首页 文章

枚举注册表项C.

提问于
浏览
2

我想在HKLM \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run中显示所有注册表项,子项和值,以查看启动时运行的程序 .

我正在使用MS的这段代码 .

void QueryKey(HKEY hKey) 
{ 
TCHAR    achKey[MAX_KEY_LENGTH];   // buffer for subkey name
DWORD    cbName;                   // size of name string 
TCHAR    achClass[MAX_PATH] = TEXT("");  // buffer for class name 
DWORD    cchClassName = MAX_PATH;  // size of class string 
DWORD    cSubKeys=0;               // number of subkeys 
DWORD    cbMaxSubKey;              // longest subkey size 
DWORD    cchMaxClass;              // longest class string 
DWORD    cValues;              // number of values for key 
DWORD    cchMaxValue;          // longest value name 
DWORD    cbMaxValueData;       // longest value data 
DWORD    cbSecurityDescriptor; // size of security descriptor 
FILETIME ftLastWriteTime;      // last write time 

DWORD i, retCode; 

TCHAR  achValue[MAX_VALUE_NAME]; 
DWORD cchValue = MAX_VALUE_NAME; 

// Get the class name and the value count. 
retCode = RegQueryInfoKey(
    hKey,                    // key handle 
    achClass,                // buffer for class name 
    &cchClassName,           // size of class string 
    NULL,                    // reserved 
    &cSubKeys,               // number of subkeys 
    &cbMaxSubKey,            // longest subkey size 
    &cchMaxClass,            // longest class string 
    &cValues,                // number of values for this key 
    &cchMaxValue,            // longest value name 
    &cbMaxValueData,         // longest value data 
    &cbSecurityDescriptor,   // security descriptor 
    &ftLastWriteTime);       // last write time 

// Enumerate the subkeys, until RegEnumKeyEx fails.

if (cSubKeys == 0)
{
    printf("No values found\n");                          
}


if (cSubKeys)
{
    printf( "\nNumber of subkeys: %d\n", cSubKeys);



    for (i=0; i<cSubKeys; i++) 
    { 
        cbName = MAX_KEY_LENGTH;
        retCode = RegEnumKeyEx(hKey, i,
                 achKey, 
                 &cbName, 
                 NULL, 
                 NULL, 
                 NULL, 
                 &ftLastWriteTime); 
        if (retCode == ERROR_SUCCESS) 
        {
            _tprintf(TEXT("(%d) %s\n"), i+1, achKey);

        }
    }
} 

// Enumerate the key values. 

if (cValues) 
{
    printf( "\nNumber of values: %d\n", cValues);

    for (i=0, retCode=ERROR_SUCCESS; i<cValues; i++) 
    { 
        cchValue = MAX_VALUE_NAME; 
        achValue[0] = '\0'; 
        retCode = RegEnumValue(hKey, i, 
            achValue, 
            &cchValue, 
            NULL, 
            NULL,
            NULL,
            NULL);

        if (retCode == ERROR_SUCCESS ) 
        { 
            _tprintf(TEXT("(%d) %s\n"), i+1, achValue); 
        } 
    }
}
}








int RegKeyCount = 0;

int main(int argc, char *argv[])
{


HKEY hTestKey;

  if(RegOpenKeyEx(HKEY_LOCAL_MACHINE, TEXT("SOFTWARE\\Microsoft\\Windows  \\CurrentVersion\\Run"), 0, KEY_READ, &hTestKey) == ERROR_SUCCESS)
  {
  QueryKey(hTestKey);
  }
}

我很困惑,如果我为“SOFTWARE \ Microsoft \ Windows \ CurrentVersion”运行此代码,它将显示所有子键和值(我可以看到Run是CurrentVersion的子键),但是当我试图让它显示时运行它的子键和值表示即使条目存在也没有找到任何内容 .

我还应该说我不知道子键/值的值的名称,它们可以是任何东西 .

这确实是RegEnumValue应该做什么或者我需要使用另一个注册表功能吗?

1 回答

  • 1

    我发现的唯一问题是参数中的空格为 RegOpenKeyEx() ,如果取出嵌入的空格使程序读取 TEXT("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") ,程序运行正常 .

    你的 printf 在开头有点令人困惑,也许你应该将 "No values found\n" 改为 "No keys found\n"

    if (cSubKeys == 0)
        printf("No keys found\n");
    

    另外:如果您在64位操作系统中将此代码构建/运行为32位程序,请注意您将获得HKLM \ SOFTWARE \ Wow6432Node \ Microsoft \ Windows \ CurrentVersion \ Run的内容,而不是HKLM \ SOFTWARE \微软\的Windows \ CurrentVersion \ Run中!

相关问题