[chrome_elf] NTRegistry - added wow64 redirection support.

chrome_elf/nt_registry/nt_registry_unittest.cc

+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <rpc.h>
+#include <stddef.h>
+#include <windows.h>

[grt (UTC plus 2), 2016/09/29 10:30:23]

nit: ordinarily windows.h must be included before other windows headers. unless
there's a reason not to do that here, please move windows.h up.

[penny, 2016/09/30 05:28:23]

Done.

+
+#include "chrome_elf/nt_registry/nt_registry.h"

[grt (UTC plus 2), 2016/09/29 10:30:22]

move up above line 5 with a blank line between this and the system headers --
the header under test should precede all other includes; see
https://google.github.io/styleguide/cppguide.html#Names_and_Order_of_Includes.

[penny, 2016/09/30 05:28:23]

Done.

+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace {
+
+constexpr wchar_t kTempTestKeys[] = L"SOFTWARE\\Chromium\\TempTestKeys\\";
+
+//------------------------------------------------------------------------------
+// WOW64 redirection tests
+//
+// - Only HKCU will be tested on the auto (try) bots.
+//   HKLM will be kept separate (and manual) for local testing only.
+//
+// NOTE: Currently no real WOW64 context testing, as building x86 projects
+//       during x64 builds is not currently supported for performance reasons.
+// https://cs.chromium.org/chromium/src/build/toolchain/win/BUILD.gn?sq%3Dpackage:chromium&l=314
+//------------------------------------------------------------------------------
+
+// Utility function for the WOW64 redirection test suites.
+// Note: Testing redirection through ADVAPI32 here as well, to get notice if
+//       expected behaviour changes!
+// If |redirected_path| == nullptr, no redirection is expected in any case.
+void DoRedirectTest(nt::ROOT_KEY nt_root_key,
+                    const wchar_t* path,
+                    const wchar_t* redirected_path OPTIONAL) {
+  HANDLE handle = INVALID_HANDLE_VALUE;
+  HKEY key_handle = nullptr;
+  constexpr ACCESS_MASK kAccess = KEY_WRITE | DELETE;
+  const HKEY root_key =
+      (nt_root_key == nt::HKCU) ? HKEY_CURRENT_USER : HKEY_LOCAL_MACHINE;
+
+  // Make sure clean before starting.
+  nt::DeleteRegKey(nt_root_key, nt::NONE, path);
+  if (redirected_path)
+    nt::DeleteRegKey(nt_root_key, nt::NONE, redirected_path);
+
+  //----------------------------------------------------------------------------
+  // No redirection through ADVAPI32 on straight x86 or x64.
+  ASSERT_EQ(ERROR_SUCCESS,
+            RegCreateKeyExW(root_key, path, 0, nullptr, REG_OPTION_NON_VOLATILE,
+                            kAccess, nullptr, &key_handle, nullptr));
+  ASSERT_EQ(ERROR_SUCCESS, RegCloseKey(key_handle));
+  ASSERT_TRUE(nt::OpenRegKey(nt_root_key, path, kAccess, &handle, nullptr));
+  ASSERT_TRUE(nt::DeleteRegKey(handle));
+  nt::CloseRegKey(handle);
+
+#ifdef _WIN64
+  //----------------------------------------------------------------------------
+  // Try forcing WOW64 redirection on x64 through ADVAPI32.
+  ASSERT_EQ(ERROR_SUCCESS,
+            RegCreateKeyExW(root_key, path, 0, nullptr, REG_OPTION_NON_VOLATILE,
+                            kAccess | KEY_WOW64_32KEY, nullptr, &key_handle,
+                            nullptr));
+  ASSERT_EQ(ERROR_SUCCESS, RegCloseKey(key_handle));
+  // Check path:
+  if (nt::OpenRegKey(nt_root_key, path, kAccess, &handle, nullptr)) {
+    if (redirected_path)
+      ADD_FAILURE();
+    ASSERT_TRUE(nt::DeleteRegKey(handle));
+    nt::CloseRegKey(handle);
+  } else if (!redirected_path) {
+    // Should have succeeded.
+    ADD_FAILURE();
+  }
+  if (redirected_path) {
+    // Check redirected path:
+    if (nt::OpenRegKey(nt_root_key, redirected_path, kAccess, &handle,
+                       nullptr)) {
+      if (!redirected_path)
+        ADD_FAILURE();
+      ASSERT_TRUE(nt::DeleteRegKey(handle));
+      nt::CloseRegKey(handle);
+    } else {
+      // Should have succeeded.
+      ADD_FAILURE();
+    }
+  }
+
+  //----------------------------------------------------------------------------
+  // Try forcing WOW64 redirection on x64 through NTDLL.
+  ASSERT_TRUE(
+      nt::CreateRegKey(nt_root_key, path, kAccess | KEY_WOW64_32KEY, nullptr));
+  // Check path:
+  if (nt::OpenRegKey(nt_root_key, path, kAccess, &handle, nullptr)) {
+    if (redirected_path)
+      ADD_FAILURE();
+    ASSERT_TRUE(nt::DeleteRegKey(handle));
+    nt::CloseRegKey(handle);
+  } else if (!redirected_path) {
+    // Should have succeeded.
+    ADD_FAILURE();
+  }
+  if (redirected_path) {
+    // Check redirected path:
+    if (nt::OpenRegKey(nt_root_key, redirected_path, kAccess, &handle,
+                       nullptr)) {
+      if (!redirected_path)
+        ADD_FAILURE();
+      ASSERT_TRUE(nt::DeleteRegKey(handle));
+      nt::CloseRegKey(handle);
+    } else {
+      // Should have succeeded.
+      ADD_FAILURE();
+    }
+  }
+#endif  // _WIN64
+}
+
+// These test reg paths match |classes_subtree| in nt_registry.cc.
+constexpr wchar_t* kClassesRedirects[] = {

