Revert r18064 and correctly set the cell size for hash cells.
[reactos.git] / reactos / ntoskrnl / cm / regfile.c
index 6e751e5..5b4abda 100644 (file)
@@ -1,38 +1,25 @@
-/*
- * COPYRIGHT:        See COPYING in the top level directory
- * PROJECT:          ReactOS kernel
- * FILE:             ntoskrnl/cm/regfile.c
- * PURPOSE:          Registry file manipulation routines
- * UPDATE HISTORY:
-*/
-
-#ifdef WIN32_REGDBG
-#include "cm_win32.h"
-#else
-#include <ddk/ntddk.h>
-#include <ddk/ntifs.h>
-#include <roscfg.h>
-#include <internal/ob.h>
-#include <limits.h>
-#include <string.h>
-#include <internal/pool.h>
-#include <internal/registry.h>
-#include <reactos/bugcodes.h>
-
+/* $Id$
+ *
+ * COPYRIGHT:       See COPYING in the top level directory
+ * PROJECT:         ReactOS kernel
+ * FILE:            ntoskrnl/cm/regfile.c
+ * PURPOSE:         Registry file manipulation routines
+ *
+ * PROGRAMMERS:     No programmer listed.
+ */
+
+#include <ntoskrnl.h>
 #define NDEBUG
 #include <internal/debug.h>
 
 #include "cm.h"
-#endif
+
 
 /* uncomment to enable hive checks (incomplete and probably buggy) */
 // #define HIVE_CHECK
 
 /* LOCAL MACROS *************************************************************/
 
-#define ROUND_UP(N, S) ((((N) + (S) - 1) / (S)) * (S))
-#define ROUND_DOWN(N, S) ((N) - ((N) % (S)))
-
 #define ABS_VALUE(V) (((V) < 0) ? -(V) : (V))
 
 BOOLEAN CmiDoVerify = FALSE;
@@ -45,19 +32,19 @@ CmiCalcChecksum(PULONG Buffer);
 VOID
 CmiCreateDefaultHiveHeader(PHIVE_HEADER Header)
 {
-  assert(Header);
+  ASSERT(Header);
   RtlZeroMemory(Header, sizeof(HIVE_HEADER));
   Header->BlockId = REG_HIVE_ID;
   Header->UpdateCounter1 = 0;
   Header->UpdateCounter2 = 0;
-  Header->DateModified.dwLowDateTime = 0;
-  Header->DateModified.dwHighDateTime = 0;
+  Header->DateModified.u.LowPart = 0;
+  Header->DateModified.u.HighPart = 0;
   Header->Unused3 = 1;
   Header->Unused4 = 3;
   Header->Unused5 = 0;
   Header->Unused6 = 1;
   Header->Unused7 = 1;
-  Header->RootKeyCell = 0;
+  Header->RootKeyOffset = (BLOCK_OFFSET)-1;
   Header->BlockSize = REG_BLOCK_SIZE;
   Header->Unused6 = 1;
   Header->Checksum = 0;
@@ -65,35 +52,31 @@ CmiCreateDefaultHiveHeader(PHIVE_HEADER Header)
 
 
 VOID
-CmiCreateDefaultBinCell(PHBIN BinCell)
+CmiCreateDefaultBinHeader(PHBIN BinHeader)
 {
-  assert(BinCell);
-  RtlZeroMemory(BinCell, sizeof(HBIN));
-  BinCell->BlockId = REG_BIN_ID;
-  BinCell->DateModified.dwLowDateTime = 0;
-  BinCell->DateModified.dwHighDateTime = 0;
-  BinCell->BlockSize = REG_BLOCK_SIZE;
+  ASSERT(BinHeader);
+  RtlZeroMemory(BinHeader, sizeof(HBIN));
+  BinHeader->HeaderId = REG_BIN_ID;
+  BinHeader->DateModified.u.LowPart = 0;
+  BinHeader->DateModified.u.HighPart = 0;
+  BinHeader->BinSize = REG_BLOCK_SIZE;
 }
 
 
 VOID
 CmiCreateDefaultRootKeyCell(PKEY_CELL RootKeyCell)
 {
-  assert(RootKeyCell);
+  ASSERT(RootKeyCell);
   RtlZeroMemory(RootKeyCell, sizeof(KEY_CELL));
-#ifdef WIN32_REGDBG
-  RootKeyCell->CellSize = -(LONG)sizeof(KEY_CELL);
-#else
   RootKeyCell->CellSize = -sizeof(KEY_CELL);
-#endif
   RootKeyCell->Id = REG_KEY_CELL_ID;
-  RootKeyCell->Type = REG_ROOT_KEY_CELL_TYPE;
-  NtQuerySystemTime((PTIME) &RootKeyCell->LastWriteTime);
+  RootKeyCell->Flags = REG_KEY_ROOT_CELL | REG_KEY_NAME_PACKED;
+  KeQuerySystemTime(&RootKeyCell->LastWriteTime);
   RootKeyCell->ParentKeyOffset = 0;
   RootKeyCell->NumberOfSubKeys = 0;
   RootKeyCell->HashTableOffset = -1;
   RootKeyCell->NumberOfValues = 0;
-  RootKeyCell->ValuesOffset = -1;
+  RootKeyCell->ValueListOffset = -1;
   RootKeyCell->SecurityKeyOffset = 0;
   RootKeyCell->ClassNameOffset = -1;
   RootKeyCell->NameSize = 0;
@@ -102,30 +85,30 @@ CmiCreateDefaultRootKeyCell(PKEY_CELL RootKeyCell)
 
 
 VOID
-CmiVerifyBinCell(PHBIN BinCell)
+CmiVerifyBinHeader(PHBIN BinHeader)
 {
   if (CmiDoVerify)
     {
 
-  assert(BinCell);
+  ASSERT(BinHeader);
 
-  if (BinCell->BlockId != REG_BIN_ID)
+  if (BinHeader->HeaderId != REG_BIN_ID)
     {
-      DbgPrint("BlockId is %.08x (should be %.08x)\n",
-        BinCell->BlockId, REG_BIN_ID);
-      assert(BinCell->BlockId == REG_BIN_ID);
+      DbgPrint("Bin header ID is %.08x (should be %.08x)\n",
+        BinHeader->HeaderId, REG_BIN_ID);
+      ASSERT(BinHeader->HeaderId == REG_BIN_ID);
     }
 
-  //BinCell->DateModified.dwLowDateTime
+  //BinHeader->DateModified.dwLowDateTime
+
+  //BinHeader->DateModified.dwHighDateTime
 
-  //BinCell->DateModified.dwHighDateTime
 
-  
-  if (BinCell->BlockSize != REG_BLOCK_SIZE)
+  if (BinHeader->BinSize != REG_BLOCK_SIZE)
     {
-      DbgPrint("BlockSize is %.08x (should be %.08x)\n",
-        BinCell->BlockSize, REG_BLOCK_SIZE);
-      assert(BinCell->BlockSize == REG_BLOCK_SIZE);
+      DbgPrint("BinSize is %.08x (should be a multiple of %.08x)\n",
+        BinHeader->BinSize, REG_BLOCK_SIZE);
+      ASSERT(BinHeader->BinSize % REG_BLOCK_SIZE == 0);
     }
 
     }
@@ -138,29 +121,23 @@ CmiVerifyKeyCell(PKEY_CELL KeyCell)
   if (CmiDoVerify)
     {
 
-  assert(KeyCell);
+  ASSERT(KeyCell);
 
   if (KeyCell->CellSize == 0)
     {
       DbgPrint("CellSize is %d (must not be 0)\n",
         KeyCell->CellSize);
-      assert(KeyCell->CellSize != 0);
+      ASSERT(KeyCell->CellSize != 0);
     }
 
   if (KeyCell->Id != REG_KEY_CELL_ID)
     {
       DbgPrint("Id is %.08x (should be %.08x)\n",
         KeyCell->Id, REG_KEY_CELL_ID);
-      assert(KeyCell->Id == REG_KEY_CELL_ID);
+      ASSERT(KeyCell->Id == REG_KEY_CELL_ID);
     }
 
-  if ((KeyCell->Type != REG_KEY_CELL_TYPE)
-    && (KeyCell->Type != REG_ROOT_KEY_CELL_TYPE))
-    {
-      DbgPrint("Type is %.08x (should be %.08x or %.08x)\n",
-        KeyCell->Type, REG_KEY_CELL_TYPE, REG_ROOT_KEY_CELL_TYPE);
-      assert(FALSE);
-    }
+  //KeyCell->Flags;
 
   //KeyCell->LastWriteTime;
 
@@ -168,14 +145,14 @@ CmiVerifyKeyCell(PKEY_CELL KeyCell)
     {
       DbgPrint("ParentKeyOffset is %d (must not be < 0)\n",
         KeyCell->ParentKeyOffset);
-      assert(KeyCell->ParentKeyOffset >= 0);
+      ASSERT(KeyCell->ParentKeyOffset >= 0);
     }
 
   if (KeyCell->NumberOfSubKeys < 0)
     {
       DbgPrint("NumberOfSubKeys is %d (must not be < 0)\n",
         KeyCell->NumberOfSubKeys);
-      assert(KeyCell->NumberOfSubKeys >= 0);
+      ASSERT(KeyCell->NumberOfSubKeys >= 0);
     }
 
   //KeyCell->HashTableOffset;
@@ -184,7 +161,7 @@ CmiVerifyKeyCell(PKEY_CELL KeyCell)
     {
       DbgPrint("NumberOfValues is %d (must not be < 0)\n",
         KeyCell->NumberOfValues);
-      assert(KeyCell->NumberOfValues >= 0);
+      ASSERT(KeyCell->NumberOfValues >= 0);
     }
 
   //KeyCell->ValuesOffset = -1;
@@ -193,7 +170,7 @@ CmiVerifyKeyCell(PKEY_CELL KeyCell)
     {
       DbgPrint("SecurityKeyOffset is %d (must not be < 0)\n",
         KeyCell->SecurityKeyOffset);
-      assert(KeyCell->SecurityKeyOffset >= 0);
+      ASSERT(KeyCell->SecurityKeyOffset >= 0);
     }
 
   //KeyCell->ClassNameOffset = -1;
@@ -214,11 +191,11 @@ CmiVerifyRootKeyCell(PKEY_CELL RootKeyCell)
 
   CmiVerifyKeyCell(RootKeyCell);
 
-  if (RootKeyCell->Type != REG_ROOT_KEY_CELL_TYPE)
+  if (!(RootKeyCell->Flags & REG_KEY_ROOT_CELL))
     {
-      DbgPrint("Type is %.08x (should be %.08x)\n",
-        RootKeyCell->Type, REG_ROOT_KEY_CELL_TYPE);
-      assert(RootKeyCell->Type == REG_ROOT_KEY_CELL_TYPE);
+      DbgPrint("Flags is %.08x (should be %.08x)\n",
+        RootKeyCell->Flags, REG_KEY_ROOT_CELL | REG_KEY_NAME_PACKED);
+      ASSERT(!(RootKeyCell->Flags & (REG_KEY_ROOT_CELL | REG_KEY_NAME_PACKED)));
     }
 
     }
@@ -231,20 +208,20 @@ CmiVerifyValueCell(PVALUE_CELL ValueCell)
   if (CmiDoVerify)
     {
 
-  assert(ValueCell);
+  ASSERT(ValueCell);
 
   if (ValueCell->CellSize == 0)
     {
       DbgPrint("CellSize is %d (must not be 0)\n",
         ValueCell->CellSize);
-      assert(ValueCell->CellSize != 0);
+      ASSERT(ValueCell->CellSize != 0);
     }
 
   if (ValueCell->Id != REG_VALUE_CELL_ID)
     {
       DbgPrint("Id is %.08x (should be %.08x)\n",
         ValueCell->Id, REG_VALUE_CELL_ID);
-      assert(ValueCell->Id == REG_VALUE_CELL_ID);
+      ASSERT(ValueCell->Id == REG_VALUE_CELL_ID);
     }
 
   //ValueCell->NameSize;
@@ -268,7 +245,7 @@ CmiVerifyValueListCell(PVALUE_LIST_CELL ValueListCell)
     {
       DbgPrint("CellSize is %d (must not be 0)\n",
         ValueListCell->CellSize);
-      assert(ValueListCell->CellSize != 0);
+      ASSERT(ValueListCell->CellSize != 0);
     }
 
     }
@@ -285,21 +262,21 @@ CmiVerifyKeyObject(PKEY_OBJECT KeyObject)
     {
       DbgPrint("RegistryHive is NULL (must not be NULL)\n",
         KeyObject->RegistryHive);
-      assert(KeyObject->RegistryHive != NULL);
+      ASSERT(KeyObject->RegistryHive != NULL);
     }
 
   if (KeyObject->KeyCell == NULL)
     {
       DbgPrint("KeyCell is NULL (must not be NULL)\n",
         KeyObject->KeyCell);
-      assert(KeyObject->KeyCell != NULL);
+      ASSERT(KeyObject->KeyCell != NULL);
     }
 
   if (KeyObject->ParentKey == NULL)
     {
       DbgPrint("ParentKey is NULL (must not be NULL)\n",
         KeyObject->ParentKey);
-      assert(KeyObject->ParentKey != NULL);
+      ASSERT(KeyObject->ParentKey != NULL);
     }
 
     }
@@ -317,42 +294,42 @@ CmiVerifyHiveHeader(PHIVE_HEADER Header)
       DbgPrint("BlockId is %.08x (must be %.08x)\n",
         Header->BlockId,
         REG_HIVE_ID);
-      assert(Header->BlockId == REG_HIVE_ID);
+      ASSERT(Header->BlockId == REG_HIVE_ID);
     }
 
   if (Header->Unused3 != 1)
     {
       DbgPrint("Unused3 is %.08x (must be 1)\n",
         Header->Unused3);
-      assert(Header->Unused3 == 1);
+      ASSERT(Header->Unused3 == 1);
     }
 
   if (Header->Unused4 != 3)
     {
       DbgPrint("Unused4 is %.08x (must be 3)\n",
         Header->Unused4);
-      assert(Header->Unused4 == 3);
+      ASSERT(Header->Unused4 == 3);
     }
 
   if (Header->Unused5 != 0)
     {
       DbgPrint("Unused5 is %.08x (must be 0)\n",
         Header->Unused5);
-      assert(Header->Unused5 == 0);
+      ASSERT(Header->Unused5 == 0);
     }
 
   if (Header->Unused6 != 1)
     {
       DbgPrint("Unused6 is %.08x (must be 1)\n",
         Header->Unused6);
-      assert(Header->Unused6 == 1);
+      ASSERT(Header->Unused6 == 1);
     }
 
   if (Header->Unused7 != 1)
     {
       DbgPrint("Unused7 is %.08x (must be 1)\n",
         Header->Unused7);
-      assert(Header->Unused7 == 1);
+      ASSERT(Header->Unused7 == 1);
     }
 
     }
@@ -371,62 +348,6 @@ CmiVerifyRegistryHive(PREGISTRY_HIVE RegistryHive)
 }
 
 
-static NTSTATUS
-CmiPopulateHive(HANDLE FileHandle)
-{
-  IO_STATUS_BLOCK IoStatusBlock;
-  LARGE_INTEGER FileOffset;
-  PCELL_HEADER FreeCell;
-  NTSTATUS Status;
-  PHBIN BinCell;
-  PCHAR tBuf;
-  ULONG i;
-
-  tBuf = (PCHAR) ExAllocatePool(NonPagedPool, REG_BLOCK_SIZE);
-  if (tBuf == NULL)
-    return STATUS_INSUFFICIENT_RESOURCES;
-
-  BinCell = (PHBIN) tBuf;
-  FreeCell = (PCELL_HEADER) (tBuf + REG_HBIN_DATA_OFFSET);
-
-  CmiCreateDefaultBinCell(BinCell);
-
-  // The whole block is free
-  FreeCell->CellSize = REG_BLOCK_SIZE - REG_HBIN_DATA_OFFSET;
-
-  // Add free blocks so we don't need to expand
-  // the file for a while
-  for (i = 1; i < 50; i++)
-    {
-      // Block offset of this bin
-      BinCell->BlockOffset = i * REG_BLOCK_SIZE;
-
-      FileOffset.u.HighPart = 0;
-      FileOffset.u.LowPart  = (i + 1) * REG_BLOCK_SIZE;
-
-      Status = NtWriteFile(FileHandle,
-                          NULL,
-                          NULL,
-                          NULL,
-                          &IoStatusBlock,
-                          tBuf,
-                          REG_BLOCK_SIZE,
-                          &FileOffset,
-                          NULL);
-      assertmsg(NT_SUCCESS(Status), ("Status: 0x%X\n", Status));
-      if (!NT_SUCCESS(Status))
-       {
-         ExFreePool(tBuf);
-         return Status;
-       }
-    }
-
-  ExFreePool(tBuf);
-
-  return Status;
-}
-
-
 static NTSTATUS
 CmiCreateNewRegFile(HANDLE FileHandle)
 {
@@ -435,32 +356,35 @@ CmiCreateNewRegFile(HANDLE FileHandle)
   PHIVE_HEADER HiveHeader;
   PKEY_CELL RootKeyCell;
   NTSTATUS Status;
-  PHBIN BinCell;
+  PHBIN BinHeader;
   PCHAR Buffer;
 
   Buffer = (PCHAR) ExAllocatePool(NonPagedPool, 2 * REG_BLOCK_SIZE);
   if (Buffer == NULL)
     return STATUS_INSUFFICIENT_RESOURCES;
 
+  RtlZeroMemory (Buffer,
+                2 * REG_BLOCK_SIZE);
+
   HiveHeader = (PHIVE_HEADER)Buffer;
-  BinCell = (PHBIN)((ULONG_PTR)Buffer + REG_BLOCK_SIZE);
+  BinHeader = (PHBIN)((ULONG_PTR)Buffer + REG_BLOCK_SIZE);
   RootKeyCell = (PKEY_CELL)((ULONG_PTR)Buffer + REG_BLOCK_SIZE + REG_HBIN_DATA_OFFSET);
   FreeCell = (PCELL_HEADER)((ULONG_PTR)Buffer + REG_BLOCK_SIZE + REG_HBIN_DATA_OFFSET + sizeof(KEY_CELL));
 
   CmiCreateDefaultHiveHeader(HiveHeader);
-  CmiCreateDefaultBinCell(BinCell);
+  CmiCreateDefaultBinHeader(BinHeader);
   CmiCreateDefaultRootKeyCell(RootKeyCell);
 
   /* First block */
-  BinCell->BlockOffset = 0;
+  BinHeader->BinOffset = 0;
 
   /* Offset to root key block */
-  HiveHeader->RootKeyCell = REG_HBIN_DATA_OFFSET;
+  HiveHeader->RootKeyOffset = REG_HBIN_DATA_OFFSET;
 
   /* The rest of the block is free */
   FreeCell->CellSize = REG_BLOCK_SIZE - (REG_HBIN_DATA_OFFSET + sizeof(KEY_CELL));
 
-  Status = NtWriteFile(FileHandle,
+  Status = ZwWriteFile(FileHandle,
                       NULL,
                       NULL,
                       NULL,
@@ -472,21 +396,12 @@ CmiCreateNewRegFile(HANDLE FileHandle)
 
   ExFreePool(Buffer);
 
-  assertmsg(NT_SUCCESS(Status), ("Status: 0x%X\n", Status));
-
   if (!NT_SUCCESS(Status))
     {
       return(Status);
     }
 
-#if 1
-  if (NT_SUCCESS(Status))
-    {
-      CmiPopulateHive(FileHandle);
-    }
-#endif
-
-  Status = NtFlushBuffersFile(FileHandle,
+  Status = ZwFlushBuffersFile(FileHandle,
                              &IoStatusBlock);
 
   return(Status);
@@ -516,11 +431,11 @@ CmiCheckAndFixHive(PREGISTRY_HIVE RegistryHive)
   /* Try to open the hive file */
   InitializeObjectAttributes(&ObjectAttributes,
                             &RegistryHive->HiveFileName,
-                            0,
+                            OBJ_CASE_INSENSITIVE,
                             NULL,
                             NULL);
 
-  Status = NtCreateFile(&HiveHandle,
+  Status = ZwCreateFile(&HiveHandle,
                        FILE_READ_DATA | FILE_READ_ATTRIBUTES,
                        &ObjectAttributes,
                        &IoStatusBlock,
@@ -537,18 +452,18 @@ CmiCheckAndFixHive(PREGISTRY_HIVE RegistryHive)
     }
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtCreateFile() failed (Status %lx)\n", Status);
+      DPRINT("ZwCreateFile() failed (Status %lx)\n", Status);
       return(Status);
     }
 
   /* Try to open the log file */
   InitializeObjectAttributes(&ObjectAttributes,
                             &RegistryHive->LogFileName,
-                            0,
+                            OBJ_CASE_INSENSITIVE,
                             NULL,
                             NULL);
 
-  Status = NtCreateFile(&LogHandle,
+  Status = ZwCreateFile(&LogHandle,
                        FILE_READ_DATA | FILE_READ_ATTRIBUTES,
                        &ObjectAttributes,
                        &IoStatusBlock,
@@ -565,8 +480,8 @@ CmiCheckAndFixHive(PREGISTRY_HIVE RegistryHive)
     }
   else if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtCreateFile() failed (Status %lx)\n", Status);
-      NtClose(HiveHandle);
+      DPRINT("ZwCreateFile() failed (Status %lx)\n", Status);
+      ZwClose(HiveHandle);
       return(Status);
     }
 
@@ -582,7 +497,7 @@ CmiCheckAndFixHive(PREGISTRY_HIVE RegistryHive)
 
   /* Read hive base block */
   FileOffset.QuadPart = 0ULL;
-  Status = NtReadFile(HiveHandle,
+  Status = ZwReadFile(HiveHandle,
                      0,
                      0,
                      0,
@@ -593,7 +508,7 @@ CmiCheckAndFixHive(PREGISTRY_HIVE RegistryHive)
                      0);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtReadFile() failed (Status %lx)\n", Status);
+      DPRINT("ZwReadFile() failed (Status %lx)\n", Status);
       goto ByeBye;
     }
 
@@ -604,7 +519,7 @@ CmiCheckAndFixHive(PREGISTRY_HIVE RegistryHive)
        {
          /* There is no way to fix the hive without log file - BSOD! */
          DPRINT("Hive header inconsistent and no log file available!\n");
-         KeBugCheck(CONFIG_LIST_FAILED);
+         KEBUGCHECK(CONFIG_LIST_FAILED);
        }
 
       Status = STATUS_SUCCESS;
@@ -624,7 +539,7 @@ CmiCheckAndFixHive(PREGISTRY_HIVE RegistryHive)
 
       /* Read log file header */
       FileOffset.QuadPart = 0ULL;
-      Status = NtReadFile(LogHandle,
+      Status = ZwReadFile(LogHandle,
                          0,
                          0,
                          0,
@@ -635,7 +550,7 @@ CmiCheckAndFixHive(PREGISTRY_HIVE RegistryHive)
                          0);
       if (!NT_SUCCESS(Status))
        {
-         DPRINT("NtReadFile() failed (Status %lx)\n", Status);
+         DPRINT("ZwReadFile() failed (Status %lx)\n", Status);
          goto ByeBye;
        }
 
