Fix splitting of cells (noticed by Hartmut).
[reactos.git] / reactos / ntoskrnl / cm / regfile.c
index 8799e4f..85b3409 100644 (file)
@@ -1,19 +1,14 @@
-/*
- * COPYRIGHT:        See COPYING in the top level directory
- * PROJECT:          ReactOS kernel
- * FILE:             ntoskrnl/cm/regfile.c
- * PURPOSE:          Registry file manipulation routines
- * UPDATE HISTORY:
-*/
-
-#include <ddk/ntddk.h>
-#include <string.h>
-#include <roscfg.h>
-#include <internal/ob.h>
-#include <internal/registry.h>
-#include <ntos/minmax.h>
-#include <reactos/bugcodes.h>
-
+/* $Id$
+ *
+ * COPYRIGHT:       See COPYING in the top level directory
+ * PROJECT:         ReactOS kernel
+ * FILE:            ntoskrnl/cm/regfile.c
+ * PURPOSE:         Registry file manipulation routines
+ *
+ * PROGRAMMERS:     No programmer listed.
+ */
+
+#include <ntoskrnl.h>
 #define NDEBUG
 #include <internal/debug.h>
 
@@ -25,8 +20,6 @@
 
 /* LOCAL MACROS *************************************************************/
 
-#define ROUND_DOWN(N, S) ((N) - ((N) % (S)))
-
 #define ABS_VALUE(V) (((V) < 0) ? -(V) : (V))
 
 BOOLEAN CmiDoVerify = FALSE;
@@ -39,46 +32,45 @@ CmiCalcChecksum(PULONG Buffer);
 VOID
 CmiCreateDefaultHiveHeader(PHIVE_HEADER Header)
 {
-  assert(Header);
+  ASSERT(Header);
   RtlZeroMemory(Header, sizeof(HIVE_HEADER));
   Header->BlockId = REG_HIVE_ID;
   Header->UpdateCounter1 = 0;
   Header->UpdateCounter2 = 0;
   Header->DateModified.u.LowPart = 0;
   Header->DateModified.u.HighPart = 0;
-  Header->Unused3 = 1;
-  Header->Unused4 = 3;
-  Header->Unused5 = 0;
-  Header->Unused6 = 1;
+  Header->MajorVersion = 1;
+  Header->MinorVersion = 3;
+  Header->Type = 0;
+  Header->Format = 1;
   Header->Unused7 = 1;
   Header->RootKeyOffset = (BLOCK_OFFSET)-1;
   Header->BlockSize = REG_BLOCK_SIZE;
-  Header->Unused6 = 1;
   Header->Checksum = 0;
 }
 
 
 VOID
-CmiCreateDefaultBinCell(PHBIN BinCell)
+CmiCreateDefaultBinHeader(PHBIN BinHeader)
 {
-  assert(BinCell);
-  RtlZeroMemory(BinCell, sizeof(HBIN));
-  BinCell->BlockId = REG_BIN_ID;
-  BinCell->DateModified.u.LowPart = 0;
-  BinCell->DateModified.u.HighPart = 0;
-  BinCell->BlockSize = REG_BLOCK_SIZE;
+  ASSERT(BinHeader);
+  RtlZeroMemory(BinHeader, sizeof(HBIN));
+  BinHeader->HeaderId = REG_BIN_ID;
+  BinHeader->DateModified.u.LowPart = 0;
+  BinHeader->DateModified.u.HighPart = 0;
+  BinHeader->BinSize = REG_BLOCK_SIZE;
 }
 
 
 VOID
 CmiCreateDefaultRootKeyCell(PKEY_CELL RootKeyCell)
 {
-  assert(RootKeyCell);
+  ASSERT(RootKeyCell);
   RtlZeroMemory(RootKeyCell, sizeof(KEY_CELL));
   RootKeyCell->CellSize = -sizeof(KEY_CELL);
   RootKeyCell->Id = REG_KEY_CELL_ID;
   RootKeyCell->Flags = REG_KEY_ROOT_CELL | REG_KEY_NAME_PACKED;
-  NtQuerySystemTime(&RootKeyCell->LastWriteTime);
+  KeQuerySystemTime(&RootKeyCell->LastWriteTime);
   RootKeyCell->ParentKeyOffset = 0;
   RootKeyCell->NumberOfSubKeys = 0;
   RootKeyCell->HashTableOffset = -1;
@@ -92,30 +84,30 @@ CmiCreateDefaultRootKeyCell(PKEY_CELL RootKeyCell)
 
 
 VOID
-CmiVerifyBinCell(PHBIN BinCell)
+CmiVerifyBinHeader(PHBIN BinHeader)
 {
   if (CmiDoVerify)
     {
 
-  assert(BinCell);
+  ASSERT(BinHeader);
 
-  if (BinCell->BlockId != REG_BIN_ID)
+  if (BinHeader->HeaderId != REG_BIN_ID)
     {
-      DbgPrint("BlockId is %.08x (should be %.08x)\n",
-        BinCell->BlockId, REG_BIN_ID);
-      assert(BinCell->BlockId == REG_BIN_ID);
+      DbgPrint("Bin header ID is %.08x (should be %.08x)\n",
+        BinHeader->HeaderId, REG_BIN_ID);
+      ASSERT(BinHeader->HeaderId == REG_BIN_ID);
     }
 
-  //BinCell->DateModified.dwLowDateTime
+  //BinHeader->DateModified.dwLowDateTime
 
-  //BinCell->DateModified.dwHighDateTime
+  //BinHeader->DateModified.dwHighDateTime
 
-  
-  if (BinCell->BlockSize != REG_BLOCK_SIZE)
+
+  if (BinHeader->BinSize != REG_BLOCK_SIZE)
     {
-      DbgPrint("BlockSize is %.08x (should be %.08x)\n",
-        BinCell->BlockSize, REG_BLOCK_SIZE);
-      assert(BinCell->BlockSize == REG_BLOCK_SIZE);
+      DbgPrint("BinSize is %.08x (should be a multiple of %.08x)\n",
+        BinHeader->BinSize, REG_BLOCK_SIZE);
+      ASSERT(BinHeader->BinSize % REG_BLOCK_SIZE == 0);
     }
 
     }
@@ -128,20 +120,20 @@ CmiVerifyKeyCell(PKEY_CELL KeyCell)
   if (CmiDoVerify)
     {
 
-  assert(KeyCell);
+  ASSERT(KeyCell);
 
   if (KeyCell->CellSize == 0)
     {
       DbgPrint("CellSize is %d (must not be 0)\n",
         KeyCell->CellSize);
-      assert(KeyCell->CellSize != 0);
+      ASSERT(KeyCell->CellSize != 0);
     }
 
   if (KeyCell->Id != REG_KEY_CELL_ID)
     {
       DbgPrint("Id is %.08x (should be %.08x)\n",
         KeyCell->Id, REG_KEY_CELL_ID);
-      assert(KeyCell->Id == REG_KEY_CELL_ID);
+      ASSERT(KeyCell->Id == REG_KEY_CELL_ID);
     }
 
   //KeyCell->Flags;
@@ -152,14 +144,14 @@ CmiVerifyKeyCell(PKEY_CELL KeyCell)
     {
       DbgPrint("ParentKeyOffset is %d (must not be < 0)\n",
         KeyCell->ParentKeyOffset);
-      assert(KeyCell->ParentKeyOffset >= 0);
+      ASSERT(KeyCell->ParentKeyOffset >= 0);
     }
 
   if (KeyCell->NumberOfSubKeys < 0)
     {
       DbgPrint("NumberOfSubKeys is %d (must not be < 0)\n",
         KeyCell->NumberOfSubKeys);
-      assert(KeyCell->NumberOfSubKeys >= 0);
+      ASSERT(KeyCell->NumberOfSubKeys >= 0);
     }
 
   //KeyCell->HashTableOffset;
@@ -168,7 +160,7 @@ CmiVerifyKeyCell(PKEY_CELL KeyCell)
     {
       DbgPrint("NumberOfValues is %d (must not be < 0)\n",
         KeyCell->NumberOfValues);
-      assert(KeyCell->NumberOfValues >= 0);
+      ASSERT(KeyCell->NumberOfValues >= 0);
     }
 
   //KeyCell->ValuesOffset = -1;
@@ -177,7 +169,7 @@ CmiVerifyKeyCell(PKEY_CELL KeyCell)
     {
       DbgPrint("SecurityKeyOffset is %d (must not be < 0)\n",
         KeyCell->SecurityKeyOffset);
-      assert(KeyCell->SecurityKeyOffset >= 0);
+      ASSERT(KeyCell->SecurityKeyOffset >= 0);
     }
 
   //KeyCell->ClassNameOffset = -1;
@@ -202,7 +194,7 @@ CmiVerifyRootKeyCell(PKEY_CELL RootKeyCell)
     {
       DbgPrint("Flags is %.08x (should be %.08x)\n",
         RootKeyCell->Flags, REG_KEY_ROOT_CELL | REG_KEY_NAME_PACKED);
-      assert(!(RootKeyCell->Flags & (REG_KEY_ROOT_CELL | REG_KEY_NAME_PACKED)));
+      ASSERT(!(RootKeyCell->Flags & (REG_KEY_ROOT_CELL | REG_KEY_NAME_PACKED)));
     }
 
     }
@@ -215,20 +207,20 @@ CmiVerifyValueCell(PVALUE_CELL ValueCell)
   if (CmiDoVerify)
     {
 
-  assert(ValueCell);
+  ASSERT(ValueCell);
 
   if (ValueCell->CellSize == 0)
     {
       DbgPrint("CellSize is %d (must not be 0)\n",
         ValueCell->CellSize);
-      assert(ValueCell->CellSize != 0);
+      ASSERT(ValueCell->CellSize != 0);
     }
 
   if (ValueCell->Id != REG_VALUE_CELL_ID)
     {
       DbgPrint("Id is %.08x (should be %.08x)\n",
         ValueCell->Id, REG_VALUE_CELL_ID);
-      assert(ValueCell->Id == REG_VALUE_CELL_ID);
+      ASSERT(ValueCell->Id == REG_VALUE_CELL_ID);
     }
 
   //ValueCell->NameSize;
@@ -252,7 +244,7 @@ CmiVerifyValueListCell(PVALUE_LIST_CELL ValueListCell)
     {
       DbgPrint("CellSize is %d (must not be 0)\n",
         ValueListCell->CellSize);
-      assert(ValueListCell->CellSize != 0);
+      ASSERT(ValueListCell->CellSize != 0);
     }
 
     }
@@ -269,21 +261,21 @@ CmiVerifyKeyObject(PKEY_OBJECT KeyObject)
     {
       DbgPrint("RegistryHive is NULL (must not be NULL)\n",
         KeyObject->RegistryHive);
-      assert(KeyObject->RegistryHive != NULL);
+      ASSERT(KeyObject->RegistryHive != NULL);
     }
 
   if (KeyObject->KeyCell == NULL)
     {
       DbgPrint("KeyCell is NULL (must not be NULL)\n",
         KeyObject->KeyCell);
-      assert(KeyObject->KeyCell != NULL);
+      ASSERT(KeyObject->KeyCell != NULL);
     }
 
   if (KeyObject->ParentKey == NULL)
     {
       DbgPrint("ParentKey is NULL (must not be NULL)\n",
         KeyObject->ParentKey);
-      assert(KeyObject->ParentKey != NULL);
+      ASSERT(KeyObject->ParentKey != NULL);
     }
 
     }
@@ -301,42 +293,42 @@ CmiVerifyHiveHeader(PHIVE_HEADER Header)
       DbgPrint("BlockId is %.08x (must be %.08x)\n",
         Header->BlockId,
         REG_HIVE_ID);
-      assert(Header->BlockId == REG_HIVE_ID);
+      ASSERT(Header->BlockId == REG_HIVE_ID);
     }
 
-  if (Header->Unused3 != 1)
+  if (Header->MajorVersion != 1)
     {
-      DbgPrint("Unused3 is %.08x (must be 1)\n",
-        Header->Unused3);
-      assert(Header->Unused3 == 1);
+      DbgPrint("MajorVersion is %.08x (must be 1)\n",
+        Header->MajorVersion);
+      ASSERT(Header->MajorVersion == 1);
     }
 
-  if (Header->Unused4 != 3)
+  if (Header->MinorVersion != 3)
     {
-      DbgPrint("Unused4 is %.08x (must be 3)\n",
-        Header->Unused4);
-      assert(Header->Unused4 == 3);
+      DbgPrint("MinorVersion is %.08x (must be 3)\n",
+        Header->MajorVersion);
+      ASSERT(Header->MajorVersion == 3);
     }
 
-  if (Header->Unused5 != 0)
+  if (Header->Type != 0)
     {
-      DbgPrint("Unused5 is %.08x (must be 0)\n",
-        Header->Unused5);
-      assert(Header->Unused5 == 0);
+      DbgPrint("Type is %.08x (must be 0)\n",
+        Header->Type);
+      ASSERT(Header->Type == 0);
     }
 
-  if (Header->Unused6 != 1)
+  if (Header->Format != 1)
     {
-      DbgPrint("Unused6 is %.08x (must be 1)\n",
-        Header->Unused6);
-      assert(Header->Unused6 == 1);
+      DbgPrint("Format is %.08x (must be 1)\n",
+        Header->Format);
+      ASSERT(Header->Format == 1);
     }
 
   if (Header->Unused7 != 1)
     {
       DbgPrint("Unused7 is %.08x (must be 1)\n",
         Header->Unused7);
-      assert(Header->Unused7 == 1);
+      ASSERT(Header->Unused7 == 1);
     }
 
     }
@@ -363,24 +355,27 @@ CmiCreateNewRegFile(HANDLE FileHandle)
   PHIVE_HEADER HiveHeader;
   PKEY_CELL RootKeyCell;
   NTSTATUS Status;
-  PHBIN BinCell;
+  PHBIN BinHeader;
   PCHAR Buffer;
 
   Buffer = (PCHAR) ExAllocatePool(NonPagedPool, 2 * REG_BLOCK_SIZE);
   if (Buffer == NULL)
     return STATUS_INSUFFICIENT_RESOURCES;
 
+  RtlZeroMemory (Buffer,
+                2 * REG_BLOCK_SIZE);
+
   HiveHeader = (PHIVE_HEADER)Buffer;
-  BinCell = (PHBIN)((ULONG_PTR)Buffer + REG_BLOCK_SIZE);
+  BinHeader = (PHBIN)((ULONG_PTR)Buffer + REG_BLOCK_SIZE);
   RootKeyCell = (PKEY_CELL)((ULONG_PTR)Buffer + REG_BLOCK_SIZE + REG_HBIN_DATA_OFFSET);
   FreeCell = (PCELL_HEADER)((ULONG_PTR)Buffer + REG_BLOCK_SIZE + REG_HBIN_DATA_OFFSET + sizeof(KEY_CELL));
 