[grt (UTC plus 2), 2016/09/29 10:30:23]

constexpr const wchar_t* kClassesRedirects[] = ...
"constexpr" makes the array itself a compile-time constant.
"const" says that the pointers in the array point to constant strings.
C++ is the awesome!

[penny, 2016/09/30 05:28:23]

Done.

+    L"SOFTWARE\\Classes\\CLSID\\chrome_testing",
+    L"SOFTWARE\\Classes\\WOW6432Node\\CLSID\\chrome_testing",
+    L"SOFTWARE\\Classes\\DirectShow\\chrome_testing",
+    L"SOFTWARE\\Classes\\WOW6432Node\\DirectShow\\chrome_testing",
+    L"SOFTWARE\\Classes\\Interface\\chrome_testing",
+    L"SOFTWARE\\Classes\\WOW6432Node\\Interface\\chrome_testing",
+    L"SOFTWARE\\Classes\\Media Type\\chrome_testing",
+    L"SOFTWARE\\Classes\\WOW6432Node\\Media Type\\chrome_testing",
+    L"SOFTWARE\\Classes\\MediaFoundation\\chrome_testing",
+    L"SOFTWARE\\Classes\\WOW6432Node\\MediaFoundation\\chrome_testing"};
+
+// kClassesRedirects must have an even number of elements.

[grt (UTC plus 2), 2016/09/29 10:30:23]

nit: remove superfluous comment since it adds nothing beyond the string in line
132 (https://google.github.io/styleguide/cppguide.html#Implementation_Comments)

[penny, 2016/09/30 05:28:23]

Done.

+static_assert((_countof(kClassesRedirects) & 0x01) == 0,
+              "Must have an even number of kClassesRedirects.");
+
+// This test does NOT use NtRegistryTest class.  It requires Windows WOW64
+// redirection to take place, which would not happen with a testing redirection
+// layer.
+TEST(NtRegistryTestRedirection, Wow64RedirectionHKCU) {
+  // Make SURE no process-wide testing registry override was
+  // set by another test (in the same process).
+  ::wcscpy(nt::HKCU_override, L"");

[grt (UTC plus 2), 2016/09/29 10:30:23]

won't this make sure that another test blows up spectacularly rather than making
sure that there isn't another one? how about the following so that this test
will fail if another one is already running?
  ASSERT_EQ(*nt::HKCU_override, L'\0') << "Parallel tests are not supported.";

[penny, 2016/09/30 05:28:23]

OK - I've actually fixed some of the other tests now (blacklist), that weren't
cleaning up the testing override at the end of their test run.  This is what
would cause a problem.  I no longer need to do the "just in case the env is
dirty" cleanup here anymore.

