NAME NOT FOUND is showing in the results-column of Process Monitor, so I was going to create the value myself. But I don't know if it's a Binary, String or, let's say, DWORD that's been tried to access. Does anyone know if there's a way for finding that out in case of RegQueryValue?
Not exactly, but we can make a good guess in some cases.
RegQueryValue operation in Process Monitor essentially corresponds to the
RegQueryValueEx function being called. That function has a parameter called
lpType, but it's...
A pointer to a variable that receives a code indicating the type of data stored in the specified value.
Emphasis mine. It's there so that applications can be told the type of the value they got. (
RegQueryValueEx doesn't care about data types, it just passes bytes around. It's the program's job to interpret the bytes.) Even if a program specified the type for some reason, Process Monitor doesn't report the value on function entry, only on successful exit.
It does, however, report "length." For reasons unclear, this isn't actually the
lpcbData value that the application provides to specify how big its buffer for the result is — on a 64-bit system, you need to subtract 12 to get the original. A DWord value occupies 4 bytes, a QWord value occupies 8 bytes, and all the other kinds are variable-length. (Programs might also prepare no memory at all before calling the function just to check whether the value exists.) So if the "length" reported by Process Monitor is 16, the program is expecting a 4-byte chunk of data, which is almost certainly a DWord.