Contribute  :  Web Resources  :  Past Polls  :  Site Statistics  :  Downloads  :  Forum  
    BiW ReversingThe challenge is yours    
 Welcome to BiW Reversing
 Wednesday, August 15 2018 @ 03:22 AM CEST
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 

Problem in reading REG_SZ value from registry

 
Post new topic   Reply to topic    www.reversing.be Forum Index -> Coding Corner
View previous topic :: View next topic  
Author Message
Defsanguje
New to the board
New to the board


Joined: 18 Jun 2006
Posts: 5
Location: Finland

PostPosted: Mon Oct 23, 2006 7:19 pm    Post subject: Problem in reading REG_SZ value from registry Reply with quote

........

Last edited by Defsanguje on Thu Sep 02, 2010 9:20 pm; edited 1 time in total
Back to top
View user's profile Send private message
detten
Site Admin


Joined: 05 Feb 2005
Posts: 317

PostPosted: Tue Oct 24, 2006 2:51 pm    Post subject: Reply with quote

You already did the first step, which is debugging your code. When you notice RegOpenKeyEx fails, you should note the return value, as this will tell you what the actual problem is (search for the error code in Winerror.h or use FormatMessage api to convert to readable error message.)

I haven't looked at your code in much detail, but the first thing I noticed is that you are trying to retrieve the DefaultDomainName and not the CPUID. So maybe you are even using XP home and that key doesn't exist?

Try to retrieve the exact return value from RegOpenKeyEx.

_________________
Ignorance is bliss, knowledge is power
Back to top
View user's profile Send private message Visit poster's website
Defsanguje
New to the board
New to the board


Joined: 18 Jun 2006
Posts: 5
Location: Finland

PostPosted: Tue Oct 24, 2006 6:01 pm    Post subject: Reply with quote

The exact return value from RegOpenKeyEx is 3E6 (Invalid access to memory location). Sounds like I am using "wrong parameters" or something, but in ollydbg everything looks fine:
hxxp://img405.imageshack.us/img405/6010/inollygs3.png
but still I return from the call with eax = 000003E6 Sad

I'm using WinXP Home and CPUID is stored in [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] with name "AltDefaultDomainName" & "DefaultDomainName"... And many other places in my registry, I will try to choose the best when I get this to work.
Back to top
View user's profile Send private message
stingduk
Regular
Regular


Joined: 19 Feb 2005
Posts: 148

PostPosted: Fri Oct 27, 2006 12:34 pm    Post subject: Reply with quote

you image is not viewable and i dont have masm atm to assemble and check

but ill quote verbatim from msdn

Quote:

hKey
[in] A handle to an open registry key. This handle is returned by the RegCreateKeyEx or RegOpenKeyEx function, or it can be one of the following predefined keys:

HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS




running an edit find on this page i didnt see either RegCreateEx or any predefined key
so most probably thats your primary problem
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    www.reversing.be Forum Index -> Coding Corner All times are GMT + 1 Hour
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group
 Copyright © 2018 BiW Reversing
 All trademarks and copyrights on this page are owned by their respective owners.
Powered By Geeklog 
Created this page in 0.05 seconds