@@ -647,7 +562,7 @@ CmiCheckAndFixHive(PREGISTRY_HIVE RegistryHive)
              HiveHeader->UpdateCounter1 != HiveHeader->UpdateCounter2)
            {
              DPRINT("Hive file and log file are inconsistent!\n");
-             KeBugCheck(CONFIG_LIST_FAILED);
+             KEBUGCHECK(CONFIG_LIST_FAILED);
            }
 
          /* Log file damaged but hive is okay */
@@ -668,24 +583,24 @@ CmiCheckAndFixHive(PREGISTRY_HIVE RegistryHive)
        */
 
       /* Get file size */
-      Status = NtQueryInformationFile(LogHandle,
+      Status = ZwQueryInformationFile(LogHandle,
                                      &IoStatusBlock,
                                      &fsi,
                                      sizeof(fsi),
                                      FileStandardInformation);
       if (!NT_SUCCESS(Status))
        {
-         DPRINT("NtQueryInformationFile() failed (Status %lx)\n", Status);
+         DPRINT("ZwQueryInformationFile() failed (Status %lx)\n", Status);
          goto ByeBye;
        }
       FileSize = fsi.EndOfFile.u.LowPart;
 
       /* Calculate bitmap and block size */
-      BitmapSize = ROUND_UP((FileSize / 4096) - 1, sizeof(ULONG) * 8) / 8;
+      BitmapSize = ROUND_UP((FileSize / REG_BLOCK_SIZE) - 1, sizeof(ULONG) * 8) / 8;
       BufferSize = sizeof(HIVE_HEADER) +
                          sizeof(ULONG) +
                          BitmapSize;
-      BufferSize = ROUND_UP(BufferSize, 4096);
+      BufferSize = ROUND_UP(BufferSize, REG_BLOCK_SIZE);
 
       /* Reallocate log header block */
       ExFreePool(LogHeader);
@@ -700,7 +615,7 @@ CmiCheckAndFixHive(PREGISTRY_HIVE RegistryHive)
 
       /* Read log file header */
       FileOffset.QuadPart = 0ULL;
-      Status = NtReadFile(LogHandle,
+      Status = ZwReadFile(LogHandle,
                          0,
                          0,
                          0,
@@ -711,13 +626,13 @@ CmiCheckAndFixHive(PREGISTRY_HIVE RegistryHive)
                          0);
       if (!NT_SUCCESS(Status))
        {
-         DPRINT("NtReadFile() failed (Status %lx)\n", Status);
+         DPRINT("ZwReadFile() failed (Status %lx)\n", Status);
          goto ByeBye;
        }
 
       /* Initialize bitmap */
       RtlInitializeBitMap(&BlockBitMap,
-                         (PVOID)((ULONG)LogHeader + 4096 + sizeof(ULONG)),
+                         (PVOID)((ULONG_PTR)LogHeader + REG_BLOCK_SIZE + sizeof(ULONG)),
                          BitmapSize * 8);
 
       /* FIXME: Update dirty blocks */
@@ -739,51 +654,224 @@ ByeBye:
     ExFreePool(LogHeader);
 
   if (LogHandle != INVALID_HANDLE_VALUE)
-    NtClose(LogHandle);
+    ZwClose(LogHandle);
 
-  NtClose(HiveHandle);
+  ZwClose(HiveHandle);
 
   return(Status);
 }
 #endif
 
 
+NTSTATUS
+CmiImportHiveBins(PREGISTRY_HIVE Hive,
+                 PUCHAR ChunkPtr)
+{
+  BLOCK_OFFSET BlockOffset;
+  ULONG BlockIndex;
+  PHBIN Bin;
+  ULONG j;
+
+  BlockIndex = 0;
+  BlockOffset = 0;
+  while (BlockIndex < Hive->BlockListSize)
+    {
+      Bin = (PHBIN)((ULONG_PTR)ChunkPtr + BlockOffset);
+
+      if (Bin->HeaderId != REG_BIN_ID)
+       {
+         DPRINT1 ("Bad bin header id %x, offset %x\n", Bin->HeaderId, BlockOffset);
+         return STATUS_REGISTRY_CORRUPT;
+       }
+
+      ASSERTMSG("Bin size must be multiple of 4K\n",
+                (Bin->BinSize % REG_BLOCK_SIZE) == 0);
+
+      /* Allocate the hive block */
+      Hive->BlockList[BlockIndex].Bin = ExAllocatePool (PagedPool,
+                                                       Bin->BinSize);
+      if (Hive->BlockList[BlockIndex].Bin == NULL)
+       {
+         DPRINT1 ("ExAllocatePool() failed\n");
+         return STATUS_INSUFFICIENT_RESOURCES;
+       }
+      Hive->BlockList[BlockIndex].Block = (PVOID)Hive->BlockList[BlockIndex].Bin;
+
+      /* Import the Bin */
+      RtlCopyMemory (Hive->BlockList[BlockIndex].Bin,
+                    Bin,
+                    Bin->BinSize);
+
+      if (Bin->BinSize > REG_BLOCK_SIZE)
+       {
+         for (j = 1; j < Bin->BinSize / REG_BLOCK_SIZE; j++)
+           {
+             Hive->BlockList[BlockIndex + j].Bin = Hive->BlockList[BlockIndex].Bin;
+             Hive->BlockList[BlockIndex + j].Block =
+               (PVOID)((ULONG_PTR)Hive->BlockList[BlockIndex].Bin + (j * REG_BLOCK_SIZE));
+           }
+       }
+
+      BlockIndex += Bin->BinSize / REG_BLOCK_SIZE;
+      BlockOffset += Bin->BinSize;
+    }
+
+  return STATUS_SUCCESS;
+}
+
+
+VOID
+CmiFreeHiveBins (PREGISTRY_HIVE Hive)
+{
+  ULONG i;
+  PHBIN Bin;
+
+  Bin = NULL;
+  for (i = 0; i < Hive->BlockListSize; i++)
+    {
+      if (Hive->BlockList[i].Bin == NULL)
+       continue;
+
+      if (Hive->BlockList[i].Bin != Bin)
+       {
+         Bin = Hive->BlockList[i].Bin;
+         ExFreePool (Hive->BlockList[i].Bin);
+       }
+      Hive->BlockList[i].Bin = NULL;
+      Hive->BlockList[i].Block = NULL;
+    }
+}
+
+
+NTSTATUS
+CmiCreateHiveFreeCellList(PREGISTRY_HIVE Hive)
+{
+  BLOCK_OFFSET BlockOffset;
+  PCELL_HEADER FreeBlock;
+  ULONG BlockIndex;
+  ULONG FreeOffset;
+  PHBIN Bin;
+  NTSTATUS Status;
+
+  /* Initialize the free cell list */
+  Hive->FreeListSize = 0;
+  Hive->FreeListMax = 0;
+  Hive->FreeList = NULL;
+  Hive->FreeListOffset = NULL;
+
+  BlockOffset = 0;
+  BlockIndex = 0;
+  while (BlockIndex < Hive->BlockListSize)
+    {
+      Bin = Hive->BlockList[BlockIndex].Bin;
+
+      /* Search free blocks and add to list */
+      FreeOffset = REG_HBIN_DATA_OFFSET;
+      while (FreeOffset < Bin->BinSize)
+       {
+         FreeBlock = (PCELL_HEADER) ((ULONG_PTR) Bin + FreeOffset);
+         if (FreeBlock->CellSize > 0)
+           {
+             Status = CmiAddFree(Hive,
+                                 FreeBlock,
+                                 Bin->BinOffset + FreeOffset,
+                                 FALSE);
+
+             if (!NT_SUCCESS(Status))
+               {
+                 return Status;
+               }
+
+             FreeOffset += FreeBlock->CellSize;
+           }
+         else
+           {
+             FreeOffset -= FreeBlock->CellSize;
+           }
+       }
+
+      BlockIndex += Bin->BinSize / REG_BLOCK_SIZE;
+      BlockOffset += Bin->BinSize;
+    }
+
+  return STATUS_SUCCESS;
+}
+
+
+VOID
+CmiFreeHiveFreeCellList(PREGISTRY_HIVE Hive)
+{
+  ExFreePool (Hive->FreeList);
+  ExFreePool (Hive->FreeListOffset);
+
+  Hive->FreeListSize = 0;
+  Hive->FreeListMax = 0;
+  Hive->FreeList = NULL;
+  Hive->FreeListOffset = NULL;
+}
+
+
+NTSTATUS
+CmiCreateHiveBitmap(PREGISTRY_HIVE Hive)
+{
+  ULONG BitmapSize;
+
+  /* Calculate bitmap size in bytes (always a multiple of 32 bits) */
+  BitmapSize = ROUND_UP(Hive->BlockListSize, sizeof(ULONG) * 8) / 8;
+  DPRINT("Hive->BlockListSize: %lu\n", Hive->BlockListSize);
+  DPRINT("BitmapSize:  %lu Bytes  %lu Bits\n", BitmapSize, BitmapSize * 8);
+
+  /* Allocate bitmap */
+  Hive->BitmapBuffer = (PULONG)ExAllocatePool(PagedPool,
+                                             BitmapSize);
+  if (Hive->BitmapBuffer == NULL)
+    {
+      return STATUS_INSUFFICIENT_RESOURCES;
+    }
+
+  RtlInitializeBitMap(&Hive->DirtyBitMap,
+                     Hive->BitmapBuffer,
+                     BitmapSize * 8);
+
+  /* Initialize bitmap */
+  RtlClearAllBits(&Hive->DirtyBitMap);
+  Hive->HiveDirty = FALSE;
+
+  return STATUS_SUCCESS;
+}
+
+
 static NTSTATUS
-CmiInitNonVolatileRegistryHive(PREGISTRY_HIVE RegistryHive,
-                              PWSTR Filename,
-                              BOOLEAN CreateNew)
+CmiInitNonVolatileRegistryHive (PREGISTRY_HIVE RegistryHive,
+                               PWSTR Filename)
 {
   OBJECT_ATTRIBUTES ObjectAttributes;
-  FILE_STANDARD_INFORMATION fsi;
-  PCELL_HEADER FreeBlock;
-  LARGE_INTEGER FileOffset;
-  BLOCK_OFFSET BlockOffset;
   ULONG CreateDisposition;
   IO_STATUS_BLOCK IoSB;
   HANDLE FileHandle;
-  ULONG FreeOffset;
+  PSECTION_OBJECT SectionObject;
+  PUCHAR ViewBase;
+  ULONG ViewSize;
   NTSTATUS Status;
-  PHBIN tmpBin;
-  ULONG i, j;
-  ULONG BitmapSize;
-  PULONG BitmapBuffer;
 
-  DPRINT1("CmiInitNonVolatileRegistryHive(%p, %S, %d) - Entered.\n", RegistryHive, Filename, CreateNew);
+  DPRINT("CmiInitNonVolatileRegistryHive(%p, %S) called\n",
+        RegistryHive, Filename);
 
   /* Duplicate Filename */
   Status = RtlCreateUnicodeString(&RegistryHive->HiveFileName,
-                                 Filename);
+                                  Filename);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("RtlCreateUnicodeString() failed (Status %lx)\n", Status);
+      DPRINT("RtlpCreateUnicodeString() failed (Status %lx)\n", Status);
       return(Status);
     }
 
   /* Create log file name */
   RegistryHive->LogFileName.Length = (wcslen(Filename) + 4) * sizeof(WCHAR);
   RegistryHive->LogFileName.MaximumLength = RegistryHive->LogFileName.Length + sizeof(WCHAR);
-  RegistryHive->LogFileName.Buffer = ExAllocatePool(NonPagedPool,
-                                                   RegistryHive->LogFileName.MaximumLength);
+  RegistryHive->LogFileName.Buffer = ExAllocatePoolWithTag(PagedPool,
+                                                          RegistryHive->LogFileName.MaximumLength,
+                                                           TAG('U', 'S', 'T', 'R'));
   if (RegistryHive->LogFileName.Buffer == NULL)
     {
       RtlFreeUnicodeString(&RegistryHive->HiveFileName);
@@ -809,26 +897,12 @@ CmiInitNonVolatileRegistryHive(PREGISTRY_HIVE RegistryHive,
 
   InitializeObjectAttributes(&ObjectAttributes,
                             &RegistryHive->HiveFileName,
-                            0,
+                            OBJ_CASE_INSENSITIVE,
                             NULL,
                             NULL);
 
-  /*
-   * Note:
-   * This is a workaround to prevent a BSOD because of missing registry hives.
-   * The workaround is only useful for developers. An implementation for the
-   * ordinary user must bail out on missing registry hives because they are
-   * essential to booting and configuring the OS.
-   */
-#if 0
-  if (CreateNew == TRUE)
-    CreateDisposition = FILE_OPEN_IF;
-  else
-    CreateDisposition = FILE_OPEN;
-#endif
   CreateDisposition = FILE_OPEN_IF;
-
-  Status = NtCreateFile(&FileHandle,
+  Status = ZwCreateFile(&FileHandle,
                        FILE_ALL_ACCESS,
                        &ObjectAttributes,
                        &IoSB,
@@ -843,325 +917,426 @@ CmiInitNonVolatileRegistryHive(PREGISTRY_HIVE RegistryHive,
     {
       RtlFreeUnicodeString(&RegistryHive->HiveFileName);
       RtlFreeUnicodeString(&RegistryHive->LogFileName);
-      DPRINT("NtCreateFile() failed (Status %lx)\n", Status);
+      DPRINT("ZwCreateFile() failed (Status %lx)\n", Status);
       return(Status);
     }
 
-  /* Note: Another workaround! See the note above! */
-#if 0
-  if ((CreateNew) && (IoSB.Information == FILE_CREATED))
-#endif
   if (IoSB.Information != FILE_OPENED)
     {
       Status = CmiCreateNewRegFile(FileHandle);
       if (!NT_SUCCESS(Status))
        {
          DPRINT("CmiCreateNewRegFile() failed (Status %lx)\n", Status);
-         NtClose(FileHandle);
+         ZwClose(FileHandle);
          RtlFreeUnicodeString(&RegistryHive->HiveFileName);
          RtlFreeUnicodeString(&RegistryHive->LogFileName);
          return(Status);
        }
     }
 
-  /* Read hive header */
-  FileOffset.u.HighPart = 0;
-  FileOffset.u.LowPart = 0;
-  DPRINT("    Attempting to ZwReadFile(%d) for %d bytes into %p\n", FileHandle, sizeof(HIVE_HEADER), RegistryHive->HiveHeader);
-  Status = NtReadFile(FileHandle,
-                     0,
-                     0,
-                     0,
-                     &IoSB,
-                     RegistryHive->HiveHeader,
-                     sizeof(HIVE_HEADER),
-                     &FileOffset,
-                     0);
-  assertmsg(NT_SUCCESS(Status), ("Status: 0x%X\n", Status));
+  /* Create the hive section */
+  Status = MmCreateSection(&SectionObject,
+                          SECTION_ALL_ACCESS,
+                          NULL,
+                          NULL,
+                          PAGE_READWRITE,
+                          SEC_COMMIT,
+                          FileHandle,
+                          NULL);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtReadFile() failed (Status %lx)\n", Status);
-      NtClose(FileHandle);
+      DPRINT1("MmCreateSection() failed (Status %lx)\n", Status);
       RtlFreeUnicodeString(&RegistryHive->HiveFileName);
       RtlFreeUnicodeString(&RegistryHive->LogFileName);
-      return Status;
+      return(Status);
     }
 
-  /* Read update counter */
-  RegistryHive->UpdateCounter = RegistryHive->HiveHeader->UpdateCounter1;
-
-  Status = NtQueryInformationFile(FileHandle,
-                                 &IoSB,
-                                 &fsi,
-                                 sizeof(fsi),
-                                 FileStandardInformation);
-  assertmsg(NT_SUCCESS(Status), ("Status: 0x%X\n", Status));
+  /* Map the hive file */
+  ViewBase = NULL;
+  ViewSize = 0;
+  Status = MmMapViewOfSection(SectionObject,
+                             PsGetCurrentProcess(),
+                             (PVOID*)&ViewBase,
+                             0,
+                             ViewSize,
+                             NULL,
+                             &ViewSize,
+                             0,
+                             MEM_COMMIT,
+                             PAGE_READWRITE);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtQueryInformationFile() failed (Status %lx)\n", Status);
-      NtClose(FileHandle);
+      DPRINT1("MmMapViewOfSection() failed (Status %lx)\n", Status);
+      ObDereferenceObject(SectionObject);
       RtlFreeUnicodeString(&RegistryHive->HiveFileName);
       RtlFreeUnicodeString(&RegistryHive->LogFileName);
-      return Status;
+      ZwClose(FileHandle);
+      return(Status);
     }
+  DPRINT("ViewBase %p  ViewSize %lx\n", ViewBase, ViewSize);
+
+  /* Copy hive header and initalize hive */
+  RtlCopyMemory (RegistryHive->HiveHeader,
+                ViewBase,
+                sizeof(HIVE_HEADER));
+  RegistryHive->FileSize = ViewSize;
+  RegistryHive->BlockListSize = (RegistryHive->FileSize / REG_BLOCK_SIZE) - 1;
+  RegistryHive->UpdateCounter = RegistryHive->HiveHeader->UpdateCounter1;
 
-  RegistryHive->FileSize = fsi.EndOfFile.u.LowPart;
-#ifdef WIN32_REGDBG
-//  assert(RegistryHive->FileSize);
-  if (RegistryHive->FileSize == 0)
+  /* Allocate hive block list */
+  RegistryHive->BlockList = ExAllocatePool(NonPagedPool,
+                                          RegistryHive->BlockListSize * sizeof(BLOCK_LIST_ENTRY));
+  if (RegistryHive->BlockList == NULL)
     {
-      DPRINT("CmiInitPermanentRegistryHive() - Failed, zero length hive file.\n");
-      NtClose(FileHandle);
+      DPRINT1("Failed to allocate the hive block list\n");
+      MmUnmapViewOfSection(PsGetCurrentProcess(),
+                          ViewBase);
+      ObDereferenceObject(SectionObject);
       RtlFreeUnicodeString(&RegistryHive->HiveFileName);
       RtlFreeUnicodeString(&RegistryHive->LogFileName);
+      ZwClose(FileHandle);
       return STATUS_INSUFFICIENT_RESOURCES;
     }
-#endif
-  RegistryHive->BlockListSize = (RegistryHive->FileSize / 4096) - 1;
+  RtlZeroMemory (RegistryHive->BlockList,
+                RegistryHive->BlockListSize * sizeof(BLOCK_LIST_ENTRY));
 
-  DPRINT("Space needed for block list describing hive: 0x%x\n",
-    sizeof(PHBIN *) * RegistryHive->BlockListSize);
+  /* Import the hive bins */
+  Status = CmiImportHiveBins (RegistryHive,
+                             ViewBase + REG_BLOCK_SIZE);
+  if (!NT_SUCCESS(Status))
+    {
+      ExFreePool(RegistryHive->BlockList);
+      MmUnmapViewOfSection(PsGetCurrentProcess(),
+                          ViewBase);
+      ObDereferenceObject(SectionObject);
+      RtlFreeUnicodeString(&RegistryHive->HiveFileName);
+      RtlFreeUnicodeString(&RegistryHive->LogFileName);
+      ZwClose(FileHandle);
+      return Status;
+    }
 
-  RegistryHive->BlockList = ExAllocatePool(NonPagedPool,
-         sizeof(PHBIN *) * RegistryHive->BlockListSize);
+  /* Unmap and dereference the hive section */
+  MmUnmapViewOfSection(PsGetCurrentProcess(),
+                       ViewBase);
+  ObDereferenceObject(SectionObject);
 
-  if (RegistryHive->BlockList == NULL)
+  /* Close the hive file */
+  ZwClose(FileHandle);
+
+  /* Initialize the free cell list */
+  Status = CmiCreateHiveFreeCellList (RegistryHive);
+  if (!NT_SUCCESS(Status))
     {
+      CmiFreeHiveBins(RegistryHive);
       ExFreePool(RegistryHive->BlockList);
-      NtClose(FileHandle);
       RtlFreeUnicodeString(&RegistryHive->HiveFileName);
       RtlFreeUnicodeString(&RegistryHive->LogFileName);
-      DPRINT("CmiInitNonVolatileRegistryHive() - Failed 6.\n");
-      return STATUS_INSUFFICIENT_RESOURCES;
+      return Status;
     }
 
-  RegistryHive->BlockList[0] = ExAllocatePool(PagedPool,
-         RegistryHive->FileSize - 4096);
-#ifdef WIN32_REGDBG
-  RtlZeroMemory(RegistryHive->BlockList[0], RegistryHive->FileSize - 4096);
-#endif
-
-  if (RegistryHive->BlockList[0] == NULL)
+  /* Create the block bitmap */
+  Status = CmiCreateHiveBitmap (RegistryHive);
+  if (!NT_SUCCESS(Status))
     {
+      CmiFreeHiveFreeCellList(RegistryHive);
+      CmiFreeHiveBins(RegistryHive);
       ExFreePool(RegistryHive->BlockList);
-      NtClose(FileHandle);
       RtlFreeUnicodeString(&RegistryHive->HiveFileName);
       RtlFreeUnicodeString(&RegistryHive->LogFileName);
-      DPRINT("CmiInitNonVolatileRegistryHive() - Failed 8.\n");
-      return STATUS_INSUFFICIENT_RESOURCES;
+      return Status;
     }
 
-  FileOffset.u.HighPart = 0;
-  FileOffset.u.LowPart = 4096;
+  DPRINT("CmiInitNonVolatileRegistryHive(%p, %S) - Finished.\n",
+        RegistryHive, Filename);
 
-  DPRINT("    Attempting to NtReadFile(%d) for %d bytes into %p\n",
-        FileHandle, RegistryHive->FileSize - 4096, (PVOID)RegistryHive->BlockList[0]);
-  Status = NtReadFile(FileHandle,
-                     0,
-                     0,
-                     0,
-                     &IoSB,
-                     (PVOID) RegistryHive->BlockList[0],
-                     RegistryHive->FileSize - 4096,
-                     &FileOffset,
-                     0);
+  return STATUS_SUCCESS;
+}
 
-  assertmsg(NT_SUCCESS(Status), ("Status: 0x%X\n", Status));
 
-  NtClose(FileHandle);
+NTSTATUS
+CmiCreateVolatileHive(PREGISTRY_HIVE *RegistryHive)
+{
+  PKEY_CELL RootKeyCell;
+  PREGISTRY_HIVE Hive;
 
-  RegistryHive->FreeListSize = 0;
-  RegistryHive->FreeListMax = 0;
-  RegistryHive->FreeList = NULL;
+  *RegistryHive = NULL;
 
-  BlockOffset = 0;
-  for (i = 0; i < RegistryHive->BlockListSize; i++)
-    {
-      RegistryHive->BlockList[i] = (PHBIN) (((ULONG_PTR) RegistryHive->BlockList[0]) + BlockOffset);
-      tmpBin = (PHBIN) (((ULONG_PTR) RegistryHive->BlockList[i]));
-      if (tmpBin->BlockId != REG_BIN_ID)
-       {
-         DPRINT("Bad BlockId %x, offset %x\n", tmpBin->BlockId, BlockOffset);
-         //KeBugCheck(0);
-         return STATUS_INSUFFICIENT_RESOURCES;
-       }
+  Hive = ExAllocatePool (NonPagedPool,
+                        sizeof(REGISTRY_HIVE));
+  if (Hive == NULL)
+    return STATUS_INSUFFICIENT_RESOURCES;
 