   CmiCreateDefaultHiveHeader(HiveHeader);
-  CmiCreateDefaultBinCell(BinCell);
+  CmiCreateDefaultBinHeader(BinHeader);
   CmiCreateDefaultRootKeyCell(RootKeyCell);
 
   /* First block */
-  BinCell->BlockOffset = 0;
+  BinHeader->BinOffset = 0;
 
   /* Offset to root key block */
   HiveHeader->RootKeyOffset = REG_HBIN_DATA_OFFSET;
@@ -388,7 +383,7 @@ CmiCreateNewRegFile(HANDLE FileHandle)
   /* The rest of the block is free */
   FreeCell->CellSize = REG_BLOCK_SIZE - (REG_HBIN_DATA_OFFSET + sizeof(KEY_CELL));
 
-  Status = NtWriteFile(FileHandle,
+  Status = ZwWriteFile(FileHandle,
                       NULL,
                       NULL,
                       NULL,
@@ -400,14 +395,12 @@ CmiCreateNewRegFile(HANDLE FileHandle)
 
   ExFreePool(Buffer);
 
-  assertmsg(NT_SUCCESS(Status), ("Status: 0x%X\n", Status));
-
   if (!NT_SUCCESS(Status))
     {
       return(Status);
     }
 
-  Status = NtFlushBuffersFile(FileHandle,
+  Status = ZwFlushBuffersFile(FileHandle,
                              &IoStatusBlock);
 
   return(Status);
@@ -437,11 +430,11 @@ CmiCheckAndFixHive(PREGISTRY_HIVE RegistryHive)
   /* Try to open the hive file */
   InitializeObjectAttributes(&ObjectAttributes,
                             &RegistryHive->HiveFileName,
-                            0,
+                            OBJ_CASE_INSENSITIVE,
                             NULL,
                             NULL);
 
-  Status = NtCreateFile(&HiveHandle,
+  Status = ZwCreateFile(&HiveHandle,
                        FILE_READ_DATA | FILE_READ_ATTRIBUTES,
                        &ObjectAttributes,
                        &IoStatusBlock,
@@ -458,18 +451,18 @@ CmiCheckAndFixHive(PREGISTRY_HIVE RegistryHive)
     }
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtCreateFile() failed (Status %lx)\n", Status);
+      DPRINT("ZwCreateFile() failed (Status %lx)\n", Status);
       return(Status);
     }
 
   /* Try to open the log file */
   InitializeObjectAttributes(&ObjectAttributes,
                             &RegistryHive->LogFileName,
-                            0,
+                            OBJ_CASE_INSENSITIVE,
                             NULL,
                             NULL);
 
-  Status = NtCreateFile(&LogHandle,
+  Status = ZwCreateFile(&LogHandle,
                        FILE_READ_DATA | FILE_READ_ATTRIBUTES,
                        &ObjectAttributes,
                        &IoStatusBlock,
@@ -486,8 +479,8 @@ CmiCheckAndFixHive(PREGISTRY_HIVE RegistryHive)
     }
   else if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtCreateFile() failed (Status %lx)\n", Status);
-      NtClose(HiveHandle);
+      DPRINT("ZwCreateFile() failed (Status %lx)\n", Status);
+      ZwClose(HiveHandle);
       return(Status);
     }
 
@@ -503,7 +496,7 @@ CmiCheckAndFixHive(PREGISTRY_HIVE RegistryHive)
 
   /* Read hive base block */
   FileOffset.QuadPart = 0ULL;
-  Status = NtReadFile(HiveHandle,
+  Status = ZwReadFile(HiveHandle,
                      0,
                      0,
                      0,
@@ -514,7 +507,7 @@ CmiCheckAndFixHive(PREGISTRY_HIVE RegistryHive)
                      0);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtReadFile() failed (Status %lx)\n", Status);
+      DPRINT("ZwReadFile() failed (Status %lx)\n", Status);
       goto ByeBye;
     }
 
@@ -545,7 +538,7 @@ CmiCheckAndFixHive(PREGISTRY_HIVE RegistryHive)
 
       /* Read log file header */
       FileOffset.QuadPart = 0ULL;
-      Status = NtReadFile(LogHandle,
+      Status = ZwReadFile(LogHandle,
                          0,
                          0,
                          0,
@@ -556,7 +549,7 @@ CmiCheckAndFixHive(PREGISTRY_HIVE RegistryHive)
                          0);
       if (!NT_SUCCESS(Status))
        {
-         DPRINT("NtReadFile() failed (Status %lx)\n", Status);
+         DPRINT("ZwReadFile() failed (Status %lx)\n", Status);
          goto ByeBye;
        }
 
@@ -589,24 +582,24 @@ CmiCheckAndFixHive(PREGISTRY_HIVE RegistryHive)
        */
 
       /* Get file size */
-      Status = NtQueryInformationFile(LogHandle,
+      Status = ZwQueryInformationFile(LogHandle,
                                      &IoStatusBlock,
                                      &fsi,
                                      sizeof(fsi),
                                      FileStandardInformation);
       if (!NT_SUCCESS(Status))
        {
-         DPRINT("NtQueryInformationFile() failed (Status %lx)\n", Status);
+         DPRINT("ZwQueryInformationFile() failed (Status %lx)\n", Status);
          goto ByeBye;
        }
       FileSize = fsi.EndOfFile.u.LowPart;
 
       /* Calculate bitmap and block size */
-      BitmapSize = ROUND_UP((FileSize / 4096) - 1, sizeof(ULONG) * 8) / 8;
+      BitmapSize = ROUND_UP((FileSize / REG_BLOCK_SIZE) - 1, sizeof(ULONG) * 8) / 8;
       BufferSize = sizeof(HIVE_HEADER) +
                          sizeof(ULONG) +
                          BitmapSize;
-      BufferSize = ROUND_UP(BufferSize, 4096);
+      BufferSize = ROUND_UP(BufferSize, REG_BLOCK_SIZE);
 
       /* Reallocate log header block */
       ExFreePool(LogHeader);
@@ -621,7 +614,7 @@ CmiCheckAndFixHive(PREGISTRY_HIVE RegistryHive)
 
       /* Read log file header */
       FileOffset.QuadPart = 0ULL;
-      Status = NtReadFile(LogHandle,
+      Status = ZwReadFile(LogHandle,
                          0,
                          0,
                          0,
@@ -632,13 +625,13 @@ CmiCheckAndFixHive(PREGISTRY_HIVE RegistryHive)
                          0);
       if (!NT_SUCCESS(Status))
        {
-         DPRINT("NtReadFile() failed (Status %lx)\n", Status);
+         DPRINT("ZwReadFile() failed (Status %lx)\n", Status);
          goto ByeBye;
        }
 
       /* Initialize bitmap */
       RtlInitializeBitMap(&BlockBitMap,
-                         (PVOID)((ULONG)LogHeader + 4096 + sizeof(ULONG)),
+                         (PVOID)((ULONG_PTR)LogHeader + REG_BLOCK_SIZE + sizeof(ULONG)),
                          BitmapSize * 8);
 
       /* FIXME: Update dirty blocks */
@@ -660,9 +653,9 @@ ByeBye:
     ExFreePool(LogHeader);
 
   if (LogHandle != INVALID_HANDLE_VALUE)
-    NtClose(LogHandle);
+    ZwClose(LogHandle);
 
-  NtClose(HiveHandle);
+  ZwClose(HiveHandle);
 
   return(Status);
 }
@@ -684,40 +677,42 @@ CmiImportHiveBins(PREGISTRY_HIVE Hive,
     {
       Bin = (PHBIN)((ULONG_PTR)ChunkPtr + BlockOffset);
 
-      if (Bin->BlockId != REG_BIN_ID)
+      if (Bin->HeaderId != REG_BIN_ID)
        {
-         DPRINT1 ("Bad BlockId %x, offset %x\n", Bin->BlockId, BlockOffset);
+         DPRINT1 ("Bad bin header id %x, offset %x\n", Bin->HeaderId, BlockOffset);
          return STATUS_REGISTRY_CORRUPT;
        }
 
-      assertmsg((Bin->BlockSize % 4096) == 0,
-               ("BlockSize (0x%.08x) must be multiple of 4K\n",
-               Bin->BlockSize));
+      ASSERTMSG("Bin size must be multiple of 4K\n",
+                (Bin->BinSize % REG_BLOCK_SIZE) == 0);
 
       /* Allocate the hive block */
-      Hive->BlockList[BlockIndex] = ExAllocatePool (PagedPool,
-                                                   Bin->BlockSize);
-      if (Hive->BlockList[BlockIndex] == NULL)
+      Hive->BlockList[BlockIndex].Bin = ExAllocatePool (PagedPool,
+                                                       Bin->BinSize);
+      if (Hive->BlockList[BlockIndex].Bin == NULL)
        {
          DPRINT1 ("ExAllocatePool() failed\n");
          return STATUS_INSUFFICIENT_RESOURCES;
        }
+      Hive->BlockList[BlockIndex].Block = (PVOID)Hive->BlockList[BlockIndex].Bin;
 
       /* Import the Bin */
-      RtlCopyMemory (Hive->BlockList[BlockIndex],
+      RtlCopyMemory (Hive->BlockList[BlockIndex].Bin,
                     Bin,
-                    Bin->BlockSize);
+                    Bin->BinSize);
 
-      if (Bin->BlockSize > 4096)
+      if (Bin->BinSize > REG_BLOCK_SIZE)
        {
-         for (j = 1; j < Bin->BlockSize / 4096; j++)
+         for (j = 1; j < Bin->BinSize / REG_BLOCK_SIZE; j++)
            {
-             Hive->BlockList[BlockIndex + j] = Hive->BlockList[BlockIndex];
+             Hive->BlockList[BlockIndex + j].Bin = Hive->BlockList[BlockIndex].Bin;
+             Hive->BlockList[BlockIndex + j].Block =
+               (PVOID)((ULONG_PTR)Hive->BlockList[BlockIndex].Bin + (j * REG_BLOCK_SIZE));
            }
        }
 
-      BlockIndex += Bin->BlockSize / 4096;
-      BlockOffset += Bin->BlockSize;
+      BlockIndex += Bin->BinSize / REG_BLOCK_SIZE;
+      BlockOffset += Bin->BinSize;
     }
 
   return STATUS_SUCCESS;
@@ -733,15 +728,16 @@ CmiFreeHiveBins (PREGISTRY_HIVE Hive)
   Bin = NULL;
   for (i = 0; i < Hive->BlockListSize; i++)
     {
-      if (Hive->BlockList[i] == NULL)
+      if (Hive->BlockList[i].Bin == NULL)
        continue;
 
-      if (Hive->BlockList[i] != Bin)
+      if (Hive->BlockList[i].Bin != Bin)
        {
-         Bin = Hive->BlockList[i];
-         ExFreePool (Hive->BlockList[i]);
+         Bin = Hive->BlockList[i].Bin;
+         ExFreePool (Hive->BlockList[i].Bin);
        }
-      Hive->BlockList[i] = NULL;
+      Hive->BlockList[i].Bin = NULL;
+      Hive->BlockList[i].Block = NULL;
     }
 }
 
@@ -766,18 +762,18 @@ CmiCreateHiveFreeCellList(PREGISTRY_HIVE Hive)
   BlockIndex = 0;
   while (BlockIndex < Hive->BlockListSize)
     {
-      Bin = Hive->BlockList[BlockIndex];
+      Bin = Hive->BlockList[BlockIndex].Bin;
 
       /* Search free blocks and add to list */
       FreeOffset = REG_HBIN_DATA_OFFSET;
-      while (FreeOffset < Bin->BlockSize)
+      while (FreeOffset < Bin->BinSize)
        {
          FreeBlock = (PCELL_HEADER) ((ULONG_PTR) Bin + FreeOffset);
          if (FreeBlock->CellSize > 0)
            {
              Status = CmiAddFree(Hive,
                                  FreeBlock,
-                                 Bin->BlockOffset + FreeOffset,
+                                 Bin->BinOffset + FreeOffset,
                                  FALSE);
 
              if (!NT_SUCCESS(Status))
@@ -793,8 +789,8 @@ CmiCreateHiveFreeCellList(PREGISTRY_HIVE Hive)
            }
        }
 
-      BlockIndex += Bin->BlockSize / 4096;
-      BlockOffset += Bin->BlockSize;
+      BlockIndex += Bin->BinSize / REG_BLOCK_SIZE;
+      BlockOffset += Bin->BinSize;
     }
 
   return STATUS_SUCCESS;
@@ -852,7 +848,7 @@ CmiInitNonVolatileRegistryHive (PREGISTRY_HIVE RegistryHive,
   ULONG CreateDisposition;
   IO_STATUS_BLOCK IoSB;
   HANDLE FileHandle;
-  HANDLE SectionHandle;
+  PSECTION_OBJECT SectionObject;
   PUCHAR ViewBase;
   ULONG ViewSize;
   NTSTATUS Status;
@@ -862,7 +858,7 @@ CmiInitNonVolatileRegistryHive (PREGISTRY_HIVE RegistryHive,
 
   /* Duplicate Filename */
   Status = RtlCreateUnicodeString(&RegistryHive->HiveFileName,
-                                 Filename);
+                                  Filename);
   if (!NT_SUCCESS(Status))
     {
       DPRINT("RtlCreateUnicodeString() failed (Status %lx)\n", Status);
@@ -872,8 +868,9 @@ CmiInitNonVolatileRegistryHive (PREGISTRY_HIVE RegistryHive,
   /* Create log file name */
   RegistryHive->LogFileName.Length = (wcslen(Filename) + 4) * sizeof(WCHAR);
   RegistryHive->LogFileName.MaximumLength = RegistryHive->LogFileName.Length + sizeof(WCHAR);
-  RegistryHive->LogFileName.Buffer = ExAllocatePool(NonPagedPool,
-                                                   RegistryHive->LogFileName.MaximumLength);
+  RegistryHive->LogFileName.Buffer = ExAllocatePoolWithTag(PagedPool,
+                                                          RegistryHive->LogFileName.MaximumLength,
+                                                           TAG('U', 'S', 'T', 'R'));
   if (RegistryHive->LogFileName.Buffer == NULL)
     {
       RtlFreeUnicodeString(&RegistryHive->HiveFileName);
@@ -899,12 +896,12 @@ CmiInitNonVolatileRegistryHive (PREGISTRY_HIVE RegistryHive,
 
   InitializeObjectAttributes(&ObjectAttributes,
                             &RegistryHive->HiveFileName,
-                            0,
+                            OBJ_CASE_INSENSITIVE,
                             NULL,
                             NULL);
 
