Question

I am trying to create an offline registry in memory using the offreg.dll provided in the windows ddk 7 package.

You can find out more information on the offreg.dll here: MSDN

Currently, while attempting to read a value from an open registry hive / key I receive the following error: 234 or ERROR_MORE_DATA

Here is the .h code that contains ORGetValue:

DWORD
ORAPI
ORGetValue (
    __in ORHKEY     Handle,
    __in_opt PCWSTR lpSubKey,
    __in_opt PCWSTR lpValue,
    __out_opt PDWORD pdwType,
    __out_bcount_opt(*pcbData) PVOID pvData,
    __inout_opt PDWORD pcbData
    );

Here is the code that I am using to pull the data

[DllImport("offreg.dll", CharSet = CharSet.Auto, EntryPoint = "ORGetValue", SetLastError = true, CallingConvention = CallingConvention.StdCall)]
        public static extern uint ORGetValue(IntPtr Handle, string lpSubKey, string lpValue, out uint pdwType, out string pvData, out uint pcbData);

        IntPtr myHive;            
        IntPtr myKey;
        string myValue;
        uint pdwtype;
        uint pcbdata;    

uint ret3 = ORGetValue(myKey, "", "DefaultUserName", out pdwtype, out myValue, out pcbdata);

The goal is to be able to read myValue as a string.

I am not sure if I need to use marshaling… or a second call with an adjusted buffer.. Or really how to adjust the buffer in C#. Any help or pointers would be greatly appreciated.

Thank you.

Answer 1

The attribute on the pcbData argument is wrong, it is ref, not out. You need to initialize it to the Capacity of the StringBuilder you pass for the pvData argument. Right now the API function probably sees a 0 so will return the error code.

It ought to look something like this:

[DllImport("offreg.dll", CharSet = CharSet.Auto, SetLastError = true)]
public static extern uint ORGetValue(IntPtr Handle, string lpSubKey, string lpValue, out int pdwType, StringBuilder pvData, ref int pcbData);

  int pdwtype;
  var buffer = new StringBuilder(256);
  int pcbdata = buffer.Capacity;
  uint ret3 = ORGetValue(myKey, "", "DefaultUserName", out pdwtype, buffer, ref pcbdata);
  string myValue = buffer.ToString();