-      assertmsg((tmpBin->BlockSize % 4096) == 0, ("BlockSize (0x%.08x) must be multiplum of 4K\n", tmpBin->BlockSize));
+  RtlZeroMemory (Hive,
+                sizeof(REGISTRY_HIVE));
 
-      if (tmpBin->BlockSize > 4096)
-       {
-         for (j = 1; j < tmpBin->BlockSize / 4096; j++)
-           {
-             RegistryHive->BlockList[i + j] = RegistryHive->BlockList[i];
-           }
-         i = i + j - 1;
-       }
+  DPRINT("Hive 0x%p\n", Hive);
 
-      /* Search free blocks and add to list */
-      FreeOffset = REG_HBIN_DATA_OFFSET;
-      while (FreeOffset < tmpBin->BlockSize)
-       {
-         FreeBlock = (PCELL_HEADER) ((ULONG_PTR) RegistryHive->BlockList[i] + FreeOffset);
-         if (FreeBlock->CellSize > 0)
-           {
-             Status = CmiAddFree(RegistryHive,
-                                 FreeBlock,
-                                 RegistryHive->BlockList[i]->BlockOffset + FreeOffset,
-                                 FALSE);
+  Hive->HiveHeader = (PHIVE_HEADER)ExAllocatePool (NonPagedPool,
+                                                  sizeof(HIVE_HEADER));
+  if (Hive->HiveHeader == NULL)
+    {
+      ExFreePool (Hive);
+      return STATUS_INSUFFICIENT_RESOURCES;
+    }
+  RtlZeroMemory (Hive->HiveHeader,
+                sizeof(HIVE_HEADER));
 
-             if (!NT_SUCCESS(Status))
-               {
-                 /* FIXME: */
-                 assert(FALSE);
-               }
+  Hive->Flags = (HIVE_NO_FILE | HIVE_POINTER);
 
-             FreeOffset += FreeBlock->CellSize;
-           }
-         else
-           {
-             FreeOffset -= FreeBlock->CellSize;
-           }
-       }
-      BlockOffset += tmpBin->BlockSize;
-    }
+  CmiCreateDefaultHiveHeader (Hive->HiveHeader);
 
-  /*
-   * Create block bitmap and clear all bits
-   */
-  /* Calculate bitmap size in bytes (always a multiple of 32 bits) */
-  BitmapSize = ROUND_UP(RegistryHive->BlockListSize, sizeof(ULONG) * 8) / 8;
-  DPRINT("RegistryHive->BlockListSize: %lu\n", RegistryHive->BlockListSize);
-  DPRINT("BitmapSize:  %lu Bytes  %lu Bits\n", BitmapSize, BitmapSize * 8);
-
-  /* Allocate bitmap */
-  BitmapBuffer = (PULONG)ExAllocatePool(PagedPool,
-                                       BitmapSize);
-  RtlInitializeBitMap(&RegistryHive->DirtyBitMap,
-                     BitmapBuffer,
-                     BitmapSize * 8);
-
-  /* Initialize bitmap */
-  RtlClearAllBits(&RegistryHive->DirtyBitMap);
-  RegistryHive->HiveDirty = FALSE;
-
-  DPRINT("CmiInitNonVolatileRegistryHive(%p, %S, %d) - Finished.\n",
-        RegistryHive, Filename, CreateNew);
-
-  return(STATUS_SUCCESS);
-}
-
-
-static NTSTATUS
-CmiInitVolatileRegistryHive(PREGISTRY_HIVE RegistryHive)
-{
-  PKEY_CELL RootKeyCell;
+  RootKeyCell = (PKEY_CELL)ExAllocatePool (NonPagedPool,
+                                          sizeof(KEY_CELL));
+  if (RootKeyCell == NULL)
+    {
+      ExFreePool(Hive->HiveHeader);
+      ExFreePool(Hive);
+      return STATUS_INSUFFICIENT_RESOURCES;
+    }
 
-  RegistryHive->Flags |= HIVE_VOLATILE;
+  CmiCreateDefaultRootKeyCell (RootKeyCell);
+  Hive->HiveHeader->RootKeyOffset = (BLOCK_OFFSET)RootKeyCell;
 
-  CmiCreateDefaultHiveHeader(RegistryHive->HiveHeader);
+  /* Acquire hive list lock exclusively */
+  KeEnterCriticalRegion();
+  ExAcquireResourceExclusiveLite (&CmiRegistryLock, TRUE);
 
-  RootKeyCell = (PKEY_CELL) ExAllocatePool(NonPagedPool, sizeof(KEY_CELL));
+  /* Add the new hive to the hive list */
+  InsertTailList (&CmiHiveListHead,
+                 &Hive->HiveList);
 
-  if (RootKeyCell == NULL)
-    return STATUS_INSUFFICIENT_RESOURCES;
+  /* Release hive list lock */
+  ExReleaseResourceLite (&CmiRegistryLock);
+  KeLeaveCriticalRegion();
 
-  CmiCreateDefaultRootKeyCell(RootKeyCell);
+  VERIFY_REGISTRY_HIVE (Hive);
 
-  RegistryHive->HiveHeader->RootKeyCell = (BLOCK_OFFSET) RootKeyCell;
+  *RegistryHive = Hive;
 
   return STATUS_SUCCESS;
 }
 
 
 NTSTATUS
-CmiCreateRegistryHive(PWSTR Filename,
-                     PREGISTRY_HIVE *RegistryHive,
-                     BOOLEAN CreateNew)
+CmiCreateTempHive(PREGISTRY_HIVE *RegistryHive)
 {
+  PHBIN BinHeader;
+  PCELL_HEADER FreeCell;
   PREGISTRY_HIVE Hive;
   NTSTATUS Status;
 
-  DPRINT("CmiCreateRegistryHive(Filename %S)\n", Filename);
+  DPRINT ("CmiCreateTempHive() called\n");
 
   *RegistryHive = NULL;
 
-  Hive = ExAllocatePool(NonPagedPool, sizeof(REGISTRY_HIVE));
+  Hive = ExAllocatePool (NonPagedPool,
+                        sizeof(REGISTRY_HIVE));
   if (Hive == NULL)
-    return(STATUS_INSUFFICIENT_RESOURCES);
-
-  DPRINT("Hive %x\n", Hive);
-
-  RtlZeroMemory(Hive, sizeof(REGISTRY_HIVE));
+    {
+      DPRINT1 ("Failed to allocate registry hive block\n");
+      return STATUS_INSUFFICIENT_RESOURCES;
+    }
+  RtlZeroMemory (Hive,
+                sizeof(REGISTRY_HIVE));
 
-  Hive->HiveHeader = (PHIVE_HEADER)
-    ExAllocatePool(NonPagedPool, sizeof(HIVE_HEADER));
+  DPRINT ("Hive 0x%p\n", Hive);
 
+  Hive->HiveHeader = (PHIVE_HEADER)ExAllocatePool (NonPagedPool,
+                                                  REG_BLOCK_SIZE);
   if (Hive->HiveHeader == NULL)
     {
-      ExFreePool(Hive);
-      return(STATUS_INSUFFICIENT_RESOURCES);
+      DPRINT1 ("Failed to allocate hive header block\n");
+      ExFreePool (Hive);
+      return STATUS_INSUFFICIENT_RESOURCES;
     }
+  RtlZeroMemory (Hive->HiveHeader,
+                REG_BLOCK_SIZE);
 
-  if (Filename != NULL)
+  DPRINT ("HiveHeader 0x%p\n", Hive->HiveHeader);
+
+  Hive->Flags = HIVE_NO_FILE;
+
+  RtlInitUnicodeString (&Hive->HiveFileName,
+                       NULL);
+  RtlInitUnicodeString (&Hive->LogFileName,
+                       NULL);
+
+  CmiCreateDefaultHiveHeader (Hive->HiveHeader);
+
+  /* Allocate hive block list */
+  Hive->BlockList = ExAllocatePool (NonPagedPool,
+                                   sizeof(PBLOCK_LIST_ENTRY));
+  if (Hive->BlockList == NULL)
     {
-      Status = CmiInitNonVolatileRegistryHive(Hive, Filename, CreateNew);
+      DPRINT1 ("Failed to allocate hive block list\n");
+      ExFreePool(Hive->HiveHeader);
+      ExFreePool(Hive);
+      return STATUS_INSUFFICIENT_RESOURCES;
     }
-  else
+
+  /* Allocate first Bin */
+  Hive->BlockList[0].Bin = ExAllocatePool (NonPagedPool,
+                                          REG_BLOCK_SIZE);
+  if (Hive->BlockList[0].Bin == NULL)
     {
-      Status = CmiInitVolatileRegistryHive(Hive);
+      DPRINT1 ("Failed to allocate first bin\n");
+      ExFreePool(Hive->BlockList);
+      ExFreePool(Hive->HiveHeader);
+      ExFreePool(Hive);
+      return STATUS_INSUFFICIENT_RESOURCES;
     }
+  Hive->BlockList[0].Block = (PVOID)Hive->BlockList[0].Bin;
 
-  if (!NT_SUCCESS(Status))
+  Hive->FileSize = 2* REG_BLOCK_SIZE;
+  Hive->BlockListSize = 1;
+  Hive->UpdateCounter = Hive->HiveHeader->UpdateCounter1;
+
+
+  BinHeader = Hive->BlockList[0].Bin;
+  FreeCell = (PCELL_HEADER)((ULONG_PTR)BinHeader + REG_HBIN_DATA_OFFSET);
+
+  CmiCreateDefaultBinHeader (BinHeader);
+
+  /* First block */
+  BinHeader->BinOffset = 0;
+
+  /* Offset to root key block */
+  Hive->HiveHeader->RootKeyOffset = (BLOCK_OFFSET)-1;
+
+  /* The rest of the block is free */
+  FreeCell->CellSize = REG_BLOCK_SIZE - REG_HBIN_DATA_OFFSET;
+
+  /* Create the free cell list */
+  Status = CmiCreateHiveFreeCellList (Hive);
+  if (Hive->BlockList[0].Bin == NULL)
     {
+      DPRINT1 ("CmiCreateHiveFreeCellList() failed (Status %lx)\n", Status);
+      ExFreePool(Hive->BlockList[0].Bin);
+      ExFreePool(Hive->BlockList);
       ExFreePool(Hive->HiveHeader);
       ExFreePool(Hive);
-      return(Status);
+      return Status;
     }
 
-  ExInitializeResourceLite(&Hive->HiveResource);
-
   /* Acquire hive list lock exclusively */
-  ExAcquireResourceExclusiveLite(&CmiHiveListLock, TRUE);
+  KeEnterCriticalRegion();
+  ExAcquireResourceExclusiveLite(&CmiRegistryLock, TRUE);
 
   /* Add the new hive to the hive list */
-  InsertTailList(&CmiHiveListHead, &Hive->HiveList);
+  InsertTailList (&CmiHiveListHead,
+                 &Hive->HiveList);
 
   /* Release hive list lock */
-  ExReleaseResourceLite(&CmiHiveListLock);
+  ExReleaseResourceLite(&CmiRegistryLock);
+  KeLeaveCriticalRegion();
 
-  VERIFY_REGISTRY_HIVE(Hive);
+  VERIFY_REGISTRY_HIVE (Hive);
 
   *RegistryHive = Hive;
 
-  DPRINT("CmiCreateRegistryHive(Filename %S) - Finished.\n", Filename);
+  return STATUS_SUCCESS;
+}
 
-  return(STATUS_SUCCESS);
+
+NTSTATUS
+CmiLoadHive(IN POBJECT_ATTRIBUTES KeyObjectAttributes,
+           IN PUNICODE_STRING FileName,
+           IN ULONG Flags)
+{
+  PREGISTRY_HIVE Hive;
+  NTSTATUS Status;
+
+  DPRINT ("CmiLoadHive(Filename %wZ)\n", FileName);
+
+  if (Flags & ~REG_NO_LAZY_FLUSH)
+    return STATUS_INVALID_PARAMETER;
+
+  Hive = ExAllocatePool (NonPagedPool,
+                        sizeof(REGISTRY_HIVE));
+  if (Hive == NULL)
+    {
+      DPRINT1 ("Failed to allocate hive header.\n");
+      return STATUS_INSUFFICIENT_RESOURCES;
+    }
+  RtlZeroMemory (Hive,
+                sizeof(REGISTRY_HIVE));
+
+  DPRINT ("Hive 0x%p\n", Hive);
+  Hive->Flags = (Flags & REG_NO_LAZY_FLUSH) ? HIVE_NO_SYNCH : 0;
+
+  Hive->HiveHeader = (PHIVE_HEADER)ExAllocatePool(NonPagedPool,
+                                                 sizeof(HIVE_HEADER));
+  if (Hive->HiveHeader == NULL)
+    {
+      DPRINT1 ("Failed to allocate hive header.\n");
+      ExFreePool (Hive);
+      return STATUS_INSUFFICIENT_RESOURCES;
+    }
+
+  RtlZeroMemory (Hive->HiveHeader,
+                sizeof(HIVE_HEADER));
+
+  Status = CmiInitNonVolatileRegistryHive (Hive,
+                                          FileName->Buffer);
+  if (!NT_SUCCESS (Status))
+    {
+      DPRINT1 ("CmiInitNonVolatileRegistryHive() failed (Status %lx)\n", Status);
+      ExFreePool (Hive->HiveHeader);
+      ExFreePool (Hive);
+      return Status;
+    }
+
+  /* Add the new hive to the hive list */
+  InsertTailList (&CmiHiveListHead,
+                 &Hive->HiveList);
+
+  VERIFY_REGISTRY_HIVE(Hive);
+
+  Status = CmiConnectHive (KeyObjectAttributes,
+                          Hive);
+  if (!NT_SUCCESS(Status))
+    {
+      DPRINT1 ("CmiConnectHive() failed (Status %lx)\n", Status);
+//      CmiRemoveRegistryHive (Hive);
+    }
+
+  DPRINT ("CmiLoadHive() done\n");
+
+  return Status;
 }
 
 
 NTSTATUS
 CmiRemoveRegistryHive(PREGISTRY_HIVE RegistryHive)
 {
-  /* Acquire hive list lock exclusively */
-  ExAcquireResourceExclusiveLite(&CmiHiveListLock, TRUE);
+  if (RegistryHive->Flags & HIVE_POINTER)
+    return STATUS_UNSUCCESSFUL;
 
   /* Remove hive from hive list */
-  RemoveEntryList(&RegistryHive->HiveList);
+  RemoveEntryList (&RegistryHive->HiveList);
 
-  /* Release hive list lock */
-  ExReleaseResourceLite(&CmiHiveListLock);
+  /* Release file names */
+  RtlFreeUnicodeString (&RegistryHive->HiveFileName);
+  RtlFreeUnicodeString (&RegistryHive->LogFileName);
 
+  /* Release hive bitmap */
+  ExFreePool (RegistryHive->BitmapBuffer);
 
-  /* FIXME: Remove attached keys and values */
+  /* Release free cell list */
+  ExFreePool (RegistryHive->FreeList);
+  ExFreePool (RegistryHive->FreeListOffset);
 
+  /* Release bins and bin list */
+  CmiFreeHiveBins (RegistryHive);
+  ExFreePool (RegistryHive->BlockList);
 
   /* Release hive header */
-  ExFreePool(RegistryHive->HiveHeader);
+  ExFreePool (RegistryHive->HiveHeader);
 
   /* Release hive */
-  ExFreePool(RegistryHive);
+  ExFreePool (RegistryHive);
 
-  return(STATUS_SUCCESS);
+  return STATUS_SUCCESS;
 }
 
 
@@ -1192,7 +1367,7 @@ CmiStartLogUpdate(PREGISTRY_HIVE RegistryHive)
   PUCHAR Buffer;
   PUCHAR Ptr;
   ULONG BlockIndex;
-  ULONG BlockOffset;
+  ULONG LastIndex;
   PVOID BlockPtr;
   NTSTATUS Status;
 
@@ -1202,25 +1377,28 @@ CmiStartLogUpdate(PREGISTRY_HIVE RegistryHive)
   BufferSize = sizeof(HIVE_HEADER) +
               sizeof(ULONG) +
               BitmapSize;
-  BufferSize = ROUND_UP(BufferSize, 4096);
+  BufferSize = ROUND_UP(BufferSize, REG_BLOCK_SIZE);
 
   DPRINT("Bitmap size %lu  buffer size: %lu\n", BitmapSize, BufferSize);
 
-  Buffer = (PUCHAR)ExAllocatePool(NonPagedPool, BufferSize);
+  Buffer = (PUCHAR)ExAllocatePool(NonPagedPool,
+                                 BufferSize);
   if (Buffer == NULL)
     {
       DPRINT("ExAllocatePool() failed\n");
       return(STATUS_INSUFFICIENT_RESOURCES);
     }
+  RtlZeroMemory (Buffer,
+                BufferSize);
 
   /* Open log file for writing */
   InitializeObjectAttributes(&ObjectAttributes,
                             &RegistryHive->LogFileName,
-                            0,
+                            OBJ_CASE_INSENSITIVE,
                             NULL,
                             NULL);
 
-  Status = NtCreateFile(&FileHandle,
+  Status = ZwCreateFile(&FileHandle,
                        FILE_ALL_ACCESS,
                        &ObjectAttributes,
                        &IoStatusBlock,
@@ -1233,7 +1411,7 @@ CmiStartLogUpdate(PREGISTRY_HIVE RegistryHive)
                        0);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtCreateFile() failed (Status %lx)\n", Status);
+      DPRINT("ZwCreateFile() failed (Status %lx)\n", Status);
       ExFreePool(Buffer);
       return(Status);
     }
@@ -1257,8 +1435,8 @@ CmiStartLogUpdate(PREGISTRY_HIVE RegistryHive)
                BitmapSize);
 
   /* Write hive block and block bitmap */
-  FileOffset.QuadPart = 0ULL;
-  Status = NtWriteFile(FileHandle,
+  FileOffset.QuadPart = (ULONGLONG)0;
+  Status = ZwWriteFile(FileHandle,
                       NULL,
                       NULL,
                       NULL,
@@ -1269,8 +1447,8 @@ CmiStartLogUpdate(PREGISTRY_HIVE RegistryHive)
                       NULL);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtWriteFile() failed (Status %lx)\n", Status);
-      NtClose(FileHandle);
+      DPRINT("ZwWriteFile() failed (Status %lx)\n", Status);
+      ZwClose(FileHandle);
       ExFreePool(Buffer);
       return(Status);
     }
@@ -1279,12 +1457,13 @@ CmiStartLogUpdate(PREGISTRY_HIVE RegistryHive)
   /* Write dirty blocks */
   FileOffset.QuadPart = (ULONGLONG)BufferSize;
   BlockIndex = 0;
-  while (TRUE)
+  while (BlockIndex < RegistryHive->BlockListSize)
     {
+      LastIndex = BlockIndex;
       BlockIndex = RtlFindSetBits(&RegistryHive->DirtyBitMap,
                                  1,
                                  BlockIndex);
-      if (BlockIndex == (ULONG)-1)
+      if (BlockIndex == (ULONG)-1 || BlockIndex < LastIndex)
        {
          DPRINT("No more set bits\n");
          Status = STATUS_SUCCESS;
@@ -1293,16 +1472,12 @@ CmiStartLogUpdate(PREGISTRY_HIVE RegistryHive)
 
       DPRINT("Block %lu is dirty\n", BlockIndex);
 
-      BlockOffset = RegistryHive->BlockList[BlockIndex]->BlockOffset;
-      DPRINT("Block offset %lx\n", BlockOffset);
-
-      BlockPtr = RegistryHive->BlockList[BlockIndex] + ((BlockIndex * 4096) - BlockOffset);
+      BlockPtr = RegistryHive->BlockList[BlockIndex].Block;
       DPRINT("BlockPtr %p\n", BlockPtr);
-
       DPRINT("File offset %I64x\n", FileOffset.QuadPart);
 
       /* Write hive block */
-      Status = NtWriteFile(FileHandle,
+      Status = ZwWriteFile(FileHandle,
                           NULL,
                           NULL,
                           NULL,
@@ -1313,51 +1488,51 @@ CmiStartLogUpdate(PREGISTRY_HIVE RegistryHive)
                           NULL);
       if (!NT_SUCCESS(Status))
        {
-         DPRINT("NtWriteFile() failed (Status %lx)\n", Status);
-         NtClose(FileHandle);
+         DPRINT1("ZwWriteFile() failed (Status %lx)\n", Status);
+         ZwClose(FileHandle);
          return(Status);
        }
 
       BlockIndex++;
-      FileOffset.QuadPart += 4096ULL;
+      FileOffset.QuadPart += (ULONGLONG)REG_BLOCK_SIZE;
     }
 
   /* Truncate log file */
   EndOfFileInfo.EndOfFile.QuadPart = FileOffset.QuadPart;
-  Status = NtSetInformationFile(FileHandle,
+  Status = ZwSetInformationFile(FileHandle,
                                &IoStatusBlock,
                                &EndOfFileInfo,
                                sizeof(FILE_END_OF_FILE_INFORMATION),
                                FileEndOfFileInformation);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtSetInformationFile() failed (Status %lx)\n", Status);
-      NtClose(FileHandle);
+      DPRINT("ZwSetInformationFile() failed (Status %lx)\n", Status);
+      ZwClose(FileHandle);
       return(Status);
     }
 
   FileAllocationInfo.AllocationSize.QuadPart = FileOffset.QuadPart;
-  Status = NtSetInformationFile(FileHandle,
+  Status = ZwSetInformationFile(FileHandle,
                                &IoStatusBlock,
                                &FileAllocationInfo,
                                sizeof(FILE_ALLOCATION_INFORMATION),
                                FileAllocationInformation);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtSetInformationFile() failed (Status %lx)\n", Status);
-      NtClose(FileHandle);
+      DPRINT("ZwSetInformationFile() failed (Status %lx)\n", Status);
+      ZwClose(FileHandle);
       return(Status);
     }
 
   /* Flush the log file */
-  Status = NtFlushBuffersFile(FileHandle,
+  Status = ZwFlushBuffersFile(FileHandle,
                              &IoStatusBlock);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtFlushBuffersFile() failed (Status %lx)\n", Status);
+      DPRINT("ZwFlushBuffersFile() failed (Status %lx)\n", Status);
     }
 
-  NtClose(FileHandle);
+  ZwClose(FileHandle);
 
   return(Status);
 }
@@ -1382,7 +1557,7 @@ CmiFinishLogUpdate(PREGISTRY_HIVE RegistryHive)
   BufferSize = sizeof(HIVE_HEADER) +
               sizeof(ULONG) +
               BitmapSize;
-  BufferSize = ROUND_UP(BufferSize, 4096);
+  BufferSize = ROUND_UP(BufferSize, REG_BLOCK_SIZE);
 
   DPRINT("Bitmap size %lu  buffer size: %lu\n", BitmapSize, BufferSize);
 
@@ -1396,11 +1571,11 @@ CmiFinishLogUpdate(PREGISTRY_HIVE RegistryHive)
   /* Open log file for writing */
   InitializeObjectAttributes(&ObjectAttributes,
                             &RegistryHive->LogFileName,
-                            0,
+                            OBJ_CASE_INSENSITIVE,
                             NULL,
                             NULL);
 
