On 03/15/2019 02:35 PM, Aric Stewart wrote:
It is easier for me here as I am being passed a UNICODE_STRING with the full path for the driver registry path in an NT API format.
-aric
For opening the key, yes, better to use NtOpenKey(). But there's no need to use NtEnumerateValueKey(); you can pass the same handle to RegEnumValue(). This would also let you use RegEnumValueA() instead of doing the conversion yourself.