ZwQueryValueKey返回STATUS_BUFFER_TOO_SMALL怎么解决？

Status = ZwQueryValueKey(KeyHandle,
&UnicodeValueName,
KeyValuePartialInformation,
Information,
sizeof(Information),
&InformationSize);
哪个变量长度不够，谁可以告述我么？

Status = ZwQueryValueKey(KeyHandle,
&UnicodeValueName,
KeyValuePartialInformation,
Information,   //这个值太小，重新分配
sizeof(Information), //不能这样写
&InformationSize);


参考一下这个

    rs := $10000;

    repeat
      ReallocMem (fSysInfo, rs);
      rv := NtQuerySystemInformation (d, fSysInfo, rs, @res);
      rs := rs * 2;
    until rv <> STATUS_INFO_LENGTH_MISMATCH;

主要是最后三个参数搞错了

Status = ZwQueryValueKey(KeyHandle,
&UnicodeValueName,
KeyValuePartialInformation,
Information, //这个值所指空间太小
sizeof(Information),
&InformationSize);//此值为所需大小

调用失败后，InformationSize指定所需大小
你要把Information指向的空间大小变为InformationSize值

int GetRegValueDword(PCWSTR RegPath,PCWSTR ValueName,PULONG Value)
{
int ReturnValue = 0;
NTSTATUS Status;
OBJECT_ATTRIBUTES ObjectAttributes;
HANDLE KeyHandle;
KEY_VALUE_PARTIAL_INFORMATION *Information;
ULONG InformationSize;
UNICODE_STRING UnicodeRegPath;
UNICODE_STRING UnicodeValueName;

RtlInitUnicodeString(&UnicodeRegPath, RegPath);
RtlInitUnicodeString(&UnicodeValueName, ValueName);

InitializeObjectAttributes(&ObjectAttributes,
&UnicodeRegPath,
OBJ_CASE_INSENSITIVE, // Flags
NULL, // Root directory
NULL); // Security descriptor

Status = ZwOpenKey(&KeyHandle,
KEY_ALL_ACCESS,
&ObjectAttributes);
if (Status != STATUS_SUCCESS)
{
DbgPrint(\"one\");
return 0;
}

InformationSize = sizeof(Information) + sizeof(ULONG);

Information = (KEY_VALUE_PARTIAL_INFORMATION*)ExAllocatePoolWithTag(PagedPool, InformationSize,\'ISmD\'); // DmSI

if (Information == NULL)
{DbgPrint(\"two\");
ZwClose(KeyHandle);
return 0;
}

Status = ZwQueryValueKey(KeyHandle,
&UnicodeValueName,
KeyValuePartialInformation,
Information,
sizeof(Information),
&InformationSize);
if (Status == STATUS_SUCCESS)
{
if (Information->Type == REG_DWORD && Information->DataLength == sizeof(ULONG))
{
DbgPrint(\"three\");
RtlCopyMemory(Value, Information->Data, sizeof(ULONG));
ReturnValue = 1;
}
}
else if (Status == STATUS_BUFFER_TOO_SMALL) DbgPrint(\"STATUS_BUFFER_TOO_SMALL\");
else if (Status == STATUS_INVALID_PARAMETER) DbgPrint(\"STATUS_INVALID_PARAMETER\");
else if (Status == STATUS_OBJECT_NAME_NOT_FOUND) DbgPrint(\"STATUS_OBJECT_NAME_NOT_FOUND\");
ExFreePool(Information);
ZwClose(KeyHandle);
DbgPrint(\"four\");

return ReturnValue;
}
这是我的取值函数，总是返回STATUS_BUFFER_TOO_SMALL，我应改怎么改多谢了 :D

.........
//------------------change-------------
//InformationSize = sizeof(Information) + sizeof(ULONG);

//Information = (KEY_VALUE_PARTIAL_INFORMATION*)ExAllocatePoolWithTag(PagedPool,
//InformationSize,\'ISmD\'); // DmSI


Status = ZwQueryValueKey(KeyHandle,
&UnicodeValueName,
KeyValuePartialInformation,
NULL,//传此参数，计算所需空间大小，由InformationSize返回
0,
&InformationSize);


if (Status == STATUS_BUFFER_TOO_SMALL)
{//ZwQueryValueKey计算的大小来申请空间
Information = (KEY_VALUE_PARTIAL_INFORMATION*)ExAllocatePoolWithTag(PagedPool, InformationSize,\'ISmD\'); // DmSI

if (Information == NULL)
{DbgPrint(\"two\");
ZwClose(KeyHandle);
return 0;
}

Status = ZwQueryValueKey(KeyHandle,
&UnicodeValueName,
KeyValuePartialInformation,
Information,
InformationSize
&InformationSize);
}

//------------------change-------------
if (Status == STATUS_SUCCESS)
{
...


[编辑 -  5/27/04 by  snowStart]

[编辑 -  5/27/04 by  snowStart]

我试了，还是报STATUS_BUFFER_TOO_SMALL，能不能发个例子给我，我的邮箱是：wj_super@163.com,多谢了！


[quote].........
//------------------change-------------
//InformationSize = sizeof(Information) + sizeof(ULONG);

//Information = (KEY_VALUE_PARTIAL_INFORMATION*)ExAllocatePoolWithTag(PagedPool,
//InformationSize,\'ISmD\'); // DmSI


Status = ZwQueryValueKey(KeyHandle,
&UnicodeValueName,
KeyValuePartialInformation,
NULL,//传此参数，计算所需空间大小，由InformationSize返回
0,
&InformationSize);


if (Status == STATUS_BUFFER_TOO_SMALL)
{//ZwQueryValueKey计算的大小来申请空间
Information = (KEY_VALUE_PARTIAL_INFORMATION*)ExAllocatePoolWithTag(PagedPool, InformationSize,\'ISmD\'); // DmSI

if (Information == NULL)
{DbgPrint(\"two\");
ZwClose(KeyHandle);
return 0;
}

Status = ZwQueryValueKey(KeyHandle,
&UnicodeValueName,
KeyValuePartialInformation,
Information,
InformationSize
&InformationSize);
}

//------------------change-------------
if (Status == STATUS_SUCCESS)
{
...


[编辑 -  5/27/04 by  snowStart]

[编辑 -  5/27/04 by  snowStart] [/quote