-  Status = NtCreateFile(&FileHandle,
+  Status = ZwCreateFile(&FileHandle,
                        FILE_ALL_ACCESS,
                        &ObjectAttributes,
                        &IoStatusBlock,
@@ -1413,7 +1588,7 @@ CmiFinishLogUpdate(PREGISTRY_HIVE RegistryHive)
                        0);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtCreateFile() failed (Status %lx)\n", Status);
+      DPRINT("ZwCreateFile() failed (Status %lx)\n", Status);
       ExFreePool(Buffer);
       return(Status);
     }
@@ -1438,8 +1613,8 @@ CmiFinishLogUpdate(PREGISTRY_HIVE RegistryHive)
                BitmapSize);
 
   /* Write hive block and block bitmap */
-  FileOffset.QuadPart = 0ULL;
-  Status = NtWriteFile(FileHandle,
+  FileOffset.QuadPart = (ULONGLONG)0;
+  Status = ZwWriteFile(FileHandle,
                       NULL,
                       NULL,
                       NULL,
@@ -1450,8 +1625,8 @@ CmiFinishLogUpdate(PREGISTRY_HIVE RegistryHive)
                       NULL);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtWriteFile() failed (Status %lx)\n", Status);
-      NtClose(FileHandle);
+      DPRINT("ZwWriteFile() failed (Status %lx)\n", Status);
+      ZwClose(FileHandle);
       ExFreePool(Buffer);
       return(Status);
     }
@@ -1459,14 +1634,14 @@ CmiFinishLogUpdate(PREGISTRY_HIVE RegistryHive)
   ExFreePool(Buffer);
 
   /* Flush the log file */
-  Status = NtFlushBuffersFile(FileHandle,
+  Status = ZwFlushBuffersFile(FileHandle,
                              &IoStatusBlock);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtFlushBuffersFile() failed (Status %lx)\n", Status);
+      DPRINT("ZwFlushBuffersFile() failed (Status %lx)\n", Status);
     }
 
-  NtClose(FileHandle);
+  ZwClose(FileHandle);
 
   return(Status);
 }
@@ -1484,24 +1659,24 @@ CmiCleanupLogUpdate(PREGISTRY_HIVE RegistryHive)
   ULONG BitmapSize;
   NTSTATUS Status;
 
-  DPRINT("CmiFinishLogUpdate() called\n");
+  DPRINT("CmiCleanupLogUpdate() called\n");
 
   BitmapSize = ROUND_UP(RegistryHive->BlockListSize, sizeof(ULONG) * 8) / 8;
   BufferSize = sizeof(HIVE_HEADER) +
               sizeof(ULONG) +
               BitmapSize;
-  BufferSize = ROUND_UP(BufferSize, 4096);
+  BufferSize = ROUND_UP(BufferSize, REG_BLOCK_SIZE);
 
   DPRINT("Bitmap size %lu  buffer size: %lu\n", BitmapSize, BufferSize);
 
   /* Open log file for writing */
   InitializeObjectAttributes(&ObjectAttributes,
                             &RegistryHive->LogFileName,
-                            0,
+                            OBJ_CASE_INSENSITIVE,
                             NULL,
                             NULL);
 
-  Status = NtCreateFile(&FileHandle,
+  Status = ZwCreateFile(&FileHandle,
                        FILE_ALL_ACCESS,
                        &ObjectAttributes,
                        &IoStatusBlock,
@@ -1514,26 +1689,26 @@ CmiCleanupLogUpdate(PREGISTRY_HIVE RegistryHive)
                        0);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtCreateFile() failed (Status %lx)\n", Status);
+      DPRINT("ZwCreateFile() failed (Status %lx)\n", Status);
       return(Status);
     }
 
   /* Truncate log file */
   EndOfFileInfo.EndOfFile.QuadPart = (ULONGLONG)BufferSize;
-  Status = NtSetInformationFile(FileHandle,
+  Status = ZwSetInformationFile(FileHandle,
                                &IoStatusBlock,
                                &EndOfFileInfo,
                                sizeof(FILE_END_OF_FILE_INFORMATION),
                                FileEndOfFileInformation);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtSetInformationFile() failed (Status %lx)\n", Status);
-      NtClose(FileHandle);
+      DPRINT("ZwSetInformationFile() failed (Status %lx)\n", Status);
+      ZwClose(FileHandle);
       return(Status);
     }
 
   FileAllocationInfo.AllocationSize.QuadPart = (ULONGLONG)BufferSize;
-  Status = NtSetInformationFile(FileHandle,
+  Status = ZwSetInformationFile(FileHandle,
                                &IoStatusBlock,
                                &FileAllocationInfo,
                                sizeof(FILE_ALLOCATION_INFORMATION),
@@ -1541,19 +1716,19 @@ CmiCleanupLogUpdate(PREGISTRY_HIVE RegistryHive)
   if (!NT_SUCCESS(Status))
     {
       DPRINT("NtSetInformationFile() failed (Status %lx)\n", Status);
-      NtClose(FileHandle);
+      ZwClose(FileHandle);
       return(Status);
     }
 
   /* Flush the log file */
-  Status = NtFlushBuffersFile(FileHandle,
+  Status = ZwFlushBuffersFile(FileHandle,
                              &IoStatusBlock);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtFlushBuffersFile() failed (Status %lx)\n", Status);
+      DPRINT("ZwFlushBuffersFile() failed (Status %lx)\n", Status);
     }
 
-  NtClose(FileHandle);
+  ZwClose(FileHandle);
 
   return(Status);
 }
@@ -1567,7 +1742,7 @@ CmiStartHiveUpdate(PREGISTRY_HIVE RegistryHive)
   HANDLE FileHandle;
   LARGE_INTEGER FileOffset;
   ULONG BlockIndex;
-  ULONG BlockOffset;
+  ULONG LastIndex;
   PVOID BlockPtr;
   NTSTATUS Status;
 
@@ -1576,11 +1751,11 @@ CmiStartHiveUpdate(PREGISTRY_HIVE RegistryHive)
   /* Open hive for writing */
   InitializeObjectAttributes(&ObjectAttributes,
                             &RegistryHive->HiveFileName,
-                            0,
+                            OBJ_CASE_INSENSITIVE,
                             NULL,
                             NULL);
 
-  Status = NtCreateFile(&FileHandle,
+  Status = ZwCreateFile(&FileHandle,
                        FILE_ALL_ACCESS,
                        &ObjectAttributes,
                        &IoStatusBlock,
@@ -1593,7 +1768,7 @@ CmiStartHiveUpdate(PREGISTRY_HIVE RegistryHive)
                        0);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtCreateFile() failed (Status %lx)\n", Status);
+      DPRINT("ZwCreateFile() failed (Status %lx)\n", Status);
       return(Status);
     }
 
@@ -1602,8 +1777,8 @@ CmiStartHiveUpdate(PREGISTRY_HIVE RegistryHive)
   RegistryHive->HiveHeader->Checksum = CmiCalcChecksum((PULONG)RegistryHive->HiveHeader);
 
   /* Write hive block */
-  FileOffset.QuadPart = 0ULL;
-  Status = NtWriteFile(FileHandle,
+  FileOffset.QuadPart = (ULONGLONG)0;
+  Status = ZwWriteFile(FileHandle,
                       NULL,
                       NULL,
                       NULL,
@@ -1614,18 +1789,19 @@ CmiStartHiveUpdate(PREGISTRY_HIVE RegistryHive)
                       NULL);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtWriteFile() failed (Status %lx)\n", Status);
-      NtClose(FileHandle);
+      DPRINT("ZwWriteFile() failed (Status %lx)\n", Status);
+      ZwClose(FileHandle);
       return(Status);
     }
 
   BlockIndex = 0;
-  while (TRUE)
+  while (BlockIndex < RegistryHive->BlockListSize)
     {
+      LastIndex = BlockIndex;
       BlockIndex = RtlFindSetBits(&RegistryHive->DirtyBitMap,
                                  1,
                                  BlockIndex);
-      if (BlockIndex == (ULONG)-1)
+      if (BlockIndex == (ULONG)-1 || BlockIndex < LastIndex)
        {
          DPRINT("No more set bits\n");
          Status = STATUS_SUCCESS;
@@ -1634,18 +1810,14 @@ CmiStartHiveUpdate(PREGISTRY_HIVE RegistryHive)
 
       DPRINT("Block %lu is dirty\n", BlockIndex);
 
-      BlockOffset = RegistryHive->BlockList[BlockIndex]->BlockOffset;
-      DPRINT("Block offset %lx\n", BlockOffset);
-
-      BlockPtr = RegistryHive->BlockList[BlockIndex] + ((BlockIndex * 4096) - BlockOffset);
-      DPRINT("BlockPtr %p\n", BlockPtr);
-
-      FileOffset.QuadPart = (ULONGLONG)(BlockIndex + 1) * 4096ULL;
-      DPRINT("File offset %I64x\n", FileOffset.QuadPart);
+      BlockPtr = RegistryHive->BlockList[BlockIndex].Block;
+      DPRINT("  BlockPtr %p\n", BlockPtr);
 
+      FileOffset.QuadPart = (ULONGLONG)(BlockIndex + 1) * (ULONGLONG)REG_BLOCK_SIZE;
+      DPRINT("  File offset %I64x\n", FileOffset.QuadPart);
 
       /* Write hive block */
-      Status = NtWriteFile(FileHandle,
+      Status = ZwWriteFile(FileHandle,
                           NULL,
                           NULL,
                           NULL,
@@ -1656,22 +1828,22 @@ CmiStartHiveUpdate(PREGISTRY_HIVE RegistryHive)
                           NULL);
       if (!NT_SUCCESS(Status))
        {
-         DPRINT("NtWriteFile() failed (Status %lx)\n", Status);
-         NtClose(FileHandle);
+         DPRINT("ZwWriteFile() failed (Status %lx)\n", Status);
+         ZwClose(FileHandle);
          return(Status);
        }
 
       BlockIndex++;
     }
 
-  Status = NtFlushBuffersFile(FileHandle,
+  Status = ZwFlushBuffersFile(FileHandle,
                              &IoStatusBlock);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtFlushBuffersFile() failed (Status %lx)\n", Status);
+      DPRINT("ZwFlushBuffersFile() failed (Status %lx)\n", Status);
     }
 
-  NtClose(FileHandle);
+  ZwClose(FileHandle);
 
   return(Status);
 }
@@ -1690,11 +1862,11 @@ CmiFinishHiveUpdate(PREGISTRY_HIVE RegistryHive)
 
   InitializeObjectAttributes(&ObjectAttributes,
                             &RegistryHive->HiveFileName,
-                            0,
+                            OBJ_CASE_INSENSITIVE,
                             NULL,
                             NULL);
 
-  Status = NtCreateFile(&FileHandle,
+  Status = ZwCreateFile(&FileHandle,
                        FILE_ALL_ACCESS,
                        &ObjectAttributes,
                        &IoStatusBlock,
@@ -1707,7 +1879,7 @@ CmiFinishHiveUpdate(PREGISTRY_HIVE RegistryHive)
                        0);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtCreateFile() failed (Status %lx)\n", Status);
+      DPRINT("ZwCreateFile() failed (Status %lx)\n", Status);
       return(Status);
     }
 
@@ -1717,8 +1889,8 @@ CmiFinishHiveUpdate(PREGISTRY_HIVE RegistryHive)
   RegistryHive->HiveHeader->Checksum = CmiCalcChecksum((PULONG)RegistryHive->HiveHeader);
 
   /* Write hive block */
-  FileOffset.QuadPart = 0ULL;
-  Status = NtWriteFile(FileHandle,
+  FileOffset.QuadPart = (ULONGLONG)0;
+  Status = ZwWriteFile(FileHandle,
                       NULL,
                       NULL,
                       NULL,
@@ -1729,19 +1901,19 @@ CmiFinishHiveUpdate(PREGISTRY_HIVE RegistryHive)
                       NULL);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtWriteFile() failed (Status %lx)\n", Status);
-      NtClose(FileHandle);
+      DPRINT("ZwWriteFile() failed (Status %lx)\n", Status);
+      ZwClose(FileHandle);
       return(Status);
     }
 
-  Status = NtFlushBuffersFile(FileHandle,
+  Status = ZwFlushBuffersFile(FileHandle,
                              &IoStatusBlock);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtFlushBuffersFile() failed (Status %lx)\n", Status);
+      DPRINT("ZwFlushBuffersFile() failed (Status %lx)\n", Status);
     }
 
-  NtClose(FileHandle);
+  ZwClose(FileHandle);
 
   return(Status);
 }
@@ -1765,7 +1937,7 @@ CmiFlushRegistryHive(PREGISTRY_HIVE RegistryHive)
         &RegistryHive->LogFileName);
 
   /* Update hive header modification time */
-  NtQuerySystemTime((PTIME)&RegistryHive->HiveHeader->DateModified);
+  KeQuerySystemTime(&RegistryHive->HiveHeader->DateModified);
 
   /* Start log update */
   Status = CmiStartLogUpdate(RegistryHive);
@@ -1821,123 +1993,255 @@ CmiFlushRegistryHive(PREGISTRY_HIVE RegistryHive)
 
 
 ULONG
-CmiGetMaxNameLength(PREGISTRY_HIVE  RegistryHive,
-  PKEY_CELL  KeyCell)
+CmiGetNumberOfSubKeys(PKEY_OBJECT KeyObject)
+{
+  PKEY_OBJECT CurKey;
+  PKEY_CELL KeyCell;
+  ULONG SubKeyCount;
+  ULONG i;
+
+  VERIFY_KEY_OBJECT(KeyObject);
+
+  KeyCell = KeyObject->KeyCell;
+  VERIFY_KEY_CELL(KeyCell);
+
+  SubKeyCount = (KeyCell == NULL) ? 0 : KeyCell->NumberOfSubKeys;
+
+  /* Search for volatile or 'foreign' keys */
+  for (i = 0; i < KeyObject->NumberOfSubKeys; i++)
+    {
+      CurKey = KeyObject->SubKeys[i];
+      if (CurKey->RegistryHive == CmiVolatileHive ||
+         CurKey->RegistryHive != KeyObject->RegistryHive)
+       {
+         SubKeyCount++;
+       }
+    }
+
+  return SubKeyCount;
+}
+
+
+ULONG
+CmiGetMaxNameLength(PKEY_OBJECT KeyObject)
 {
   PHASH_TABLE_CELL HashBlock;
+  PKEY_OBJECT CurKey;
   PKEY_CELL CurSubKeyCell;
+  PKEY_CELL KeyCell;
   ULONG MaxName;
+  ULONG NameSize;
   ULONG i;
 
+  VERIFY_KEY_OBJECT(KeyObject);
+
+  KeyCell = KeyObject->KeyCell;
   VERIFY_KEY_CELL(KeyCell);
 
   MaxName = 0;
-  HashBlock = CmiGetBlock(RegistryHive, KeyCell->HashTableOffset, NULL);
+  HashBlock = CmiGetCell (KeyObject->RegistryHive,
+                         KeyCell->HashTableOffset,
+                         NULL);
   if (HashBlock == NULL)
     {
-      return 0;
+      DPRINT("CmiGetBlock() failed\n");
+    }
+  else
+    {
+      for (i = 0; i < HashBlock->HashTableSize; i++)
+       {
+         if (HashBlock->Table[i].KeyOffset != 0)
+           {
+             CurSubKeyCell = CmiGetCell (KeyObject->RegistryHive,
+                                         HashBlock->Table[i].KeyOffset,
+                                          NULL);
+             if (CurSubKeyCell == NULL)
+               {
+                 DPRINT("CmiGetBlock() failed\n");
+                 continue;
+               }
+
+             NameSize = CurSubKeyCell->NameSize;
+             if (CurSubKeyCell->Flags & REG_KEY_NAME_PACKED)
+               {
+                 NameSize *= sizeof(WCHAR);
+               }
+
+             if (NameSize > MaxName)
+               {
+                 MaxName = NameSize;
+               }
+           }
+       }
     }
 
-  for (i = 0; i < HashBlock->HashTableSize; i++)
+  DPRINT ("KeyObject->NumberOfSubKeys %d\n", KeyObject->NumberOfSubKeys);
+  for (i = 0; i < KeyObject->NumberOfSubKeys; i++)
     {
-      if (HashBlock->Table[i].KeyOffset != 0)
-        {
-          CurSubKeyCell = CmiGetBlock(RegistryHive,
-            HashBlock->Table[i].KeyOffset,
-            NULL);
-          if (MaxName < CurSubKeyCell->NameSize)
-            {
-              MaxName = CurSubKeyCell->NameSize;
-            }
-          CmiReleaseBlock(RegistryHive, CurSubKeyCell);
-        }
+      CurKey = KeyObject->SubKeys[i];
+      if (CurKey->RegistryHive == CmiVolatileHive ||
+         CurKey->RegistryHive != KeyObject->RegistryHive)
+       {
+         CurSubKeyCell = CurKey->KeyCell;
+         if (CurSubKeyCell == NULL)
+           {
+             DPRINT("CmiGetBlock() failed\n");
+             continue;
+           }
+
+         if ((CurSubKeyCell->Flags & REG_KEY_ROOT_CELL) == REG_KEY_ROOT_CELL)
+           {
+             /* Use name of the key object */
+             NameSize = CurKey->Name.Length;
+           }
+         else
+           {
+             /* Use name of the key cell */
+             NameSize = CurSubKeyCell->NameSize;
+             if (CurSubKeyCell->Flags & REG_KEY_NAME_PACKED)
+               {
+                 NameSize *= sizeof(WCHAR);
+               }
+           }
+         DPRINT ("NameSize %lu\n", NameSize);
+
+         if (NameSize > MaxName)
+           {
+             MaxName = NameSize;
+           }
+       }
     }
 
-  CmiReleaseBlock(RegistryHive, HashBlock);
-  
+  DPRINT ("MaxName %lu\n", MaxName);
+
   return MaxName;
 }
 
 
 ULONG
-CmiGetMaxClassLength(PREGISTRY_HIVE  RegistryHive,
-  PKEY_CELL  KeyCell)
+CmiGetMaxClassLength(PKEY_OBJECT  KeyObject)
 {
   PHASH_TABLE_CELL HashBlock;
+  PKEY_OBJECT CurKey;
   PKEY_CELL CurSubKeyCell;
+  PKEY_CELL KeyCell;
   ULONG MaxClass;
   ULONG i;
 
+  VERIFY_KEY_OBJECT(KeyObject);
+
+  KeyCell = KeyObject->KeyCell;
   VERIFY_KEY_CELL(KeyCell);
 
   MaxClass = 0;
-  HashBlock = CmiGetBlock(RegistryHive, KeyCell->HashTableOffset, NULL);
+  HashBlock = CmiGetCell (KeyObject->RegistryHive,
+                         KeyCell->HashTableOffset,
+                         NULL);
   if (HashBlock == NULL)
     {
-      return 0;
+      DPRINT("CmiGetBlock() failed\n");
     }
-
-  for (i = 0; i < HashBlock->HashTableSize; i++)
+  else
     {
-      if (HashBlock->Table[i].KeyOffset != 0)
-        {
-          CurSubKeyCell = CmiGetBlock(RegistryHive,
-            HashBlock->Table[i].KeyOffset,
-            NULL);
-          if (MaxClass < CurSubKeyCell->ClassSize)
-            {
-              MaxClass = CurSubKeyCell->ClassSize;
-            }
-          CmiReleaseBlock(RegistryHive, CurSubKeyCell);
-        }
+      for (i = 0; i < HashBlock->HashTableSize; i++)
+       {
+         if (HashBlock->Table[i].KeyOffset != 0)
+           {
+             CurSubKeyCell = CmiGetCell (KeyObject->RegistryHive,
+                                         HashBlock->Table[i].KeyOffset,
+                                         NULL);
+             if (CurSubKeyCell == NULL)
+               {
+                 DPRINT("CmiGetBlock() failed\n");
+                 continue;
+               }
+
+             if (MaxClass < CurSubKeyCell->ClassSize)
+               {
+                 MaxClass = CurSubKeyCell->ClassSize;
+               }
+           }
+       }
     }
 
-  CmiReleaseBlock(RegistryHive, HashBlock);
+  DPRINT("KeyObject->NumberOfSubKeys %d\n", KeyObject->NumberOfSubKeys);
+  for (i = 0; i < KeyObject->NumberOfSubKeys; i++)
+    {
+      CurKey = KeyObject->SubKeys[i];
+      if (CurKey->RegistryHive == CmiVolatileHive ||
+         CurKey->RegistryHive != KeyObject->RegistryHive)
+       {
+         CurSubKeyCell = CurKey->KeyCell;
+         if (CurSubKeyCell == NULL)
+           {
+             DPRINT("CmiGetBlock() failed\n");
+             continue;
+           }
+
+         if (MaxClass < CurSubKeyCell->ClassSize)
+           {
+             MaxClass = CurSubKeyCell->ClassSize;
+           }
+       }
+    }
 
   return MaxClass;
 }
 
 
-ULONG  
+ULONG
 CmiGetMaxValueNameLength(PREGISTRY_HIVE RegistryHive,
-  PKEY_CELL KeyCell)
+                        PKEY_CELL KeyCell)
 {
   PVALUE_LIST_CELL ValueListCell;
   PVALUE_CELL CurValueCell;
   ULONG MaxValueName;
+  ULONG Size;
   ULONG i;
 
   VERIFY_KEY_CELL(KeyCell);
 
-  ValueListCell = CmiGetBlock(RegistryHive, KeyCell->ValuesOffset, NULL);
   MaxValueName = 0;
+  ValueListCell = CmiGetCell (RegistryHive,
+                             KeyCell->ValueListOffset,
+                             NULL);
   if (ValueListCell == NULL)
     {
+      DPRINT("CmiGetBlock() failed\n");
       return 0;
     }
 
   for (i = 0; i < KeyCell->NumberOfValues; i++)
     {
-      CurValueCell = CmiGetBlock(RegistryHive,
-        ValueListCell->Values[i],
-        NULL);
-      if (CurValueCell != NULL &&
-          MaxValueName < CurValueCell->NameSize)
-        {
-          MaxValueName = CurValueCell->NameSize;
+      CurValueCell = CmiGetCell (RegistryHive,
+                                ValueListCell->ValueOffset[i],
+                                NULL);
+      if (CurValueCell == NULL)
+       {
+         DPRINT("CmiGetBlock() failed\n");
+       }
+
+      if (CurValueCell != NULL)
+       {
+         Size = CurValueCell->NameSize;
+         if (CurValueCell->Flags & REG_VALUE_NAME_PACKED)
+           {
+             Size *= sizeof(WCHAR);
+           }
+         if (MaxValueName < Size)
+           {
+             MaxValueName = Size;
+           }
         }
-      CmiReleaseBlock(RegistryHive, CurValueCell);
     }
 
-  CmiReleaseBlock(RegistryHive, ValueListCell);
-  
   return MaxValueName;
 }
 
 
-ULONG  
+ULONG
 CmiGetMaxValueDataLength(PREGISTRY_HIVE RegistryHive,
-  PKEY_CELL KeyCell)
+                        PKEY_CELL KeyCell)
 {
   PVALUE_LIST_CELL ValueListCell;
   PVALUE_CELL CurValueCell;
@@ -1946,8 +2250,8 @@ CmiGetMaxValueDataLength(PREGISTRY_HIVE RegistryHive,
 
