从c#加载注册表hive失败

Question

我正在尝试加载离线NTUSER.DAT文件(然后修改它)，但我无法获得此工作。RegLoadKey返回8589934592，我不知道这意味着什么。这是失败的行:

long retVal = RegLoadKey(HKEY_USERS, "123test", @"D:tempNTUSER.DAT");

下面是完整的测试代码:

public class RegistryTest
{
    [StructLayout(LayoutKind.Sequential)]
    private struct LUID
    {
        public uint LowPart;
        public int HighPart;
    }
    [StructLayout(LayoutKind.Sequential)]
    private struct LUID_AND_ATTRIBUTES
    {
        public LUID pLuid;
        public UInt32 Attributes;
    }
    [StructLayout(LayoutKind.Sequential, Pack = 1)]
    private struct TokPriv1Luid
    {
        public int Count;
        public LUID Luid;
        public UInt32 Attr;
    }
    private const Int32 ANYSIZE_ARRAY = 1;
    private const UInt32 SE_PRIVILEGE_ENABLED = 0x00000002;
    private const UInt32 TOKEN_ADJUST_PRIVILEGES = 0x0020;
    private const UInt32 TOKEN_QUERY = 0x0008;
    private const uint HKEY_USERS = 0x80000003;
    private const string SE_RESTORE_NAME = "SeRestorePrivilege";
    private const string SE_BACKUP_NAME = "SeBackupPrivilege";
    [DllImport("kernel32.dll")]
    static extern IntPtr GetCurrentProcess();
    [DllImport("advapi32.dll", SetLastError = true)]
    [return: MarshalAs(UnmanagedType.Bool)]
    static extern bool OpenProcessToken(IntPtr ProcessHandle, UInt32 DesiredAccess, out IntPtr TokenHandle);
    [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Auto)]
    [return: MarshalAs(UnmanagedType.Bool)]
    static extern bool LookupPrivilegeValue(string lpSystemName, string lpName, out LUID lpLuid);
    [DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)]
    static extern bool AdjustTokenPrivileges(
        IntPtr htok,
        bool disableAllPrivileges,
        ref TokPriv1Luid newState,
        int len,
        IntPtr prev,
        IntPtr relen);
    [DllImport("advapi32.dll", SetLastError = true)]
    static extern long RegLoadKey(UInt32 hKey, String lpSubKey, String lpFile);
    [DllImport("advapi32.dll", SetLastError = true)]
    static extern long RegUnLoadKey(UInt32 hKey, string lpSubKey);
    private IntPtr _myToken;
    private TokPriv1Luid _tokenPrivileges = new TokPriv1Luid();
    private TokPriv1Luid _tokenPrivileges2 = new TokPriv1Luid();
    private LUID _restoreLuid;
    private LUID _backupLuid;
    public RegistryTest()
    {
        if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, out _myToken))
            Console.WriteLine("OpenProcess Error");
        if (!LookupPrivilegeValue(null, SE_RESTORE_NAME, out _restoreLuid))
            Console.WriteLine("LookupPrivilegeValue Error");
        if (!LookupPrivilegeValue(null, SE_BACKUP_NAME, out _backupLuid))
            Console.WriteLine("LookupPrivilegeValue Error");
        _tokenPrivileges.Attr = SE_PRIVILEGE_ENABLED;
        _tokenPrivileges.Luid = _restoreLuid;
        _tokenPrivileges.Count = 1;
        _tokenPrivileges2.Attr = SE_PRIVILEGE_ENABLED;
        _tokenPrivileges2.Luid = _backupLuid;
        _tokenPrivileges2.Count = 1;
        if (!AdjustTokenPrivileges(_myToken, false, ref _tokenPrivileges, 0, IntPtr.Zero, IntPtr.Zero))
            Console.WriteLine("AdjustTokenPrivileges Error: " + Marshal.GetLastWin32Error());
        if (!AdjustTokenPrivileges(_myToken, false, ref _tokenPrivileges2, 0, IntPtr.Zero, IntPtr.Zero))
            Console.WriteLine("AdjustTokenPrivileges Error: " + Marshal.GetLastWin32Error());
        // --> RegLoadKey fails with return value 8589934592 <--
        long retVal = RegLoadKey(HKEY_USERS, "123test", @"D:tempNTUSER.DAT");
        if (retVal != 0)
            Console.WriteLine("RegLoadKey Error:" + retVal);
        string test = Registry.GetValue(@"HKEY_LOCAL_MACHINE123testEnvironment", "TEMP", "") as string;
        retVal = RegUnLoadKey(HKEY_USERS, "123test");
    }
}

我错过了什么?请帮助! !如果有人有加载hive和修改值的c#示例代码，那就更好了。

谢谢。

Answer 1

8589934592是0x200000000，长度大于32位。

RegLoadKey返回一个32位的win32"long"值。您已经声明该函数返回一个64位的c# long。如果你修复RegLoadKey声明返回一个int，你将得到一个0的值，如预期的