Windows NT Native API Wrapper Library

• Download source code - 396.56 KB
• Download NT Registry Editor - 239.26 KB

Introduction

This is intended to be a library like the .NET Framework, but which uses native Windows NT API functions - like NtOpenKey, NtCreateFile, etc.

Using the Code

To use this code, you will first need to either get the binaries (which only require .NET Framework 2.0 to run), or you will need to use the source code (which still needs .NET Framework 2.0, but needs language features only present in C# 3.0).

This library is by no means finished, and the only decent part is the System.WindowsNT.Registry.NtRegistryKey class. It is intended to use the native Windows NT API functions, because many features available in them are not available in normal, documented Windows API functions. For example, you can choose whether paths are case-sensitive or not, and there are some functions with no counterparts in the Win32 API, like NtCompressKey. Furthermore, this library supports registry keys with null characters in their paths - something that the Windows API doesn't support.

Some (actually, most) users complain that these functions are not intended to be used by us. Well, I think actually there are people out there who will find this library useful.

To use the code, just add a reference to the library in your application, and use the System.WindowsNT.Registry.NtRegistryKey class, almost completely like you would use Microsoft.Win32.RegistryKey class.

Heads up, though: Since this project is not even close to being finished, the interface is not at all guaranteed to be the same in the next release. For example, in future releases, there may no longer be any indexes for accessing registry values; instead, GetValue() might be added. So expect some version problems.

Here is the current public class interface:

public class NtRegistryKey : NtObject
{
   // Fields
   public const short MaxKeyNameLength = 0x100;
   public const short MaxValueNameLength = 0x7fff;
   public const short NoCountLimit = -1;

   // Events
   // DO NOT USE YET; NOT SUPPORTED
   public event EventHandler NameChanged;

   // Methods
   protected NtRegistryKey(SafeNtRegistryHandle handle);
   protected void CheckAndThrowIfDisposed();
   public void Compact();
   public void Compress();
   public static NtRegistryKey CreateKey(string path, KeyAccessMask accessMask,
       AllowedObjectAttributes attributes, RegCreateOptions createOptions,
       RegCreationDisposition creationDisposition);
   public void DeleteKey();
   public void Flush();
   public IEnumerable GetMatches(bool searchSubKeyNames, bool searchValueNames,
       bool searchValueData, Regex regex, RecursionOptions recursion,
       AllowedObjectAttributes subKeyOpenAttributes);
   public static bool KeyExists(string keyName);
   public void Load(string hiveName, string fileName,
       AllowedObjectAttributes attributes);
   public void Load2(string hiveName, string fileName,
       KeyRestoreOptions loadOptions, AllowedObjectAttributes attributes);
   public void Lock();
   // DO NOT USE YET; NOT SUPPORTED
   protected virtual void OnNameChanged(NameChangedEventArgs e);
   public static NtRegistryKey OpenCurrentUserKey();
   public static NtRegistryKey OpenCurrentUserKey(KeyAccessMask accessMask,
       AllowedObjectAttributes attributes);
   public static NtRegistryKey OpenKey(string path, KeyAccessMask accessMask,
       AllowedObjectAttributes attributes);
   public static NtRegistryKey OpenMachineHive();
   public static NtRegistryKey OpenMachineHive(KeyAccessMask accessMask,
       AllowedObjectAttributes attributes);
   public NtRegistryKey OpenParentKey(KeyAccessMask accessMask,
       AllowedObjectAttributes attributes);
   public static NtRegistryKey OpenRegistry();
   public static NtRegistryKey OpenRegistry(KeyAccessMask accessMask,
       AllowedObjectAttributes attributes);
   public static NtRegistryKey OpenUsersHive();
   public static NtRegistryKey OpenUsersHive(KeyAccessMask accessMask,
       AllowedObjectAttributes attributes);
   public void Restore(NtFile file, KeyRestoreOptions restoreOptions);
   public static string RtlFormatCurrentUserKeyPath();
   public void Save(NtFile file);
   public void SaveEx(NtFile file, RegHiveFormat hiveFormat);
   public void Unload(string subKeyName);
   public RegNotifyInformation[] WaitForChange(RegNotifyFilter notifyFilter,
      bool watchSubTree);

   // Properties
   public KeyAccessMask AccessMask { get; }
   public static bool AutoAskForPrivilege { get; set; }
   public string Class { get; }
   public string FullPath { get; }
   public override SafeNtHandle GenericHandle { get; }
   public SafeNtRegistryHandle Handle { get; private set; }
   public DateTime LastWriteTime { get; set; }
   public string Name { get; set; }
   public SubKeyCollection SubKeys { get; private set; }
   public int TitleIndex { get; }
   public int UserFlags { get; set; }
   public ValueCollection Values { get; private set; }

   //Classes
   public struct MatchResult {...}
   public class SubKeyCollection {...}
   public class ValueCollection {...}
}

This is one sample class from the many supported classes in this library; there are many others, like NtFile, NtEvent, the Devices namespace, the Security namespace, etc. Explore them all, but remember that the following are not complete and may not work (I hope this list is complete!):

Any event notifications for NtRegistryKey and/or NtFile.

• NtProcess creation methods.
• NtThread creation methods.
• NtFile, if opened without either the SynchronousIoAlert or SynchronousIoNonAlert flags.

Points of Interest

Use the code, have fun, but don't expect it to work 100%!!!

Any comments/suggestions/bug reports/etc. are welcome. But don't expect them to be fixed the next day!

Current Problems

There are many problems, but I'll put down the two important ones.

• First of all, I too am having SEVERE problems with NtNotifyChangeKey - any sort of documentation on it is appreciated, as I can find almost none on the Web.
• Second, I do not know what privileges are needed for functions like NtCompressKey, as I get an error saying I don't have them. If anyone knows, please let me know.

History

• December 5, 2007: Article submitted

Bibliography

I have only copied header files (Windows DDK) - nothing else has been copied, except for a few lines of C++ code from here. No other code was very helpful, as I'm writing this in C#, and I have converted a LOT of code(by hand). Thanks a LOT, however, to this website, as, without it, this project would not be possible. And last (but not least), thanks to the program called Reflector!