
      > > >> > .
      > > >> > .
      > > >> > .
      > > >> > Name[n-1] = \0 0x0
      > > >> > Name[n] = \0 0x0
      > > >> >
      > > >> > I want to convert this unicode string to a regular string.
      However,
      > > > when
      > > >> > I
      > > >> > call RtlUnicodeStringToAnsiString, I get an NTSTATUS error
      indicating
      > > > that
      > > >> > I
      > > >> > have a buffer overrun.
      > > >> >
      > > >> > Here is my call to RtlUnicodeStringToAnsiString:
      > > >> > RtlUnicodeStringToAnsiString((PANSI_STRING) lHostname,
      > > >> > (PUNICODE_STRING)
      > > >> > valueInfoP->Data, FALSE);
      > > >> >
      > > >> > I have done an ExAllocatePoolWithTag for the lHostname variable.
      Why
      > > >> > doesn't this successfully convert to a regular string though?
      > > >> >
      > > >> > I've tried everything (well, obviously not everything). Any help
      > would
      > > > be
      > > >> > greatly appreciated.
      > > >> >
      > > >> > Thank you,
      > > >> > -- John
      > > >> >
      > > >> >
      > > >>
      > > >>
      > > >
      > > >
      > >
      > >
      >

      alexander | Tues, 20 May 2008 08:08:00 GMT |

    7. these are constant
      1 RtlInitAnsiString(IHostname, "Bla");
      2 PUCHAR pBla = "Bla";

      this on the other hand is not constant and is safe b/c it is declared on the
      stack in its entirety.
      UCHAR bla[] = "Bla"

      d
      --
      Please do not send e-mail directly to this alias. this alias is for
      newsgroup purposes only.
      This posting is provided "AS IS" with no warranties, and confers no rights.

      "Alexander Grigoriev" <alegr...earthlink.net> wrote in message
      news:e3BMomKdEHA.2408...tk2msftngp13.phx.gbl...
      > Don't use a string constant to initialize ANSI_STRING (and UNICODE_STRING)
      > if you plan to modify this string. It may be placed to read-only memory.
      > "John Thompson" <johnthompson1...hotmail.com> wrote in message
      > news:4107a358$1...news.xetron.com...
      > > Thanks guys,
      > >
      > > I think I'm getting closer. This is what I have now:
      > > ANSI_STRING lHostname;
      > > UNICODE_STRING lUniHostname;
      > > PKEY_VALUE_PARTIAL_INFORMATION PValueInfo;
      > >
      > > RtlInitAnsiString(&lHostname, "Bla");
      > > RtlInitUnicodeString(&lUniHostname, (PCWSTR) PValueInfo->Data);
      > > // PValueInfo holds the value returned from the call to ZwQueryValueKey
      > >
      > > status = RtlUnicodeStringToAnsiString(&lHostname, &lUniHostname, FALSE);
      > > DbgPrint("ANSI = %s\n", lHostname.Buffer);
      > >
      > > The DbgPrint seems to print out the first three letters of the
      computer's
      > > name. However, status is still equal to:
      > > 0x80000005
      > > This is still indicating a buffer overrun. Any other ideas?
      > >
      > > Thanks again,
      > > -- John
      > >
      > >
      > >
      > > <nospam...cristalink.com> wrote in message
      > > news:Orf29mFdEHA.3632...TK2MSFTNGP11.phx.gbl...
      > > > You cannot "cast" but you can "convert" with
      > > RtlUnicodeStringToAnsiString().
      > > > You have to properly initialize parameters for
      > > > RtlUnicodeStringToAnsiString(), which are structures, not pointers to
