REG_EXPAND_SZ and ExpandEnvironmentStrings

[Zen]

Hi, everyone,...
...ARRRGGHH,...
I'm writing a Registry search routine, and, I've never retrieved a REG_EXPAND_SZ type before (a Registry Key Value) and tried to convert it to readable form.
The documentation Registry Value Types, MSDN, says that you use: ExpandEnvironmentStrings to convert a string that contains unexpanded references to environment variables and replaces them with the "values defined for the current user".
...Have any of you ever attempted this ??? It sounds like a MAJOR pain-in-the-ass. Any tips ???

...Oh,...and a secondary question: when you are retrieving a Key Value (using, RegEnumValue), and it is the "Default" name, does that mean that the name string is of zero length, or is there some other convention not described in the documentation ??? (I'm assuming that there can be ONLY ONE default Name, and the associated value, but, I COULD BE WRONG.)
Thanks,...

[MichaelW]

I recall using ExpandEnvironmentStrings, but don't have the code on the system I'm on, so I made a 32-bit macro version, that seems to work OK on my laptop under Windows 8.1-64 :

Code Select Expand


xenvstr MACRO envstr
    push    ebx
    push    edi
    push    esi
    mov     esi, reparg(envstr)
    invoke ExpandEnvironmentStrings, esi, 0, 0
    mov     ebx, eax
    mov     edi, alloc(ebx)
    invoke ExpandEnvironmentStrings, esi, edi, ebx
    printf("%s:\n\n%s\n\n", esi, edi)
    free    edi     
    pop     esi
    pop     edi
    pop     ebx
ENDM

include \masm32\include\masm32rt.inc
.data
.code
start:
    xenvstr "%ComSpec%"
    xenvstr "%NUMBER_OF_PROCESSORS%"
    xenvstr "%OS%"
    xenvstr "%Path%"
    xenvstr "%PATHEXT%"
    xenvstr "%PROCESSOR_ARCHITECTURE%"
    xenvstr "%PROCESSOR_IDENTIFIER%"
    xenvstr "%PROCESSOR_LEVEL%"
    xenvstr "%PROCESSOR_REVISION%"
    xenvstr "%PSModulePath%"
    xenvstr "%TEMP%"
    xenvstr "%TMP%"
    xenvstr "%USERNAME%"
    xenvstr "%windir%"
    inkey
    exit
end start


[dedndave]

Code Select Expand

szDefaultName db 0,0

[jj2007]

Raymond Chen:

This simplicity in design pushes the responsibility onto the code that uses the registry. If you read a registry value and the data is tagged with the REG_EXPAND_SZ type, then it's up to you to expand it if that's what you want to do.

include \masm32\MasmBasic\MasmBasic.inc
  Init
  Let esi=GetRegVal("HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment","TEMP", "not found")
  Print "TEMP=[", esi, "]", CrLf$
  Print "TEMP=[", ExpandEnv$(esi), "]"
  Exit
end start

Code Select Expand

TEMP=[%SystemRoot%\TEMP]
TEMP=[C:\Windows\TEMP]

(I'm assuming that there can be ONLY ONE default Name, and the associated value, but, I COULD BE WRONG.)

Try HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Locale

[dedndave]

the "Default" value is a carry-over from windows 95
in early versions of the system registry, there were no data "Values", per se
each key had only one value - what we now call the Default value
i.e., it has no name

knowing that should help you understand its' use and meaning

[Zen]

Thanks guys,...again, just what I wanted to know,...
...And, JOCHEN, that blog entry from Raymond Chen explains everything,...I had gotten the impression that the Registry was unregulated (that you could basically write anything to it),...and, Raymond Chen confirmed that.     

[adeyblue]

I think somebody mentioned them in your previous thread, but the SHReg* functions are basically the Vista+ 'nice' registry functions, but available on XP.

For example, RegGetValue will auto expand REG_EXPAND_SZ but it doesn't exist on XP. SHRegGetValue on the other hand is (SP2 anyway), and does all of the same things and with the same parameters

[Zen]

OK,...I got ExpandEnvironmentStrings to decode an enormous number of path strings with environment-variables, and my List View looks a lot better and produces much more useful information.
...But,...I have a number of path strings of the form:   
C:\PROGRA~ 2\MICROS~3\Office12\OUTLCTL.DLL
...And, I don't even know what they are,...much less, what function to call to decode them,...
Any ideas ???

[sinsi]

GetLongPathName

[Zen]

SINSI,
PERFECT ! THANKS !
I have never even heard of that function before,...it's just what I need.