How to access registry items under driver service registry key path of Win11 24H2 in a WDF driver?

Jingshan Song (Jingshan) 15 Reputation points
2024-05-22T01:22:02.8666667+00:00

I am currently utilizing a Kernel Mode Driver Framework (KMDF) driver, employing the RtlQueryRegistryValues function with parameters (RTL_REGISTRY_ABSOLUTE, L"\Registry\Machine\System\CurrentControlSet\Services...") to access specific registry entries.

However, upon enabling the verifier of version 24H2 (build 26100), I encountered an error recorded in the System.evtx log. The error message indicates a violation: "Registry operations should not use absolute paths. Detected querying of value(s) under unisolated registry key relative to RTL_REGISTRY_ABSOLUTE"

Consequently, I modified the initial parameter of RtlQueryRegistryValues to "RTL_REGISTRY_SERVICES." Subsequently, the error message in the System.evtx log changed to: "Registry operations should only use key handles returned from WDF or WDM APIs."

In an attempt to rectify this issue, I explored alternative approaches such as utilizing "WdfDeviceOpenRegistryKey" with parameters "PLUGPLAY_REGKEY_DEVICE" and "PLUGPLAY_REGKEY_DRIVER," as well as "WdfDriverOpenParametersRegistryKey." However, it appears that none of these methods successfully access the intended registry path "\Registry\Machine\System\CurrentControlSet\Services...". Furthermore, the absence of an API to retrieve the registry path following the invocation of "WdfDeviceOpenRegistryKey" exacerbates the challenge, as I am unable to ascertain the specific registry key opened by the function.

Presently, I am at a loss regarding how to access the driver service registry item without encountering error prompts. Moreover, I find it perplexing that while invoking WdfDriverGetRegistryPath(Driver) yields the correct path of the driver service, I am unable to identify the appropriate API to utilize this path effectively."

C++
C++
A high-level, general-purpose programming language, created as an extension of the C programming language, that has object-oriented, generic, and functional features in addition to facilities for low-level memory manipulation.
3,608 questions
Windows Hardware Performance
Windows Hardware Performance
Windows: A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.Hardware Performance: Delivering / providing hardware or hardware systems or adjusting / adapting hardware or hardware systems.
1,570 questions
Windows Driver Kit (WDK)
Windows Driver Kit (WDK)
A set of Microsoft tools that are used to develop, test, and deploy Windows drivers.
44 questions
{count} votes