Programmatically registering a performance counter in the registry

I am trying to register a performance counter, and part of this process involves adding some textual descriptions to a specific registry key. For English, this key is HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Perflib \ 009, which is apparently also known as HKEY_PERFORMANCE_TEXT. There are a couple of values ​​(Counter, Help) that have REG_MULTI_SZ data, and I need to change them to achieve my goal.

The official way to do this is to use a tool called lodctr along with the .h and .ini files . There is also a function for this programmatically , but I understand that it is just a simple shell that calls the lodctr program. I found the prospect of maintaining, distributing and storing synchronized 3 separate files a bit cumbersome, so I wrote the code for this earlier, and it worked fine under Windows XP (and possibly Vista, although I don't remember exactly).

Now I am trying to use the same code in Windows 7 and it does not work. The problem is that whenever I try to set the registry values, it does not work with ERROR_BADKEY; even regedit cannot change the values, so this is not a problem with my code. I started Process Monitor and noticed that there was no activity at the driver level, so it seems that this access should be blocked in the user mode code (for example, advapi32.dll or anywhere). I understand why Microsoft will try to stop people from doing this, as it is very easy to explode, and this will lead to the failure of the entire collection of performance counters on the machine.

I am going to debug the lodctr and see that the magic is purely out of curiosity, but I wonder if someone has come across this before? Are there any alternatives besides the lodctr utility? Is it possible to directly access the NT API? I would prefer to avoid the hassle of the lodctr method, if possible.

Minimal example to reproduce the problem:

HKEY hKey = NULL;
LONG nResult = RegOpenKeyEx(HKEY_LOCAL_MACHINE, _T("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\009"), 0, KEY_ALL_ACCESS, &hKey);
if(ERROR_SUCCESS == nResult)
{
    LPCTSTR lpData = _T("bar");
    DWORD cbData = (_tcsclen(lpData) + 1) * sizeof(TCHAR);
    nResult = RegSetValueEx(hKey, _T("foo"), 0, REG_SZ, (const BYTE*)lpData, cbData);
    // here nResult == ERROR_BADKEY
    RegCloseKey(hKey);
    hKey = NULL;
}

EDIT 1:

, API- , Google. KB, RegSetValueEx. , , , , . KB, Perfc009.dat Perfh009.dat system32. , , REG_MULTI_SZ , . , , , , , .

+2
1

, . . , , .h .ini .

+2

Source: https://habr.com/ru/post/1678853/


All Articles