Vista and NT exports

[Quell]

Hey.
I am accessing exported function from NTDLL.DLL directing using the following code:

	if( !(CreateKey = (NtCreateKey) GetProcAddress( GetModuleHandle(L"ntdll.dll"),
			"NtCreateKey" )) ) {

		printf("Could not find NtCreateKey entry point in NTDLL.DLL\n");
		exit(1);
	}
	if( !(DeleteKey = (NtDeleteKey) GetProcAddress( GetModuleHandle(L"ntdll.dll"),
			"NtDeleteKey" )) ) {

		printf("Could not find NtDeleteKey entry point in NTDLL.DLL\n");
		exit(1);
	}
	if( !(SetValueKey = (NtSetValueKey) GetProcAddress( GetModuleHandle(L"ntdll.dll"),
			"NtSetValueKey" )) ) {

		printf("Could not find NtSetValueKey entry point in NTDLL.DLL\n");
		exit(1);
	}
	if(!(QueryValueKey = (NtQueryValueKey) GetProcAddress(GetModuleHandle(L"ntdll.dll"),"NtSetValueKey")))
	{
		printf("Could not find NtQueryValueKey entry point in NTDLL.DLL\n");
		exit(1);
	}

This code work fine on 2000/xp/vista. However when i try to call the function on vista, i dont; get an error, but
the function does nothing. Any ideas why?

	Status = CreateKey( &SoftwareKeyHandle, KEY_ALL_ACCESS,&ObjectAttributes, 0,  NULL, REG_OPTION_NON_VOLATILE,&Disposition );

This is a piece of code that works ifne on 2k/xp but vista return success but the code doesn;t actually create the key.
Any ideas why this might be?
Thx in advance.

[hankdane]

The key is probably created, but not where you think it's created. Vista uses virtualization, so that if you write to protected areas, such as under the HKLM registry root, or the Program Files directory, your app thinks it's doing it, but the actual runtime location is changed. Usually the location can be found under the user profile area (files in "C:\Documents and Settings\[user name]," reg keys under HKCU).

[Quell]

Thx, ill check that out, but i was wondering if there are any good articles that explain extent of virtualization on vista? i read some on msdn but most were rather basic.
[EDIT]
Okey, i just tested this on another vista box and it worked fine. Wouldn;t the vrtualization be taken into account when i use regedit to browse the registry?
[EDIT 2]
Thx, works.

[hankdane]

Quell,

Regedit will give you the 'true' view of the registry, although it probably depends on the account you are running as.

A good Vista compatibility overview can be found here: http://msdn2.microsoft.com/en-us/win.../aa904987.aspx