   CreateDisposition = FILE_OPEN_IF;
-  Status = NtCreateFile(&FileHandle,
+  Status = ZwCreateFile(&FileHandle,
                        FILE_ALL_ACCESS,
                        &ObjectAttributes,
                        &IoSB,
@@ -919,7 +916,7 @@ CmiInitNonVolatileRegistryHive (PREGISTRY_HIVE RegistryHive,
     {
       RtlFreeUnicodeString(&RegistryHive->HiveFileName);
       RtlFreeUnicodeString(&RegistryHive->LogFileName);
-      DPRINT("NtCreateFile() failed (Status %lx)\n", Status);
+      DPRINT("ZwCreateFile() failed (Status %lx)\n", Status);
       return(Status);
     }
 
@@ -929,7 +926,7 @@ CmiInitNonVolatileRegistryHive (PREGISTRY_HIVE RegistryHive,
       if (!NT_SUCCESS(Status))
        {
          DPRINT("CmiCreateNewRegFile() failed (Status %lx)\n", Status);
-         NtClose(FileHandle);
+         ZwClose(FileHandle);
          RtlFreeUnicodeString(&RegistryHive->HiveFileName);
          RtlFreeUnicodeString(&RegistryHive->LogFileName);
          return(Status);
@@ -937,17 +934,17 @@ CmiInitNonVolatileRegistryHive (PREGISTRY_HIVE RegistryHive,
     }
 
   /* Create the hive section */
-  Status = NtCreateSection(&SectionHandle,
+  Status = MmCreateSection(&SectionObject,
                           SECTION_ALL_ACCESS,
                           NULL,
                           NULL,
                           PAGE_READWRITE,
                           SEC_COMMIT,
-                          FileHandle);
-  NtClose(FileHandle);
+                          FileHandle,
+                          NULL);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT1("NtCreateSection() failed (Status %lx)\n", Status);
+      DPRINT1("MmCreateSection() failed (Status %lx)\n", Status);
       RtlFreeUnicodeString(&RegistryHive->HiveFileName);
       RtlFreeUnicodeString(&RegistryHive->LogFileName);
       return(Status);
@@ -956,8 +953,8 @@ CmiInitNonVolatileRegistryHive (PREGISTRY_HIVE RegistryHive,
   /* Map the hive file */
   ViewBase = NULL;
   ViewSize = 0;
-  Status = NtMapViewOfSection(SectionHandle,
-                             NtCurrentProcess(),
+  Status = MmMapViewOfSection(SectionObject,
+                             PsGetCurrentProcess(),
                              (PVOID*)&ViewBase,
                              0,
                              ViewSize,
@@ -968,10 +965,11 @@ CmiInitNonVolatileRegistryHive (PREGISTRY_HIVE RegistryHive,
                              PAGE_READWRITE);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT1("MmMapViewInSystemSpace() failed (Status %lx)\n", Status);
-      NtClose(SectionHandle);
+      DPRINT1("MmMapViewOfSection() failed (Status %lx)\n", Status);
+      ObDereferenceObject(SectionObject);
       RtlFreeUnicodeString(&RegistryHive->HiveFileName);
       RtlFreeUnicodeString(&RegistryHive->LogFileName);
+      ZwClose(FileHandle);
       return(Status);
     }
   DPRINT("ViewBase %p  ViewSize %lx\n", ViewBase, ViewSize);
@@ -981,41 +979,48 @@ CmiInitNonVolatileRegistryHive (PREGISTRY_HIVE RegistryHive,
                 ViewBase,
                 sizeof(HIVE_HEADER));
   RegistryHive->FileSize = ViewSize;
-  RegistryHive->BlockListSize = (RegistryHive->FileSize / 4096) - 1;
+  RegistryHive->BlockListSize = (RegistryHive->FileSize / REG_BLOCK_SIZE) - 1;
   RegistryHive->UpdateCounter = RegistryHive->HiveHeader->UpdateCounter1;
 
   /* Allocate hive block list */
   RegistryHive->BlockList = ExAllocatePool(NonPagedPool,
-         sizeof(PHBIN *) * RegistryHive->BlockListSize);
+                                          RegistryHive->BlockListSize * sizeof(BLOCK_LIST_ENTRY));
   if (RegistryHive->BlockList == NULL)
     {
       DPRINT1("Failed to allocate the hive block list\n");
-      NtUnmapViewOfSection(NtCurrentProcess(),
+      MmUnmapViewOfSection(PsGetCurrentProcess(),
                           ViewBase);
-      NtClose(SectionHandle);
+      ObDereferenceObject(SectionObject);
       RtlFreeUnicodeString(&RegistryHive->HiveFileName);
       RtlFreeUnicodeString(&RegistryHive->LogFileName);
+      ZwClose(FileHandle);
       return STATUS_INSUFFICIENT_RESOURCES;
     }
+  RtlZeroMemory (RegistryHive->BlockList,
+                RegistryHive->BlockListSize * sizeof(BLOCK_LIST_ENTRY));
 
   /* Import the hive bins */
   Status = CmiImportHiveBins (RegistryHive,
-                             ViewBase + 4096);
+                             ViewBase + REG_BLOCK_SIZE);
   if (!NT_SUCCESS(Status))
     {
       ExFreePool(RegistryHive->BlockList);
-      NtUnmapViewOfSection(NtCurrentProcess(),
+      MmUnmapViewOfSection(PsGetCurrentProcess(),
                           ViewBase);
-      NtClose(SectionHandle);
+      ObDereferenceObject(SectionObject);
       RtlFreeUnicodeString(&RegistryHive->HiveFileName);
       RtlFreeUnicodeString(&RegistryHive->LogFileName);
+      ZwClose(FileHandle);
       return Status;
     }
 
   /* Unmap and dereference the hive section */
-  NtUnmapViewOfSection(NtCurrentProcess(),
-                      ViewBase);
-  NtClose(SectionHandle);
+  MmUnmapViewOfSection(PsGetCurrentProcess(),
+                       ViewBase);
+  ObDereferenceObject(SectionObject);
+
+  /* Close the hive file */
+  ZwClose(FileHandle);
 
   /* Initialize the free cell list */
   Status = CmiCreateHiveFreeCellList (RegistryHive);
@@ -1043,7 +1048,7 @@ CmiInitNonVolatileRegistryHive (PREGISTRY_HIVE RegistryHive,
   DPRINT("CmiInitNonVolatileRegistryHive(%p, %S) - Finished.\n",
         RegistryHive, Filename);
 
-  return(STATUS_SUCCESS);
+  return STATUS_SUCCESS;
 }
 
 
@@ -1063,7 +1068,7 @@ CmiCreateVolatileHive(PREGISTRY_HIVE *RegistryHive)
   RtlZeroMemory (Hive,
                 sizeof(REGISTRY_HIVE));
 
-  DPRINT("Hive %x\n", Hive);
+  DPRINT("Hive 0x%p\n", Hive);
 
   Hive->HiveHeader = (PHIVE_HEADER)ExAllocatePool (NonPagedPool,
                                                   sizeof(HIVE_HEADER));
@@ -1072,6 +1077,8 @@ CmiCreateVolatileHive(PREGISTRY_HIVE *RegistryHive)
       ExFreePool (Hive);
       return STATUS_INSUFFICIENT_RESOURCES;
     }
+  RtlZeroMemory (Hive->HiveHeader,
+                sizeof(HIVE_HEADER));
 
   Hive->Flags = (HIVE_NO_FILE | HIVE_POINTER);
 
@@ -1089,18 +1096,17 @@ CmiCreateVolatileHive(PREGISTRY_HIVE *RegistryHive)
   CmiCreateDefaultRootKeyCell (RootKeyCell);
   Hive->HiveHeader->RootKeyOffset = (BLOCK_OFFSET)RootKeyCell;
 
-  ExInitializeResourceLite (&Hive->HiveResource);
-
   /* Acquire hive list lock exclusively */
-  ExAcquireResourceExclusiveLite (&CmiHiveListLock,
-                                 TRUE);
+  KeEnterCriticalRegion();
+  ExAcquireResourceExclusiveLite (&CmiRegistryLock, TRUE);
 
   /* Add the new hive to the hive list */
   InsertTailList (&CmiHiveListHead,
                  &Hive->HiveList);
 
   /* Release hive list lock */
-  ExReleaseResourceLite (&CmiHiveListLock);
+  ExReleaseResourceLite (&CmiRegistryLock);
+  KeLeaveCriticalRegion();
 
   VERIFY_REGISTRY_HIVE (Hive);
 
@@ -1113,7 +1119,7 @@ CmiCreateVolatileHive(PREGISTRY_HIVE *RegistryHive)
 NTSTATUS
 CmiCreateTempHive(PREGISTRY_HIVE *RegistryHive)
 {
-  PHBIN BinCell;
+  PHBIN BinHeader;
   PCELL_HEADER FreeCell;
   PREGISTRY_HIVE Hive;
   NTSTATUS Status;
@@ -1132,7 +1138,7 @@ CmiCreateTempHive(PREGISTRY_HIVE *RegistryHive)
   RtlZeroMemory (Hive,
                 sizeof(REGISTRY_HIVE));
 
-  DPRINT ("Hive %x\n", Hive);
+  DPRINT ("Hive 0x%p\n", Hive);
 
   Hive->HiveHeader = (PHIVE_HEADER)ExAllocatePool (NonPagedPool,
                                                   REG_BLOCK_SIZE);
@@ -1145,7 +1151,7 @@ CmiCreateTempHive(PREGISTRY_HIVE *RegistryHive)
   RtlZeroMemory (Hive->HiveHeader,
                 REG_BLOCK_SIZE);
 
-  DPRINT ("HiveHeader %x\n", Hive->HiveHeader);
+  DPRINT ("HiveHeader 0x%p\n", Hive->HiveHeader);
 
   Hive->Flags = HIVE_NO_FILE;
 
@@ -1158,7 +1164,7 @@ CmiCreateTempHive(PREGISTRY_HIVE *RegistryHive)
 
   /* Allocate hive block list */
   Hive->BlockList = ExAllocatePool (NonPagedPool,
-                                   sizeof(PHBIN *));
+                                   sizeof(PBLOCK_LIST_ENTRY));
   if (Hive->BlockList == NULL)
     {
       DPRINT1 ("Failed to allocate hive block list\n");
@@ -1168,9 +1174,9 @@ CmiCreateTempHive(PREGISTRY_HIVE *RegistryHive)
     }
 
   /* Allocate first Bin */
-  Hive->BlockList[0] = ExAllocatePool (NonPagedPool,
-                                      REG_BLOCK_SIZE);
-  if (Hive->BlockList[0] == NULL)
+  Hive->BlockList[0].Bin = ExAllocatePool (NonPagedPool,
+                                          REG_BLOCK_SIZE);
+  if (Hive->BlockList[0].Bin == NULL)
     {
       DPRINT1 ("Failed to allocate first bin\n");
       ExFreePool(Hive->BlockList);
@@ -1178,19 +1184,20 @@ CmiCreateTempHive(PREGISTRY_HIVE *RegistryHive)
       ExFreePool(Hive);
       return STATUS_INSUFFICIENT_RESOURCES;
     }
+  Hive->BlockList[0].Block = (PVOID)Hive->BlockList[0].Bin;
 
   Hive->FileSize = 2* REG_BLOCK_SIZE;
   Hive->BlockListSize = 1;
   Hive->UpdateCounter = Hive->HiveHeader->UpdateCounter1;
 
 
-  BinCell = (PHBIN)Hive->BlockList[0];
-  FreeCell = (PCELL_HEADER)((ULONG_PTR)BinCell + REG_HBIN_DATA_OFFSET);
+  BinHeader = Hive->BlockList[0].Bin;
+  FreeCell = (PCELL_HEADER)((ULONG_PTR)BinHeader + REG_HBIN_DATA_OFFSET);
 
-  CmiCreateDefaultBinCell (BinCell);
+  CmiCreateDefaultBinHeader (BinHeader);
 
   /* First block */
-  BinCell->BlockOffset = 0;
+  BinHeader->BinOffset = 0;
 
   /* Offset to root key block */
   Hive->HiveHeader->RootKeyOffset = (BLOCK_OFFSET)-1;
@@ -1200,29 +1207,27 @@ CmiCreateTempHive(PREGISTRY_HIVE *RegistryHive)
 
   /* Create the free cell list */
   Status = CmiCreateHiveFreeCellList (Hive);
-  if (Hive->BlockList[0] == NULL)
+  if (Hive->BlockList[0].Bin == NULL)
     {
       DPRINT1 ("CmiCreateHiveFreeCellList() failed (Status %lx)\n", Status);
-      ExFreePool(Hive->BlockList[0]);
+      ExFreePool(Hive->BlockList[0].Bin);
       ExFreePool(Hive->BlockList);
       ExFreePool(Hive->HiveHeader);
       ExFreePool(Hive);
       return Status;
     }
 
-
-  ExInitializeResourceLite (&Hive->HiveResource);
-
   /* Acquire hive list lock exclusively */
-  ExAcquireResourceExclusiveLite (&CmiHiveListLock,
-                                 TRUE);
+  KeEnterCriticalRegion();
+  ExAcquireResourceExclusiveLite(&CmiRegistryLock, TRUE);
 
   /* Add the new hive to the hive list */
   InsertTailList (&CmiHiveListHead,
                  &Hive->HiveList);
 
   /* Release hive list lock */
-  ExReleaseResourceLite (&CmiHiveListLock);
+  ExReleaseResourceLite(&CmiRegistryLock);
+  KeLeaveCriticalRegion();
 
   VERIFY_REGISTRY_HIVE (Hive);
 
@@ -1255,7 +1260,7 @@ CmiLoadHive(IN POBJECT_ATTRIBUTES KeyObjectAttributes,
   RtlZeroMemory (Hive,
                 sizeof(REGISTRY_HIVE));
 
-  DPRINT ("Hive %x\n", Hive);
+  DPRINT ("Hive 0x%p\n", Hive);
   Hive->Flags = (Flags & REG_NO_LAZY_FLUSH) ? HIVE_NO_SYNCH : 0;
 
   Hive->HiveHeader = (PHIVE_HEADER)ExAllocatePool(NonPagedPool,
@@ -1267,6 +1272,9 @@ CmiLoadHive(IN POBJECT_ATTRIBUTES KeyObjectAttributes,
       return STATUS_INSUFFICIENT_RESOURCES;
     }
 
+  RtlZeroMemory (Hive->HiveHeader,
+                sizeof(HIVE_HEADER));
+
   Status = CmiInitNonVolatileRegistryHive (Hive,
                                           FileName->Buffer);
   if (!NT_SUCCESS (Status))
@@ -1277,19 +1285,12 @@ CmiLoadHive(IN POBJECT_ATTRIBUTES KeyObjectAttributes,
       return Status;
     }
 
