I'm trying to get the type of the registry key default value type but it doesn't seem to work. I use the following code:
INVOKE RegQueryValueEx, hKey, NULL, NULL, ADDR iValueType, NULL, NULL
Where hKey is the handle to the key that has been opened before by RegOpenKeyEx SUCCESSFULLY and iValueType is a local variable in a procedure that executes the above code.
The above INVOKE statement returns error code 2 that means "The system cannot find the file specified." According to the Microsoft documentation to complete successfully such a call it has to be exactly what I'm using, but it doesn't works
Does anyone have any ideas about that?
MSDN:
If the lpValueName registry value does not exist, RegQueryValueEx returns ERROR_FILE_NOT_FOUND and the value returned through the lpcbData parameter is undefined.
Since you pass NULL, the API looks for the default registry entry for this key. Does it exist? Many registry keys don't have it.
For me RegQueryValueExA was really tricky. You need two offset and it seem to be a must. One with a DWORD size and it will never fail.
mov [aSIZE], 256
PUSH offset aSIZE
PUSH offset D_BUFFER_260_BYTE
PUSH 0
PUSH 0
PUSH eax
PUSH hKey
CALL RegQueryValueExA
I think i remember a case where exact size did matter... plus (((Terminator)))
I have understood what really happens about the default registry. Simply many keys don't have it at all and if a key does have it then it's enumerated through RegEnumValues function call. Thanks to everyone who has helped with that.