in rtl/inc/kregkey.h [143:194]
PAGED NTSTATUS QueryValueBlob(
_In_ PCUNICODE_STRING Name,
_In_ Lambda Callback,
_In_ ULONG ExpectedDataType = REG_BINARY)
{
NTSTATUS NtStatus;
union
{
KEY_VALUE_PARTIAL_INFORMATION StackInformation;
UCHAR Buffer[256];
};
KEY_VALUE_PARTIAL_INFORMATION *Information = &StackInformation;
wistd::unique_ptr<UCHAR[]> HeapBuffer;
ULONG BytesNeeded;
NtStatus = ZwQueryValueKey(
*this,
const_cast<PUNICODE_STRING>(Name),
KeyValuePartialInformation,
Buffer,
sizeof(Buffer),
&BytesNeeded);
if (NtStatus == STATUS_BUFFER_OVERFLOW)
{
HeapBuffer.reset(new(std::nothrow, 'niBR') UCHAR[BytesNeeded]);
if (!HeapBuffer)
return STATUS_INSUFFICIENT_RESOURCES;
NtStatus = ZwQueryValueKey(
*this,
const_cast<PUNICODE_STRING>(Name),
KeyValuePartialInformation,
HeapBuffer.get(),
BytesNeeded,
&BytesNeeded);
if (!NT_SUCCESS(NtStatus))
return NtStatus;
Information = reinterpret_cast<KEY_VALUE_PARTIAL_INFORMATION*>(HeapBuffer.get());
}
else if (!NT_SUCCESS(NtStatus))
{
return NtStatus;
}
if (Information->Type != ExpectedDataType)
return STATUS_OBJECT_TYPE_MISMATCH;
return Callback(Information->Data, Information->DataLength);
}