-  ExInitializeResourceLite (&Hive->HiveResource);
-
   /* Add the new hive to the hive list */
-  ExAcquireResourceExclusiveLite (&CmiHiveListLock,
-                                 TRUE);
   InsertTailList (&CmiHiveListHead,
                  &Hive->HiveList);
-  ExReleaseResourceLite (&CmiHiveListLock);
-
 
   VERIFY_REGISTRY_HIVE(Hive);
 
-
   Status = CmiConnectHive (KeyObjectAttributes,
                           Hive);
   if (!NT_SUCCESS(Status))
@@ -1310,16 +1311,9 @@ CmiRemoveRegistryHive(PREGISTRY_HIVE RegistryHive)
   if (RegistryHive->Flags & HIVE_POINTER)
     return STATUS_UNSUCCESSFUL;
 
-  /* Acquire hive list lock exclusively */
-  ExAcquireResourceExclusiveLite (&CmiHiveListLock,
-                                 TRUE);
-
   /* Remove hive from hive list */
   RemoveEntryList (&RegistryHive->HiveList);
 
-  /* Release hive list lock */
-  ExReleaseResourceLite (&CmiHiveListLock);
-
   /* Release file names */
   RtlFreeUnicodeString (&RegistryHive->HiveFileName);
   RtlFreeUnicodeString (&RegistryHive->LogFileName);
@@ -1331,9 +1325,6 @@ CmiRemoveRegistryHive(PREGISTRY_HIVE RegistryHive)
   ExFreePool (RegistryHive->FreeList);
   ExFreePool (RegistryHive->FreeListOffset);
 
-  /* Release hive resource */
-  ExDeleteResource (&RegistryHive->HiveResource);
-
   /* Release bins and bin list */
   CmiFreeHiveBins (RegistryHive);
   ExFreePool (RegistryHive->BlockList);
@@ -1375,6 +1366,7 @@ CmiStartLogUpdate(PREGISTRY_HIVE RegistryHive)
   PUCHAR Buffer;
   PUCHAR Ptr;
   ULONG BlockIndex;
+  ULONG LastIndex;
   PVOID BlockPtr;
   NTSTATUS Status;
 
@@ -1384,25 +1376,28 @@ CmiStartLogUpdate(PREGISTRY_HIVE RegistryHive)
   BufferSize = sizeof(HIVE_HEADER) +
               sizeof(ULONG) +
               BitmapSize;
-  BufferSize = ROUND_UP(BufferSize, 4096);
+  BufferSize = ROUND_UP(BufferSize, REG_BLOCK_SIZE);
 
   DPRINT("Bitmap size %lu  buffer size: %lu\n", BitmapSize, BufferSize);
 
-  Buffer = (PUCHAR)ExAllocatePool(NonPagedPool, BufferSize);
+  Buffer = (PUCHAR)ExAllocatePool(NonPagedPool,
+                                 BufferSize);
   if (Buffer == NULL)
     {
       DPRINT("ExAllocatePool() failed\n");
       return(STATUS_INSUFFICIENT_RESOURCES);
     }
+  RtlZeroMemory (Buffer,
+                BufferSize);
 
   /* Open log file for writing */
   InitializeObjectAttributes(&ObjectAttributes,
                             &RegistryHive->LogFileName,
-                            0,
+                            OBJ_CASE_INSENSITIVE,
                             NULL,
                             NULL);
 
-  Status = NtCreateFile(&FileHandle,
+  Status = ZwCreateFile(&FileHandle,
                        FILE_ALL_ACCESS,
                        &ObjectAttributes,
                        &IoStatusBlock,
@@ -1415,7 +1410,7 @@ CmiStartLogUpdate(PREGISTRY_HIVE RegistryHive)
                        0);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtCreateFile() failed (Status %lx)\n", Status);
+      DPRINT("ZwCreateFile() failed (Status %lx)\n", Status);
       ExFreePool(Buffer);
       return(Status);
     }
@@ -1439,8 +1434,8 @@ CmiStartLogUpdate(PREGISTRY_HIVE RegistryHive)
                BitmapSize);
 
   /* Write hive block and block bitmap */
-  FileOffset.QuadPart = 0ULL;
-  Status = NtWriteFile(FileHandle,
+  FileOffset.QuadPart = (ULONGLONG)0;
+  Status = ZwWriteFile(FileHandle,
                       NULL,
                       NULL,
                       NULL,
@@ -1451,8 +1446,8 @@ CmiStartLogUpdate(PREGISTRY_HIVE RegistryHive)
                       NULL);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtWriteFile() failed (Status %lx)\n", Status);
-      NtClose(FileHandle);
+      DPRINT("ZwWriteFile() failed (Status %lx)\n", Status);
+      ZwClose(FileHandle);
       ExFreePool(Buffer);
       return(Status);
     }
@@ -1461,13 +1456,13 @@ CmiStartLogUpdate(PREGISTRY_HIVE RegistryHive)
   /* Write dirty blocks */
   FileOffset.QuadPart = (ULONGLONG)BufferSize;
   BlockIndex = 0;
-  while (TRUE)
+  while (BlockIndex < RegistryHive->BlockListSize)
     {
+      LastIndex = BlockIndex;
       BlockIndex = RtlFindSetBits(&RegistryHive->DirtyBitMap,
                                  1,
                                  BlockIndex);
-      if ((BlockIndex == (ULONG)-1) ||
-         (BlockIndex >= RegistryHive->BlockListSize))
+      if (BlockIndex == (ULONG)-1 || BlockIndex < LastIndex)
        {
          DPRINT("No more set bits\n");
          Status = STATUS_SUCCESS;
@@ -1476,12 +1471,12 @@ CmiStartLogUpdate(PREGISTRY_HIVE RegistryHive)
 
       DPRINT("Block %lu is dirty\n", BlockIndex);
 
-      BlockPtr = RegistryHive->BlockList[BlockIndex];
+      BlockPtr = RegistryHive->BlockList[BlockIndex].Block;
       DPRINT("BlockPtr %p\n", BlockPtr);
       DPRINT("File offset %I64x\n", FileOffset.QuadPart);
 
       /* Write hive block */
-      Status = NtWriteFile(FileHandle,
+      Status = ZwWriteFile(FileHandle,
                           NULL,
                           NULL,
                           NULL,
@@ -1492,51 +1487,51 @@ CmiStartLogUpdate(PREGISTRY_HIVE RegistryHive)
                           NULL);
       if (!NT_SUCCESS(Status))
        {
-         DPRINT1("NtWriteFile() failed (Status %lx)\n", Status);
-         NtClose(FileHandle);
+         DPRINT1("ZwWriteFile() failed (Status %lx)\n", Status);
+         ZwClose(FileHandle);
          return(Status);
        }
 
       BlockIndex++;
-      FileOffset.QuadPart += 4096ULL;
+      FileOffset.QuadPart += (ULONGLONG)REG_BLOCK_SIZE;
     }
 
   /* Truncate log file */
   EndOfFileInfo.EndOfFile.QuadPart = FileOffset.QuadPart;
-  Status = NtSetInformationFile(FileHandle,
+  Status = ZwSetInformationFile(FileHandle,
                                &IoStatusBlock,
                                &EndOfFileInfo,
                                sizeof(FILE_END_OF_FILE_INFORMATION),
                                FileEndOfFileInformation);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtSetInformationFile() failed (Status %lx)\n", Status);
-      NtClose(FileHandle);
+      DPRINT("ZwSetInformationFile() failed (Status %lx)\n", Status);
+      ZwClose(FileHandle);
       return(Status);
     }
 
   FileAllocationInfo.AllocationSize.QuadPart = FileOffset.QuadPart;
-  Status = NtSetInformationFile(FileHandle,
+  Status = ZwSetInformationFile(FileHandle,
                                &IoStatusBlock,
                                &FileAllocationInfo,
                                sizeof(FILE_ALLOCATION_INFORMATION),
                                FileAllocationInformation);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtSetInformationFile() failed (Status %lx)\n", Status);
-      NtClose(FileHandle);
+      DPRINT("ZwSetInformationFile() failed (Status %lx)\n", Status);
+      ZwClose(FileHandle);
       return(Status);
     }
 
   /* Flush the log file */
-  Status = NtFlushBuffersFile(FileHandle,
+  Status = ZwFlushBuffersFile(FileHandle,
                              &IoStatusBlock);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtFlushBuffersFile() failed (Status %lx)\n", Status);
+      DPRINT("ZwFlushBuffersFile() failed (Status %lx)\n", Status);
     }
 
-  NtClose(FileHandle);
+  ZwClose(FileHandle);
 
   return(Status);
 }
@@ -1561,7 +1556,7 @@ CmiFinishLogUpdate(PREGISTRY_HIVE RegistryHive)
   BufferSize = sizeof(HIVE_HEADER) +
               sizeof(ULONG) +
               BitmapSize;
-  BufferSize = ROUND_UP(BufferSize, 4096);
+  BufferSize = ROUND_UP(BufferSize, REG_BLOCK_SIZE);
 
   DPRINT("Bitmap size %lu  buffer size: %lu\n", BitmapSize, BufferSize);
 
@@ -1575,11 +1570,11 @@ CmiFinishLogUpdate(PREGISTRY_HIVE RegistryHive)
   /* Open log file for writing */
   InitializeObjectAttributes(&ObjectAttributes,
                             &RegistryHive->LogFileName,
-                            0,
+                            OBJ_CASE_INSENSITIVE,
                             NULL,
                             NULL);
 
-  Status = NtCreateFile(&FileHandle,
+  Status = ZwCreateFile(&FileHandle,
                        FILE_ALL_ACCESS,
                        &ObjectAttributes,
                        &IoStatusBlock,
@@ -1592,7 +1587,7 @@ CmiFinishLogUpdate(PREGISTRY_HIVE RegistryHive)
                        0);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtCreateFile() failed (Status %lx)\n", Status);
+      DPRINT("ZwCreateFile() failed (Status %lx)\n", Status);
       ExFreePool(Buffer);
       return(Status);
     }
@@ -1617,8 +1612,8 @@ CmiFinishLogUpdate(PREGISTRY_HIVE RegistryHive)
                BitmapSize);
 
   /* Write hive block and block bitmap */
-  FileOffset.QuadPart = 0ULL;
-  Status = NtWriteFile(FileHandle,
+  FileOffset.QuadPart = (ULONGLONG)0;
+  Status = ZwWriteFile(FileHandle,
                       NULL,
                       NULL,
                       NULL,
@@ -1629,8 +1624,8 @@ CmiFinishLogUpdate(PREGISTRY_HIVE RegistryHive)
                       NULL);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtWriteFile() failed (Status %lx)\n", Status);
-      NtClose(FileHandle);
+      DPRINT("ZwWriteFile() failed (Status %lx)\n", Status);
+      ZwClose(FileHandle);
       ExFreePool(Buffer);
       return(Status);
     }
@@ -1638,14 +1633,14 @@ CmiFinishLogUpdate(PREGISTRY_HIVE RegistryHive)
   ExFreePool(Buffer);
 
   /* Flush the log file */
-  Status = NtFlushBuffersFile(FileHandle,
+  Status = ZwFlushBuffersFile(FileHandle,
                              &IoStatusBlock);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtFlushBuffersFile() failed (Status %lx)\n", Status);
+      DPRINT("ZwFlushBuffersFile() failed (Status %lx)\n", Status);
     }
 
-  NtClose(FileHandle);
+  ZwClose(FileHandle);
 
   return(Status);
 }
@@ -1669,18 +1664,18 @@ CmiCleanupLogUpdate(PREGISTRY_HIVE RegistryHive)
   BufferSize = sizeof(HIVE_HEADER) +
               sizeof(ULONG) +
               BitmapSize;
-  BufferSize = ROUND_UP(BufferSize, 4096);
+  BufferSize = ROUND_UP(BufferSize, REG_BLOCK_SIZE);
 
   DPRINT("Bitmap size %lu  buffer size: %lu\n", BitmapSize, BufferSize);
 
   /* Open log file for writing */
   InitializeObjectAttributes(&ObjectAttributes,
                             &RegistryHive->LogFileName,
-                            0,
+                            OBJ_CASE_INSENSITIVE,
                             NULL,
                             NULL);
 
-  Status = NtCreateFile(&FileHandle,
+  Status = ZwCreateFile(&FileHandle,
                        FILE_ALL_ACCESS,
                        &ObjectAttributes,
                        &IoStatusBlock,
@@ -1693,26 +1688,26 @@ CmiCleanupLogUpdate(PREGISTRY_HIVE RegistryHive)
                        0);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtCreateFile() failed (Status %lx)\n", Status);
+      DPRINT("ZwCreateFile() failed (Status %lx)\n", Status);
       return(Status);
     }
 
   /* Truncate log file */
   EndOfFileInfo.EndOfFile.QuadPart = (ULONGLONG)BufferSize;
-  Status = NtSetInformationFile(FileHandle,
+  Status = ZwSetInformationFile(FileHandle,
                                &IoStatusBlock,
                                &EndOfFileInfo,
                                sizeof(FILE_END_OF_FILE_INFORMATION),
                                FileEndOfFileInformation);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtSetInformationFile() failed (Status %lx)\n", Status);
-      NtClose(FileHandle);
+      DPRINT("ZwSetInformationFile() failed (Status %lx)\n", Status);
+      ZwClose(FileHandle);
       return(Status);
     }
 
   FileAllocationInfo.AllocationSize.QuadPart = (ULONGLONG)BufferSize;
-  Status = NtSetInformationFile(FileHandle,
+  Status = ZwSetInformationFile(FileHandle,
                                &IoStatusBlock,
                                &FileAllocationInfo,
                                sizeof(FILE_ALLOCATION_INFORMATION),
@@ -1720,19 +1715,19 @@ CmiCleanupLogUpdate(PREGISTRY_HIVE RegistryHive)
   if (!NT_SUCCESS(Status))
     {
       DPRINT("NtSetInformationFile() failed (Status %lx)\n", Status);
-      NtClose(FileHandle);
+      ZwClose(FileHandle);
       return(Status);
     }
 
   /* Flush the log file */
-  Status = NtFlushBuffersFile(FileHandle,
+  Status = ZwFlushBuffersFile(FileHandle,
                              &IoStatusBlock);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtFlushBuffersFile() failed (Status %lx)\n", Status);
+      DPRINT("ZwFlushBuffersFile() failed (Status %lx)\n", Status);
     }
 