+  ::wcscpy(nt::HKLM_override, L"");
+
+  // Using two elements for each loop.
+  for (size_t index = 0; index < _countof(kClassesRedirects); index += 2) {
+    DoRedirectTest(nt::HKCU, kClassesRedirects[index],
+                   kClassesRedirects[index + 1]);
+  }
+}
+
+// These test reg paths match |hklm_software_subtree| in nt_registry.cc.
+constexpr wchar_t* kHKLMNoRedirects[] = {
+    L"SOFTWARE\\Classes\\chrome_testing", L"SOFTWARE\\Clients\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\COM3\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\Cryptography\\Calais\\Current\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\Cryptography\\Calais\\Readers\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\Cryptography\\Services\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\CTF\\SystemShared\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\CTF\\TIP\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\DFS\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\Driver Signing\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\EnterpriseCertificates\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\EventSystem\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\MSMQ\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\Non-Driver Signing\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\Notepad\\DefaultFonts\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\OLE\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\RAS\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\RPC\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\SOFTWARE\\Microsoft\\Shared "
+    L"Tools\\MSInfo\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\SystemCertificates\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\TermServLicensing\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\Transaction Server\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App "
+    L"Paths\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Control "
+    L"Panel\\Cursors\\Schemes\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AutoplayHandlers"
+    L"\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\DriveIcons"
+    L"\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\KindMap"
+    L"\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group "
+    L"Policy\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\PreviewHandlers"
+    L"\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Telephony\\Locations"
+    L"\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\Windows "
+    L"NT\\CurrentVersion\\Console\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\Windows "
+    L"NT\\CurrentVersion\\FontDpi\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\Windows "
+    L"NT\\CurrentVersion\\FontLink\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\Windows "
+    L"NT\\CurrentVersion\\FontMapper\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Fonts\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\Windows "
+    L"NT\\CurrentVersion\\FontSubstitutes\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\Windows "
+    L"NT\\CurrentVersion\\Gre_initialize\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution "
+    L"Options\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\Windows "
+    L"NT\\CurrentVersion\\LanguagePack\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards"
+    L"\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\Windows "
+    L"NT\\CurrentVersion\\Perflib\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Ports\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Print\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList"
+    L"\\chrome_testing",
+    L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time "
+    L"Zones\\chrome_testing",
+    L"SOFTWARE\\Policies\\chrome_testing",
+    L"SOFTWARE\\RegisteredApplications\\chrome_testing"};
+
+// Run from administrator command prompt!
+// Note: Disabled for automated testing (HKLM protection).  Local testing
+// only.
+//
+// This test does NOT use NtRegistryTest class.  It requires Windows WOW64
+// redirection to take place, which would not happen with a testing redirection
+// layer.
+TEST(NtRegistryTestRedirection, DISABLED_Wow64RedirectionHKLM) {
+  // Make SURE no process-wide testing registry override was
+  // set by another test (in the same process).
+  ::wcscpy(nt::HKCU_override, L"");
+  ::wcscpy(nt::HKLM_override, L"");
+
+  // 1) SOFTWARE is redirected.
+  DoRedirectTest(nt::HKLM, L"SOFTWARE\\chrome_testing",
+                 L"SOFTWARE\\WOW6432Node\\chrome_testing");
+
+  // 2) Except some subkeys are not.
+  for (size_t index = 0; index < _countof(kHKLMNoRedirects); ++index) {
+    DoRedirectTest(nt::HKLM, kHKLMNoRedirects[index], nullptr);
+  }
+
+  // 3) But then some Classes subkeys are redirected.
+  // Using two elements for each loop.
+  for (size_t index = 0; index < _countof(kClassesRedirects); index += 2) {
+    DoRedirectTest(nt::HKLM, kClassesRedirects[index],
+                   kClassesRedirects[index + 1]);
+  }
+
+  // 4) And just make sure other Classes subkeys are shared.
+  DoRedirectTest(nt::HKLM, L"SOFTWARE\\Classes\\ChromeTest", nullptr);
+}
+
+//------------------------------------------------------------------------------
+// NtRegistryTest class
+//
+// Only use this class for tests that need testing registry redirection.
+//------------------------------------------------------------------------------
+class NtRegistryTest : public testing::Test {
+ public:

[grt (UTC plus 2), 2016/09/29 10:30:23]

nit: test harness style generally has these protected: rather than public:

[penny, 2016/09/30 05:28:23]

Done. I just saw other ones set to public.  Thanks!

+  static void SetUpTestCase() { NtRegDeleteStaleTestKeys(); }
+
+  NtRegistryTest() {
+    NtRegTestingRedirect(nt::HKCU);
+    NtRegTestingRedirect(nt::HKLM);
+  }
+
+  ~NtRegistryTest() {
+    CancelNtRegTestingRedirect(nt::HKCU);
+    CancelNtRegTestingRedirect(nt::HKLM);
+  }
+
+ private:
+  static void NtRegDeleteStaleTestKeys() {
+    HKEY key = nullptr;
+
+    // Only open the key if it already exists.
+    if (RegOpenKeyExW(HKEY_CURRENT_USER, kTempTestKeys, 0, KEY_ALL_ACCESS,
+                      &key) != ERROR_SUCCESS)
+      return;
+
+    std::vector<std::wstring> to_delete;
+    DWORD index = 0;
+    DWORD name_size = 0;
+    wchar_t key_name[255] = {};

[grt (UTC plus 2), 2016/09/29 10:30:22]

256 to account for the terminator. please add a link to
https://msdn.microsoft.com/en-us/library/windows/desktop/ms724872(v=vs.85).aspx.

[penny, 2016/09/30 05:28:23]

Done. This is defined in nt_registry.h now.

+    FILETIME ft = {};
+    LONG status = ERROR_GEN_FAILURE;
+    // Get the current system time.
+    FILETIME current = {};
+    GetSystemTimeAsFileTime(&current);
+    ULONGLONG current_ticks =
+        (static_cast<ULONGLONG>(current.dwHighDateTime) << 32) +
+        current.dwLowDateTime;
+
+    do {
+      name_size = 255;

[grt (UTC plus 2), 2016/09/29 10:30:22]

_countof(key_name)

[penny, 2016/09/30 05:28:23]

Good one, thanks.

+      status = RegEnumKeyExW(key, index, key_name, &name_size, NULL, NULL, NULL,

[grt (UTC plus 2), 2016/09/29 10:30:23]

NULL -> nullptr everywhere

[penny, 2016/09/30 05:28:23]

Done.

+                             &ft);

[grt (UTC plus 2), 2016/09/29 10:30:22]

ft -> last_write_time
(https://google.github.io/styleguide/cppguide.html#General_Naming_Rules)

[penny, 2016/09/30 05:28:23]

Done.

+      if (status == ERROR_SUCCESS) {
+        ULONGLONG key_ticks =

[grt (UTC plus 2), 2016/09/29 10:30:22]

please use base::Time::FromFileTime for last_write_time, base::Time::Now for
|current|, and base::TimeDelta::FromHours for the delta. this will be a
bajillion times more clear. :-) here's one approach:

    const base::Time max_write_time = base::Time::Now() -
        base::TimeDelta::FromHours(12);
...
        if (base::Time::FromFileTime(last_write_time) < max_write_time)
          to_delete.emplace_back(key_name, name_size);

[penny, 2016/09/30 05:28:23]

Sorry, there's no base usage at all in nt_registry.  Enforced by DEPS in this
directory.  I was going to use base just in the unittests, when this file lived
in a different subdirectory (.\Test\) where I could have a different DEPS file. 
But it doesn't live there now.

