[C++] 用Visual studio11在Windows8上开发内核枚举注册表

#include <ntddk.h>
VOID DriverUnload(IN PDRIVER_OBJECT DriverObject)
{
DbgPrint("Driver Unload");
}
//自定义枚举注册表键值函数
NTSTATUS
MyRegEnumSubValue()  
{
UNICODE_STRING RegUnicodeString;
HANDLE hRegister;
ULONG ulSize;
NTSTATUS ntStatus;
UNICODE_STRING uniKeyName;
PKEY_VALUE_FULL_INFORMATION  pvbi;
PKEY_FULL_INFORMATION pfi;
ULONG i;
OBJECT_ATTRIBUTES objectAttributes;
//初始化UNICODE_STRING字符串
RtlInitUnicodeString( &RegUnicodeString,
L"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN");
//初始化objectAttributes
InitializeObjectAttributes(&objectAttributes,
    &RegUnicodeString,
    OBJ_CASE_INSENSITIVE,//对大小写敏感
    NULL,
    NULL );
//打开注册表
  ntStatus = ZwOpenKey( &hRegister,
    KEY_ALL_ACCESS,
    &objectAttributes);
if (NT_SUCCESS(ntStatus))
{
KdPrint(("Open register successfully\n"));
}
ZwQueryKey(hRegister,
KeyFullInformation,
NULL,
0,
&ulSize);
pfi=(PKEY_FULL_INFORMATION)
ExAllocatePool(PagedPool,ulSize);
//查询注册表
ZwQueryKey(hRegister,
KeyFullInformation,
pfi,
ulSize,
&ulSize);
//开始循环枚举注册表
for(i=0;i<pfi->Values;i++)
{
ZwEnumerateValueKey(hRegister,
i,
KeyValueFullInformation,
NULL,
0,
&ulSize);
pvbi =(PKEY_VALUE_FULL_INFORMATION )
ExAllocatePool(PagedPool,ulSize);
ZwEnumerateValueKey(hRegister,
i,
KeyValueFullInformation,
pvbi,
ulSize,
&ulSize);
uniKeyName.Length = uniKeyName.MaximumLength =
(USHORT)pvbi->NameLength;
uniKeyName.Buffer = pvbi->Name;
//将键值输出
DbgPrint("第%d个键值名称是:%wZ\n",i,&uniKeyName);
//判断键值的类型
if (pvbi->Type==REG_SZ)
{
DbgPrint("键值的类型是:REG_SZ\n");
}
else if (pvbi->Type==REG_MULTI_SZ)
{
DbgPrint("键值的类型是:REG_MULTI_SZ\n");
}
else if (pvbi->Type==REG_DWORD)
{
KdPrint(("键值的类型是:REG_DWORD\n"));
}
else if (pvbi->Type==REG_BINARY)
{
KdPrint(("键值的类型是:REG_BINARY\n"));
}
ExFreePool(pvbi);
}
ExFreePool(pfi);
ZwClose(hRegister);
return STATUS_SUCCESS;
}
NTSTATUS 
DriverEntry( 
IN PDRIVER_OBJECT  DriverObject, 
IN PUNICODE_STRING  RegistryPath 
  )
{
MyRegEnumSubValue();
DriverObject->DriverUnload = DriverUnload;
return STATUS_SUCCESS;
}