-  NtClose(FileHandle);
+  ZwClose(FileHandle);
 
   return(Status);
 }
@@ -1746,6 +1741,7 @@ CmiStartHiveUpdate(PREGISTRY_HIVE RegistryHive)
   HANDLE FileHandle;
   LARGE_INTEGER FileOffset;
   ULONG BlockIndex;
+  ULONG LastIndex;
   PVOID BlockPtr;
   NTSTATUS Status;
 
@@ -1754,11 +1750,11 @@ CmiStartHiveUpdate(PREGISTRY_HIVE RegistryHive)
   /* Open hive for writing */
   InitializeObjectAttributes(&ObjectAttributes,
                             &RegistryHive->HiveFileName,
-                            0,
+                            OBJ_CASE_INSENSITIVE,
                             NULL,
                             NULL);
 
-  Status = NtCreateFile(&FileHandle,
+  Status = ZwCreateFile(&FileHandle,
                        FILE_ALL_ACCESS,
                        &ObjectAttributes,
                        &IoStatusBlock,
@@ -1771,7 +1767,7 @@ CmiStartHiveUpdate(PREGISTRY_HIVE RegistryHive)
                        0);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtCreateFile() failed (Status %lx)\n", Status);
+      DPRINT("ZwCreateFile() failed (Status %lx)\n", Status);
       return(Status);
     }
 
@@ -1780,8 +1776,8 @@ CmiStartHiveUpdate(PREGISTRY_HIVE RegistryHive)
   RegistryHive->HiveHeader->Checksum = CmiCalcChecksum((PULONG)RegistryHive->HiveHeader);
 
   /* Write hive block */
-  FileOffset.QuadPart = 0ULL;
-  Status = NtWriteFile(FileHandle,
+  FileOffset.QuadPart = (ULONGLONG)0;
+  Status = ZwWriteFile(FileHandle,
                       NULL,
                       NULL,
                       NULL,
@@ -1792,19 +1788,19 @@ CmiStartHiveUpdate(PREGISTRY_HIVE RegistryHive)
                       NULL);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtWriteFile() failed (Status %lx)\n", Status);
-      NtClose(FileHandle);
+      DPRINT("ZwWriteFile() failed (Status %lx)\n", Status);
+      ZwClose(FileHandle);
       return(Status);
     }
 
   BlockIndex = 0;
-  while (TRUE)
+  while (BlockIndex < RegistryHive->BlockListSize)
     {
+      LastIndex = BlockIndex;
       BlockIndex = RtlFindSetBits(&RegistryHive->DirtyBitMap,
                                  1,
                                  BlockIndex);
-      if ((BlockIndex == (ULONG)-1) ||
-         (BlockIndex >= RegistryHive->BlockListSize))
+      if (BlockIndex == (ULONG)-1 || BlockIndex < LastIndex)
        {
          DPRINT("No more set bits\n");
          Status = STATUS_SUCCESS;
@@ -1813,14 +1809,14 @@ CmiStartHiveUpdate(PREGISTRY_HIVE RegistryHive)
 
       DPRINT("Block %lu is dirty\n", BlockIndex);
 
-      BlockPtr = RegistryHive->BlockList[BlockIndex];
-      DPRINT("BlockPtr %p\n", BlockPtr);
+      BlockPtr = RegistryHive->BlockList[BlockIndex].Block;
+      DPRINT("  BlockPtr %p\n", BlockPtr);
 
-      FileOffset.QuadPart = (ULONGLONG)(BlockIndex + 1) * 4096ULL;
-      DPRINT("File offset %I64x\n", FileOffset.QuadPart);
+      FileOffset.QuadPart = (ULONGLONG)(BlockIndex + 1) * (ULONGLONG)REG_BLOCK_SIZE;
+      DPRINT("  File offset %I64x\n", FileOffset.QuadPart);
 
       /* Write hive block */
-      Status = NtWriteFile(FileHandle,
+      Status = ZwWriteFile(FileHandle,
                           NULL,
                           NULL,
                           NULL,
@@ -1831,22 +1827,22 @@ CmiStartHiveUpdate(PREGISTRY_HIVE RegistryHive)
                           NULL);
       if (!NT_SUCCESS(Status))
        {
-         DPRINT("NtWriteFile() failed (Status %lx)\n", Status);
-         NtClose(FileHandle);
+         DPRINT("ZwWriteFile() failed (Status %lx)\n", Status);
+         ZwClose(FileHandle);
          return(Status);
        }
 
       BlockIndex++;
     }
 
-  Status = NtFlushBuffersFile(FileHandle,
+  Status = ZwFlushBuffersFile(FileHandle,
                              &IoStatusBlock);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtFlushBuffersFile() failed (Status %lx)\n", Status);
+      DPRINT("ZwFlushBuffersFile() failed (Status %lx)\n", Status);
     }
 
-  NtClose(FileHandle);
+  ZwClose(FileHandle);
 
   return(Status);
 }
@@ -1865,11 +1861,11 @@ CmiFinishHiveUpdate(PREGISTRY_HIVE RegistryHive)
 
   InitializeObjectAttributes(&ObjectAttributes,
                             &RegistryHive->HiveFileName,
-                            0,
+                            OBJ_CASE_INSENSITIVE,
                             NULL,
                             NULL);
 
-  Status = NtCreateFile(&FileHandle,
+  Status = ZwCreateFile(&FileHandle,
                        FILE_ALL_ACCESS,
                        &ObjectAttributes,
                        &IoStatusBlock,
@@ -1882,7 +1878,7 @@ CmiFinishHiveUpdate(PREGISTRY_HIVE RegistryHive)
                        0);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtCreateFile() failed (Status %lx)\n", Status);
+      DPRINT("ZwCreateFile() failed (Status %lx)\n", Status);
       return(Status);
     }
 
@@ -1892,8 +1888,8 @@ CmiFinishHiveUpdate(PREGISTRY_HIVE RegistryHive)
   RegistryHive->HiveHeader->Checksum = CmiCalcChecksum((PULONG)RegistryHive->HiveHeader);
 
   /* Write hive block */
-  FileOffset.QuadPart = 0ULL;
-  Status = NtWriteFile(FileHandle,
+  FileOffset.QuadPart = (ULONGLONG)0;
+  Status = ZwWriteFile(FileHandle,
                       NULL,
                       NULL,
                       NULL,
@@ -1904,19 +1900,19 @@ CmiFinishHiveUpdate(PREGISTRY_HIVE RegistryHive)
                       NULL);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtWriteFile() failed (Status %lx)\n", Status);
-      NtClose(FileHandle);
+      DPRINT("ZwWriteFile() failed (Status %lx)\n", Status);
+      ZwClose(FileHandle);
       return(Status);
     }
 
-  Status = NtFlushBuffersFile(FileHandle,
+  Status = ZwFlushBuffersFile(FileHandle,
                              &IoStatusBlock);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("NtFlushBuffersFile() failed (Status %lx)\n", Status);
+      DPRINT("ZwFlushBuffersFile() failed (Status %lx)\n", Status);
     }
 
-  NtClose(FileHandle);
+  ZwClose(FileHandle);
 
   return(Status);
 }
@@ -1940,7 +1936,7 @@ CmiFlushRegistryHive(PREGISTRY_HIVE RegistryHive)
         &RegistryHive->LogFileName);
 
   /* Update hive header modification time */
-  NtQuerySystemTime(&RegistryHive->HiveHeader->DateModified);
+  KeQuerySystemTime(&RegistryHive->HiveHeader->DateModified);
 
   /* Start log update */
   Status = CmiStartLogUpdate(RegistryHive);
@@ -1995,6 +1991,36 @@ CmiFlushRegistryHive(PREGISTRY_HIVE RegistryHive)
 }
 
 
+ULONG
+CmiGetNumberOfSubKeys(PKEY_OBJECT KeyObject)
+{
+  PKEY_OBJECT CurKey;
+  PKEY_CELL KeyCell;
+  ULONG SubKeyCount;
+  ULONG i;
+
+  VERIFY_KEY_OBJECT(KeyObject);
+
+  KeyCell = KeyObject->KeyCell;
+  VERIFY_KEY_CELL(KeyCell);
+
+  SubKeyCount = (KeyCell == NULL) ? 0 : KeyCell->NumberOfSubKeys;
+
+  /* Search for volatile or 'foreign' keys */
+  for (i = 0; i < KeyObject->NumberOfSubKeys; i++)
+    {
+      CurKey = KeyObject->SubKeys[i];
+      if (CurKey->RegistryHive == CmiVolatileHive ||
+         CurKey->RegistryHive != KeyObject->RegistryHive)
+       {
+         SubKeyCount++;
+       }
+    }
+
+  return SubKeyCount;
+}
+
+
 ULONG
 CmiGetMaxNameLength(PKEY_OBJECT KeyObject)
 {
@@ -2022,8 +2048,8 @@ CmiGetMaxNameLength(PKEY_OBJECT KeyObject)
   else
     {
       for (i = 0; i < HashBlock->HashTableSize; i++)
-        {
-          if (HashBlock->Table[i].KeyOffset != 0)
+       {
+         if (HashBlock->Table[i].KeyOffset != 0)
            {
              CurSubKeyCell = CmiGetCell (KeyObject->RegistryHive,
                                          HashBlock->Table[i].KeyOffset,
@@ -2033,45 +2059,60 @@ CmiGetMaxNameLength(PKEY_OBJECT KeyObject)
                  DPRINT("CmiGetBlock() failed\n");
                  continue;
                }
-              NameSize = CurSubKeyCell->NameSize;
+
+             NameSize = CurSubKeyCell->NameSize;
              if (CurSubKeyCell->Flags & REG_KEY_NAME_PACKED)
                {
                  NameSize *= sizeof(WCHAR);
                }
-             if (MaxName < NameSize)
+
+             if (NameSize > MaxName)
                {
                  MaxName = NameSize;
                }
            }
        }
     }
-  if (KeyObject->RegistryHive != CmiVolatileHive)
+
+  DPRINT ("KeyObject->NumberOfSubKeys %d\n", KeyObject->NumberOfSubKeys);
+  for (i = 0; i < KeyObject->NumberOfSubKeys; i++)
     {
-      DPRINT("KeyObject->NumberOfSubKeys %d\n", KeyObject->NumberOfSubKeys);
-      for (i = 0; i < KeyObject->NumberOfSubKeys; i++)
-        {
-         CurKey = KeyObject->SubKeys[i];
-         if (CurKey->RegistryHive == CmiVolatileHive)
+      CurKey = KeyObject->SubKeys[i];
+      if (CurKey->RegistryHive == CmiVolatileHive ||
+         CurKey->RegistryHive != KeyObject->RegistryHive)
+       {
+         CurSubKeyCell = CurKey->KeyCell;
+         if (CurSubKeyCell == NULL)
            {
-             CurSubKeyCell = CurKey->KeyCell;
-             if (CurSubKeyCell == NULL)
-               {
-                  DPRINT("CmiGetBlock() failed\n");
-                 continue;
-               }
-              NameSize = CurSubKeyCell->NameSize;
+             DPRINT("CmiGetBlock() failed\n");
+             continue;
+           }
+
+         if ((CurSubKeyCell->Flags & REG_KEY_ROOT_CELL) == REG_KEY_ROOT_CELL)
+           {
+             /* Use name of the key object */
+             NameSize = CurKey->Name.Length;
+           }
+         else
+           {
+             /* Use name of the key cell */
+             NameSize = CurSubKeyCell->NameSize;
              if (CurSubKeyCell->Flags & REG_KEY_NAME_PACKED)
-               {
-                 NameSize *= sizeof(WCHAR);
-               }
-             if (MaxName < NameSize)
-               {
-                 MaxName = NameSize;
-               }
+               {
+                 NameSize *= sizeof(WCHAR);
+               }
+           }
+         DPRINT ("NameSize %lu\n", NameSize);
+
+         if (NameSize > MaxName)
+           {
+             MaxName = NameSize;
            }
        }
     }
 
+  DPRINT ("MaxName %lu\n", MaxName);
+
   return MaxName;
 }
 
@@ -2102,8 +2143,8 @@ CmiGetMaxClassLength(PKEY_OBJECT  KeyObject)
   else
     {
       for (i = 0; i < HashBlock->HashTableSize; i++)
-        {
-          if (HashBlock->Table[i].KeyOffset != 0)
+       {
+         if (HashBlock->Table[i].KeyOffset != 0)
            {
              CurSubKeyCell = CmiGetCell (KeyObject->RegistryHive,
                                          HashBlock->Table[i].KeyOffset,
@@ -2121,24 +2162,24 @@ CmiGetMaxClassLength(PKEY_OBJECT  KeyObject)
            }
        }
     }
-  if (KeyObject->RegistryHive != CmiVolatileHive)
+
+  DPRINT("KeyObject->NumberOfSubKeys %d\n", KeyObject->NumberOfSubKeys);
+  for (i = 0; i < KeyObject->NumberOfSubKeys; i++)
     {
-      DPRINT("KeyObject->NumberOfSubKeys %d\n", KeyObject->NumberOfSubKeys);
-      for (i = 0; i < KeyObject->NumberOfSubKeys; i++)
-        {
-         CurKey = KeyObject->SubKeys[i];
-         if (CurKey->RegistryHive == CmiVolatileHive)
+      CurKey = KeyObject->SubKeys[i];
+      if (CurKey->RegistryHive == CmiVolatileHive ||
+         CurKey->RegistryHive != KeyObject->RegistryHive)
+       {
+         CurSubKeyCell = CurKey->KeyCell;
+         if (CurSubKeyCell == NULL)
            {
-             CurSubKeyCell = CurKey->KeyCell;
-             if (CurSubKeyCell == NULL)
-               {
-                  DPRINT("CmiGetBlock() failed\n");
-                 continue;
-               }
-             if (MaxClass < CurSubKeyCell->ClassSize)
-               {
-                 MaxClass = CurSubKeyCell->ClassSize;
-               }
+             DPRINT("CmiGetBlock() failed\n");
+             continue;
+           }
+
+         if (MaxClass < CurSubKeyCell->ClassSize)
+           {
+             MaxClass = CurSubKeyCell->ClassSize;
            }
        }
     }
@@ -2180,15 +2221,15 @@ CmiGetMaxValueNameLength(PREGISTRY_HIVE RegistryHive,
        }
 
       if (CurValueCell != NULL)
-        {
+       {
          Size = CurValueCell->NameSize;
          if (CurValueCell->Flags & REG_VALUE_NAME_PACKED)
            {
              Size *= sizeof(WCHAR);
            }
-          if (MaxValueName < Size)
-            {
-              MaxValueName = Size;
+         if (MaxValueName < Size)
+           {
+             MaxValueName = Size;
            }
         }
     }
@@ -2220,7 +2261,7 @@ CmiGetMaxValueDataLength(PREGISTRY_HIVE RegistryHive,
       CurValueCell = CmiGetCell (RegistryHive,
                                  ValueListCell->ValueOffset[i],NULL);
       if ((CurValueCell != NULL) &&
-          (MaxValueData < (CurValueCell->DataSize & REG_DATA_SIZE_MASK)))
+          (MaxValueData < (LONG)(CurValueCell->DataSize & REG_DATA_SIZE_MASK)))
         {
           MaxValueData = CurValueCell->DataSize & REG_DATA_SIZE_MASK;
         }
@@ -2247,7 +2288,7 @@ CmiScanForSubKey(IN PREGISTRY_HIVE RegistryHive,
 
