I am trying to create an offline registry in memory using the offreg.dll provided in the windows ddk 7 package.

You can find out more information on the offreg.dll here: MSDN

Currently, while attempting to read a value from an open registry hive / key I receive the following error: 234 or ERROR_MORE_DATA

Here is the .h code that contains ORGetValue:

DWORD
ORAPI
ORGetValue (
    __in ORHKEY     Handle,
    __in_opt PCWSTR lpSubKey,
    __in_opt PCWSTR lpValue,
    __out_opt PDWORD pdwType,
    __out_bcount_opt(*pcbData) PVOID pvData,
    __inout_opt PDWORD pcbData
    );

Here is the code that I am using to pull the data

[DllImport("offreg.dll", CharSet = CharSet.Auto, EntryPoint = "ORGetValue", SetLastError = true, CallingConvention = CallingConvention.StdCall)]
        public static extern uint ORGetValue(IntPtr Handle, string lpSubKey, string lpValue, out uint pdwType, out string pvData, out uint pcbData);

        IntPtr myHive;            
        IntPtr myKey;
        string myValue;
        uint pdwtype;
        uint pcbdata;    

uint ret3 = ORGetValue(myKey, "", "DefaultUserName", out pdwtype, out myValue, out pcbdata);

The goal is to be able to read myValue as a string.

I am not sure if I need to use marshaling... or a second call with an adjusted buffer.. Or really how to adjust the buffer in C#. Any help or pointers would be greatly appreciated.

Thank you.