RtlQueryRegistryValues read REG_DWORD

Question

I'm writing a Uart16550 driver, and one of the things I have to do is read from the registry some initialization parameters using RtlQueryRegistryValues.

(a lot of code skipped...)

RTL_QUERY_REGISTRY_TABLE table[2];

and

table[1].QueryRoutine = NULL;
table[1].Name = NULL;

The parameter is stored in the registry as a REG_DWORD and I'm trying to set my table with:

unsigned long buffer;

(because DWORD is not defined in ntddk.h and I'm not sure if I break anything including WinDef.h) and

table[0].EntryContext = &buffer;

The status of the call to RtlQueryRegistryValues is STATUS_SUCCESS

status =  RtlQueryRegistryValues(
    RTL_REGISTRY_ABSOLUTE,
    path,
    table,
    NULL,
    NULL);

but when I try to

DbgPrint("registry: %lu", buffer)

I get way too big numbers (I expected the result to be 1 or 2).

Am I doing something wrong with the DbgPrint, or my parameters aren't set correctly for the query table?

And where is the RED_DWORD data type defined?

EDIT:

WCHAR keyname[20] = "parameter";
CHAR def[20] = "parameter";
WCHAR path[100] = L"\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Services\\hello\\Parameters"; 
unsigned long buffer; 
table[0].QueryRoutine = NULL; 
table[0].Name = keyname; 
table[0].Flags = RTL_QUERY_REGISTRY_DIRECT; 
table[0].EntryContext = &buffer; 
table[0].DefaultType = REG_DWORD; 
table[0].DefaultData = def; 
table[0].DefaultLength = strlen(def) + 1;

Answer 1

table[0].DefaultData should be a pointer to an unsigned long.
table[0].DefaultLength should be sizeof(unsigned long).

Otherwise you may get back 1634886000 which is your default value converted to long ('para'). Everything else looks like it should work (assuming the key and value actually exists).

REG_DWORD is defined in winnt.h

#define REG_DWORD                   ( 4 )   // 32-bit number
#define REG_DWORD_LITTLE_ENDIAN     ( 4 )   // 32-bit number (same as REG_DWORD)
#define REG_DWORD_BIG_ENDIAN        ( 5 )   // 32-bit number