RegEnumKeyEx Confused

[Don57]

I am trying to enumerate a list of installed apps, by reading HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall

The first call appears to succeed, but the sz_SubKey contains the registry path to Uninstall inclusive

The second call appears to succeed also but the lp_Enum_Buffer is empty on it's return


          invoke RegOpenKeyEx, HKEY_LOCAL_MACHINE, ADDR sz_SubKey, NULL, KEY_ENUMERATE_SUB_KEYS , hReg

          invoke RegEnumKeyEx, hReg, NULL, lp_Enum_Buffer, NULL, NULL, NULL, NULL, NULL

[Donkey]

You should check the error code returned by the function if lp_Enum_Buffer returns empty, it may be that the enumeration has ended. Also the second parameter in RegEnumKeyEx is zero for the first call and must be incremented with each subsequent call until ERROR_NO_MORE_ITEMS is returned.

[dedndave]

many of the registry functions require a call to get the buffer size - then you make the actual call to get the info

after you have a handle to the key.....
you call RegQueryInfoKey to find out how big the buffer should be
in this case, it returns the length of the longest subkey
your bufffer should be that plus one, as i recall

after that, you can call RegEnumKeyEx with a buffer that you know to be large enough
one of the parameters is a pointer to the buffer
another parameter is a pointer to a dword value that holds the buffer size - this is a critical part you are missing
another parameter is the index, which can be incremented with each call to access a different subkey

[Don57]

I get no error codes. I think that the problem might be that i define the entire path in sz_SubKey for the call RegOpenKeyEx and set the path to NULL in RegEnumKeyEx thinking that it would default. Plus I'm not sure of the structure that is returned

[dedndave]

Code Select Expand

invoke RegOpenKeyEx, HKEY_LOCAL_MACHINE, ADDR sz_SubKey, NULL, KEY_ENUMERATE_SUB_KEYS , hReg

i spotted another problem
when you open the key, the last parm should be a pointer to hReg

Code Select Expand

invoke RegOpenKeyEx, HKEY_LOCAL_MACHINE, ADDR sz_SubKey, NULL, KEY_ENUMERATE_SUB_KEYS , ADDR hReg

it should have crashed the other way   :P
0xc0000005 error - my fave

[Tedd]

You're also not setting the buffer size.

This works as intended:

Code Select Expand


.586
.model flat, stdcall
option casemap:none
include windows.inc
include kernel32.inc
includelib kernel32.lib
include advapi32.inc
includelib advapi32.lib

.const
swkey       db "Software\Microsoft\Windows\CurrentVersion\Uninstall",0

.data?
hSWKey      HANDLE ?
buff_siz    DWORD ?
buff        db 256 dup(?)

.code
start:
    invoke RegOpenKeyEx, HKEY_LOCAL_MACHINE,ADDR swkey,0,KEY_READ,ADDR hSWKey
    .IF (eax==ERROR_SUCCESS)
        push esi
        mov esi,0
      @@:
        mov eax,SIZEOF buff
        mov buff_siz,eax
        invoke RegEnumKeyEx, hSWKey,esi,ADDR buff,ADDR buff_siz,NULL,NULL,NULL,NULL
        ;should also be checking for ERROR_NO_MORE_ITEMS here, which means a successful end rather than an actual error
        cmp eax,ERROR_SUCCESS
        jne @F

        ;buff now contains the subkey name..

        inc esi
        jmp @B
      @@:
        pop esi

        invoke RegCloseKey, hSWKey
    .ELSE
        ;fail...
    .ENDIF
    invoke ExitProcess, NULL
end start

[Don57]

Thanks for the help.

[dedndave]

and - i had to alter the access rights...

i won't show the result - it's 10 kb of text - lol
but, it's a console mode program