   VERIFY_KEY_CELL(KeyCell);
 
-  ValueListCell = CmiGetBlock(RegistryHive, KeyCell->ValuesOffset, NULL);
   MaxValueData = 0;
+  ValueListCell = CmiGetCell (RegistryHive, KeyCell->ValueListOffset, NULL);
   if (ValueListCell == NULL)
     {
       return 0;
@@ -1955,145 +2259,173 @@ CmiGetMaxValueDataLength(PREGISTRY_HIVE RegistryHive,
 
   for (i = 0; i < KeyCell->NumberOfValues; i++)
     {
-      CurValueCell = CmiGetBlock(RegistryHive,
-                                  ValueListCell->Values[i],NULL);
+      CurValueCell = CmiGetCell (RegistryHive,
+                                 ValueListCell->ValueOffset[i],NULL);
       if ((CurValueCell != NULL) &&
-          (MaxValueData < (CurValueCell->DataSize & LONG_MAX)))
+          (MaxValueData < (LONG)(CurValueCell->DataSize & REG_DATA_SIZE_MASK)))
         {
-          MaxValueData = CurValueCell->DataSize & LONG_MAX;
+          MaxValueData = CurValueCell->DataSize & REG_DATA_SIZE_MASK;
         }
-      CmiReleaseBlock(RegistryHive, CurValueCell);
     }
 
-  CmiReleaseBlock(RegistryHive, ValueListCell);
-  
   return MaxValueData;
 }
 
 
 NTSTATUS
 CmiScanForSubKey(IN PREGISTRY_HIVE RegistryHive,
-       IN PKEY_CELL KeyCell,
-       OUT PKEY_CELL *SubKeyCell,
-       OUT BLOCK_OFFSET *BlockOffset,
-       IN PCHAR KeyName,
-       IN ACCESS_MASK DesiredAccess,
-       IN ULONG Attributes)
+                IN PKEY_CELL KeyCell,
+                OUT PKEY_CELL *SubKeyCell,
+                OUT BLOCK_OFFSET *BlockOffset,
+                IN PUNICODE_STRING KeyName,
+                IN ACCESS_MASK DesiredAccess,
+                IN ULONG Attributes)
 {
   PHASH_TABLE_CELL HashBlock;
   PKEY_CELL CurSubKeyCell;
-  WORD KeyLength;
   ULONG i;
 
   VERIFY_KEY_CELL(KeyCell);
 
-  //DPRINT("Scanning for sub key %s\n", KeyName);
+  DPRINT("Scanning for sub key %wZ\n", KeyName);
 
-  assert(RegistryHive);
+  ASSERT(RegistryHive);
 
-  KeyLength = strlen(KeyName);
-
-  HashBlock = CmiGetBlock(RegistryHive, KeyCell->HashTableOffset, NULL);
   *SubKeyCell = NULL;
-  if (HashBlock == NULL)
+
+  /* The key does not have any subkeys */
+  if (KeyCell->HashTableOffset == (BLOCK_OFFSET)-1)
     {
       return STATUS_SUCCESS;
     }
 
-  for (i = 0; (i < KeyCell->NumberOfSubKeys)
-               && (i < HashBlock->HashTableSize); i++)
+  /* Get hash table */
+  HashBlock = CmiGetCell (RegistryHive, KeyCell->HashTableOffset, NULL);
+  if (HashBlock == NULL)
+    {
+      DPRINT("CmiGetBlock() failed\n");
+      return STATUS_UNSUCCESSFUL;
+    }
+
+  for (i = 0; (i < KeyCell->NumberOfSubKeys) && (i < HashBlock->HashTableSize); i++)
     {
       if (Attributes & OBJ_CASE_INSENSITIVE)
-        {
-          if ((HashBlock->Table[i].KeyOffset != 0) &&
-              (HashBlock->Table[i].KeyOffset != (ULONG_PTR)-1) &&
-              (_strnicmp(KeyName, (PCHAR) &HashBlock->Table[i].HashValue, 4) == 0))
-            {
-              CurSubKeyCell = CmiGetBlock(RegistryHive, 
-                HashBlock->Table[i].KeyOffset,
-                NULL);
-              if ((CurSubKeyCell->NameSize == KeyLength)
-                  && (_strnicmp(KeyName, CurSubKeyCell->Name, KeyLength) == 0))
-                {
-                  *SubKeyCell = CurSubKeyCell;
-                  *BlockOffset = HashBlock->Table[i].KeyOffset;
-                  break;
-                }
-              else
-                {
-                  CmiReleaseBlock(RegistryHive, CurSubKeyCell);
-                }
-            }
-        }
+       {
+         if (HashBlock->Table[i].KeyOffset != 0 &&
+             HashBlock->Table[i].KeyOffset != (ULONG_PTR)-1 &&
+             (HashBlock->Table[i].HashValue == 0 ||
+              CmiCompareHashI(KeyName, (PCHAR)&HashBlock->Table[i].HashValue)))
+           {
+             CurSubKeyCell = CmiGetCell (RegistryHive,
+                                         HashBlock->Table[i].KeyOffset,
+                                         NULL);
+             if (CurSubKeyCell == NULL)
+               {
+                 DPRINT("CmiGetBlock() failed\n");
+                 return STATUS_UNSUCCESSFUL;
+               }
+
+             if (CmiCompareKeyNamesI(KeyName, CurSubKeyCell))
+               {
+                 *SubKeyCell = CurSubKeyCell;
+                 *BlockOffset = HashBlock->Table[i].KeyOffset;
+                 break;
+               }
+           }
+       }
       else
-        {
-          if (HashBlock->Table[i].KeyOffset != 0 &&
-              HashBlock->Table[i].KeyOffset != (ULONG_PTR) -1 &&
-              !strncmp(KeyName, (PCHAR) &HashBlock->Table[i].HashValue, 4))
-            {
-              CurSubKeyCell = CmiGetBlock(RegistryHive,
-                HashBlock->Table[i].KeyOffset,NULL);
-              if (CurSubKeyCell->NameSize == KeyLength
-                  && !_strnicmp(KeyName, CurSubKeyCell->Name, KeyLength))
-                {
-                  *SubKeyCell = CurSubKeyCell;
-                  *BlockOffset = HashBlock->Table[i].KeyOffset;
-                  break;
-                }
-              else
-                {
-                  CmiReleaseBlock(RegistryHive, CurSubKeyCell);
-                }
-            }
-        }
+       {
+         if (HashBlock->Table[i].KeyOffset != 0 &&
+             HashBlock->Table[i].KeyOffset != (ULONG_PTR) -1 &&
+             (HashBlock->Table[i].HashValue == 0 ||
+              CmiCompareHash(KeyName, (PCHAR)&HashBlock->Table[i].HashValue)))
+           {
+             CurSubKeyCell = CmiGetCell (RegistryHive,
+                                         HashBlock->Table[i].KeyOffset,
+                                         NULL);
+             if (CurSubKeyCell == NULL)
+               {
+                 DPRINT("CmiGetBlock() failed\n");
+                 return STATUS_UNSUCCESSFUL;
+               }
+
+             if (CmiCompareKeyNames(KeyName, CurSubKeyCell))
+               {
+                 *SubKeyCell = CurSubKeyCell;
+                 *BlockOffset = HashBlock->Table[i].KeyOffset;
+                 break;
+               }
+           }
+       }
     }
-  
-  CmiReleaseBlock(RegistryHive, HashBlock);
-  
+
   return STATUS_SUCCESS;
 }
 
 
 NTSTATUS
 CmiAddSubKey(PREGISTRY_HIVE RegistryHive,
-            PKEY_OBJECT Parent,
+            PKEY_OBJECT ParentKey,
             PKEY_OBJECT SubKey,
-            PWSTR NewSubKeyName,
-            USHORT NewSubKeyNameSize,
+            PUNICODE_STRING SubKeyName,
             ULONG TitleIndex,
             PUNICODE_STRING Class,
             ULONG CreateOptions)
 {
-  PHASH_TABLE_CELL NewHashBlock;
   PHASH_TABLE_CELL HashBlock;
   BLOCK_OFFSET NKBOffset;
-  PKEY_CELL NewKeyCell; 
+  PKEY_CELL NewKeyCell;
   ULONG NewBlockSize;
-  PKEY_CELL KeyCell;
+  PKEY_CELL ParentKeyCell;
+  PDATA_CELL ClassCell;
   NTSTATUS Status;
   USHORT NameSize;
+  PWSTR NamePtr;
+  BOOLEAN Packable;
+  ULONG i;
 
-  KeyCell = Parent->KeyCell;
+  ParentKeyCell = ParentKey->KeyCell;
 
-  VERIFY_KEY_CELL(KeyCell);
+  VERIFY_KEY_CELL(ParentKeyCell);
 
-  if (NewSubKeyName[0] == L'\\')
+  /* Skip leading backslash */
+  if (SubKeyName->Buffer[0] == L'\\')
     {
-      NewSubKeyName++;
-      NameSize = NewSubKeyNameSize / 2 - 1;
+      NamePtr = &SubKeyName->Buffer[1];
+      NameSize = SubKeyName->Length - sizeof(WCHAR);
     }
   else
     {
-      NameSize = NewSubKeyNameSize / 2;
+      NamePtr = SubKeyName->Buffer;
+      NameSize = SubKeyName->Length;
+    }
+
+  /* Check whether key name can be packed */
+  Packable = TRUE;
+  for (i = 0; i < NameSize / sizeof(WCHAR); i++)
+    {
+      if (NamePtr[i] & 0xFF00)
+       {
+         Packable = FALSE;
+         break;
+       }
+    }
+
+  /* Adjust name size */
+  if (Packable)
+    {
+      NameSize = NameSize / sizeof(WCHAR);
     }
+
+  DPRINT("Key %S  Length %lu  %s\n", NamePtr, NameSize, (Packable)?"True":"False");
+
   Status = STATUS_SUCCESS;
 
   NewBlockSize = sizeof(KEY_CELL) + NameSize;
-  Status = CmiAllocateBlock(RegistryHive,
-    (PVOID) &NewKeyCell,
-    NewBlockSize,
-    &NKBOffset);
-
+  Status = CmiAllocateCell (RegistryHive,
+                           NewBlockSize,
+                           (PVOID) &NewKeyCell,
+                           &NKBOffset);
   if (NewKeyCell == NULL)
     {
       Status = STATUS_INSUFFICIENT_RESOURCES;
@@ -2101,31 +2433,45 @@ CmiAddSubKey(PREGISTRY_HIVE RegistryHive,
   else
     {
       NewKeyCell->Id = REG_KEY_CELL_ID;
-      NewKeyCell->Type = REG_KEY_CELL_TYPE;
-      ZwQuerySystemTime((PTIME) &NewKeyCell->LastWriteTime);
+      NewKeyCell->Flags = 0;
+      KeQuerySystemTime(&NewKeyCell->LastWriteTime);
       NewKeyCell->ParentKeyOffset = -1;
       NewKeyCell->NumberOfSubKeys = 0;
       NewKeyCell->HashTableOffset = -1;
       NewKeyCell->NumberOfValues = 0;
-      NewKeyCell->ValuesOffset = -1;
+      NewKeyCell->ValueListOffset = -1;
       NewKeyCell->SecurityKeyOffset = -1;
-      NewKeyCell->NameSize = NameSize;
-      wcstombs(NewKeyCell->Name, NewSubKeyName, NameSize);
       NewKeyCell->ClassNameOffset = -1;
 
-      VERIFY_KEY_CELL(NewKeyCell);
-
-      if (Class)
+      /* Pack the key name */
+      NewKeyCell->NameSize = NameSize;
+      if (Packable)
        {
-         PDATA_CELL pClass;
+         NewKeyCell->Flags |= REG_KEY_NAME_PACKED;
+         for (i = 0; i < NameSize; i++)
+           {
+             NewKeyCell->Name[i] = (CHAR)(NamePtr[i] & 0x00FF);
+           }
+       }
+      else
+       {
+         RtlCopyMemory(NewKeyCell->Name,
+                       NamePtr,
+                       NameSize);
+       }
 
-         NewKeyCell->ClassSize = Class->Length + sizeof(WCHAR);
-         Status = CmiAllocateBlock(RegistryHive,
-                                   (PVOID) &pClass,
-                                   NewKeyCell->ClassSize,
+      VERIFY_KEY_CELL(NewKeyCell);
+
+      if (Class != NULL)
+       {
+         NewKeyCell->ClassSize = Class->Length;
+         Status = CmiAllocateCell (RegistryHive,
+                                   sizeof(CELL_HEADER) + NewKeyCell->ClassSize,
+                                   (PVOID)&ClassCell,
                                    &NewKeyCell->ClassNameOffset);
-         wcsncpy((PWSTR) pClass->Data, Class->Buffer, Class->Length);
-         ((PWSTR) (pClass->Data))[Class->Length] = 0;
+         RtlCopyMemory (ClassCell->Data,
+                        Class->Buffer,
+                        Class->Length);
        }
     }
 
@@ -2135,19 +2481,19 @@ CmiAddSubKey(PREGISTRY_HIVE RegistryHive,
     }
 
   SubKey->KeyCell = NewKeyCell;
-  SubKey->BlockOffset = NKBOffset;
+  SubKey->KeyCellOffset = NKBOffset;
 
-  /* Don't modify hash table if key is volatile and parent is not */
-  if (IsVolatileHive(RegistryHive) && (!IsVolatileHive(Parent->RegistryHive)))
+  /* Don't modify hash table if key is located in a pointer-based hive and parent key is not */
+  if (IsPointerHive(RegistryHive) && (!IsPointerHive(ParentKey->RegistryHive)))
     {
       return(Status);
     }
 
-  if (KeyCell->HashTableOffset == (ULONG_PTR) -1)
+  if (ParentKeyCell->HashTableOffset == (ULONG_PTR) -1)
     {
-      Status = CmiAllocateHashTableBlock(RegistryHive,
+      Status = CmiAllocateHashTableCell (RegistryHive,
                                         &HashBlock,
-                                        &KeyCell->HashTableOffset,
+                                        &ParentKeyCell->HashTableOffset,
                                         REG_INIT_HASH_TABLE_SIZE);
       if (!NT_SUCCESS(Status))
        {
@@ -2156,13 +2502,22 @@ CmiAddSubKey(PREGISTRY_HIVE RegistryHive,
     }
   else
     {
-      HashBlock = CmiGetBlock(RegistryHive, KeyCell->HashTableOffset, NULL);
-      if (((KeyCell->NumberOfSubKeys + 1) >= HashBlock->HashTableSize))
+      HashBlock = CmiGetCell (RegistryHive,
+                             ParentKeyCell->HashTableOffset,
+                             NULL);
+      if (HashBlock == NULL)
+       {
+         DPRINT("CmiGetCell() failed\n");
+         return STATUS_UNSUCCESSFUL;
+       }
+
+      if (((ParentKeyCell->NumberOfSubKeys + 1) >= HashBlock->HashTableSize))
        {
+         PHASH_TABLE_CELL NewHashBlock;
          BLOCK_OFFSET HTOffset;
 
-         /* Reallocate the hash table block */
-         Status = CmiAllocateHashTableBlock(RegistryHive,
+         /* Reallocate the hash table cell */
+         Status = CmiAllocateHashTableCell (RegistryHive,
                                             &NewHashBlock,
                                             &HTOffset,
                                             HashBlock->HashTableSize +
@@ -2177,23 +2532,27 @@ CmiAddSubKey(PREGISTRY_HIVE RegistryHive,
          RtlCopyMemory(&NewHashBlock->Table[0],
                        &HashBlock->Table[0],
                        sizeof(NewHashBlock->Table[0]) * HashBlock->HashTableSize);
-         CmiDestroyBlock(RegistryHive,
+         CmiDestroyCell (RegistryHive,
                          HashBlock,
-                         KeyCell->HashTableOffset);
-         KeyCell->HashTableOffset = HTOffset;
+                         ParentKeyCell->HashTableOffset);
+         ParentKeyCell->HashTableOffset = HTOffset;
          HashBlock = NewHashBlock;
        }
     }
 
   Status = CmiAddKeyToHashTable(RegistryHive,
                                HashBlock,
+                               ParentKeyCell->HashTableOffset,
                                NewKeyCell,
                                NKBOffset);
   if (NT_SUCCESS(Status))
     {
-      KeyCell->NumberOfSubKeys++;
+      ParentKeyCell->NumberOfSubKeys++;
     }
 
+  KeQuerySystemTime (&ParentKeyCell->LastWriteTime);
+  CmiMarkBlockDirty (RegistryHive, ParentKey->KeyCellOffset);
+
   return(Status);
 }
 
@@ -2215,65 +2574,86 @@ CmiRemoveSubKey(PREGISTRY_HIVE RegistryHive,
   if (SubKey->KeyCell->NumberOfValues != 0)
     {
       /* Get pointer to the value list cell */
-      ValueList = CmiGetBlock(RegistryHive,
-                             SubKey->KeyCell->ValuesOffset,
+      ValueList = CmiGetCell (RegistryHive,
+                             SubKey->KeyCell->ValueListOffset,
                              NULL);
-      if (ValueList != NULL)
+      if (ValueList == NULL)
        {
-         /* Enumerate all values */
-         for (i = 0; i < SubKey->KeyCell->NumberOfValues; i++)
+         DPRINT("CmiGetCell() failed\n");
+         return STATUS_UNSUCCESSFUL;
+       }
+
+      /* Enumerate all values */
+      for (i = 0; i < SubKey->KeyCell->NumberOfValues; i++)
+       {
+         /* Get pointer to value cell */
+         ValueCell = CmiGetCell(RegistryHive,
+                                ValueList->ValueOffset[i],
+                                NULL);
+         if (ValueCell == NULL)
+           {
+             DPRINT("CmiGetCell() failed\n");
+             return STATUS_UNSUCCESSFUL;
+           }
+
+         if (!(ValueCell->DataSize & REG_DATA_IN_OFFSET)
+              && ValueCell->DataSize > sizeof(BLOCK_OFFSET))
            {
-             /* Get pointer to value cell */
-             ValueCell = CmiGetBlock(RegistryHive,
-                                     ValueList->Values[i],
-                                     NULL);
-             if (ValueCell != NULL)
+             DataCell = CmiGetCell (RegistryHive,
+                                    ValueCell->DataOffset,
+                                    NULL);
+             if (DataCell == NULL)
+               {
+                 DPRINT("CmiGetCell() failed\n");
+                 return STATUS_UNSUCCESSFUL;
+               }
+
+             if (DataCell != NULL)
                {
-                 if (ValueCell->DataSize > 4)
-                   {
-                     DataCell = CmiGetBlock(RegistryHive,
-                                            ValueCell->DataOffset,
-                                            NULL);
-                     if (DataCell != NULL)
-                       {
-                         /* Destroy data cell */
-                         CmiDestroyBlock(RegistryHive,
-                                         DataCell,
-                                         ValueCell->DataOffset);
-                       }
-                   }
-
-                 /* Destroy value cell */
-                 CmiDestroyBlock(RegistryHive,
-                                 ValueCell,
-                                 ValueList->Values[i]);
+                 /* Destroy data cell */
+                 CmiDestroyCell (RegistryHive,
+                                 DataCell,
+                                 ValueCell->DataOffset);
                }
            }
+
+         /* Destroy value cell */
+         CmiDestroyCell (RegistryHive,
+                         ValueCell,
+                         ValueList->ValueOffset[i]);
        }
 
       /* Destroy value list cell */
-      CmiDestroyBlock(RegistryHive,
+      CmiDestroyCell (RegistryHive,
                      ValueList,
-                     SubKey->KeyCell->ValuesOffset);
+                     SubKey->KeyCell->ValueListOffset);
 
       SubKey->KeyCell->NumberOfValues = 0;
-      SubKey->KeyCell->ValuesOffset = -1;
+      SubKey->KeyCell->ValueListOffset = (BLOCK_OFFSET)-1;
+
+      CmiMarkBlockDirty(RegistryHive,
+                       SubKey->KeyCellOffset);
     }
 
   /* Remove the key from the parent key's hash block */
   if (ParentKey->KeyCell->HashTableOffset != (BLOCK_OFFSET) -1)
     {
-      DPRINT("ParentKey HashTableOffset %lx\n", ParentKey->KeyCell->HashTableOffset)
-      HashBlock = CmiGetBlock(RegistryHive,
+      DPRINT("ParentKey HashTableOffset %lx\n", ParentKey->KeyCell->HashTableOffset);
+      HashBlock = CmiGetCell (ParentKey->RegistryHive,
                              ParentKey->KeyCell->HashTableOffset,
                              NULL);
-      DPRINT("ParentKey HashBlock %p\n", HashBlock)
+      if (HashBlock == NULL)
+       {
+         DPRINT("CmiGetCell() failed\n");
+         return STATUS_UNSUCCESSFUL;
+       }
+      DPRINT("ParentKey HashBlock %p\n", HashBlock);
       if (HashBlock != NULL)
        {
-         CmiRemoveKeyFromHashTable(RegistryHive,
+         CmiRemoveKeyFromHashTable(ParentKey->RegistryHive,
                                    HashBlock,
-                                   SubKey->BlockOffset);
-         CmiMarkBlockDirty(RegistryHive,
+                                   SubKey->KeyCellOffset);
+         CmiMarkBlockDirty(ParentKey->RegistryHive,
                            ParentKey->KeyCell->HashTableOffset);
        }
     }
@@ -2281,14 +2661,19 @@ CmiRemoveSubKey(PREGISTRY_HIVE RegistryHive,
   /* Remove the key's hash block */
   if (SubKey->KeyCell->HashTableOffset != (BLOCK_OFFSET) -1)
     {
-      DPRINT("SubKey HashTableOffset %lx\n", SubKey->KeyCell->HashTableOffset)
-      HashBlock = CmiGetBlock(RegistryHive,
+      DPRINT("SubKey HashTableOffset %lx\n", SubKey->KeyCell->HashTableOffset);
+      HashBlock = CmiGetCell (RegistryHive,
                              SubKey->KeyCell->HashTableOffset,
                              NULL);
-      DPRINT("SubKey HashBlock %p\n", HashBlock)
+      if (HashBlock == NULL)
+       {
+         DPRINT("CmiGetCell() failed\n");
+         return STATUS_UNSUCCESSFUL;
+       }
+      DPRINT("SubKey HashBlock %p\n", HashBlock);
       if (HashBlock != NULL)
        {
-         CmiDestroyBlock(RegistryHive,
+         CmiDestroyCell (RegistryHive,
                          HashBlock,
                          SubKey->KeyCell->HashTableOffset);
          SubKey->KeyCell->HashTableOffset = -1;
@@ -2298,128 +2683,150 @@ CmiRemoveSubKey(PREGISTRY_HIVE RegistryHive,
   /* Decrement the number of the parent key's sub keys */
   if (ParentKey != NULL)
     {
-      DPRINT("ParentKey %p\n", ParentKey)
+      DPRINT("ParentKey %p\n", ParentKey);
       ParentKey->KeyCell->NumberOfSubKeys--;
 
