驱动读取注册表

#include <ntddk.h>
#define  MY_REG_SOFTWARE_KEY_NAME L"\\Registry\\Machine\\Software\\lxw"

NTSTATUS	Unload(PDRIVER_OBJECT driver)
{
	DbgPrint("unload driver");
	return STATUS_SUCCESS;
}


VOID QueryRegTest()
{
	UNICODE_STRING RegUnicodeString;
	HANDLE hRegister;
	PKEY_VALUE_PARTIAL_INFORMATION pvpi;
	OBJECT_ATTRIBUTES objectAttributes;
	NTSTATUS ntStatus;
	UNICODE_STRING ValueName;
	ULONG ulSize;


	//初始化UNICODE_STRING字符串
	RtlInitUnicodeString(&RegUnicodeString,
		MY_REG_SOFTWARE_KEY_NAME);


	//初始化objectAttributes
	InitializeObjectAttributes(&objectAttributes,
		&RegUnicodeString,
		OBJ_CASE_INSENSITIVE,//对大小写敏感
		NULL,
		NULL);
	//打开注册表
	ntStatus = ZwOpenKey(&hRegister,
		KEY_ALL_ACCESS,
		&objectAttributes);

	if (NT_SUCCESS(ntStatus))
	{
		KdPrint(("Open register successfully\n"));
	}


	//初始化ValueName
	RtlInitUnicodeString(&ValueName, L"test");


	ntStatus = ZwQueryValueKey(hRegister,
		&ValueName,
		KeyValuePartialInformation,
		NULL,
		0,
		&ulSize);

	if (ntStatus == STATUS_OBJECT_NAME_NOT_FOUND || ulSize == 0)
	{
		ZwClose(hRegister);
		KdPrint(("The item is not exist\n"));
		return;
	}
	pvpi =
		(PKEY_VALUE_PARTIAL_INFORMATION)
		ExAllocatePool(PagedPool, ulSize);

	ntStatus = ZwQueryValueKey(hRegister,
		&ValueName,
		KeyValuePartialInformation,
		pvpi,
		ulSize,
		&ulSize);
	if (!NT_SUCCESS(ntStatus))
	{
		ZwClose(hRegister);
		KdPrint(("Read regsiter error\n"));
		return;
	}
	//判断是否为REG_SZ类型
	if (pvpi->Type == REG_SZ)
	{
		ANSI_STRING a;
		ANSI_STRING a1;
		UNICODE_STRING u;

		//pvpi->Data 为读取到的键值,正常应该是 "value of test!"

		KdPrint(("以宽字符串打印:%S\n", pvpi->Data));  //以宽字符串方式打印,输出正常,但是pvpi->Data明明是uchar类型的,为什么能用宽字符来输出?

		KdPrint(("以ANSI字符串格式打印:%s\n", pvpi->Data)); //以ANSI字符串格式打印,输出不正常,只能输出第一个字符,但是pvpi->Data是uchar类型的,为毛不正确?
		KdPrint(("以ANSI字符串格式打印:%s\n", (char*)pvpi->Data));//添加强制换转,效果同上


		RtlInitUnicodeString(&u, pvpi->Data); //RtlInitUnicodeString的第二个参数要求为wchar* ,而pvpi->Data类型为uchar ,但是编译能通过,输出也正常,为什么可以这样呢?
		//RtlInitUnicodeString(&u,(WCHAR*)pvpi->Data); //此句添加强制转换,效果同上
		KdPrint(("unicode_string:%wZ\n", &u));

		RtlUnicodeStringToAnsiString(&a1, &u, TRUE); //unicode_string转换为asni_string,输出正确
		KdPrint(("unicode to ansi_string:%Z\n", &a1));
		RtlFreeAnsiString(&a1);


		RtlInitAnsiString(&a, (char*)pvpi->Data);//输出内容不正确,只能输出第一个字符
		KdPrint(("ansi_string:%Z\n", &a));


	}
	ZwClose(hRegister);
}


NTSTATUS	DriverEntry(PDRIVER_OBJECT	driver, PUNICODE_STRING	RegPath)
{
	DbgPrint("Driver Entry");
	driver->DriverUnload = Unload;
	QueryRegTest();
	return STATUS_SUCCESS;
}