Search code examples
keyregistrynt-native-api

How can I convert a native (NT) registry key name into a Win32 name?

Calling NtQueryKey with KeyNameInformation returns result in the Native format like so:

\REGISTRY\MACHINE = HKLM
\REGISTRY\USER\<SID> = HKCU
\REGISTRY\USER = HKU
\REGISTRY\MACHINE\SYSTEM\ControlSet<Current>\Hardware Profiles\<CurrentID> = HKCC
\REGISTRY\USER\<SID>_CLASSES = HKCR (User's)
\REGISTRY\Machine\SOFTWARE\Classes = HKCR (System)

How can I reliably convert such NT format to the Win32 registry key?

Solution

  • Topic is solved. It seems they're no direct API to do the conversion. To make it reliably, just open HKCR, HKCU, HKCC => retrieve the actual NT name using NtQueryKey + KeyNameInformation (for HKU, HKLM that's already known and static paths) => than apply vice versa auto-replacement for the desired NT path in a specific order.