       /* Remove the parent key's hash table */
       if (ParentKey->KeyCell->NumberOfSubKeys == 0)
        {
-         DPRINT("ParentKey HashTableOffset %lx\n", ParentKey->KeyCell->HashTableOffset)
-         HashBlock = CmiGetBlock(RegistryHive,
+         DPRINT("ParentKey HashTableOffset %lx\n", ParentKey->KeyCell->HashTableOffset);
+         HashBlock = CmiGetCell (ParentKey->RegistryHive,
                                  ParentKey->KeyCell->HashTableOffset,
                                  NULL);
-         DPRINT("ParentKey HashBlock %p\n", HashBlock)
+         if (HashBlock == NULL)
+           {
+             DPRINT("CmiGetCell() failed\n");
+             return STATUS_UNSUCCESSFUL;
+           }
+         DPRINT("ParentKey HashBlock %p\n", HashBlock);
          if (HashBlock != NULL)
            {
-             CmiDestroyBlock(RegistryHive,
+             CmiDestroyCell (ParentKey->RegistryHive,
                              HashBlock,
                              ParentKey->KeyCell->HashTableOffset);
-             ParentKey->KeyCell->HashTableOffset = -1;
+             ParentKey->KeyCell->HashTableOffset = (BLOCK_OFFSET)-1;
            }
        }
 
-      NtQuerySystemTime((PTIME)&ParentKey->KeyCell->LastWriteTime);
-      CmiMarkBlockDirty(RegistryHive,
-                       ParentKey->BlockOffset);
+      KeQuerySystemTime(&ParentKey->KeyCell->LastWriteTime);
+      CmiMarkBlockDirty(ParentKey->RegistryHive,
+                       ParentKey->KeyCellOffset);
     }
 
   /* Destroy key cell */
-  CmiDestroyBlock(RegistryHive,
+  CmiDestroyCell (RegistryHive,
                  SubKey->KeyCell,
-                 SubKey->BlockOffset);
-  SubKey->BlockOffset = -1;
+                 SubKey->KeyCellOffset);
   SubKey->KeyCell = NULL;
+  SubKey->KeyCellOffset = (BLOCK_OFFSET)-1;
 
-  return(STATUS_SUCCESS);
+  DPRINT("CmiRemoveSubKey() done\n");
+
+  return STATUS_SUCCESS;
 }
 
 
 NTSTATUS
 CmiScanKeyForValue(IN PREGISTRY_HIVE RegistryHive,
-       IN PKEY_CELL KeyCell,
-       IN PUNICODE_STRING ValueName,
-       OUT PVALUE_CELL *ValueCell,
-       OUT BLOCK_OFFSET *VBOffset)
+                  IN PKEY_CELL KeyCell,
+                  IN PUNICODE_STRING ValueName,
+                  OUT PVALUE_CELL *ValueCell,
+                  OUT BLOCK_OFFSET *ValueCellOffset)
 {
   PVALUE_LIST_CELL ValueListCell;
   PVALUE_CELL CurValueCell;
   ULONG i;
 
-  ValueListCell = CmiGetBlock(RegistryHive, KeyCell->ValuesOffset, NULL);
-
   *ValueCell = NULL;
+  if (ValueCellOffset != NULL)
+    *ValueCellOffset = (BLOCK_OFFSET)-1;
+
+  /* The key does not have any values */
+  if (KeyCell->ValueListOffset == (BLOCK_OFFSET)-1)
+    {
+      return STATUS_OBJECT_NAME_NOT_FOUND;
+    }
 
+  ValueListCell = CmiGetCell (RegistryHive, KeyCell->ValueListOffset, NULL);
   if (ValueListCell == NULL)
     {
       DPRINT("ValueListCell is NULL\n");
-      return STATUS_SUCCESS;
+      return STATUS_UNSUCCESSFUL;
     }
 
   VERIFY_VALUE_LIST_CELL(ValueListCell);
 
   for (i = 0; i < KeyCell->NumberOfValues; i++)
     {
-      CurValueCell = CmiGetBlock(RegistryHive,
-                                ValueListCell->Values[i],
+      CurValueCell = CmiGetCell (RegistryHive,
+                                ValueListCell->ValueOffset[i],
                                 NULL);
+      if (CurValueCell == NULL)
+       {
+         DPRINT("CmiGetBlock() failed\n");
+         return STATUS_UNSUCCESSFUL;
+       }
 
       if ((CurValueCell != NULL) &&
          CmiComparePackedNames(ValueName,
                                CurValueCell->Name,
                                CurValueCell->NameSize,
-                               CurValueCell->Flags & REG_VALUE_NAME_PACKED))
+                               (BOOLEAN)((CurValueCell->Flags & REG_VALUE_NAME_PACKED) ? TRUE : FALSE)))
        {
          *ValueCell = CurValueCell;
-         if (VBOffset)
-           *VBOffset = ValueListCell->Values[i];
+         if (ValueCellOffset != NULL)
+           *ValueCellOffset = ValueListCell->ValueOffset[i];
          //DPRINT("Found value %s\n", ValueName);
-         break;
+         return STATUS_SUCCESS;
        }
-      CmiReleaseBlock(RegistryHive, CurValueCell);
     }
 
-  CmiReleaseBlock(RegistryHive, ValueListCell);
-
-  return STATUS_SUCCESS;
+  return STATUS_OBJECT_NAME_NOT_FOUND;
 }
 
 
 NTSTATUS
 CmiGetValueFromKeyByIndex(IN PREGISTRY_HIVE RegistryHive,
-       IN PKEY_CELL KeyCell,
-       IN ULONG Index,
-       OUT PVALUE_CELL *ValueCell)
+                         IN PKEY_CELL KeyCell,
+                         IN ULONG Index,
+                         OUT PVALUE_CELL *ValueCell)
 {
   PVALUE_LIST_CELL ValueListCell;
   PVALUE_CELL CurValueCell;
 
-  ValueListCell = CmiGetBlock(RegistryHive, KeyCell->ValuesOffset, NULL);
-
   *ValueCell = NULL;
 
-  if (ValueListCell == NULL)
+  if (KeyCell->ValueListOffset == (BLOCK_OFFSET)-1)
     {
       return STATUS_NO_MORE_ENTRIES;
     }
 
-  VERIFY_VALUE_LIST_CELL(ValueListCell);
-
   if (Index >= KeyCell->NumberOfValues)
     {
       return STATUS_NO_MORE_ENTRIES;
     }
 
-  CurValueCell = CmiGetBlock(RegistryHive,
-    ValueListCell->Values[Index],
-    NULL);
 
-  if (CurValueCell != NULL)
+  ValueListCell = CmiGetCell (RegistryHive, KeyCell->ValueListOffset, NULL);
+  if (ValueListCell == NULL)
+    {
+      DPRINT("CmiGetBlock() failed\n");
+      return STATUS_UNSUCCESSFUL;
+    }
+
+  VERIFY_VALUE_LIST_CELL(ValueListCell);
+
+
+  CurValueCell = CmiGetCell (RegistryHive,
+                            ValueListCell->ValueOffset[Index],
+                            NULL);
+  if (CurValueCell == NULL)
     {
-      *ValueCell = CurValueCell;
+      DPRINT("CmiGetBlock() failed\n");
+      return STATUS_UNSUCCESSFUL;
     }
 
-  CmiReleaseBlock(RegistryHive, CurValueCell);
-  CmiReleaseBlock(RegistryHive, ValueListCell);
+  *ValueCell = CurValueCell;
 
   return STATUS_SUCCESS;
 }
@@ -2428,77 +2835,93 @@ CmiGetValueFromKeyByIndex(IN PREGISTRY_HIVE RegistryHive,
 NTSTATUS
 CmiAddValueToKey(IN PREGISTRY_HIVE RegistryHive,
                 IN PKEY_CELL KeyCell,
+                IN BLOCK_OFFSET KeyCellOffset,
                 IN PUNICODE_STRING ValueName,
                 OUT PVALUE_CELL *pValueCell,
-                OUT BLOCK_OFFSET *pVBOffset)
+                OUT BLOCK_OFFSET *pValueCellOffset)
 {
   PVALUE_LIST_CELL NewValueListCell;
   PVALUE_LIST_CELL ValueListCell;
   PVALUE_CELL NewValueCell;
-  BLOCK_OFFSET VLBOffset;
-  BLOCK_OFFSET VBOffset;
+  BLOCK_OFFSET NewValueListCellOffset;
+  BLOCK_OFFSET ValueListCellOffset;
+  BLOCK_OFFSET NewValueCellOffset;
+  ULONG CellSize;
   NTSTATUS Status;
 
-  Status = CmiAllocateValueCell(RegistryHive,
-                               &NewValueCell,
-                               &VBOffset,
-                               ValueName);
-  *pVBOffset = VBOffset;
-
-  if (!NT_SUCCESS(Status))
-    {
-      return Status;
-    }
-
-  ValueListCell = CmiGetBlock(RegistryHive, KeyCell->ValuesOffset, NULL);
+  DPRINT("KeyCell->ValuesOffset %lu\n", (ULONG)KeyCell->ValueListOffset);
 
+  ValueListCell = CmiGetCell (RegistryHive, KeyCell->ValueListOffset, NULL);
   if (ValueListCell == NULL)
     {
-      Status = CmiAllocateBlock(RegistryHive,
-             (PVOID) &ValueListCell,
-             sizeof(BLOCK_OFFSET) * 3,
-             &VLBOffset);
-
+      CellSize = sizeof(VALUE_LIST_CELL) +
+                (3 * sizeof(BLOCK_OFFSET));
+      Status = CmiAllocateCell (RegistryHive,
+                               CellSize,
+                               (PVOID) &ValueListCell,
+                               &ValueListCellOffset);
       if (!NT_SUCCESS(Status))
        {
-         CmiDestroyValueCell(RegistryHive, NewValueCell, VBOffset);
          return Status;
        }
-      KeyCell->ValuesOffset = VLBOffset;
+
+      KeyCell->ValueListOffset = ValueListCellOffset;
+      CmiMarkBlockDirty(RegistryHive, KeyCellOffset);
+      CmiMarkBlockDirty(RegistryHive, ValueListCellOffset);
     }
-  else if (KeyCell->NumberOfValues >= 
-          (((ULONG)ABS_VALUE(ValueListCell->CellSize) - 4) / sizeof(BLOCK_OFFSET)))
+  else if (KeyCell->NumberOfValues >=
+          (((ULONG)ABS_VALUE(ValueListCell->CellSize) - sizeof(VALUE_LIST_CELL)) / sizeof(BLOCK_OFFSET)))
     {
-      Status = CmiAllocateBlock(RegistryHive,
+#if 0
+      CellSize = sizeof(VALUE_LIST_CELL) +
+                ((KeyCell->NumberOfValues + REG_VALUE_LIST_CELL_MULTIPLE) * sizeof(BLOCK_OFFSET));
+#endif
+      CellSize = 2 * (ULONG)ABS_VALUE(ValueListCell->CellSize);
+      Status = CmiAllocateCell (RegistryHive,
+                               CellSize,
                                (PVOID) &NewValueListCell,
-                               (KeyCell->NumberOfValues + REG_VALUE_LIST_CELL_MULTIPLE) *
-                                 sizeof(BLOCK_OFFSET),
-                               &VLBOffset);
+                               &NewValueListCellOffset);
       if (!NT_SUCCESS(Status))
        {
-         CmiDestroyValueCell(RegistryHive, NewValueCell, VBOffset);
          return Status;
        }
 
-      RtlCopyMemory(&NewValueListCell->Values[0],
-                   &ValueListCell->Values[0],
+      RtlCopyMemory(&NewValueListCell->ValueOffset[0],
+                   &ValueListCell->ValueOffset[0],
                    sizeof(BLOCK_OFFSET) * KeyCell->NumberOfValues);
-      CmiDestroyBlock(RegistryHive, ValueListCell, KeyCell->ValuesOffset);
-      KeyCell->ValuesOffset = VLBOffset;
+      CmiDestroyCell (RegistryHive, ValueListCell, KeyCell->ValueListOffset);
+      CmiMarkBlockDirty (RegistryHive, KeyCell->ValueListOffset);
+
+      KeyCell->ValueListOffset = NewValueListCellOffset;
       ValueListCell = NewValueListCell;
+      CmiMarkBlockDirty (RegistryHive, KeyCellOffset);
+      CmiMarkBlockDirty (RegistryHive, NewValueListCellOffset);
     }
 
   DPRINT("KeyCell->NumberOfValues %lu, ValueListCell->CellSize %lu (%lu %lx)\n",
         KeyCell->NumberOfValues,
         (ULONG)ABS_VALUE(ValueListCell->CellSize),
-        ((ULONG)ABS_VALUE(ValueListCell->CellSize) - 4) / sizeof(BLOCK_OFFSET),
-        ((ULONG)ABS_VALUE(ValueListCell->CellSize) - 4) / sizeof(BLOCK_OFFSET));
+        ((ULONG)ABS_VALUE(ValueListCell->CellSize) - sizeof(VALUE_LIST_CELL)) / sizeof(BLOCK_OFFSET),
+        ((ULONG)ABS_VALUE(ValueListCell->CellSize) - sizeof(VALUE_LIST_CELL)) / sizeof(BLOCK_OFFSET));
 
-  ValueListCell->Values[KeyCell->NumberOfValues] = VBOffset;
+  Status = CmiAllocateValueCell(RegistryHive,
+                               &NewValueCell,
+                               &NewValueCellOffset,
+                               ValueName);
+  if (!NT_SUCCESS(Status))
+    {
+      return Status;
+    }
+
+  ValueListCell->ValueOffset[KeyCell->NumberOfValues] = NewValueCellOffset;
   KeyCell->NumberOfValues++;
-  CmiReleaseBlock(RegistryHive, ValueListCell);
-  CmiReleaseBlock(RegistryHive, NewValueCell);
+
+  CmiMarkBlockDirty(RegistryHive, KeyCellOffset);
+  CmiMarkBlockDirty(RegistryHive, KeyCell->ValueListOffset);
+  CmiMarkBlockDirty(RegistryHive, NewValueCellOffset);
+
   *pValueCell = NewValueCell;
+  *pValueCellOffset = NewValueCellOffset;
 
   return STATUS_SUCCESS;
 }
@@ -2512,12 +2935,13 @@ CmiDeleteValueFromKey(IN PREGISTRY_HIVE RegistryHive,
 {
   PVALUE_LIST_CELL ValueListCell;
   PVALUE_CELL CurValueCell;
-  ULONG  i;
-
-  ValueListCell = CmiGetBlock(RegistryHive, KeyCell->ValuesOffset, NULL);
+  ULONG i;
+  NTSTATUS Status;
 
+  ValueListCell = CmiGetCell (RegistryHive, KeyCell->ValueListOffset, NULL);
   if (ValueListCell == NULL)
     {
+      DPRINT1("CmiGetBlock() failed\n");
       return STATUS_SUCCESS;
     }
 
@@ -2525,59 +2949,69 @@ CmiDeleteValueFromKey(IN PREGISTRY_HIVE RegistryHive,
 
   for (i = 0; i < KeyCell->NumberOfValues; i++)
     {
-      CurValueCell = CmiGetBlock(RegistryHive, ValueListCell->Values[i], NULL);
+      CurValueCell = CmiGetCell (RegistryHive, ValueListCell->ValueOffset[i], NULL);
+      if (CurValueCell == NULL)
+       {
+         DPRINT1("CmiGetBlock() failed\n");
+         return STATUS_UNSUCCESSFUL;
+       }
 
-      if ((CurValueCell != NULL) &&
-         CmiComparePackedNames(ValueName,
+      if (CmiComparePackedNames(ValueName,
                                CurValueCell->Name,
                                CurValueCell->NameSize,
-                               CurValueCell->Flags & REG_VALUE_NAME_PACKED))
+                               (BOOLEAN)((CurValueCell->Flags & REG_VALUE_NAME_PACKED) ? TRUE : FALSE)))
        {
-         CmiDestroyValueCell(RegistryHive, CurValueCell, ValueListCell->Values[i]);
+         Status = CmiDestroyValueCell(RegistryHive,
+                                      CurValueCell,
+                                      ValueListCell->ValueOffset[i]);
+         if (CurValueCell == NULL)
+           {
+             DPRINT1("CmiDestroyValueCell() failed\n");
+             return Status;
+           }
 
-          if ((KeyCell->NumberOfValues - 1) < i)
-            {
-              RtlCopyMemory(&ValueListCell->Values[i],
-                &ValueListCell->Values[i + 1],
-                sizeof(BLOCK_OFFSET) * (KeyCell->NumberOfValues - 1 - i));
-            }
-          else
-            {
-              RtlZeroMemory(&ValueListCell->Values[i], sizeof(BLOCK_OFFSET));
-            }
+         if (i < (KeyCell->NumberOfValues - 1))
+           {
+             RtlMoveMemory(&ValueListCell->ValueOffset[i],
+                           &ValueListCell->ValueOffset[i + 1],
+                           sizeof(BLOCK_OFFSET) * (KeyCell->NumberOfValues - 1 - i));
+           }
+         ValueListCell->ValueOffset[KeyCell->NumberOfValues - 1] = 0;
 
-          KeyCell->NumberOfValues -= 1;
-          break;
-       }
-      CmiReleaseBlock(RegistryHive, CurValueCell);
-    }
 
-  CmiReleaseBlock(RegistryHive, ValueListCell);
+         KeyCell->NumberOfValues--;
 
-  if (KeyCell->NumberOfValues == 0)
-    {
-      CmiDestroyBlock(RegistryHive,
-                     ValueListCell,
-                     KeyCell->ValuesOffset);
-    }
-  else
-    {
-      CmiMarkBlockDirty(RegistryHive,
-                       KeyCell->ValuesOffset);
+         if (KeyCell->NumberOfValues == 0)
+           {
+             CmiDestroyCell(RegistryHive,
+                            ValueListCell,
+                            KeyCell->ValueListOffset);
+             KeyCell->ValueListOffset = -1;
+           }
+         else
+           {
+             CmiMarkBlockDirty(RegistryHive,
+                               KeyCell->ValueListOffset);
+           }
+
+         CmiMarkBlockDirty(RegistryHive,
+                           KeyCellOffset);
+
+         return STATUS_SUCCESS;
+       }
     }
 
-  CmiMarkBlockDirty(RegistryHive,
-                   KeyCellOffset);
+  DPRINT("Couldn't find the desired value\n");
 
-  return STATUS_SUCCESS;
+  return STATUS_OBJECT_NAME_NOT_FOUND;
 }
 
 
 NTSTATUS
-CmiAllocateHashTableBlock(IN PREGISTRY_HIVE RegistryHive,
+CmiAllocateHashTableCell (IN PREGISTRY_HIVE RegistryHive,
        OUT PHASH_TABLE_CELL *HashBlock,
        OUT BLOCK_OFFSET *HBOffset,
-       IN ULONG HashTableSize)
+       IN ULONG SubKeyCount)
 {
   PHASH_TABLE_CELL NewHashBlock;
   ULONG NewHashSize;
@@ -2585,11 +3019,11 @@ CmiAllocateHashTableBlock(IN PREGISTRY_HIVE RegistryHive,
 
   Status = STATUS_SUCCESS;
   *HashBlock = NULL;
-  NewHashSize = sizeof(HASH_TABLE_CELL) + 
-    (HashTableSize - 1) * sizeof(HASH_RECORD);
-  Status = CmiAllocateBlock(RegistryHive,
-                           (PVOID*) &NewHashBlock,
+  NewHashSize = sizeof(HASH_TABLE_CELL) +
+               (SubKeyCount * sizeof(HASH_RECORD));
+  Status = CmiAllocateCell (RegistryHive,
                            NewHashSize,
+                           (PVOID*) &NewHashBlock,
                            HBOffset);
 
   if ((NewHashBlock == NULL) || (!NT_SUCCESS(Status)))
@@ -2598,8 +3032,10 @@ CmiAllocateHashTableBlock(IN PREGISTRY_HIVE RegistryHive,
     }
   else
     {
-      NewHashBlock->Id = REG_HASH_TABLE_BLOCK_ID;
-      NewHashBlock->HashTableSize = HashTableSize;
+      ASSERT(SubKeyCount <= 0xffff); /* should really be USHORT_MAX or similar */
+      NewHashBlock->CellSize = -NewHashSize;
+      NewHashBlock->Id = REG_HASH_TABLE_CELL_ID;
+      NewHashBlock->HashTableSize = (USHORT)SubKeyCount;
       *HashBlock = NewHashBlock;
     }
 
@@ -2609,8 +3045,8 @@ CmiAllocateHashTableBlock(IN PREGISTRY_HIVE RegistryHive,
 
 PKEY_CELL
 CmiGetKeyFromHashByIndex(PREGISTRY_HIVE RegistryHive,
-       PHASH_TABLE_CELL HashBlock,
-       ULONG Index)
+                        PHASH_TABLE_CELL HashBlock,
+                        ULONG Index)
 {
   BLOCK_OFFSET KeyOffset;
   PKEY_CELL KeyCell;
@@ -2618,16 +3054,15 @@ CmiGetKeyFromHashByIndex(PREGISTRY_HIVE RegistryHive,
   if (HashBlock == NULL)
     return NULL;
 
-  if (IsVolatileHive(RegistryHive))
+  if (IsPointerHive(RegistryHive))
     {
       KeyCell = (PKEY_CELL) HashBlock->Table[Index].KeyOffset;
     }
   else
     {
       KeyOffset =  HashBlock->Table[Index].KeyOffset;
-      KeyCell = CmiGetBlock(RegistryHive, KeyOffset, NULL);
+      KeyCell = CmiGetCell (RegistryHive, KeyOffset, NULL);
     }
-  CmiLockBlock(RegistryHive, KeyCell);
 
   return KeyCell;
 }
@@ -2635,18 +3070,26 @@ CmiGetKeyFromHashByIndex(PREGISTRY_HIVE RegistryHive,
 
 NTSTATUS
 CmiAddKeyToHashTable(PREGISTRY_HIVE RegistryHive,
-       PHASH_TABLE_CELL HashBlock,
-       PKEY_CELL NewKeyCell,
-       BLOCK_OFFSET NKBOffset)
+                    PHASH_TABLE_CELL HashCell,
+                    BLOCK_OFFSET HashCellOffset,
+                    PKEY_CELL NewKeyCell,
+                    BLOCK_OFFSET NKBOffset)
 {
   ULONG i;
 
-  for (i = 0; i < HashBlock->HashTableSize; i++)
+  for (i = 0; i < HashCell->HashTableSize; i++)
     {
-      if (HashBlock->Table[i].KeyOffset == 0)
+      if (HashCell->Table[i].KeyOffset == 0)
        {
-         HashBlock->Table[i].KeyOffset = NKBOffset;
-         RtlCopyMemory(&HashBlock->Table[i].HashValue, NewKeyCell->Name, 4);
+         HashCell->Table[i].KeyOffset = NKBOffset;
+         HashCell->Table[i].HashValue = 0;
+         if (NewKeyCell->Flags & REG_KEY_NAME_PACKED)
+           {
+             RtlCopyMemory(&HashCell->Table[i].HashValue,
+                           NewKeyCell->Name,
+                           min(NewKeyCell->NameSize, sizeof(ULONG)));
+           }
+         CmiMarkBlockDirty(RegistryHive, HashCellOffset);
          return STATUS_SUCCESS;
        }
     }
@@ -2667,7 +3110,7 @@ CmiRemoveKeyFromHashTable(PREGISTRY_HIVE RegistryHive,
       if (HashBlock->Table[i].KeyOffset == NKBOffset)
        {
          HashBlock->Table[i].KeyOffset = 0;
-         RtlZeroMemory(&HashBlock->Table[i].HashValue, 4);
+         HashBlock->Table[i].HashValue = 0;
          return STATUS_SUCCESS;
        }
     }
@@ -2678,9 +3121,9 @@ CmiRemoveKeyFromHashTable(PREGISTRY_HIVE RegistryHive,
 
