Question

I am trying to create an offline registry in memory using the offreg.dll provided in the windows ddk 7 package.

You can find out more information on the offreg.dll here:
MSDN

Currently, while attempted to create the hive using ORCreateHive, I receive the following error:

“Managed Debugging Assistant ‘PInvokeStackImbalance’ has detected a problem. This is likely because the managed PInvoke signature does not match the unmanaged target signature. Check that the calling convention and parameters of the PInvoke signature match the target unmanaged signature.”

Here is the offreg.h file containing ORCreateHive:

    typedef PVOID   ORHKEY;
typedef ORHKEY  *PORHKEY;

VOID 
ORAPI
ORGetVersion(
    __out  PDWORD pdwMajorVersion,
    __out  PDWORD pdwMinorVersion
    );

DWORD
ORAPI
OROpenHive (
    __in  PCWSTR    lpHivePath,
    __out PORHKEY   phkResult
    );

DWORD
ORAPI
ORCreateHive (
    __out PORHKEY   phkResult
    );

DWORD
ORAPI
ORCloseHive (
    __in ORHKEY     Handle
    );

The following is my C# code attempting to call the .dll and create the pointer for future use.

using System.Runtime.InteropServices;

namespace WindowsFormsApplication6
{
    public partial class Form1 : Form
    {
        public Form1()
        {
            InitializeComponent();

        }

        [DllImport("offreg.dll", CharSet = CharSet.Auto, EntryPoint = "ORCreateHive", SetLastError=true, CallingConvention = CallingConvention.StdCall)]
        public static extern IntPtr ORCreateHive2();

        private void button1_Click(object sender, EventArgs e)
        {
            try
            {
                IntPtr myHandle = ORCreateHive2();
            }
            catch (Exception r)
            {
                MessageBox.Show(r.ToString());
            }
        }
    }
}

I have been able to create pointers in the past with no issue utilizing user32.dll, icmp.dll, etc. However, I am having no such luck with offreg.dll.

Thank you.

Answer 1

You need to add a parameter in your managed signature to match the native one.

[DllImport("offreg.dll", CharSet = CharSet.Auto, EntryPoint = "ORCreateHive", SetLastError=true, CallingConvention = CallingConvention.StdCall)]
public static extern uint ORCreateHive2(out IntPtr notUsed);

Also given that the key is returned as an out parameter, your code should read as follows

IntPtr myHandle;
uint ret = ORCreateHive2(out myHandle);
if ( ret == 0 ) { 
  return myHandle;
} else {
  // Error ...
}