      > > > zero-terminated strings. Can you feel the difference?
      > > >
      > > > Copy-paste from ddk\src\wdm\videocap\atiwdm\atishare\registry.cpp:
      > > >
      > > > char g_DebugComponent[]="Long long long output buffer";
      > > > ANSI_STRING stringDriverName;
      > > > UNICODE_STRING unicodeDriverName;
      > > >
      > > > RtlInitAnsiString(&stringDriverName, g_DebugComponent);
      > > > RtlInitUnicodeString(&unicodeDriverName, L"Unicode string to be
      > > coverted");
      > > > RtlUnicodeStringToAnsiString(&stringDriverName, &unicodeDriverName,
      > > FALSE);
      > > >
      > > >
      > > >
      > > > "sean" <sigang...mti.xidian.edu.cn> wrote in message
      > > > news:ce76t4$a07$1...mail.cn99.com...
      > > > > How to CAST from PUNICODE_STRING to PANSI_STRING?
      > > > > <nospam...cristalink.com> дÈëÏûÏ¢ÐÂÎÅ
      > > > > :ukxoyZCdEHA.3016...tk2msftngp13.phx.gbl...
      > > > >> Why do you use PANSI_STRING and PUNICODE_STRING casts? It looks
      like
      > > > >> lHostname and/or valueInfoP->Data are not valid pointers to valid
      > > > >> ANSI_STRING and UNICODE_STRING structures. You need to intialize
      all
      > > > > members
      > > > >> in both structures.
      > > > >>
      > > > >> "John Thompson" <johnthompson1...hotmail.com> wrote in message
      > > > >> news:4106c732$1...news.xetron.com...
      > > > >> > Hello,
      > > > >> >
      > > > >> > I'm trying to query the computer name from the following registry
      > > key:
      > > > >> >
      > > > >
      > >
      >
      L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ComputerName\\Act
      > > > >> > iveComputerName
      > > > >> > The key is:
      > > > >> > ComputerName
      > > > >> >
      > > > >> > I can successfully pull this value out of the registry. However,
      > it
      > > is
      > > > > in
      > > > >> > the following format:
      > > > >> > Name[0] = J 0x4a
      > > > >> > Name[1] = \0 0x0
      > > > >> > Name[2] = I 0x49
      > > > >> > Name[3] = \0 0x0
      > > > >> > .
      > > > >> > .
      > > > >> > .
      > > > >> > Name[n-1] = \0 0x0
      > > > >> > Name[n] = \0 0x0
      > > > >> >
      > > > >> > I want to convert this unicode string to a regular string.
      > However,
      > > > > when
      > > > >> > I
      > > > >> > call RtlUnicodeStringToAnsiString, I get an NTSTATUS error
      > indicating
      > > > > that
      > > > >> > I
      > > > >> > have a buffer overrun.
      > > > >> >
      > > > >> > Here is my call to RtlUnicodeStringToAnsiString:
      > > > >> > RtlUnicodeStringToAnsiString((PANSI_STRING) lHostname,
      > > > >> > (PUNICODE_STRING)
      > > > >> > valueInfoP->Data, FALSE);
      > > > >> >
      > > > >> > I have done an ExAllocatePoolWithTag for the lHostname variable.
      > Why
      > > > >> > doesn't this successfully convert to a regular string though?
      > > > >> >
      > > > >> > I've tried everything (well, obviously not everything). Any help
      > > would
      > > > > be
      > > > >> > greatly appreciated.
      > > > >> >
      > > > >> > Thank you,
      > > > >> > -- John
      > > > >> >
      > > > >> >
      > > > >>
      > > > >>
      > > > >
      > > > >
      > > >
      > > >
      > >
      > >
      >