[grt (UTC plus 2), 2016/09/30 09:32:16]

You can safely use base in the test. Add this to DEPS to allow it:

specific_include_rules = {
  ".*_unittest\.cc": [
    "+base",
  ],
}

See https://cs.chromium.org/chromium/src/buildtools/checkdeps/builddeps.py for
the DEPS format documentation.

[penny, 2016/10/01 01:44:25]

MIND IS BLOWN.  Thanks for that link.

<sigh> I just deleted all the manual testing override code.  :)

[grt (UTC plus 2), 2016/10/02 20:10:54]

Doh! Sorry I didn't notice this earlier!

+            (static_cast<ULONGLONG>(ft.dwHighDateTime) << 32) +
+            ft.dwLowDateTime;
+        ULONGLONG diffInSecs = ((current_ticks - key_ticks) / 10000) / 1000;
+        // Anything older than 12 hours.
+        if (diffInSecs > (60 * 60 * 12)) {
+          // Don't delete until after the enumerating is done.

[grt (UTC plus 2), 2016/09/29 10:30:23]

nit: remove this comment and place one above line 296 that says something like:
    // Collect the names of all subkeys that have not been modified in at least
12 hours.

[penny, 2016/09/30 05:28:23]

Done.

+          std::wstring temp = key_name;
+          to_delete.push_back(temp);

[grt (UTC plus 2), 2016/09/29 10:30:23]

nit: construct the string in place using the length you already have:
          to_delete.emplace_back(key_name, name_size);

[penny, 2016/09/30 05:28:23]

TIL emplace_back!!!  Didn't know this existed.  <fireworks>

[grt (UTC plus 2), 2016/09/30 09:32:16]

Indeed! I knew about it but had forgotten that we're allowed to use it now.
Sweet!

[penny, 2016/10/01 01:44:25]

I feel like my life has changed.

+        }
+      }
+      ++index;
+    } while (status != ERROR_NO_MORE_ITEMS);
+
+    // Best effort.  If any tree deletion fails, just keep going.
+    for (std::wstring subkey : to_delete)

[grt (UTC plus 2), 2016/09/29 10:30:22]

const auto& subkey_name : to_delete

[penny, 2016/09/30 05:28:23]

Done.

+      RegDeleteTreeW(key, subkey.c_str());
+
+    RegCloseKey(key);
+  }
+
+  void NtRegTestingRedirect(nt::ROOT_KEY key) {
+    UUID uuid = {};
+    RPC_STATUS status = UuidCreateSequential(&uuid);
+    if (status != RPC_S_OK && status != RPC_S_UUID_NO_ADDRESS)
+      return;
+    RPC_WSTR guid = nullptr;
+    if (UuidToStringW(&uuid, &guid) != RPC_S_OK)
+      return;
+
+    wchar_t temp_path[MAX_PATH] = L"";
+    ::wcscat(temp_path, kTempTestKeys);
+    ::wcsncat(temp_path, reinterpret_cast<wchar_t*>(guid),
+              (MAX_PATH - ::wcslen(temp_path) - 1));
+    RpcStringFreeW(&guid);
+
+    if (key == nt::HKCU) {
+      ::wcsncpy(nt::HKCU_override, temp_path, nt::g_kRegMaxPathLen - 1);
+      override_key_hkcu = temp_path;
+    } else if (key == nt::HKLM) {
+      ::wcsncpy(nt::HKLM_override, temp_path, nt::g_kRegMaxPathLen - 1);
+      override_key_hklm = temp_path;
+    }
+  }
+
+  void CancelNtRegTestingRedirect(nt::ROOT_KEY key) {
+    if (key == nt::HKCU) {
+      ::wcsncpy(nt::HKCU_override, L"", nt::g_kRegMaxPathLen - 1);
+      RegDeleteTreeW(HKEY_CURRENT_USER, override_key_hkcu.c_str());
+      override_key_hkcu.clear();
+    } else if (key == nt::HKLM) {
+      ::wcsncpy(nt::HKLM_override, L"", nt::g_kRegMaxPathLen - 1);
+      RegDeleteTreeW(HKEY_CURRENT_USER, override_key_hklm.c_str());
+      override_key_hklm.clear();
+    }
+  }
+
+  std::wstring override_key_hkcu;
+  std::wstring override_key_hklm;
+};
+
+//------------------------------------------------------------------------------
+// NT registry API tests
+//------------------------------------------------------------------------------
+
+TEST_F(NtRegistryTest, API_DWORD) {
+  HANDLE key_handle;
+  const wchar_t* dword_val_name = L"DwordTestValue";
+  DWORD dword_val = 1234;
+
+  // Create a subkey to play under.
+  ASSERT_TRUE(nt::CreateRegKey(nt::HKCU, L"NTRegistry\\dword", KEY_ALL_ACCESS,
+                               &key_handle));
+  ASSERT_NE(key_handle, INVALID_HANDLE_VALUE);
+  ASSERT_NE(key_handle, nullptr);
+