   DPRINT("Scanning for sub key %wZ\n", KeyName);
 
-  assert(RegistryHive);
+  ASSERT(RegistryHive);
 
   *SubKeyCell = NULL;
 
@@ -2392,7 +2433,7 @@ CmiAddSubKey(PREGISTRY_HIVE RegistryHive,
     {
       NewKeyCell->Id = REG_KEY_CELL_ID;
       NewKeyCell->Flags = 0;
-      NtQuerySystemTime(&NewKeyCell->LastWriteTime);
+      KeQuerySystemTime(&NewKeyCell->LastWriteTime);
       NewKeyCell->ParentKeyOffset = -1;
       NewKeyCell->NumberOfSubKeys = 0;
       NewKeyCell->HashTableOffset = -1;
@@ -2508,7 +2549,7 @@ CmiAddSubKey(PREGISTRY_HIVE RegistryHive,
       ParentKeyCell->NumberOfSubKeys++;
     }
 
-  NtQuerySystemTime (&ParentKeyCell->LastWriteTime);
+  KeQuerySystemTime (&ParentKeyCell->LastWriteTime);
   CmiMarkBlockDirty (RegistryHive, ParentKey->KeyCellOffset);
 
   return(Status);
@@ -2541,43 +2582,44 @@ CmiRemoveSubKey(PREGISTRY_HIVE RegistryHive,
          return STATUS_UNSUCCESSFUL;
        }
 
-      if (ValueList != NULL)
+      /* Enumerate all values */
+      for (i = 0; i < SubKey->KeyCell->NumberOfValues; i++)
        {
-         /* Enumerate all values */
-         for (i = 0; i < SubKey->KeyCell->NumberOfValues; i++)
+         /* Get pointer to value cell */
+         ValueCell = CmiGetCell(RegistryHive,
+                                ValueList->ValueOffset[i],
+                                NULL);
+         if (ValueCell == NULL)
+           {
+             DPRINT("CmiGetCell() failed\n");
+             return STATUS_UNSUCCESSFUL;
+           }
+
+         if (!(ValueCell->DataSize & REG_DATA_IN_OFFSET)
+              && ValueCell->DataSize > sizeof(BLOCK_OFFSET))
            {
-             /* Get pointer to value cell */
-             ValueCell = CmiGetCell (RegistryHive,
-                                     ValueList->ValueOffset[i],
-                                     NULL);
-             if (ValueCell != NULL)
+             DataCell = CmiGetCell (RegistryHive,
+                                    ValueCell->DataOffset,
+                                    NULL);
+             if (DataCell == NULL)
+               {
+                 DPRINT("CmiGetCell() failed\n");
+                 return STATUS_UNSUCCESSFUL;
+               }
+
+             if (DataCell != NULL)
                {
-                 if (ValueCell->DataSize > sizeof(BLOCK_OFFSET))
-                   {
-                     DataCell = CmiGetCell (RegistryHive,
-                                            ValueCell->DataOffset,
-                                            NULL);
-                     if (DataCell == NULL)
-                       {
-                         DPRINT("CmiGetCell() failed\n");
-                         return STATUS_UNSUCCESSFUL;
-                       }
-
-                     if (DataCell != NULL)
-                       {
-                         /* Destroy data cell */
-                         CmiDestroyCell (RegistryHive,
-                                         DataCell,
-                                         ValueCell->DataOffset);
-                       }
-                   }
-
-                 /* Destroy value cell */
+                 /* Destroy data cell */
                  CmiDestroyCell (RegistryHive,
-                                 ValueCell,
-                                 ValueList->ValueOffset[i]);
+                                 DataCell,
+                                 ValueCell->DataOffset);
                }
            }
+
+         /* Destroy value cell */
+         CmiDestroyCell (RegistryHive,
+                         ValueCell,
+                         ValueList->ValueOffset[i]);
        }
 
       /* Destroy value list cell */
@@ -2587,12 +2629,15 @@ CmiRemoveSubKey(PREGISTRY_HIVE RegistryHive,
 
       SubKey->KeyCell->NumberOfValues = 0;
       SubKey->KeyCell->ValueListOffset = (BLOCK_OFFSET)-1;
+
+      CmiMarkBlockDirty(RegistryHive,
+                       SubKey->KeyCellOffset);
     }
 
   /* Remove the key from the parent key's hash block */
   if (ParentKey->KeyCell->HashTableOffset != (BLOCK_OFFSET) -1)
     {
-      DPRINT("ParentKey HashTableOffset %lx\n", ParentKey->KeyCell->HashTableOffset)
+      DPRINT("ParentKey HashTableOffset %lx\n", ParentKey->KeyCell->HashTableOffset);
       HashBlock = CmiGetCell (ParentKey->RegistryHive,
                              ParentKey->KeyCell->HashTableOffset,
                              NULL);
@@ -2601,7 +2646,7 @@ CmiRemoveSubKey(PREGISTRY_HIVE RegistryHive,
          DPRINT("CmiGetCell() failed\n");
          return STATUS_UNSUCCESSFUL;
        }
-      DPRINT("ParentKey HashBlock %p\n", HashBlock)
+      DPRINT("ParentKey HashBlock %p\n", HashBlock);
       if (HashBlock != NULL)
        {
          CmiRemoveKeyFromHashTable(ParentKey->RegistryHive,
@@ -2615,7 +2660,7 @@ CmiRemoveSubKey(PREGISTRY_HIVE RegistryHive,
   /* Remove the key's hash block */
   if (SubKey->KeyCell->HashTableOffset != (BLOCK_OFFSET) -1)
     {
-      DPRINT("SubKey HashTableOffset %lx\n", SubKey->KeyCell->HashTableOffset)
+      DPRINT("SubKey HashTableOffset %lx\n", SubKey->KeyCell->HashTableOffset);
       HashBlock = CmiGetCell (RegistryHive,
                              SubKey->KeyCell->HashTableOffset,
                              NULL);
@@ -2624,7 +2669,7 @@ CmiRemoveSubKey(PREGISTRY_HIVE RegistryHive,
          DPRINT("CmiGetCell() failed\n");
          return STATUS_UNSUCCESSFUL;
        }
-      DPRINT("SubKey HashBlock %p\n", HashBlock)
+      DPRINT("SubKey HashBlock %p\n", HashBlock);
       if (HashBlock != NULL)
        {
          CmiDestroyCell (RegistryHive,
@@ -2637,13 +2682,13 @@ CmiRemoveSubKey(PREGISTRY_HIVE RegistryHive,
   /* Decrement the number of the parent key's sub keys */
   if (ParentKey != NULL)
     {
-      DPRINT("ParentKey %p\n", ParentKey)
+      DPRINT("ParentKey %p\n", ParentKey);
       ParentKey->KeyCell->NumberOfSubKeys--;
 
       /* Remove the parent key's hash table */
       if (ParentKey->KeyCell->NumberOfSubKeys == 0)
        {
-         DPRINT("ParentKey HashTableOffset %lx\n", ParentKey->KeyCell->HashTableOffset)
+         DPRINT("ParentKey HashTableOffset %lx\n", ParentKey->KeyCell->HashTableOffset);
          HashBlock = CmiGetCell (ParentKey->RegistryHive,
                                  ParentKey->KeyCell->HashTableOffset,
                                  NULL);
@@ -2652,7 +2697,7 @@ CmiRemoveSubKey(PREGISTRY_HIVE RegistryHive,
              DPRINT("CmiGetCell() failed\n");
              return STATUS_UNSUCCESSFUL;
            }
-         DPRINT("ParentKey HashBlock %p\n", HashBlock)
+         DPRINT("ParentKey HashBlock %p\n", HashBlock);
          if (HashBlock != NULL)
            {
              CmiDestroyCell (ParentKey->RegistryHive,
@@ -2662,7 +2707,7 @@ CmiRemoveSubKey(PREGISTRY_HIVE RegistryHive,
            }
        }
 
-      NtQuerySystemTime(&ParentKey->KeyCell->LastWriteTime);
+      KeQuerySystemTime(&ParentKey->KeyCell->LastWriteTime);
       CmiMarkBlockDirty(ParentKey->RegistryHive,
                        ParentKey->KeyCellOffset);
     }
@@ -2674,7 +2719,9 @@ CmiRemoveSubKey(PREGISTRY_HIVE RegistryHive,
   SubKey->KeyCell = NULL;
   SubKey->KeyCellOffset = (BLOCK_OFFSET)-1;
 
-  return(STATUS_SUCCESS);
+  DPRINT("CmiRemoveSubKey() done\n");
+
+  return STATUS_SUCCESS;
 }
 
 
@@ -2683,18 +2730,20 @@ CmiScanKeyForValue(IN PREGISTRY_HIVE RegistryHive,
                   IN PKEY_CELL KeyCell,
                   IN PUNICODE_STRING ValueName,
                   OUT PVALUE_CELL *ValueCell,
-                  OUT BLOCK_OFFSET *VBOffset)
+                  OUT BLOCK_OFFSET *ValueCellOffset)
 {
   PVALUE_LIST_CELL ValueListCell;
   PVALUE_CELL CurValueCell;
   ULONG i;
 
   *ValueCell = NULL;
+  if (ValueCellOffset != NULL)
+    *ValueCellOffset = (BLOCK_OFFSET)-1;
 
   /* The key does not have any values */
   if (KeyCell->ValueListOffset == (BLOCK_OFFSET)-1)
     {
-      return STATUS_SUCCESS;
+      return STATUS_OBJECT_NAME_NOT_FOUND;
     }
 
   ValueListCell = CmiGetCell (RegistryHive, KeyCell->ValueListOffset, NULL);
@@ -2721,17 +2770,17 @@ CmiScanKeyForValue(IN PREGISTRY_HIVE RegistryHive,
          CmiComparePackedNames(ValueName,
                                CurValueCell->Name,
                                CurValueCell->NameSize,
-                               CurValueCell->Flags & REG_VALUE_NAME_PACKED))
+                               (BOOLEAN)((CurValueCell->Flags & REG_VALUE_NAME_PACKED) ? TRUE : FALSE)))
        {
          *ValueCell = CurValueCell;
-         if (VBOffset)
-           *VBOffset = ValueListCell->ValueOffset[i];
+         if (ValueCellOffset != NULL)
+           *ValueCellOffset = ValueListCell->ValueOffset[i];
          //DPRINT("Found value %s\n", ValueName);
-         break;
+         return STATUS_SUCCESS;
        }
     }
 
-  return STATUS_SUCCESS;
+  return STATUS_OBJECT_NAME_NOT_FOUND;
 }
 
 
@@ -2785,31 +2834,23 @@ CmiGetValueFromKeyByIndex(IN PREGISTRY_HIVE RegistryHive,
 NTSTATUS
 CmiAddValueToKey(IN PREGISTRY_HIVE RegistryHive,
                 IN PKEY_CELL KeyCell,
+                IN BLOCK_OFFSET KeyCellOffset,
                 IN PUNICODE_STRING ValueName,
                 OUT PVALUE_CELL *pValueCell,
-                OUT BLOCK_OFFSET *pVBOffset)
+                OUT BLOCK_OFFSET *pValueCellOffset)
 {
   PVALUE_LIST_CELL NewValueListCell;
   PVALUE_LIST_CELL ValueListCell;
   PVALUE_CELL NewValueCell;
-  BLOCK_OFFSET VLBOffset;
-  BLOCK_OFFSET VBOffset;
+  BLOCK_OFFSET NewValueListCellOffset;
+  BLOCK_OFFSET ValueListCellOffset;
+  BLOCK_OFFSET NewValueCellOffset;
   ULONG CellSize;
   NTSTATUS Status;
 
-  Status = CmiAllocateValueCell(RegistryHive,
-                               &NewValueCell,
-                               &VBOffset,
-                               ValueName);
-  if (!NT_SUCCESS(Status))
-    {
-      return Status;
-    }
-
   DPRINT("KeyCell->ValuesOffset %lu\n", (ULONG)KeyCell->ValueListOffset);
 
   ValueListCell = CmiGetCell (RegistryHive, KeyCell->ValueListOffset, NULL);
-
   if (ValueListCell == NULL)
     {
       CellSize = sizeof(VALUE_LIST_CELL) +
@@ -2817,27 +2858,30 @@ CmiAddValueToKey(IN PREGISTRY_HIVE RegistryHive,
       Status = CmiAllocateCell (RegistryHive,
                                CellSize,
                                (PVOID) &ValueListCell,
-                               &VLBOffset);
-
+                               &ValueListCellOffset);
       if (!NT_SUCCESS(Status))
        {
-         CmiDestroyValueCell(RegistryHive, NewValueCell, VBOffset);
          return Status;
        }
-      KeyCell->ValueListOffset = VLBOffset;
+
+      KeyCell->ValueListOffset = ValueListCellOffset;
+      CmiMarkBlockDirty(RegistryHive, KeyCellOffset);
+      CmiMarkBlockDirty(RegistryHive, ValueListCellOffset);
     }
-  else if (KeyCell->NumberOfValues >= 
+  else if (KeyCell->NumberOfValues >=
           (((ULONG)ABS_VALUE(ValueListCell->CellSize) - sizeof(VALUE_LIST_CELL)) / sizeof(BLOCK_OFFSET)))
     {
+#if 0
       CellSize = sizeof(VALUE_LIST_CELL) +
                 ((KeyCell->NumberOfValues + REG_VALUE_LIST_CELL_MULTIPLE) * sizeof(BLOCK_OFFSET));
+#endif
+      CellSize = 2 * (ULONG)ABS_VALUE(ValueListCell->CellSize);
       Status = CmiAllocateCell (RegistryHive,
                                CellSize,
                                (PVOID) &NewValueListCell,
-                               &VLBOffset);
+                               &NewValueListCellOffset);
       if (!NT_SUCCESS(Status))
        {
-         CmiDestroyValueCell(RegistryHive, NewValueCell, VBOffset);
          return Status;
        }
 
