Based on the details of registry keys that disappear after a restart

  • 2020-04-01 23:39:31
  • OfStack

Today, I encountered a bug, which took me a long time to solve. I will share it with you.
The Bug description
A developer calls the following code to create a registry key:

HKEY hKey;
if(::RegOpenKeyEx(HKEY_CURRENT_USER, DemoRegKey, 0, KEY_WRITE, &hKey) != ERROR_SUCCESS)
{
    RegCreateKeyEx(HKEY_CURRENT_USER, DemoRegKey, 0, NULL, REG_OPTION_VOLATILE
        , KEY_ALL_ACCESS   , NULL   , &hKey, NULL);        
}

After execution, the key values are successfully seen in the registry editor, and there is no problem with subsequent code such as getting values from them.
After submitting the test, it was found that when the system was restarted, the registry keys created by the above program were all gone, resulting in an error in subsequent code reading the keys.
According to?
I then tweaked the code and found that the following code got an error code of 2 on reboot

LONG lRet;
lRet = ::RegOpenKeyEx(HKEY_CURRENT_USER, DemoRegKey, 0, KEY_WRITE, &hKey);

The value of lRet is 2. Error code 2 means that the system cannot find the specified file. For registry functions, the corresponding key does not exist.
After debugging, you found that the code to create the registry did execute successfully and was visible in the registry. At the same time, there is no problem in calling the code that reads the key. But once the computer is rebooted, the path is gone, and the keys stored in it are gone.
It seems that some program deleted my key value, so look for all the delete key value of the code, did not find.
Delete all applications before restarting. But after the reboot, the damn keys still didn't show up.
It appears to have been deleted by a system or other program. Does my key value have the same name as the key value of some program? Okay, this time I'm going to use guid as the key name, but again it's not there after I restart it.
Wow, this is crazy.
At this point, I go back and look at all the code for creating the registry, because my program must have caused the keys to disappear.
I noticed REG_OPTION_VOLATILE   This odd parameter.
After MSDN, I finally found the reason, which was caused by this parameter.
why
REG_OPTION_VOLATILE   This parameter means that the registry key values created are in memory and will not be saved to the corresponding registry file.
English is as follows:

All registry keys are created as volatile, and the information is stored in memory and is not preserved when the corresponding registry hive is unloaded. For HKEY_LOCAL_MACHINE, this occurs when the OS is shut down. The RegSaveKey function does not save volatile registry keys. This flag is ignored for keys that already exist.

So, of course, those keys are gone after a reboot.
The solution
Simply use REG_OPTION_NON_VOLATILE

RegCreateKeyEx(HKEY_CURRENT_USER, DemoRegKey, 0, NULL, REG_OPTION_NON_VOLATILE
            , KEY_ALL_ACCESS   , NULL   , &hKey, NULL);

This can be used for testing. Once rebooted, the previously created keys are gone.

Related articles: