grr/client/grr_response_client/vfs_handlers/registry.py
def QueryValueEx(key, value_name):
  """This calls the Windows QueryValueEx function in a Unicode safe way."""
  regqueryvalueex = advapi32["RegQueryValueExW"]
  regqueryvalueex.restype = ctypes.c_long
  regqueryvalueex.argtypes = [
      ctypes.c_void_p, ctypes.c_wchar_p, LPDWORD, LPDWORD, LPBYTE, LPDWORD
  ]

  size = 256
  data_type = ctypes.wintypes.DWORD()
  while True:
    tmp_size = ctypes.wintypes.DWORD(size)
    buf = ctypes.create_string_buffer(size)
    rc = regqueryvalueex(key.handle, value_name, LPDWORD(),
                         ctypes.byref(data_type), ctypes.cast(buf, LPBYTE),
                         ctypes.byref(tmp_size))
    if rc != ERROR_MORE_DATA:
      break

    # We limit the size here to ~10 MB so the response doesn't get too big.
    if size > 10 * 1024 * 1024:
      raise OSError("Value too big to be read by GRR.")

    size *= 2

  if rc != ERROR_SUCCESS:
    raise ctypes.WinError(2)

  return (Reg2Py(buf, tmp_size.value, data_type.value), data_type.value)
This calls the Windows QueryValueEx function in a Unicode safe way.
This calls the Windows QueryValueEx function in a Unicode safe way.
This calls the Windows QueryValueEx function in a Unicode safe way .
def QueryValueEx(key, value_name):
  regqueryvalueex = advapi32["RegQueryValueExW"]
  regqueryvalueex.restype = ctypes.c_long
  regqueryvalueex.argtypes = [
      ctypes.c_void_p, ctypes.c_wchar_p, LPDWORD, LPDWORD, LPBYTE, LPDWORD
  ]
  size = 256
  data_type = ctypes.wintypes.DWORD()
  while True:
    tmp_size = ctypes.wintypes.DWORD(size)
    buf = ctypes.create_string_buffer(size)
    rc = regqueryvalueex(key.handle, value_name, LPDWORD(),
                         ctypes.byref(data_type), ctypes.cast(buf, LPBYTE),
                         ctypes.byref(tmp_size))
    if rc != ERROR_MORE_DATA:
      break
    if size > 10 * 1024 * 1024:
      raise OSError("Value too big to be read by GRR.")
    size *= 2
  if rc != ERROR_SUCCESS:
    raise ctypes.WinError(2)
  return (Reg2Py(buf, tmp_size.value, data_type.value), data_type.value)
def QueryValueEx ( key , value_name ) : regqueryvalueex = advapi32 [ "RegQueryValueExW" ] regqueryvalueex . restype = ctypes . c_long regqueryvalueex . argtypes = [ ctypes . c_void_p , ctypes . c_wchar_p , LPDWORD , LPDWORD , LPBYTE , LPDWORD ] size = 256 data_type = ctypes . wintypes . DWORD ( ) while True : tmp_size = ctypes . wintypes . DWORD ( size ) buf = ctypes . create_string_buffer ( size ) rc = regqueryvalueex ( key . handle , value_name , LPDWORD ( ) , ctypes . byref ( data_type ) , ctypes . cast ( buf , LPBYTE ) , ctypes . byref ( tmp_size ) ) if rc != ERROR_MORE_DATA : break if size > 10 * 1024 * 1024 : raise OSError ( "Value too big to be read by GRR." ) size *= 2 if rc != ERROR_SUCCESS : raise ctypes . WinError ( 2 ) return ( Reg2Py ( buf , tmp_size . value , data_type . value ) , data_type . value )
This calls the Windows QueryValueEx function in a Unicode safe way.
This calls the Windows QueryValueEx function in a Unicode safe way .
"""This calls the Windows QueryValueEx function in a Unicode safe way.""" # We limit the size here to ~10 MB so the response doesn't get too big.
key
value_name