@@ -2845,8 +2889,12 @@ CmiAddValueToKey(IN PREGISTRY_HIVE RegistryHive,
                    &ValueListCell->ValueOffset[0],
                    sizeof(BLOCK_OFFSET) * KeyCell->NumberOfValues);
       CmiDestroyCell (RegistryHive, ValueListCell, KeyCell->ValueListOffset);
-      KeyCell->ValueListOffset = VLBOffset;
+      CmiMarkBlockDirty (RegistryHive, KeyCell->ValueListOffset);
+
+      KeyCell->ValueListOffset = NewValueListCellOffset;
       ValueListCell = NewValueListCell;
+      CmiMarkBlockDirty (RegistryHive, KeyCellOffset);
+      CmiMarkBlockDirty (RegistryHive, NewValueListCellOffset);
     }
 
   DPRINT("KeyCell->NumberOfValues %lu, ValueListCell->CellSize %lu (%lu %lx)\n",
@@ -2855,11 +2903,24 @@ CmiAddValueToKey(IN PREGISTRY_HIVE RegistryHive,
         ((ULONG)ABS_VALUE(ValueListCell->CellSize) - sizeof(VALUE_LIST_CELL)) / sizeof(BLOCK_OFFSET),
         ((ULONG)ABS_VALUE(ValueListCell->CellSize) - sizeof(VALUE_LIST_CELL)) / sizeof(BLOCK_OFFSET));
 
-  ValueListCell->ValueOffset[KeyCell->NumberOfValues] = VBOffset;
+  Status = CmiAllocateValueCell(RegistryHive,
+                               &NewValueCell,
+                               &NewValueCellOffset,
+                               ValueName);
+  if (!NT_SUCCESS(Status))
+    {
+      return Status;
+    }
+
+  ValueListCell->ValueOffset[KeyCell->NumberOfValues] = NewValueCellOffset;
   KeyCell->NumberOfValues++;
 
+  CmiMarkBlockDirty(RegistryHive, KeyCellOffset);
+  CmiMarkBlockDirty(RegistryHive, KeyCell->ValueListOffset);
+  CmiMarkBlockDirty(RegistryHive, NewValueCellOffset);
+
   *pValueCell = NewValueCell;
-  *pVBOffset = VBOffset;
+  *pValueCellOffset = NewValueCellOffset;
 
   return STATUS_SUCCESS;
 }
@@ -2873,13 +2934,13 @@ CmiDeleteValueFromKey(IN PREGISTRY_HIVE RegistryHive,
 {
   PVALUE_LIST_CELL ValueListCell;
   PVALUE_CELL CurValueCell;
-  ULONG  i;
+  ULONG i;
+  NTSTATUS Status;
 
   ValueListCell = CmiGetCell (RegistryHive, KeyCell->ValueListOffset, NULL);
-
   if (ValueListCell == NULL)
     {
-      DPRINT("CmiGetBlock() failed\n");
+      DPRINT1("CmiGetBlock() failed\n");
       return STATUS_SUCCESS;
     }
 
@@ -2890,50 +2951,58 @@ CmiDeleteValueFromKey(IN PREGISTRY_HIVE RegistryHive,
       CurValueCell = CmiGetCell (RegistryHive, ValueListCell->ValueOffset[i], NULL);
       if (CurValueCell == NULL)
        {
-         DPRINT("CmiGetBlock() failed\n");
+         DPRINT1("CmiGetBlock() failed\n");
          return STATUS_UNSUCCESSFUL;
        }
 
-      if ((CurValueCell != NULL) &&
-         CmiComparePackedNames(ValueName,
+      if (CmiComparePackedNames(ValueName,
                                CurValueCell->Name,
                                CurValueCell->NameSize,
-                               CurValueCell->Flags & REG_VALUE_NAME_PACKED))
+                               (BOOLEAN)((CurValueCell->Flags & REG_VALUE_NAME_PACKED) ? TRUE : FALSE)))
        {
-         CmiDestroyValueCell(RegistryHive, CurValueCell, ValueListCell->ValueOffset[i]);
+         Status = CmiDestroyValueCell(RegistryHive,
+                                      CurValueCell,
+                                      ValueListCell->ValueOffset[i]);
+         if (CurValueCell == NULL)
+           {
+             DPRINT1("CmiDestroyValueCell() failed\n");
+             return Status;
+           }
 
-         if ((KeyCell->NumberOfValues - 1) < i)
+         if (i < (KeyCell->NumberOfValues - 1))
            {
-             RtlCopyMemory(&ValueListCell->ValueOffset[i],
+             RtlMoveMemory(&ValueListCell->ValueOffset[i],
                            &ValueListCell->ValueOffset[i + 1],
                            sizeof(BLOCK_OFFSET) * (KeyCell->NumberOfValues - 1 - i));
            }
+         ValueListCell->ValueOffset[KeyCell->NumberOfValues - 1] = 0;
+
+
+         KeyCell->NumberOfValues--;
+
+         if (KeyCell->NumberOfValues == 0)
+           {
+             CmiDestroyCell(RegistryHive,
+                            ValueListCell,
+                            KeyCell->ValueListOffset);
+             KeyCell->ValueListOffset = -1;
+           }
          else
            {
-             RtlZeroMemory(&ValueListCell->ValueOffset[i], sizeof(BLOCK_OFFSET));
+             CmiMarkBlockDirty(RegistryHive,
+                               KeyCell->ValueListOffset);
            }
 
-         KeyCell->NumberOfValues -= 1;
-         break;
-       }
-    }
+         CmiMarkBlockDirty(RegistryHive,
+                           KeyCellOffset);
 
-  if (KeyCell->NumberOfValues == 0)
-    {
-      CmiDestroyCell (RegistryHive,
-                     ValueListCell,
-                     KeyCell->ValueListOffset);
-    }
-  else
-    {
-      CmiMarkBlockDirty(RegistryHive,
-                       KeyCell->ValueListOffset);
+         return STATUS_SUCCESS;
+       }
     }
 
-  CmiMarkBlockDirty(RegistryHive,
-                   KeyCellOffset);
+  DPRINT("Couldn't find the desired value\n");
 
-  return STATUS_SUCCESS;
+  return STATUS_OBJECT_NAME_NOT_FOUND;
 }
 
 
@@ -2949,7 +3018,7 @@ CmiAllocateHashTableCell (IN PREGISTRY_HIVE RegistryHive,
 
   Status = STATUS_SUCCESS;
   *HashBlock = NULL;
-  NewHashSize = sizeof(HASH_TABLE_CELL) + 
+  NewHashSize = sizeof(HASH_TABLE_CELL) +
                (SubKeyCount * sizeof(HASH_RECORD));
   Status = CmiAllocateCell (RegistryHive,
                            NewHashSize,
@@ -2962,8 +3031,9 @@ CmiAllocateHashTableCell (IN PREGISTRY_HIVE RegistryHive,
     }
   else
     {
+      ASSERT(SubKeyCount <= 0xffff); /* should really be USHORT_MAX or similar */
       NewHashBlock->Id = REG_HASH_TABLE_CELL_ID;
-      NewHashBlock->HashTableSize = SubKeyCount;
+      NewHashBlock->HashTableSize = (USHORT)SubKeyCount;
       *HashBlock = NewHashBlock;
     }
 
@@ -3076,8 +3146,9 @@ CmiAllocateValueCell(PREGISTRY_HIVE RegistryHive,
     }
   else
     {
+      ASSERT(NameSize <= 0xffff); /* should really be USHORT_MAX or similar */
       NewValueCell->Id = REG_VALUE_CELL_ID;
-      NewValueCell->NameSize = NameSize;
+      NewValueCell->NameSize = (USHORT)NameSize;
       if (Packable)
        {
          /* Pack the value name */
@@ -3106,44 +3177,46 @@ CmiAllocateValueCell(PREGISTRY_HIVE RegistryHive,
 NTSTATUS
 CmiDestroyValueCell(PREGISTRY_HIVE RegistryHive,
                    PVALUE_CELL ValueCell,
-                   BLOCK_OFFSET VBOffset)
+                   BLOCK_OFFSET ValueCellOffset)
 {
   NTSTATUS Status;
-  PVOID pBlock;
-  PHBIN pBin;
+  PVOID DataCell;
+  PHBIN Bin;
 
-  DPRINT("CmiDestroyValueCell(Cell %p  Offset %lx)\n", ValueCell, VBOffset);
+  DPRINT("CmiDestroyValueCell(Cell %p  Offset %lx)\n",
+        ValueCell, ValueCellOffset);
 
   VERIFY_VALUE_CELL(ValueCell);
 
   /* Destroy the data cell */
-  if (ValueCell->DataSize > sizeof(BLOCK_OFFSET))
+  if (!(ValueCell->DataSize & REG_DATA_IN_OFFSET)
+      && ValueCell->DataSize > sizeof(BLOCK_OFFSET))
     {
-      pBlock = CmiGetCell (RegistryHive, ValueCell->DataOffset, &pBin);
-      if (pBlock == NULL)
+      DataCell = CmiGetCell (RegistryHive, ValueCell->DataOffset, &Bin);
+      if (DataCell == NULL)
        {
-         DPRINT("CmiGetBlock() failed\n");
+         DPRINT("CmiGetCell() failed\n");
          return STATUS_UNSUCCESSFUL;
        }
 
-      Status = CmiDestroyCell (RegistryHive, pBlock, ValueCell->DataOffset);
+      Status = CmiDestroyCell (RegistryHive, DataCell, ValueCell->DataOffset);
       if (!NT_SUCCESS(Status))
        {
-         return  Status;
+         return Status;
        }
 
       /* Update time of heap */
       if (!IsNoFileHive(RegistryHive))
-       NtQuerySystemTime(&pBin->DateModified);
+       KeQuerySystemTime(&Bin->DateModified);
     }
 
   /* Destroy the value cell */
-  Status = CmiDestroyCell (RegistryHive, ValueCell, VBOffset);
+  Status = CmiDestroyCell (RegistryHive, ValueCell, ValueCellOffset);
 
   /* Update time of heap */
-  if (!IsNoFileHive(RegistryHive) && CmiGetCell (RegistryHive, VBOffset, &pBin))
+  if (!IsNoFileHive(RegistryHive) && CmiGetCell (RegistryHive, ValueCellOffset, &Bin))
     {
-      NtQuerySystemTime(&pBin->DateModified);
+      KeQuerySystemTime(&Bin->DateModified);
     }
 
   return Status;
@@ -3152,31 +3225,41 @@ CmiDestroyValueCell(PREGISTRY_HIVE RegistryHive,
 
 NTSTATUS
 CmiAddBin(PREGISTRY_HIVE RegistryHive,
+         ULONG BlockCount,
          PVOID *NewBlock,
          BLOCK_OFFSET *NewBlockOffset)
 {
+  PBLOCK_LIST_ENTRY BlockList;
   PCELL_HEADER tmpBlock;
-  PHBIN * tmpBlockList;
   PHBIN tmpBin;
+  ULONG BinSize;
+  ULONG i;
+  ULONG BitmapSize;
+
+  DPRINT ("CmiAddBin (BlockCount %lu)\n", BlockCount);
 
-  tmpBin = ExAllocatePool(PagedPool, REG_BLOCK_SIZE);
+  BinSize = BlockCount * REG_BLOCK_SIZE;
+  tmpBin = ExAllocatePool(PagedPool, BinSize);
   if (tmpBin == NULL)
     {
       return STATUS_INSUFFICIENT_RESOURCES;
     }
+  RtlZeroMemory (tmpBin,
+                BinSize);
 
-  tmpBin->BlockId = REG_BIN_ID;
-  tmpBin->BlockOffset = RegistryHive->FileSize - REG_BLOCK_SIZE;
-  RegistryHive->FileSize += REG_BLOCK_SIZE;
-  tmpBin->BlockSize = REG_BLOCK_SIZE;
-  tmpBin->Unused1 = 0;
-  ZwQuerySystemTime(&tmpBin->DateModified);
-  tmpBin->Unused2 = 0;
+  tmpBin->HeaderId = REG_BIN_ID;
+  tmpBin->BinOffset = RegistryHive->FileSize - REG_BLOCK_SIZE;
+  RegistryHive->FileSize += BinSize;
+  tmpBin->BinSize = BinSize;
+  KeQuerySystemTime(&tmpBin->DateModified);
+  tmpBin->MemAlloc = 0;
 
-  /* Increase size of list of blocks */
-  tmpBlockList = ExAllocatePool(NonPagedPool,
-         sizeof(PHBIN *) * (RegistryHive->BlockListSize + 1));
-  if (tmpBlockList == NULL)
+  DPRINT ("  BinOffset %lx  BinSize %lx\n", tmpBin->BinOffset,tmpBin->BinSize);
+
+  /* Allocate new block list */
+  BlockList = ExAllocatePool(NonPagedPool,
+                            sizeof(BLOCK_LIST_ENTRY) * (RegistryHive->BlockListSize + BlockCount));
+  if (BlockList == NULL)
     {
       ExFreePool(tmpBin);
       return STATUS_INSUFFICIENT_RESOURCES;
@@ -3184,31 +3267,36 @@ CmiAddBin(PREGISTRY_HIVE RegistryHive,
 
   if (RegistryHive->BlockListSize > 0)
     {
-      RtlCopyMemory (tmpBlockList,
+      RtlCopyMemory (BlockList,
                     RegistryHive->BlockList,
-                    sizeof(PHBIN *)*(RegistryHive->BlockListSize));
+                    sizeof(BLOCK_LIST_ENTRY) * RegistryHive->BlockListSize);
       ExFreePool(RegistryHive->BlockList);
     }
 
-  RegistryHive->BlockList = tmpBlockList;
-  RegistryHive->BlockList[RegistryHive->BlockListSize] = tmpBin;
-  RegistryHive->BlockListSize++;
+  RegistryHive->BlockList = BlockList;
+  for (i = 0; i < BlockCount; i++)
+    {
+      RegistryHive->BlockList[RegistryHive->BlockListSize + i].Block =
+       (PVOID)((ULONG_PTR)tmpBin + (i * REG_BLOCK_SIZE));
+      RegistryHive->BlockList[RegistryHive->BlockListSize + i].Bin = tmpBin;
+    }
+  RegistryHive->BlockListSize += BlockCount;
 
   /* Initialize a free block in this heap : */
   tmpBlock = (PCELL_HEADER)((ULONG_PTR) tmpBin + REG_HBIN_DATA_OFFSET);
-  tmpBlock->CellSize = (REG_BLOCK_SIZE - REG_HBIN_DATA_OFFSET);
+  tmpBlock->CellSize = (BinSize - REG_HBIN_DATA_OFFSET);
+
+  /* Calculate bitmap size in bytes (always a multiple of 32 bits) */
+  BitmapSize = ROUND_UP(RegistryHive->BlockListSize, sizeof(ULONG) * 8) / 8;
 
