Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

RegOpenKeyEx returns always ERROR_FILE_NOT_FOUND!

2,484 views
Skip to first unread message

Stephan Roth

unread,
Sep 7, 2004, 3:46:33 AM9/7/04
to
Hi folks,

the following problem drives me crazy, I'm on the verge to go berserk! There
is not much hair left to pull out at this stage!

First of all a short code snippet:

HKEY hCurrentRootKey = HKEY_LOCAL_MACHINE;
HKEY hKey;
CString strKey = _T("SOFTWARE\\Plath\\ReportingService\\Settings");
REGSAM samDesired = KEY_QUERY_VALUE;

LONG lResult = RegOpenKeyEx(hCurrentRootKey,
strKey.operator LPCTSTR(),
0,
samDesired,
&hKey);
if (lResult != ERROR_SUCCESS)
{
// Error handling here!
}

The problem: ERROR_SUCCESS is never returned! I will always get
ERROR_FILE_NOT_FOUND, what means that the registry key specified in strKey
wasn't found.

I've tried severe other flags for the REGSAM parameter, but the result was
always the same.

This is such a weird problem. I've take a look into the MSDN documentation
and found a sample, but I cannot find any difference between my approach and
the way suggested by Microsoft.

Any help would be appreciated!

Greetings,
Stephan

Joseph M. Newcomer

unread,
Sep 7, 2004, 5:48:46 AM9/7/04
to
Does the key exist? And why the bizarre syntax strKey.operator LPCTSTR() when simply
writing strKey by itself will do the job? Why introduce gratuitous variables when
variables are not needed?

LONG lResult = RegOpenKey(HKEY_LOCAL_MACHINE, strKey, 0, KEY_QUERY_VALUE, &hKey);

would have done the job without all those extra variables that serve no purpose.

But unless you are certain that the key exists, which you have not indicated, it is hard
to tell what is going on here. It is reporting that the path you specified does not exist,
and I've never seen this report happen unless the key does not exist.

It might be the case that if the Registry is locked down (for example, you do not have the
rights to read the HKEY_LOCAL_MACHINE) you might get this error return, but I would have
expected in that case to see an access-denied error rather than a not-found error.
joe

Joseph M. Newcomer [MVP]
email: newc...@flounder.com
Web: http://www.flounder.com
MVP Tips: http://www.flounder.com/mvp_tips.htm

Stephan Roth

unread,
Sep 7, 2004, 7:49:43 AM9/7/04
to
Hi Joseph,

"Joseph M. Newcomer" <newc...@flounder.com> wrote...

> Does the key exist?

Definitely yes!

> And why the bizarre syntax strKey.operator LPCTSTR() when
> simply writing strKey by itself will do the job?

This is an explicit call of the operator LPCTSTR(), which returns a const
char pointer to the content of the CString object. However, you're right: in
this case it is not necessary to do it, but on the other hand it is not an
error.

> Why introduce gratuitous variables when variables are not
> needed?

The real code fragment is more complex and contains overhead, which is
extraneous for my problem. I've reduced the code snippet to the essential
parts.

> LONG lResult = RegOpenKey(HKEY_LOCAL_MACHINE, strKey, 0,
> KEY_QUERY_VALUE, &hKey);
>
> would have done the job without all those extra variables that
> serve no purpose.

I've tried your "one-liner" above and the result is still the same:
ERROR_FILE_NOT_FOUND

> [...]


> It might be the case that if the Registry is locked down (for example,
> you do not have the rights to read the HKEY_LOCAL_MACHINE) you might
> get this error return, but I would have expected in that case to see an
> access-denied error rather than a not-found error.

I think that the security access attribute KEY_QUERY_VALUE can be used
everytime, by everyone, but I'm not sure. What about a service during system
startup?! Are there any restrictions which I have to keep in mind if I want
to access the registry from a service which is launched during boot
procedure automatically?

Thank you,
Stephan

CheckAbdoul

unread,
Sep 7, 2004, 10:14:14 AM9/7/04
to
Run the registry monitor utility ( from www.sysinternals.com ) on the
side while executing the RegOpenKeyEx() function. That should give you an
idea of why the call is failing.

--
Cheers
Check Abdoul [VC++ MVP]
-----------------------------------

"Stephan Roth" <stephan-NO...@plath.de> wrote in message
news:2q57fdF...@uni-berlin.de...

