驱动注册表操作

void ReadRegistry()
{
	NTSTATUS nStatus;
	ULONG default_value = 0;

	static RTL_QUERY_REGISTRY_TABLE table[3];//必须比实际元素多一个，即N+1	

	KdPrint(("ReadRegistry\n"));

	table[0].Flags = RTL_QUERY_REGISTRY_DIRECT;
	table[0].Name = L"offset_x";
	table[0].EntryContext = &g_OffSet_X;
	table[0].DefaultType = REG_DWORD;
	table[0].DefaultData = &default_value;
	table[0].DefaultLength = sizeof(ULONG);

	table[1].Flags = RTL_QUERY_REGISTRY_DIRECT;
	table[1].Name = L"offset_y";
	table[1].EntryContext = &g_OffSet_Y;
	table[1].DefaultType = REG_DWORD;
	table[1].DefaultData = &default_value;
	table[1].DefaultLength = sizeof(ULONG);	
		
	nStatus = RtlQueryRegistryValues(RTL_REGISTRY_SERVICES,L"Morgan\\Parameters",table,NULL,NULL);
	if(NT_SUCCESS(nStatus))
	{
		KdPrint(("offset_x:%d\n",g_OffSet_X));
		KdPrint(("offset_y:%d\n",g_OffSet_Y));
	}else
	{
		g_OffSet_X = 0;
		g_OffSet_Y = 0;
	}
	
	
}

转载于:https://www.cnblogs.com/fanzi2009/archive/2009/08/28/1555587.html