[grt (UTC plus 2), 2016/09/29 10:30:23]

please also test that Query returns false before Set is called

[penny, 2016/09/30 05:28:23]

Done.

+  // Set
+  EXPECT_TRUE(nt::SetRegValueDWORD(key_handle, dword_val_name, dword_val));
+
+  // Get
+  DWORD get_dword = 0;
+  EXPECT_TRUE(nt::QueryRegValueDWORD(key_handle, dword_val_name, &get_dword));
+  EXPECT_TRUE(get_dword == dword_val);
+
+  // Clean up
+  EXPECT_TRUE(nt::DeleteRegKey(key_handle));
+  nt::CloseRegKey(key_handle);
+}
+
+TEST_F(NtRegistryTest, API_SZ) {
+  HANDLE key_handle;
+  const wchar_t* sz_val_name = L"SzTestValue";
+  std::wstring sz_val = L"blah de blah de blahhhhh.";
+  const wchar_t* sz_val_name2 = L"SzTestValueEmpty";
+  std::wstring sz_val2 = L"";
+
+  // Create a subkey to play under.
+  ASSERT_TRUE(nt::CreateRegKey(nt::HKCU, L"NTRegistry\\sz", KEY_ALL_ACCESS,
+                               &key_handle));
+  ASSERT_NE(key_handle, INVALID_HANDLE_VALUE);
+  ASSERT_NE(key_handle, nullptr);
+
+  // Set
+  EXPECT_TRUE(nt::SetRegValueSZ(key_handle, sz_val_name, sz_val));
+  EXPECT_TRUE(nt::SetRegValueSZ(key_handle, sz_val_name2, sz_val2));
+
+  // Get
+  std::wstring get_sz;
+  EXPECT_TRUE(nt::QueryRegValueSZ(key_handle, sz_val_name, &get_sz));
+  EXPECT_TRUE(get_sz.compare(sz_val) == 0);
+  EXPECT_TRUE(nt::QueryRegValueSZ(key_handle, sz_val_name2, &get_sz));
+  EXPECT_TRUE(get_sz.compare(sz_val2) == 0);
+
+  // Clean up
+  EXPECT_TRUE(nt::DeleteRegKey(key_handle));
+  nt::CloseRegKey(key_handle);
+}
+
+TEST_F(NtRegistryTest, API_MULTISZ) {
+  HANDLE key_handle;
+  const wchar_t* multisz_val_name = L"SzmultiTestValue";
+  std::vector<std::wstring> multisz_val;
+  std::wstring multi1 = L"one";
+  std::wstring multi2 = L"two";
+  std::wstring multi3 = L"three";
+  const wchar_t* multisz_val_name2 = L"SzmultiTestValueBad";
+  std::wstring multi_empty = L"";
+
+  // Create a subkey to play under.
+  ASSERT_TRUE(nt::CreateRegKey(nt::HKCU, L"NTRegistry\\multisz", KEY_ALL_ACCESS,
+                               &key_handle));
+  ASSERT_NE(key_handle, INVALID_HANDLE_VALUE);
+  ASSERT_NE(key_handle, nullptr);
+
+  multisz_val.push_back(multi1);
+  multisz_val.push_back(multi2);
+  multisz_val.push_back(multi3);
+  // Set
+  EXPECT_TRUE(
+      nt::SetRegValueMULTISZ(key_handle, multisz_val_name, multisz_val));
+  multisz_val.clear();