 NTSTATUS
 CmiAllocateValueCell(PREGISTRY_HIVE RegistryHive,
-  PVALUE_CELL *ValueCell,
-  BLOCK_OFFSET *VBOffset,
-  IN PUNICODE_STRING ValueName)
+                    PVALUE_CELL *ValueCell,
+                    BLOCK_OFFSET *VBOffset,
+                    IN PUNICODE_STRING ValueName)
 {
   PVALUE_CELL NewValueCell;
   NTSTATUS Status;
@@ -2695,9 +3138,9 @@ CmiAllocateValueCell(PREGISTRY_HIVE RegistryHive,
 
   DPRINT("ValueName->Length %lu  NameSize %lu\n", ValueName->Length, NameSize);
 
-  Status = CmiAllocateBlock(RegistryHive,
-                           (PVOID*) &NewValueCell,
+  Status = CmiAllocateCell (RegistryHive,
                            sizeof(VALUE_CELL) + NameSize,
+                           (PVOID*) &NewValueCell,
                            VBOffset);
   if ((NewValueCell == NULL) || (!NT_SUCCESS(Status)))
     {
@@ -2705,8 +3148,9 @@ CmiAllocateValueCell(PREGISTRY_HIVE RegistryHive,
     }
   else
     {
+      ASSERT(NameSize <= 0xffff); /* should really be USHORT_MAX or similar */
       NewValueCell->Id = REG_VALUE_CELL_ID;
-      NewValueCell->NameSize = NameSize;
+      NewValueCell->NameSize = (USHORT)NameSize;
       if (Packable)
        {
          /* Pack the value name */
@@ -2724,7 +3168,7 @@ CmiAllocateValueCell(PREGISTRY_HIVE RegistryHive,
        }
       NewValueCell->DataType = 0;
       NewValueCell->DataSize = 0;
-      NewValueCell->DataOffset = 0xffffffff;
+      NewValueCell->DataOffset = (BLOCK_OFFSET)-1;
       *ValueCell = NewValueCell;
     }
 
@@ -2735,38 +3179,46 @@ CmiAllocateValueCell(PREGISTRY_HIVE RegistryHive,
 NTSTATUS
 CmiDestroyValueCell(PREGISTRY_HIVE RegistryHive,
                    PVALUE_CELL ValueCell,
-                   BLOCK_OFFSET VBOffset)
+                   BLOCK_OFFSET ValueCellOffset)
 {
   NTSTATUS Status;
-  PVOID pBlock;
-  PHBIN pBin;
+  PVOID DataCell;
+  PHBIN Bin;
 
-  DPRINT("CmiDestroyValueCell(Cell %p  Offset %lx)\n", ValueCell, VBOffset);
+  DPRINT("CmiDestroyValueCell(Cell %p  Offset %lx)\n",
+        ValueCell, ValueCellOffset);
 
   VERIFY_VALUE_CELL(ValueCell);
 
   /* Destroy the data cell */
-  if (ValueCell->DataSize > 4)
+  if (!(ValueCell->DataSize & REG_DATA_IN_OFFSET)
+      && ValueCell->DataSize > sizeof(BLOCK_OFFSET))
     {
-      pBlock = CmiGetBlock(RegistryHive, ValueCell->DataOffset, &pBin);
-      Status = CmiDestroyBlock(RegistryHive, pBlock, ValueCell->DataOffset);
+      DataCell = CmiGetCell (RegistryHive, ValueCell->DataOffset, &Bin);
+      if (DataCell == NULL)
+       {
+         DPRINT("CmiGetCell() failed\n");
+         return STATUS_UNSUCCESSFUL;
+       }
+
+      Status = CmiDestroyCell (RegistryHive, DataCell, ValueCell->DataOffset);
       if (!NT_SUCCESS(Status))
        {
-         return  Status;
+         return Status;
        }
 
       /* Update time of heap */
-      if (IsPermanentHive(RegistryHive))
-       ZwQuerySystemTime((PTIME) &pBin->DateModified);
+      if (!IsNoFileHive(RegistryHive))
+       KeQuerySystemTime(&Bin->DateModified);
     }
 
   /* Destroy the value cell */
-  Status = CmiDestroyBlock(RegistryHive, ValueCell, VBOffset);
+  Status = CmiDestroyCell (RegistryHive, ValueCell, ValueCellOffset);
 
   /* Update time of heap */
-  if (IsPermanentHive(RegistryHive) && CmiGetBlock(RegistryHive, VBOffset, &pBin))
+  if (!IsNoFileHive(RegistryHive) && CmiGetCell (RegistryHive, ValueCellOffset, &Bin))
     {
-      ZwQuerySystemTime((PTIME) &pBin->DateModified);
+      KeQuerySystemTime(&Bin->DateModified);
     }
 
   return Status;
@@ -2775,31 +3227,41 @@ CmiDestroyValueCell(PREGISTRY_HIVE RegistryHive,
 
 NTSTATUS
 CmiAddBin(PREGISTRY_HIVE RegistryHive,
-  PVOID *NewBlock,
-  BLOCK_OFFSET *NewBlockOffset)
+         ULONG BlockCount,
+         PVOID *NewBlock,
+         BLOCK_OFFSET *NewBlockOffset)
 {
+  PBLOCK_LIST_ENTRY BlockList;
   PCELL_HEADER tmpBlock;
-  PHBIN * tmpBlockList;
   PHBIN tmpBin;
+  ULONG BinSize;
+  ULONG i;
+
+  DPRINT ("CmiAddBin (BlockCount %lu)\n", BlockCount);
 
-  tmpBin = ExAllocatePool(PagedPool, REG_BLOCK_SIZE);
+  BinSize = BlockCount * REG_BLOCK_SIZE;
+  tmpBin = ExAllocatePool(PagedPool, BinSize);
   if (tmpBin == NULL)
     {
       return STATUS_INSUFFICIENT_RESOURCES;
     }
+  RtlZeroMemory (tmpBin,
+                BinSize);
 
-  tmpBin->BlockId = REG_BIN_ID;
-  tmpBin->BlockOffset = RegistryHive->FileSize - REG_BLOCK_SIZE;
-  RegistryHive->FileSize += REG_BLOCK_SIZE;
-  tmpBin->BlockSize = REG_BLOCK_SIZE;
+  tmpBin->HeaderId = REG_BIN_ID;
+  tmpBin->BinOffset = RegistryHive->FileSize - REG_BLOCK_SIZE;
+  RegistryHive->FileSize += BinSize;
+  tmpBin->BinSize = BinSize;
   tmpBin->Unused1 = 0;
-  ZwQuerySystemTime((PTIME) &tmpBin->DateModified);
+  KeQuerySystemTime(&tmpBin->DateModified);
   tmpBin->Unused2 = 0;
 
-  /* Increase size of list of blocks */
-  tmpBlockList = ExAllocatePool(NonPagedPool,
-         sizeof(PHBIN *) * (RegistryHive->BlockListSize + 1));
-  if (tmpBlockList == NULL)
+  DPRINT ("  BinOffset %lx  BinSize %lx\n", tmpBin->BinOffset,tmpBin->BinSize);
+
+  /* Allocate new block list */
+  BlockList = ExAllocatePool(NonPagedPool,
+                            sizeof(BLOCK_LIST_ENTRY) * (RegistryHive->BlockListSize + BlockCount));
+  if (BlockList == NULL)
     {
       ExFreePool(tmpBin);
       return STATUS_INSUFFICIENT_RESOURCES;
@@ -2807,118 +3269,121 @@ CmiAddBin(PREGISTRY_HIVE RegistryHive,
 
   if (RegistryHive->BlockListSize > 0)
     {
-      memcpy(tmpBlockList,
-            RegistryHive->BlockList,
-            sizeof(PHBIN *)*(RegistryHive->BlockListSize));
+      RtlCopyMemory (BlockList,
+                    RegistryHive->BlockList,
+                    sizeof(BLOCK_LIST_ENTRY) * RegistryHive->BlockListSize);
       ExFreePool(RegistryHive->BlockList);
     }
 
-  RegistryHive->BlockList = tmpBlockList;
-  RegistryHive->BlockList[RegistryHive->BlockListSize++] = tmpBin;
+  RegistryHive->BlockList = BlockList;
+  for (i = 0; i < BlockCount; i++)
+    {
+      RegistryHive->BlockList[RegistryHive->BlockListSize + i].Block =
+       (PVOID)((ULONG_PTR)tmpBin + (i * REG_BLOCK_SIZE));
+      RegistryHive->BlockList[RegistryHive->BlockListSize + i].Bin = tmpBin;
+    }
+  RegistryHive->BlockListSize += BlockCount;
 
   /* Initialize a free block in this heap : */
   tmpBlock = (PCELL_HEADER)((ULONG_PTR) tmpBin + REG_HBIN_DATA_OFFSET);
-  tmpBlock->CellSize = (REG_BLOCK_SIZE - REG_HBIN_DATA_OFFSET);
+  tmpBlock->CellSize = (BinSize - REG_HBIN_DATA_OFFSET);
 
   /* Grow bitmap if necessary */
-  if (IsVolatileHive(RegistryHive) &&
+  if (IsNoFileHive(RegistryHive) &&
       (RegistryHive->BlockListSize % (sizeof(ULONG) * 8) == 0))
     {
       PULONG BitmapBuffer;
       ULONG BitmapSize;
 
-      DPRINT1("Grow hive bitmap\n");
+      DPRINT("Grow hive bitmap\n");
 
       /* Calculate bitmap size in bytes (always a multiple of 32 bits) */
       BitmapSize = ROUND_UP(RegistryHive->BlockListSize, sizeof(ULONG) * 8) / 8;
-      DPRINT1("RegistryHive->BlockListSize: %lu\n", RegistryHive->BlockListSize);
-      DPRINT1("BitmapSize:  %lu Bytes  %lu Bits\n", BitmapSize, BitmapSize * 8);
+      DPRINT("RegistryHive->BlockListSize: %lu\n", RegistryHive->BlockListSize);
+      DPRINT("BitmapSize:  %lu Bytes  %lu Bits\n", BitmapSize, BitmapSize * 8);
       BitmapBuffer = (PULONG)ExAllocatePool(PagedPool,
                                            BitmapSize);
       RtlZeroMemory(BitmapBuffer, BitmapSize);
       RtlCopyMemory(BitmapBuffer,
                    RegistryHive->DirtyBitMap.Buffer,
                    RegistryHive->DirtyBitMap.SizeOfBitMap);
-      ExFreePool(RegistryHive->DirtyBitMap.Buffer);
+      ExFreePool(RegistryHive->BitmapBuffer);
+      RegistryHive->BitmapBuffer = BitmapBuffer;
       RtlInitializeBitMap(&RegistryHive->DirtyBitMap,
-                         BitmapBuffer,
+                         RegistryHive->BitmapBuffer,
                          BitmapSize * 8);
     }
 
   *NewBlock = (PVOID) tmpBlock;
 
   if (NewBlockOffset)
-    *NewBlockOffset = tmpBin->BlockOffset + REG_HBIN_DATA_OFFSET;
-
-  /* FIXME: set first dword to block_offset of another free bloc */
+    *NewBlockOffset = tmpBin->BinOffset + REG_HBIN_DATA_OFFSET;
 
   /* Mark new bin dirty */
   CmiMarkBinDirty(RegistryHive,
-                 tmpBin->BlockOffset);
+                 tmpBin->BinOffset);
 
   return STATUS_SUCCESS;
 }
 
 
 NTSTATUS
-CmiAllocateBlock(PREGISTRY_HIVE RegistryHive,
-                PVOID *Block,
-                LONG BlockSize,
-                BLOCK_OFFSET * pBlockOffset)
+CmiAllocateCell (PREGISTRY_HIVE RegistryHive,
+                LONG CellSize,
+                PVOID *Cell,
+                BLOCK_OFFSET *CellOffset)
 {
-  PCELL_HEADER NewBlock;
+  PCELL_HEADER NewCell;
+  PHBIN Bin;
+  ULONG i;
+  PVOID Temp;
   NTSTATUS Status;
-  PHBIN pBin;
-
-  Status = STATUS_SUCCESS;
 
   /* Round to 16 bytes multiple */
-  BlockSize = (BlockSize + sizeof(DWORD) + 15) & 0xfffffff0;
+  CellSize = ROUND_UP(CellSize, 16);
 
   /* Handle volatile hives first */
-  if (IsVolatileHive(RegistryHive))
+  if (IsPointerHive(RegistryHive))
     {
-      NewBlock = ExAllocatePool(NonPagedPool, BlockSize);
-
-      if (NewBlock == NULL)
-       {
-         Status = STATUS_INSUFFICIENT_RESOURCES;
-       }
-      else
+      NewCell = ExAllocatePool(NonPagedPool, CellSize);
+      if (NewCell == NULL)
        {
-         RtlZeroMemory(NewBlock, BlockSize);
-         NewBlock->CellSize = BlockSize;
-         CmiLockBlock(RegistryHive, NewBlock);
-         *Block = NewBlock;
-         if (pBlockOffset)
-           *pBlockOffset = (BLOCK_OFFSET) NewBlock;
+         return STATUS_INSUFFICIENT_RESOURCES;
        }
+
+      RtlZeroMemory (NewCell,
+                    CellSize);
+      NewCell->CellSize = -CellSize;
+
+      *Cell = NewCell;
+      if (CellOffset != NULL)
+       *CellOffset = (BLOCK_OFFSET) NewCell;
     }
   else
     {
-      ULONG i;
-
       /* first search in free blocks */
-      NewBlock = NULL;
+      NewCell = NULL;
       for (i = 0; i < RegistryHive->FreeListSize; i++)
        {
-         if (RegistryHive->FreeList[i]->CellSize >= BlockSize)
+         if (RegistryHive->FreeList[i]->CellSize >= CellSize)
            {
-             PVOID Temp;
-
-             NewBlock = RegistryHive->FreeList[i];
-             if (pBlockOffset)
-               *pBlockOffset = RegistryHive->FreeListOffset[i];
+             NewCell = RegistryHive->FreeList[i];
+             if (CellOffset != NULL)
+               *CellOffset = RegistryHive->FreeListOffset[i];
 
              /* Update time of heap */
-             Temp = CmiGetBlock(RegistryHive, RegistryHive->FreeListOffset[i], &pBin);
-
-             if (Temp)
+             Temp = CmiGetCell (RegistryHive,
+                                RegistryHive->FreeListOffset[i],
+                                &Bin);
+             if (Temp == NULL)
                {
-                 ZwQuerySystemTime((PTIME) &pBin->DateModified);
-                 CmiMarkBlockDirty(RegistryHive, RegistryHive->FreeListOffset[i]);
+                 DPRINT("CmiGetBlock() failed\n");
+                 return STATUS_UNSUCCESSFUL;
                }
 
+             KeQuerySystemTime(&Bin->DateModified);
+             CmiMarkBlockDirty(RegistryHive, RegistryHive->FreeListOffset[i]);
+
              if ((i + 1) < RegistryHive->FreeListSize)
                {
                  RtlMoveMemory(&RegistryHive->FreeList[i],
@@ -2936,87 +3401,128 @@ CmiAllocateBlock(PREGISTRY_HIVE RegistryHive,
        }
 
       /* Need to extend hive file : */
-      if (NewBlock == NULL)
+      if (NewCell == NULL)
        {
-         /* Add a new block */
-         Status = CmiAddBin(RegistryHive, (PVOID *) &NewBlock , pBlockOffset);
+         /* Add a new bin */
+         Status = CmiAddBin(RegistryHive,
+                            ((CellSize + sizeof(HBIN) - 1) / REG_BLOCK_SIZE) + 1,
+                            (PVOID *)&NewCell,
+                            CellOffset);
+         if (!NT_SUCCESS(Status))
+           return Status;
        }
 
-      if (NT_SUCCESS(Status))
-       {
-         *Block = NewBlock;
+      *Cell = NewCell;
 
-         /* Split the block in two parts */
-         if (NewBlock->CellSize > BlockSize)
-           {
-             NewBlock = (PCELL_HEADER) ((ULONG_PTR) NewBlock+BlockSize);
-             NewBlock->CellSize = ((PCELL_HEADER) (*Block))->CellSize - BlockSize;
-             CmiAddFree(RegistryHive,
-                        NewBlock,
-                        *pBlockOffset + BlockSize,
-                        TRUE);
-             CmiMarkBlockDirty(RegistryHive,
-                               *pBlockOffset + BlockSize);
-           }
-         else if (NewBlock->CellSize < BlockSize)
-           {
-             return(STATUS_UNSUCCESSFUL);
-           }
-
-         RtlZeroMemory(*Block, BlockSize);
-         ((PCELL_HEADER) (*Block))->CellSize = -BlockSize;
-         CmiLockBlock(RegistryHive, *Block);
+      /* Split the block in two parts */
+      if (NewCell->CellSize > CellSize)
+       {
+         NewCell = (PCELL_HEADER) ((ULONG_PTR) NewCell + CellSize);
+         NewCell->CellSize = ((PCELL_HEADER) (*Cell))->CellSize - CellSize;
+         CmiAddFree(RegistryHive,
+                    NewCell,
+                    *CellOffset + CellSize,
+                    TRUE);
+         CmiMarkBlockDirty(RegistryHive,
+                           *CellOffset + CellSize);
+       }
+      else if (NewCell->CellSize < CellSize)
+       {
+         return STATUS_UNSUCCESSFUL;
        }
+
+      RtlZeroMemory(*Cell,
+                   CellSize);
+      ((PCELL_HEADER) (*Cell))->CellSize = -CellSize;
     }
 
-  return(Status);
+  return STATUS_SUCCESS;
 }
 
 
 NTSTATUS
-CmiDestroyBlock(PREGISTRY_HIVE RegistryHive,
-  PVOID Block,
-  BLOCK_OFFSET Offset)
+CmiDestroyCell (PREGISTRY_HIVE RegistryHive,
+               PVOID Cell,
+               BLOCK_OFFSET CellOffset)
 {
   NTSTATUS Status;
   PHBIN pBin;
 
   Status = STATUS_SUCCESS;
 
-  if (IsVolatileHive(RegistryHive))
+  if (IsPointerHive(RegistryHive))
     {
-      CmiReleaseBlock(RegistryHive, Block);
-      ExFreePool(Block);
+      ExFreePool(Cell);
     }
   else
     {
-      PCELL_HEADER pFree = Block;
+      PCELL_HEADER pFree = Cell;
 
       if (pFree->CellSize < 0)
         pFree->CellSize = -pFree->CellSize;
 
       /* Clear block (except the block size) */
-      RtlZeroMemory(((PVOID)pFree) + sizeof(ULONG),
+      RtlZeroMemory(((char*)pFree) + sizeof(ULONG),
                    pFree->CellSize - sizeof(ULONG));
 
-      /* add block to the list of free blocks */
-      CmiAddFree(RegistryHive, Block, Offset, TRUE);
-      CmiReleaseBlock(RegistryHive, Block);
+      /* Add block to the list of free blocks */
+      CmiAddFree(RegistryHive, Cell, CellOffset, TRUE);
 
       /* Update time of heap */
-      if (IsPermanentHive(RegistryHive) && CmiGetBlock(RegistryHive, Offset,&pBin))
-       ZwQuerySystemTime((PTIME) &pBin->DateModified);
-
-      CmiMarkBlockDirty(RegistryHive, Offset);
+      if (!IsNoFileHive(RegistryHive) && CmiGetCell (RegistryHive, CellOffset,&pBin))
+       KeQuerySystemTime(&pBin->DateModified);
 
-      /* FIXME: Set first dword to block_offset of another free block ? */
-      /* FIXME: Concatenate with previous and next block if free */
+      CmiMarkBlockDirty(RegistryHive, CellOffset);
     }
 
   return Status;
 }
 
 
+PVOID
+CmiGetCell (PREGISTRY_HIVE RegistryHive,
+           BLOCK_OFFSET CellOffset,
+           PHBIN *Bin)
+{
+  PHBIN pBin;
+
+  if (Bin != NULL)
+    {
+      *Bin = NULL;
+    }
+
+  if (CellOffset == (BLOCK_OFFSET)-1)
+    {
+      return NULL;
+    }
+
+  if (IsPointerHive (RegistryHive))
+    {
+      return (PVOID)CellOffset;
+    }
+
+  if (CellOffset > RegistryHive->BlockListSize * REG_BLOCK_SIZE)
+    {
+      DPRINT1("CellOffset exceeds valid range (%lu > %lu)\n",
+             CellOffset, RegistryHive->BlockListSize * REG_BLOCK_SIZE);
+      return NULL;
+    }
+
+  pBin = RegistryHive->BlockList[CellOffset / REG_BLOCK_SIZE].Bin;
+  if (pBin == NULL)
+    {
+      return NULL;
+    }
+
+  if (Bin != NULL)
+    {
+      *Bin = pBin;
+    }
+
+  return((PVOID)((ULONG_PTR)pBin + (CellOffset - pBin->BinOffset)));
+}
+
+
 static BOOLEAN
 CmiMergeFree(PREGISTRY_HIVE RegistryHive,
             PCELL_HEADER FreeBlock,
@@ -3032,15 +3538,15 @@ CmiMergeFree(PREGISTRY_HIVE RegistryHive,
   DPRINT("CmiMergeFree(Block %lx  Offset %lx  Size %lx) called\n",
         FreeBlock, FreeOffset, FreeBlock->CellSize);
 
-  CmiGetBlock(RegistryHive,
+  CmiGetCell (RegistryHive,
              FreeOffset,
              &Bin);
   DPRINT("Bin %p\n", Bin);
   if (Bin == NULL)
     return(FALSE);
 
-  BinOffset = Bin->BlockOffset;
-  BinSize = Bin->BlockSize;
+  BinOffset = Bin->BinOffset;
+  BinSize = Bin->BinSize;
   DPRINT("Bin %p  Offset %lx  Size %lx\n", Bin, BinOffset, BinSize);
 
   for (i = 0; i < RegistryHive->FreeListSize; i++)
@@ -3068,6 +3574,10 @@ CmiMergeFree(PREGISTRY_HIVE RegistryHive,
 
              if ((i + 2) < RegistryHive->FreeListSize)
                {
+                 RtlMoveMemory(&RegistryHive->FreeList[i + 1],
+                               &RegistryHive->FreeList[i + 2],
+                               sizeof(RegistryHive->FreeList[0])
+                                 * (RegistryHive->FreeListSize - i - 2));
                  RtlMoveMemory(&RegistryHive->FreeListOffset[i + 1],
                                &RegistryHive->FreeListOffset[i + 2],
                                sizeof(RegistryHive->FreeListOffset[0])
@@ -3122,8 +3632,8 @@ CmiAddFree(PREGISTRY_HIVE RegistryHive,
   LONG maxInd;
   LONG medInd;
 
-  assert(RegistryHive);
-  assert(FreeBlock);
+  ASSERT(RegistryHive);
+  ASSERT(FreeBlock);
 