Joseph M. Newcomer

unread,
Sep 7, 2004, 4:49:56 PM9/7/04
to
Calling the operator as you do is not an error, but it is certainly three sigmas out in
the bizarre syntax line. You could just as easily have written (LPCTSTR)strKey, which at
least looks like a cast. It is never a good idea to clutter up a program with weird
syntax, even if it is semantically correct.

There are levels of security that will keep you from even reading a registry key.
KEY_QUERY_VALUE is a right that can be denied. If you bring up regedit and ask for
permissions on a key, one of the rights you can deny is "read" access, which should keep
the query operation from occurring. Now the question is whether, for security purposes,
the OS chooses to return "not found" vs. "access denied". In the scheme of dealing with
security, even admitting something exists reveals information, e.g., knowing the key
exists indicates the software is installed, even if you can't read it. So it becomes a
question of what error code to return. (For example, if you give a bad userid and/or
password, you get a message saying "invalid login" rather than "bad account" or "bad
password", because knowing an account exists means a cracker could concentrate on breaking
the password, instead of trying to locate the account).

Have you tried reading this using RegEdit running under the same privileges as the
program? Note that services run under the service account, and have limited access to
various pieces of the state.

As an experiment, try doing lookups of

HKEY_LOCAL_MACHINE\Software,
HKEY_LOCAL_MACHINE\Software\Plath
HKEY_LOCAL_MACHINE\Software\Plath\ReportingService

to see if one of them is denied. This is just an experiment to try, but it might reveal
useful information. For example, if you can't open HKLM\Software, you know you have a
rights problem at that level.
joe

Joseph M. Newcomer [MVP]

Alexander Grigoriev

unread,
Sep 7, 2004, 11:07:24 PM9/7/04
to
SOFTWARE hive may not be loaded yet, when the services start. You should not
be accessing it in a service. Use
HKLM\SYSTEM\CurrentControlSet\Services\<Your service>\Settings key,
or HKLM\SYSTEM\CurrentControlSet\Control\<your key>

"Stephan Roth" <stephan-NO...@plath.de> wrote in message
news:2q57fdF...@uni-berlin.de...

Stephan Roth

unread,
Sep 8, 2004, 5:03:34 AM9/8/04
to
Hi Alexander,

"Alexander Grigoriev" <al...@earthlink.net> wrote...

> SOFTWARE hive may not be loaded yet, when the services start. You
> should not be accessing it in a service. Use
> HKLM\SYSTEM\CurrentControlSet\Services\<Your service>\Settings key,
> or HKLM\SYSTEM\CurrentControlSet\Control\<your key>

This is an interesting clue. Thanks for this hint, I will try it!

MfG
Stephan

Stephan Roth

unread,
Sep 8, 2004, 5:15:44 AM9/8/04
to
Hi Check,

"CheckAbdoul" <checkabdoul at mvps dot org> wrote...

> Run the registry monitor utility ( from www.sysinternals.com ) on
> the side while executing the RegOpenKeyEx() function. That should give
> you an idea of why the call is failing.

Thank you for this hint. RegMon seems to be a very helpful tool.

Greetings,
Stephan

Joseph M. Newcomer

unread,
Sep 8, 2004, 7:09:40 PM9/8/04
to
I never thought of that. If this is the case, there might be a "group" specification of
when the service is started, so its start can be delayed until the software hive is
available. (I knew this for boot-time drivers, but it never even crossed my mind for
services...)
joe

Joseph M. Newcomer [MVP]

Alexander Grigoriev

unread,
Sep 8, 2004, 11:29:26 PM9/8/04
to
I think SOFTWARE hive is loaded about the user logon time. Service start
order specification may not help in this case.

"Joseph M. Newcomer" <newc...@flounder.com> wrote in message
news:774vj0hf9u2vjkmne...@4ax.com...

CheckAbdoul

unread,
Sep 9, 2004, 9:35:36 AM9/9/04
to
AFAIK , software hive is loaded even before services.exe is run. So the
HKLM\SOFTWARE hive should be available provided the caller has enough rights
to access it.

--
Cheers
Check Abdoul [VC++ MVP]
-----------------------------------

"Alexander Grigoriev" <al...@earthlink.net> wrote in message
news:utAw30h...@TK2MSFTNGP15.phx.gbl...

Joseph M. Newcomer

unread,
Sep 9, 2004, 12:32:35 PM9/9/04
to
No, HKCU/Software is loaded at that time, but HKLM/Software should be available when the
boot process completes.
joe
0 new messages