+  multisz_val.push_back(multi_empty);
+  // Set
+  EXPECT_TRUE(
+      nt::SetRegValueMULTISZ(key_handle, multisz_val_name2, multisz_val));
+  multisz_val.clear();
+
+  // Get
+  EXPECT_TRUE(
+      nt::QueryRegValueMULTISZ(key_handle, multisz_val_name, &multisz_val));
+  if (multisz_val.size() == 3) {
+    EXPECT_TRUE(multi1.compare(multisz_val.at(0)) == 0);
+    EXPECT_TRUE(multi2.compare(multisz_val.at(1)) == 0);
+    EXPECT_TRUE(multi3.compare(multisz_val.at(2)) == 0);
+  } else {
+    EXPECT_TRUE(false);
+  }
+  multisz_val.clear();
+
+  // Get
+  EXPECT_TRUE(
+      nt::QueryRegValueMULTISZ(key_handle, multisz_val_name2, &multisz_val));
+  if (multisz_val.size() == 1) {
+    EXPECT_TRUE(multi_empty.compare(multisz_val.at(0)) == 0);
+  } else {
+    EXPECT_TRUE(false);
+  }
+  multisz_val.clear();
+
+  // Clean up
+  EXPECT_TRUE(nt::DeleteRegKey(key_handle));
+  nt::CloseRegKey(key_handle);
+}
+
+TEST_F(NtRegistryTest, CreateRegKeyRecursion) {
+  HANDLE key_handle;
+  const wchar_t* sz_new_key_1 = L"test1\\new\\subkey";
+  const wchar_t* sz_new_key_2 = L"test2\\new\\subkey\\blah\\";
+  const wchar_t* sz_new_key_3 = L"\\test3\\new\\subkey\\\\blah2";
+
+  // Tests for CreateRegKey recursion.
+  ASSERT_TRUE(
+      nt::CreateRegKey(nt::HKCU, sz_new_key_1, KEY_ALL_ACCESS, nullptr));
+  EXPECT_TRUE(nt::OpenRegKey(nt::HKCU, sz_new_key_1, KEY_ALL_ACCESS,
+                             &key_handle, nullptr));
+  EXPECT_TRUE(nt::DeleteRegKey(key_handle));
+  nt::CloseRegKey(key_handle);
+
+  ASSERT_TRUE(
+      nt::CreateRegKey(nt::HKCU, sz_new_key_2, KEY_ALL_ACCESS, nullptr));
+  EXPECT_TRUE(nt::OpenRegKey(nt::HKCU, sz_new_key_2, KEY_ALL_ACCESS,
+                             &key_handle, nullptr));
+  EXPECT_TRUE(nt::DeleteRegKey(key_handle));
+  nt::CloseRegKey(key_handle);
+
+  ASSERT_TRUE(
+      nt::CreateRegKey(nt::HKCU, sz_new_key_3, KEY_ALL_ACCESS, nullptr));
+  EXPECT_TRUE(nt::OpenRegKey(nt::HKCU, L"test3\\new\\subkey\\blah2",
+                             KEY_ALL_ACCESS, &key_handle, nullptr));
+  EXPECT_TRUE(nt::DeleteRegKey(key_handle));
+  nt::CloseRegKey(key_handle);
+
+  // Subkey path can be null.
+  ASSERT_TRUE(nt::CreateRegKey(nt::HKCU, nullptr, KEY_ALL_ACCESS, &key_handle));
+  ASSERT_NE(key_handle, INVALID_HANDLE_VALUE);
+  ASSERT_NE(key_handle, nullptr);
+  nt::CloseRegKey(key_handle);
+}
+
+}  // namespace