   DPRINT("FreeBlock %.08lx  FreeOffset %.08lx\n",
         FreeBlock, FreeOffset);
@@ -3143,7 +3653,7 @@ CmiAddFree(PREGISTRY_HIVE RegistryHive,
        return STATUS_INSUFFICIENT_RESOURCES;
 
       tmpListOffset = ExAllocatePool(PagedPool,
-                         sizeof(BLOCK_OFFSET *) * (RegistryHive->FreeListMax + 32));
+                         sizeof(BLOCK_OFFSET) * (RegistryHive->FreeListMax + 32));
 
       if (tmpListOffset == NULL)
        {
@@ -3158,7 +3668,7 @@ CmiAddFree(PREGISTRY_HIVE RegistryHive,
                        sizeof(PCELL_HEADER) * (RegistryHive->FreeListMax));
          RtlMoveMemory(tmpListOffset,
                        RegistryHive->FreeListOffset,
-                       sizeof(BLOCK_OFFSET *) * (RegistryHive->FreeListMax));
+                       sizeof(BLOCK_OFFSET) * (RegistryHive->FreeListMax));
          ExFreePool(RegistryHive->FreeList);
          ExFreePool(RegistryHive->FreeListOffset);
        }
@@ -3218,55 +3728,6 @@ CmiAddFree(PREGISTRY_HIVE RegistryHive,
 }
 
 
-PVOID
-CmiGetBlock(PREGISTRY_HIVE RegistryHive,
-           BLOCK_OFFSET BlockOffset,
-           PHBIN * ppBin)
-{
-  if (ppBin)
-    *ppBin = NULL;
-
-  if ((BlockOffset == 0) || (BlockOffset == (ULONG_PTR) -1))
-    return NULL;
-
-  if (IsVolatileHive(RegistryHive))
-    {
-      return (PVOID) BlockOffset;
-    }
-  else
-    {
-      PHBIN pBin;
-
-      pBin = RegistryHive->BlockList[BlockOffset / 4096];
-      if (ppBin)
-       *ppBin = pBin;
-      return((PVOID)((ULONG_PTR)pBin + (BlockOffset - pBin->BlockOffset)));
-    }
-}
-
-
-VOID
-CmiLockBlock(PREGISTRY_HIVE RegistryHive,
-            PVOID Block)
-{
-  if (IsPermanentHive(RegistryHive))
-    {
-      /* FIXME: Implement */
-    }
-}
-
-
-VOID
-CmiReleaseBlock(PREGISTRY_HIVE RegistryHive,
-               PVOID Block)
-{
-  if (IsPermanentHive(RegistryHive))
-    {
-      /* FIXME: Implement */
-    }
-}
-
-
 VOID
 CmiMarkBlockDirty(PREGISTRY_HIVE RegistryHive,
                  BLOCK_OFFSET BlockOffset)
@@ -3276,14 +3737,14 @@ CmiMarkBlockDirty(PREGISTRY_HIVE RegistryHive,
   ULONG BlockNumber;
   ULONG BlockCount;
 
-  if (IsVolatileHive(RegistryHive))
-      return;
+  if (IsNoFileHive(RegistryHive))
+    return;
 
   DPRINT("CmiMarkBlockDirty(Offset 0x%lx)\n", (ULONG)BlockOffset);
 
-  BlockNumber = (ULONG)BlockOffset / 4096;
+  BlockNumber = (ULONG)BlockOffset / REG_BLOCK_SIZE;
 
-  Cell = CmiGetBlock(RegistryHive,
+  Cell = CmiGetCell (RegistryHive,
                     BlockOffset,
                     NULL);
 
@@ -3291,7 +3752,8 @@ CmiMarkBlockDirty(PREGISTRY_HIVE RegistryHive,
   if (CellSize < 0)
     CellSize = -CellSize;
 
-  BlockCount = (ROUND_UP(BlockOffset + CellSize, 4096) - ROUND_DOWN(BlockOffset, 4096)) / 4096;
+  BlockCount = (ROUND_UP(BlockOffset + CellSize, REG_BLOCK_SIZE) -
+               ROUND_DOWN(BlockOffset, REG_BLOCK_SIZE)) / REG_BLOCK_SIZE;
 
   DPRINT("  BlockNumber %lu  Size %lu (%s)  BlockCount %lu\n",
         BlockNumber,
@@ -3314,20 +3776,20 @@ CmiMarkBinDirty(PREGISTRY_HIVE RegistryHive,
   ULONG BlockCount;
   PHBIN Bin;
 
-  if (IsVolatileHive(RegistryHive))
-      return;
+  if (IsNoFileHive(RegistryHive))
+    return;
 
   DPRINT("CmiMarkBinDirty(Offset 0x%lx)\n", (ULONG)BinOffset);
 
-  BlockNumber = (ULONG)BinOffset / 4096;
+  BlockNumber = (ULONG)BinOffset / REG_BLOCK_SIZE;
 
-  Bin = RegistryHive->BlockList[BlockNumber];
+  Bin = RegistryHive->BlockList[BlockNumber].Bin;
 
-  BlockCount = Bin->BlockSize / 4096;
+  BlockCount = Bin->BinSize / REG_BLOCK_SIZE;
 
-  DPRINT("  BlockNumber %lu  Size %lu  BlockCount %lu\n",
+  DPRINT("  BlockNumber %lu  BinSize %lu  BlockCount %lu\n",
         BlockNumber,
-        Bin->BlockSize,
+        Bin->BinSize,
         BlockCount);
 
   RegistryHive->HiveDirty = TRUE;
@@ -3346,23 +3808,23 @@ CmiGetPackedNameLength(IN PUNICODE_STRING Name,
   if (Packable != NULL)
     *Packable = TRUE;
 
-  for (i = 0; i < Name->Length; i++)
+  for (i = 0; i < Name->Length / sizeof(WCHAR); i++)
     {
-      if (Name->Buffer[i] > 0xFF)
+      if (Name->Buffer[i] & 0xFF00)
        {
          if (Packable != NULL)
            *Packable = FALSE;
-         return(Name->Length);
+         return Name->Length;
        }
     }
 
-  return(Name->Length / sizeof(WCHAR));
+  return (Name->Length / sizeof(WCHAR));
 }
 
 
 BOOLEAN
 CmiComparePackedNames(IN PUNICODE_STRING Name,
-                     IN PCHAR NameBuffer,
+                     IN PUCHAR NameBuffer,
                      IN USHORT NameBufferSize,
                      IN BOOLEAN NamePacked)
 {
@@ -3400,7 +3862,7 @@ CmiComparePackedNames(IN PUNICODE_STRING Name,
 
 VOID
 CmiCopyPackedName(PWCHAR NameBuffer,
-                 PCHAR PackedNameBuffer,
+                 PUCHAR PackedNameBuffer,
                  ULONG PackedNameSize)
 {
   ULONG i;
@@ -3409,4 +3871,436 @@ CmiCopyPackedName(PWCHAR NameBuffer,
     NameBuffer[i] = (WCHAR)PackedNameBuffer[i];
 }
 
+
+BOOLEAN
+CmiCompareHash(PUNICODE_STRING KeyName,
+              PCHAR HashString)
+{
+  CHAR Buffer[4];
+
+  Buffer[0] = (KeyName->Length >= 2) ? (CHAR)KeyName->Buffer[0] : 0;
+  Buffer[1] = (KeyName->Length >= 4) ? (CHAR)KeyName->Buffer[1] : 0;
+  Buffer[2] = (KeyName->Length >= 6) ? (CHAR)KeyName->Buffer[2] : 0;
+  Buffer[3] = (KeyName->Length >= 8) ? (CHAR)KeyName->Buffer[3] : 0;
+
+  return (strncmp(Buffer, HashString, 4) == 0);
+}
+
+
+BOOLEAN
+CmiCompareHashI(PUNICODE_STRING KeyName,
+               PCHAR HashString)
+{
+  CHAR Buffer[4];
+
+  Buffer[0] = (KeyName->Length >= 2) ? (CHAR)KeyName->Buffer[0] : 0;
+  Buffer[1] = (KeyName->Length >= 4) ? (CHAR)KeyName->Buffer[1] : 0;
+  Buffer[2] = (KeyName->Length >= 6) ? (CHAR)KeyName->Buffer[2] : 0;
+  Buffer[3] = (KeyName->Length >= 8) ? (CHAR)KeyName->Buffer[3] : 0;
+
+  return (_strnicmp(Buffer, HashString, 4) == 0);
+}
+
+
+BOOLEAN
+CmiCompareKeyNames(PUNICODE_STRING KeyName,
+                  PKEY_CELL KeyCell)
+{
+  PWCHAR UnicodeName;
+  USHORT i;
+
+  DPRINT("Flags: %hx\n", KeyCell->Flags);
+
+  if (KeyCell->Flags & REG_KEY_NAME_PACKED)
+    {
+      if (KeyName->Length != KeyCell->NameSize * sizeof(WCHAR))
+       return FALSE;
+
+      for (i = 0; i < KeyCell->NameSize; i++)
+       {
+         if (KeyName->Buffer[i] != (WCHAR)KeyCell->Name[i])
+           return FALSE;
+       }
+    }
+  else
+    {
+      if (KeyName->Length != KeyCell->NameSize)
+       return FALSE;
+
+      UnicodeName = (PWCHAR)KeyCell->Name;
+      for (i = 0; i < KeyCell->NameSize / sizeof(WCHAR); i++)
+       {
+         if (KeyName->Buffer[i] != UnicodeName[i])
+           return FALSE;
+       }
+    }
+
+  return TRUE;
+}
+
+
+BOOLEAN
+CmiCompareKeyNamesI(PUNICODE_STRING KeyName,
+                   PKEY_CELL KeyCell)
+{
+  PWCHAR UnicodeName;
+  USHORT i;
+
+  DPRINT("Flags: %hx\n", KeyCell->Flags);
+
+  if (KeyCell->Flags & REG_KEY_NAME_PACKED)
+    {
+      if (KeyName->Length != KeyCell->NameSize * sizeof(WCHAR))
+       return FALSE;
+
+      for (i = 0; i < KeyCell->NameSize; i++)
+       {
+         if (RtlUpcaseUnicodeChar(KeyName->Buffer[i]) !=
+             RtlUpcaseUnicodeChar((WCHAR)KeyCell->Name[i]))
+           return FALSE;
+       }
+    }
+  else
+    {
+      if (KeyName->Length != KeyCell->NameSize)
+       return FALSE;
+
+      UnicodeName = (PWCHAR)KeyCell->Name;
+      for (i = 0; i < KeyCell->NameSize / sizeof(WCHAR); i++)
+       {
+         if (RtlUpcaseUnicodeChar(KeyName->Buffer[i]) !=
+             RtlUpcaseUnicodeChar(UnicodeName[i]))
+           return FALSE;
+       }
+    }
+
+  return TRUE;
+}
+
+
+NTSTATUS
+CmiCopyKey (PREGISTRY_HIVE DstHive,
+           PKEY_CELL DstKeyCell,
+           PREGISTRY_HIVE SrcHive,
+           PKEY_CELL SrcKeyCell)
+{
+  PKEY_CELL NewKeyCell;
+  ULONG NewKeyCellSize;
+  BLOCK_OFFSET NewKeyCellOffset;
+  PHASH_TABLE_CELL NewHashTableCell;
+  ULONG NewHashTableSize;
+  BLOCK_OFFSET NewHashTableOffset;
+  ULONG i;
+  NTSTATUS Status;
+
+  DPRINT ("CmiCopyKey() called\n");
+
+  if (DstKeyCell == NULL)
+    {
+      /* Allocate and copy key cell */
+      NewKeyCellSize = sizeof(KEY_CELL) + SrcKeyCell->NameSize;
+      Status = CmiAllocateCell (DstHive,
+                               NewKeyCellSize,
+                               (PVOID) &NewKeyCell,
+                               &NewKeyCellOffset);
+      if (!NT_SUCCESS(Status))
+       {
+         DPRINT1 ("CmiAllocateBlock() failed (Status %lx)\n", Status);
+         return Status;
+       }
+      if (NewKeyCell == NULL)
+       {
+         DPRINT1 ("Failed to allocate a key cell\n");
+         return STATUS_INSUFFICIENT_RESOURCES;
+       }
+
+      RtlCopyMemory (NewKeyCell,
+                    SrcKeyCell,
+                    NewKeyCellSize);
+
+      DstHive->HiveHeader->RootKeyOffset = NewKeyCellOffset;
+
+      /* Copy class name */
+      if (SrcKeyCell->ClassNameOffset != (BLOCK_OFFSET) -1)
+       {
+         PDATA_CELL SrcClassNameCell;
+         PDATA_CELL NewClassNameCell;
+         BLOCK_OFFSET NewClassNameOffset;
+
+         SrcClassNameCell = CmiGetCell (SrcHive, SrcKeyCell->ClassNameOffset, NULL),
+
+         NewKeyCell->ClassSize = SrcKeyCell->ClassSize;
+         Status = CmiAllocateCell (DstHive,
+                                   sizeof(CELL_HEADER) + NewKeyCell->ClassSize,
+                                   (PVOID)&NewClassNameCell,
+                                   &NewClassNameOffset);
+         if (!NT_SUCCESS(Status))
+           {
+             DPRINT1 ("CmiAllocateBlock() failed (Status %lx)\n", Status);
+             return Status;
+           }
+
+         RtlCopyMemory (NewClassNameCell,
+                        SrcClassNameCell,
+                        NewKeyCell->ClassSize);
+         NewKeyCell->ClassNameOffset = NewClassNameOffset;
+       }
+    }
+  else
+    {
+      NewKeyCell = DstKeyCell;
+    }
+
+  /* Allocate hash table */
+  if (SrcKeyCell->NumberOfSubKeys > 0)
+    {
+      NewHashTableSize = ROUND_UP(SrcKeyCell->NumberOfSubKeys + 1, 4) - 1;
+      Status = CmiAllocateHashTableCell (DstHive,
+                                        &NewHashTableCell,
+                                        &NewHashTableOffset,
+                                        NewHashTableSize);
+      if (!NT_SUCCESS(Status))
+       {
+         DPRINT1 ("CmiAllocateHashTableBlock() failed (Status %lx)\n", Status);
+         return Status;
+       }
+      NewKeyCell->HashTableOffset = NewHashTableOffset;
+    }
+  else
+    {
+      NewHashTableCell = NULL;
+    }
+
+  /* Allocate and copy value list and values */
+  if (SrcKeyCell->NumberOfValues != 0)
+    {
+      PVALUE_LIST_CELL NewValueListCell;
+      PVALUE_LIST_CELL SrcValueListCell;
+      PVALUE_CELL NewValueCell;
+      PVALUE_CELL SrcValueCell;
+      PDATA_CELL SrcValueDataCell;
+      PDATA_CELL NewValueDataCell;
+      BLOCK_OFFSET ValueCellOffset;
+      BLOCK_OFFSET ValueDataCellOffset;
+      ULONG NewValueListCellSize;
+      ULONG NewValueCellSize;
+
+
+      NewValueListCellSize =
+       ROUND_UP(SrcKeyCell->NumberOfValues, 4) * sizeof(BLOCK_OFFSET);
+      Status = CmiAllocateCell (DstHive,
+                               NewValueListCellSize,
+                               (PVOID)&NewValueListCell,
+                               &NewKeyCell->ValueListOffset);
+      if (!NT_SUCCESS(Status))
+       {
+         DPRINT1 ("CmiAllocateBlock() failed (Status %lx)\n", Status);
+         return Status;
+       }
+
+      RtlZeroMemory (NewValueListCell,
+                    NewValueListCellSize);
+
+      /* Copy values */
+      SrcValueListCell = CmiGetCell (SrcHive, SrcKeyCell->ValueListOffset, NULL);
+      for (i = 0; i < SrcKeyCell->NumberOfValues; i++)
+       {
+         /* Copy value cell */
+         SrcValueCell = CmiGetCell (SrcHive, SrcValueListCell->ValueOffset[i], NULL);
+
+         NewValueCellSize = sizeof(VALUE_CELL) + SrcValueCell->NameSize;
+         Status = CmiAllocateCell (DstHive,
+                                   NewValueCellSize,
+                                   (PVOID*) &NewValueCell,
+                                   &ValueCellOffset);
+         if (!NT_SUCCESS(Status))
+           {
+             DPRINT1 ("CmiAllocateBlock() failed (Status %lx)\n", Status);
+             return Status;
+           }
+
+         NewValueListCell->ValueOffset[i] = ValueCellOffset;
+         RtlCopyMemory (NewValueCell,
+                        SrcValueCell,
+                        NewValueCellSize);
+
+         /* Copy value data cell */
+         if (SrcValueCell->DataSize > (LONG) sizeof(PVOID))
+           {
+             SrcValueDataCell = CmiGetCell (SrcHive, SrcValueCell->DataOffset, NULL);
+
+             Status = CmiAllocateCell (DstHive,
+                                       sizeof(CELL_HEADER) + SrcValueCell->DataSize,
+                                       (PVOID*) &NewValueDataCell,
+                                       &ValueDataCellOffset);
+             if (!NT_SUCCESS(Status))
+               {
+                 DPRINT1 ("CmiAllocateBlock() failed (Status %lx)\n", Status);
+                 return Status;
+               }
+             RtlCopyMemory (NewValueDataCell,
+                            SrcValueDataCell,
+                            SrcValueCell->DataSize);
+             NewValueCell->DataOffset = ValueDataCellOffset;
+           }
+       }
+    }
+
+  /* Copy subkeys */
+  if (SrcKeyCell->NumberOfSubKeys > 0)
+    {
+      PHASH_TABLE_CELL SrcHashTableCell;
+      PKEY_CELL SrcSubKeyCell;
+      PKEY_CELL NewSubKeyCell;
+      ULONG NewSubKeyCellSize;
+      BLOCK_OFFSET NewSubKeyCellOffset;
+      PHASH_RECORD SrcHashRecord;
+
+      SrcHashTableCell = CmiGetCell (SrcHive,
+                                    SrcKeyCell->HashTableOffset,
+                                    NULL);
+
+      for (i = 0; i < SrcKeyCell->NumberOfSubKeys; i++)
+       {
+         SrcHashRecord = &SrcHashTableCell->Table[i];
+         SrcSubKeyCell = CmiGetCell (SrcHive, SrcHashRecord->KeyOffset, NULL);
+
+         /* Allocate and copy key cell */
+         NewSubKeyCellSize = sizeof(KEY_CELL) + SrcSubKeyCell->NameSize;
+         Status = CmiAllocateCell (DstHive,
+                                   NewSubKeyCellSize,
+                                   (PVOID)&NewSubKeyCell,
+                                   &NewSubKeyCellOffset);
+         if (!NT_SUCCESS(Status))
+           {
+             DPRINT1 ("CmiAllocateBlock() failed (Status %lx)\n", Status);
+             return Status;
+           }
+         if (NewKeyCell == NULL)
+           {
+             DPRINT1 ("Failed to allocate a sub key cell\n");
+             return STATUS_INSUFFICIENT_RESOURCES;
+           }
+
+         NewHashTableCell->Table[i].KeyOffset = NewSubKeyCellOffset;
+         NewHashTableCell->Table[i].HashValue = SrcHashRecord->HashValue;
+
+         RtlCopyMemory (NewSubKeyCell,
+                        SrcSubKeyCell,
+                        NewSubKeyCellSize);
+
+         /* Copy class name */
+         if (SrcSubKeyCell->ClassNameOffset != (BLOCK_OFFSET) -1)
+           {
+             PDATA_CELL SrcClassNameCell;
+             PDATA_CELL NewClassNameCell;
+             BLOCK_OFFSET NewClassNameOffset;
+
+             SrcClassNameCell = CmiGetCell (SrcHive,
+                                            SrcSubKeyCell->ClassNameOffset,
+                                            NULL),
+
+             NewSubKeyCell->ClassSize = SrcSubKeyCell->ClassSize;
+             Status = CmiAllocateCell (DstHive,
+                                       sizeof(CELL_HEADER) + NewSubKeyCell->ClassSize,
+                                       (PVOID)&NewClassNameCell,
+                                       &NewClassNameOffset);
+             if (!NT_SUCCESS(Status))
+               {
+                 DPRINT1 ("CmiAllocateBlock() failed (Status %lx)\n", Status);
+                 return Status;
+               }
+
+             NewSubKeyCell->ClassNameOffset = NewClassNameOffset;
+             RtlCopyMemory (NewClassNameCell,
+                            SrcClassNameCell,
+                            NewSubKeyCell->ClassSize);
+           }
+
+         /* Copy subkey data and subkeys */
+         Status = CmiCopyKey (DstHive,
+                              NewSubKeyCell,
+                              SrcHive,
+                              SrcSubKeyCell);
+         if (!NT_SUCCESS(Status))
+           {
+             DPRINT1 ("CmiAllocateBlock() failed (Status %lx)\n", Status);
+             return Status;
+           }
+       }
+    }
+
+  return STATUS_SUCCESS;
+}
+
+
+NTSTATUS
+CmiSaveTempHive (PREGISTRY_HIVE Hive,
+                HANDLE FileHandle)
+{
+  IO_STATUS_BLOCK IoStatusBlock;
+  LARGE_INTEGER FileOffset;
+  ULONG BlockIndex;
+  PVOID BlockPtr;
+  NTSTATUS Status;
+
+  DPRINT ("CmiSaveTempHive() called\n");
+
+  Hive->HiveHeader->Checksum = CmiCalcChecksum ((PULONG)Hive->HiveHeader);
+
+  /* Write hive block */
+  FileOffset.QuadPart = (ULONGLONG)0;
+  Status = ZwWriteFile (FileHandle,
+                       NULL,
+                       NULL,
+                       NULL,
+                       &IoStatusBlock,
+                       Hive->HiveHeader,
+                       sizeof(HIVE_HEADER),
+                       &FileOffset,
+                       NULL);
+  if (!NT_SUCCESS(Status))
+    {
+      DPRINT1 ("ZwWriteFile() failed (Status %lx)\n", Status);
+      return Status;
+    }
+
+  DPRINT ("Saving %lu blocks\n", Hive->BlockListSize);
+  for (BlockIndex = 0; BlockIndex < Hive->BlockListSize; BlockIndex++)
+    {
+      BlockPtr = Hive->BlockList[BlockIndex].Block;
+      DPRINT ("BlockPtr %p\n", BlockPtr);
+
+      FileOffset.QuadPart = (ULONGLONG)(BlockIndex + 1) * (ULONGLONG)REG_BLOCK_SIZE;
+      DPRINT ("File offset %I64x\n", FileOffset.QuadPart);
+
+      /* Write hive block */
+      Status = ZwWriteFile (FileHandle,
+                           NULL,
+                           NULL,
+                           NULL,
+                           &IoStatusBlock,
+                           BlockPtr,
+                           REG_BLOCK_SIZE,
+                           &FileOffset,
+                           NULL);
+      if (!NT_SUCCESS(Status))
+       {
+         DPRINT1 ("ZwWriteFile() failed (Status %lx)\n", Status);
+         return Status;
+       }
+    }
+
+  Status = ZwFlushBuffersFile (FileHandle,
+                              &IoStatusBlock);
+  if (!NT_SUCCESS(Status))
+    {
+      DPRINT1 ("ZwFlushBuffersFile() failed (Status %lx)\n", Status);
+    }
+
+  DPRINT ("CmiSaveTempHive() done\n");
+
+  return Status;
+}
+
 /* EOF */