      doron | Tues, 20 May 2008 08:09:00 GMT |

    8. Good to know. Thanks guys. I suppose you can tell I'm a little new to
      driver development. :-)

      Thanks for the help.

      "Doron Holan [MS]" <doronh...nospam.microsoft.com> wrote in message
      news:uRFe6WLdEHA.3728...TK2MSFTNGP09.phx.gbl...
      > these are constant
      > 1 RtlInitAnsiString(IHostname, "Bla");
      > 2 PUCHAR pBla = "Bla";
      > this on the other hand is not constant and is safe b/c it is declared on
      the
      > stack in its entirety.
      > UCHAR bla[] = "Bla"
      > d
      > --
      > Please do not send e-mail directly to this alias. this alias is for
      > newsgroup purposes only.
      > This posting is provided "AS IS" with no warranties, and confers no
      rights.
      >
      > "Alexander Grigoriev" <alegr...earthlink.net> wrote in message
      > news:e3BMomKdEHA.2408...tk2msftngp13.phx.gbl...
      > > Don't use a string constant to initialize ANSI_STRING (and
      UNICODE_STRING)
      > > if you plan to modify this string. It may be placed to read-only memory.
      > >
      > > "John Thompson" <johnthompson1...hotmail.com> wrote in message
      > > news:4107a358$1...news.xetron.com...
      > > > Thanks guys,
      > > >
      > > > I think I'm getting closer. This is what I have now:
      > > > ANSI_STRING lHostname;
      > > > UNICODE_STRING lUniHostname;
      > > > PKEY_VALUE_PARTIAL_INFORMATION PValueInfo;
      > > >
      > > > RtlInitAnsiString(&lHostname, "Bla");
      > > > RtlInitUnicodeString(&lUniHostname, (PCWSTR) PValueInfo->Data);
      > > > // PValueInfo holds the value returned from the call to
      ZwQueryValueKey
      > > >
      > > > status = RtlUnicodeStringToAnsiString(&lHostname, &lUniHostname,
      FALSE);
      > > > DbgPrint("ANSI = %s\n", lHostname.Buffer);
      > > >
      > > > The DbgPrint seems to print out the first three letters of the
      > computer's
      > > > name. However, status is still equal to:
      > > > 0x80000005
      > > > This is still indicating a buffer overrun. Any other ideas?
      > > >
      > > > Thanks again,
      > > > -- John
      > > >
      > > >
      > > >
      > > > <nospam...cristalink.com> wrote in message
      > > > news:Orf29mFdEHA.3632...TK2MSFTNGP11.phx.gbl...
      > > > > You cannot "cast" but you can "convert" with
      > > > RtlUnicodeStringToAnsiString().
      > > > > You have to properly initialize parameters for
      > > > > RtlUnicodeStringToAnsiString(), which are structures, not pointers
      to
      > > > > zero-terminated strings. Can you feel the difference?
      > > > >
      > > > > Copy-paste from ddk\src\wdm\videocap\atiwdm\atishare\registry.cpp:
      > > > >
      > > > > char g_DebugComponent[]="Long long long output buffer";
      > > > > ANSI_STRING stringDriverName;
      > > > > UNICODE_STRING unicodeDriverName;
      > > > >
      > > > > RtlInitAnsiString(&stringDriverName, g_DebugComponent);
      > > > > RtlInitUnicodeString(&unicodeDriverName, L"Unicode string to be
      > > > coverted");
      > > > > RtlUnicodeStringToAnsiString(&stringDriverName, &unicodeDriverName,
      > > > FALSE);
      > > > >
      > > > >
      > > > >
      > > > > "sean" <sigang...mti.xidian.edu.cn> wrote in message
      > > > > news:ce76t4$a07$1...mail.cn99.com...
      > > > > > How to CAST from PUNICODE_STRING to PANSI_STRING?
      > > > > > <nospam...cristalink.com> дÈëÏûÏ¢ÐÂÎÅ
      > > > > > :ukxoyZCdEHA.3016...tk2msftngp13.phx.gbl...
      > > > > >> Why do you use PANSI_STRING and PUNICODE_STRING casts? It looks
      > like
      > > > > >> lHostname and/or valueInfoP->Data are not valid pointers to valid
      > > > > >> ANSI_STRING and UNICODE_STRING structures. You need to intialize
      > all
      > > > > > members
      > > > > >> in both structures.
      > > > > >>
      > > > > >> "John Thompson" <johnthompson1...hotmail.com> wrote in message
      > > > > >> news:4106c732$1...news.xetron.com...
      > > > > >> > Hello,
      > > > > >> >
      > > > > >> > I'm trying to query the computer name from the following
      registry
      > > > key:
      > > > > >> >
      > > > > >
      > > >
      > >
      >
      L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ComputerName\\Act
      > > > > >> > iveComputerName
      > > > > >> > The key is:
      > > > > >> > ComputerName
      > > > > >> >
      > > > > >> > I can successfully pull this value out of the registry.
      However,
      > > it
      > > > is
      > > > > > in
      > > > > >> > the following format:
      > > > > >> > Name[0] = J 0x4a
      > > > > >> > Name[1] = \0 0x0
      > > > > >> > Name[2] = I 0x49
      > > > > >> > Name[3] = \0 0x0
      > > > > >> > .
      > > > > >> > .
      > > > > >> > .
      > > > > >> > Name[n-1] = \0 0x0
      > > > > >> > Name[n] = \0 0x0
      > > > > >> >
      > > > > >> > I want to convert this unicode string to a regular string.
      > > However,
      > > > > > when
      > > > > >> > I
      > > > > >> > call RtlUnicodeStringToAnsiString, I get an NTSTATUS error
      > > indicating
      > > > > > that
      > > > > >> > I
      > > > > >> > have a buffer overrun.
      > > > > >> >
      > > > > >> > Here is my call to RtlUnicodeStringToAnsiString:
      > > > > >> > RtlUnicodeStringToAnsiString((PANSI_STRING) lHostname,
      > > > > >> > (PUNICODE_STRING)
      > > > > >> > valueInfoP->Data, FALSE);
      > > > > >> >
      > > > > >> > I have done an ExAllocatePoolWithTag for the lHostname
      variable.
      > > Why
      > > > > >> > doesn't this successfully convert to a regular string though?
      > > > > >> >
      > > > > >> > I've tried everything (well, obviously not everything). Any
      help
      > > > would
      > > > > > be
      > > > > >> > greatly appreciated.
      > > > > >> >
      > > > > >> > Thank you,
      > > > > >> > -- John
      > > > > >> >
      > > > > >> >
      > > > > >>
      > > > > >>
      > > > > >
      > > > > >
      > > > >
      > > > >
      > > >
      > > >
      > >
      > >
      >

      john | Tues, 20 May 2008 08:10:00 GMT |