When its DriverEntry routine is called, each NT driver is given a pointer to a Unicode string specifying a path to a driver-specific key in the registry, along with a pointer to the driver object. Every driver object also contains a pointer to such a string specifying a path to another key in the registry. Figure 16.6 illustrates the registry paths given to NT drivers when they initialize.
Figure 16.6 Registry Paths for NT Drivers
As Figure 16.6 shows, the HardwareDatabase pointer in the driver object and the RegistryPath pointer input to the DriverEntry routine each identify particular keys in the registry. A DriverEntry routine is given read access to the Unicode strings at RegistryPath and HardwareDatabase, but it must call support routines to manipulate registry keys and the configuration information they contain.
Under each key in the registry is either a set of named values with assigned value data or additional subkeys (eventually) with a set of values. The combination of a named value and its corresponding data is called a value entry.
NT provides the following sets of support routines that NT drivers call, depending on how a particular driver gets hardware configuration information and/or uses the registry:
Drivers that get or set information under the registry keys \Registry\Machine\System\CurrentControlSet\Services\DriverName and/or \Registry\Machine\Hardware\DeviceMap can use the Rtl..RegistryXxx routines. Note that the caller either must “know” the DriverName value or create a subkey under a key with a known name to call these Rtl..RegistryXxx routines.
Some NT device drivers also call IoCreateSymbolicLink to create symbolic links between user- or administrator-supplied names for the driver’s device(s) and the corresponding NT device object names. For more information about how to use the Zw..Key routines in conjunction with IoCreateSymbolicLink, see Section 16.9.