> Just call NtOpenRegistryKey (or whatever the exact name is) in NTOSKRNL, > either by syscall or by export. This might be a possiblity to get access to a registry key. But what is then the equivalent function to RegQueryValueEx() ?