   /* Grow bitmap if necessary */
-  if (IsNoFileHive(RegistryHive) &&
-      (RegistryHive->BlockListSize % (sizeof(ULONG) * 8) == 0))
+  if (!IsNoFileHive(RegistryHive) &&
+      BitmapSize > RegistryHive->DirtyBitMap.SizeOfBitMap / 8)
     {
       PULONG BitmapBuffer;
-      ULONG BitmapSize;
 
       DPRINT("Grow hive bitmap\n");
 
-      /* Calculate bitmap size in bytes (always a multiple of 32 bits) */
-      BitmapSize = ROUND_UP(RegistryHive->BlockListSize, sizeof(ULONG) * 8) / 8;
       DPRINT("RegistryHive->BlockListSize: %lu\n", RegistryHive->BlockListSize);
       DPRINT("BitmapSize:  %lu Bytes  %lu Bits\n", BitmapSize, BitmapSize * 8);
       BitmapBuffer = (PULONG)ExAllocatePool(PagedPool,
@@ -3216,7 +3304,7 @@ CmiAddBin(PREGISTRY_HIVE RegistryHive,
       RtlZeroMemory(BitmapBuffer, BitmapSize);
       RtlCopyMemory(BitmapBuffer,
                    RegistryHive->DirtyBitMap.Buffer,
-                   RegistryHive->DirtyBitMap.SizeOfBitMap);
+                   RegistryHive->DirtyBitMap.SizeOfBitMap / 8);
       ExFreePool(RegistryHive->BitmapBuffer);
       RegistryHive->BitmapBuffer = BitmapBuffer;
       RtlInitializeBitMap(&RegistryHive->DirtyBitMap,
@@ -3227,11 +3315,11 @@ CmiAddBin(PREGISTRY_HIVE RegistryHive,
   *NewBlock = (PVOID) tmpBlock;
 
   if (NewBlockOffset)
-    *NewBlockOffset = tmpBin->BlockOffset + REG_HBIN_DATA_OFFSET;
+    *NewBlockOffset = tmpBin->BinOffset + REG_HBIN_DATA_OFFSET;
 
   /* Mark new bin dirty */
   CmiMarkBinDirty(RegistryHive,
-                 tmpBin->BlockOffset);
+                 tmpBin->BinOffset);
 
   return STATUS_SUCCESS;
 }
@@ -3244,12 +3332,10 @@ CmiAllocateCell (PREGISTRY_HIVE RegistryHive,
                 BLOCK_OFFSET *CellOffset)
 {
   PCELL_HEADER NewCell;
-  NTSTATUS Status;
-  PHBIN pBin;
+  PHBIN Bin;
   ULONG i;
   PVOID Temp;
-
-  Status = STATUS_SUCCESS;
+  NTSTATUS Status;
 
   /* Round to 16 bytes multiple */
   CellSize = ROUND_UP(CellSize, 16);
@@ -3258,20 +3344,18 @@ CmiAllocateCell (PREGISTRY_HIVE RegistryHive,
   if (IsPointerHive(RegistryHive))
     {
       NewCell = ExAllocatePool(NonPagedPool, CellSize);
-
       if (NewCell == NULL)
        {
-         Status = STATUS_INSUFFICIENT_RESOURCES;
+         return STATUS_INSUFFICIENT_RESOURCES;
        }
-      else
-       {
-         RtlZeroMemory(NewCell, CellSize);
-         NewCell->CellSize = -CellSize;
 
-         *Cell = NewCell;
-         if (CellOffset != NULL)
-           *CellOffset = (BLOCK_OFFSET) NewCell;
-       }
+      RtlZeroMemory (NewCell,
+                    CellSize);
+      NewCell->CellSize = -CellSize;
+
+      *Cell = NewCell;
+      if (CellOffset != NULL)
+       *CellOffset = (BLOCK_OFFSET) NewCell;
     }
   else
     {
@@ -3286,18 +3370,17 @@ CmiAllocateCell (PREGISTRY_HIVE RegistryHive,
                *CellOffset = RegistryHive->FreeListOffset[i];
 
              /* Update time of heap */
-             Temp = CmiGetCell (RegistryHive, RegistryHive->FreeListOffset[i], &pBin);
+             Temp = CmiGetCell (RegistryHive,
+                                RegistryHive->FreeListOffset[i],
+                                &Bin);
              if (Temp == NULL)
                {
                  DPRINT("CmiGetBlock() failed\n");
                  return STATUS_UNSUCCESSFUL;
                }
 
-             if (Temp)
-               {
-                 NtQuerySystemTime(&pBin->DateModified);
-                 CmiMarkBlockDirty(RegistryHive, RegistryHive->FreeListOffset[i]);
-               }
+             KeQuerySystemTime(&Bin->DateModified);
+             CmiMarkBlockDirty(RegistryHive, RegistryHive->FreeListOffset[i]);
 
              if ((i + 1) < RegistryHive->FreeListSize)
                {
@@ -3319,36 +3402,40 @@ CmiAllocateCell (PREGISTRY_HIVE RegistryHive,
       if (NewCell == NULL)
        {
          /* Add a new bin */
-         Status = CmiAddBin(RegistryHive, (PVOID *) &NewCell , CellOffset);
+         Status = CmiAddBin(RegistryHive,
+                            ((CellSize + sizeof(HBIN) - 1) / REG_BLOCK_SIZE) + 1,
+                            (PVOID *)&NewCell,
+                            CellOffset);
+         if (!NT_SUCCESS(Status))
+           return Status;
        }
 
-      if (NT_SUCCESS(Status))
-       {
-         *Cell = NewCell;
-
-         /* Split the block in two parts */
-         if (NewCell->CellSize > CellSize)
-           {
-             NewCell = (PCELL_HEADER) ((ULONG_PTR) NewCell + CellSize);
-             NewCell->CellSize = ((PCELL_HEADER) (*Cell))->CellSize - CellSize;
-             CmiAddFree(RegistryHive,
-                        NewCell,
-                        *CellOffset + CellSize,
-                        TRUE);
-             CmiMarkBlockDirty(RegistryHive,
-                               *CellOffset + CellSize);
-           }
-         else if (NewCell->CellSize < CellSize)
-           {
-             return(STATUS_UNSUCCESSFUL);
-           }
+      *Cell = NewCell;
 
-         RtlZeroMemory(*Cell, CellSize);
-         ((PCELL_HEADER) (*Cell))->CellSize = -CellSize;
+      /* Split the block in two parts */
+      if (NewCell->CellSize > CellSize)
+       {
+         NewCell = (PCELL_HEADER) ((ULONG_PTR) NewCell + CellSize);
+         NewCell->CellSize = ((PCELL_HEADER) (*Cell))->CellSize - CellSize;
+         ((PCELL_HEADER) (*Cell))->CellSize = CellSize;
+         CmiAddFree(RegistryHive,
+                    NewCell,
+                    *CellOffset + CellSize,
+                    TRUE);
+         CmiMarkBlockDirty(RegistryHive,
+                           *CellOffset + CellSize);
+       }
+      else if (NewCell->CellSize < CellSize)
+       {
+         return STATUS_UNSUCCESSFUL;
        }
+
+      RtlZeroMemory(*Cell,
+                   CellSize);
+      ((PCELL_HEADER) (*Cell))->CellSize *= -1;
     }
 
-  return(Status);
+  return STATUS_SUCCESS;
 }
 
 
@@ -3374,7 +3461,7 @@ CmiDestroyCell (PREGISTRY_HIVE RegistryHive,
         pFree->CellSize = -pFree->CellSize;
 
       /* Clear block (except the block size) */
-      RtlZeroMemory(((PVOID)pFree) + sizeof(ULONG),
+      RtlZeroMemory(((char*)pFree) + sizeof(ULONG),
                    pFree->CellSize - sizeof(ULONG));
 
       /* Add block to the list of free blocks */
@@ -3382,7 +3469,7 @@ CmiDestroyCell (PREGISTRY_HIVE RegistryHive,
 
       /* Update time of heap */
       if (!IsNoFileHive(RegistryHive) && CmiGetCell (RegistryHive, CellOffset,&pBin))
-       NtQuerySystemTime(&pBin->DateModified);
+       KeQuerySystemTime(&pBin->DateModified);
 
       CmiMarkBlockDirty(RegistryHive, CellOffset);
     }
@@ -3394,13 +3481,13 @@ CmiDestroyCell (PREGISTRY_HIVE RegistryHive,
 PVOID
 CmiGetCell (PREGISTRY_HIVE RegistryHive,
            BLOCK_OFFSET CellOffset,
-           PHBIN * ppBin)
+           PHBIN *Bin)
 {
   PHBIN pBin;
 
-  if (ppBin)
+  if (Bin != NULL)
     {
-      *ppBin = NULL;
+      *Bin = NULL;
     }
 
   if (CellOffset == (BLOCK_OFFSET)-1)
@@ -3413,25 +3500,25 @@ CmiGetCell (PREGISTRY_HIVE RegistryHive,
       return (PVOID)CellOffset;
     }
 
-  if (CellOffset > RegistryHive->BlockListSize * 4096)
+  if (CellOffset > RegistryHive->BlockListSize * REG_BLOCK_SIZE)
     {
       DPRINT1("CellOffset exceeds valid range (%lu > %lu)\n",
-             CellOffset, RegistryHive->BlockListSize * 4096);
+             CellOffset, RegistryHive->BlockListSize * REG_BLOCK_SIZE);
       return NULL;
     }
 
-  pBin = RegistryHive->BlockList[CellOffset / 4096];
+  pBin = RegistryHive->BlockList[CellOffset / REG_BLOCK_SIZE].Bin;
   if (pBin == NULL)
     {
       return NULL;
     }
 
-  if (ppBin)
+  if (Bin != NULL)
     {
-      *ppBin = pBin;
+      *Bin = pBin;
     }
 
-  return((PVOID)((ULONG_PTR)pBin + (CellOffset - pBin->BlockOffset)));
+  return((PVOID)((ULONG_PTR)pBin + (CellOffset - pBin->BinOffset)));
 }
 
 
@@ -3457,8 +3544,8 @@ CmiMergeFree(PREGISTRY_HIVE RegistryHive,
   if (Bin == NULL)
     return(FALSE);
 
-  BinOffset = Bin->BlockOffset;
-  BinSize = Bin->BlockSize;
+  BinOffset = Bin->BinOffset;
+  BinSize = Bin->BinSize;
   DPRINT("Bin %p  Offset %lx  Size %lx\n", Bin, BinOffset, BinSize);
 
   for (i = 0; i < RegistryHive->FreeListSize; i++)
@@ -3544,8 +3631,8 @@ CmiAddFree(PREGISTRY_HIVE RegistryHive,
   LONG maxInd;
   LONG medInd;
 
-  assert(RegistryHive);
-  assert(FreeBlock);
+  ASSERT(RegistryHive);
+  ASSERT(FreeBlock);
 
   DPRINT("FreeBlock %.08lx  FreeOffset %.08lx\n",
         FreeBlock, FreeOffset);
@@ -3654,7 +3741,7 @@ CmiMarkBlockDirty(PREGISTRY_HIVE RegistryHive,
 
   DPRINT("CmiMarkBlockDirty(Offset 0x%lx)\n", (ULONG)BlockOffset);
 
-  BlockNumber = (ULONG)BlockOffset / 4096;
+  BlockNumber = (ULONG)BlockOffset / REG_BLOCK_SIZE;
 
   Cell = CmiGetCell (RegistryHive,
                     BlockOffset,
@@ -3664,7 +3751,8 @@ CmiMarkBlockDirty(PREGISTRY_HIVE RegistryHive,
   if (CellSize < 0)
     CellSize = -CellSize;
 
-  BlockCount = (ROUND_UP(BlockOffset + CellSize, 4096) - ROUND_DOWN(BlockOffset, 4096)) / 4096;
+  BlockCount = (ROUND_UP(BlockOffset + CellSize, REG_BLOCK_SIZE) -
+               ROUND_DOWN(BlockOffset, REG_BLOCK_SIZE)) / REG_BLOCK_SIZE;
 
   DPRINT("  BlockNumber %lu  Size %lu (%s)  BlockCount %lu\n",
         BlockNumber,
@@ -3692,15 +3780,15 @@ CmiMarkBinDirty(PREGISTRY_HIVE RegistryHive,
 
   DPRINT("CmiMarkBinDirty(Offset 0x%lx)\n", (ULONG)BinOffset);
 
-  BlockNumber = (ULONG)BinOffset / 4096;
+  BlockNumber = (ULONG)BinOffset / REG_BLOCK_SIZE;
 
-  Bin = RegistryHive->BlockList[BlockNumber];
+  Bin = RegistryHive->BlockList[BlockNumber].Bin;
 
-  BlockCount = Bin->BlockSize / 4096;
+  BlockCount = Bin->BinSize / REG_BLOCK_SIZE;
 
-  DPRINT("  BlockNumber %lu  Size %lu  BlockCount %lu\n",
+  DPRINT("  BlockNumber %lu  BinSize %lu  BlockCount %lu\n",
         BlockNumber,
-        Bin->BlockSize,
+        Bin->BinSize,
         BlockCount);
 
   RegistryHive->HiveDirty = TRUE;
@@ -3735,7 +3823,7 @@ CmiGetPackedNameLength(IN PUNICODE_STRING Name,
 
 BOOLEAN
 CmiComparePackedNames(IN PUNICODE_STRING Name,
-                     IN PCHAR NameBuffer,
+                     IN PUCHAR NameBuffer,
                      IN USHORT NameBufferSize,
                      IN BOOLEAN NamePacked)
 {
@@ -3773,7 +3861,7 @@ CmiComparePackedNames(IN PUNICODE_STRING Name,
 
 VOID
 CmiCopyPackedName(PWCHAR NameBuffer,
-                 PCHAR PackedNameBuffer,
+                 PUCHAR PackedNameBuffer,
                  ULONG PackedNameSize)
 {
   ULONG i;
@@ -3977,6 +4065,10 @@ CmiCopyKey (PREGISTRY_HIVE DstHive,
        }
       NewKeyCell->HashTableOffset = NewHashTableOffset;
     }
+  else
+    {
+      NewHashTableCell = NULL;
+    }
 
   /* Allocate and copy value list and values */
   if (SrcKeyCell->NumberOfValues != 0)
@@ -4156,8 +4248,8 @@ CmiSaveTempHive (PREGISTRY_HIVE Hive,
   Hive->HiveHeader->Checksum = CmiCalcChecksum ((PULONG)Hive->HiveHeader);
 
   /* Write hive block */
-  FileOffset.QuadPart = 0ULL;
-  Status = NtWriteFile (FileHandle,
+  FileOffset.QuadPart = (ULONGLONG)0;
+  Status = ZwWriteFile (FileHandle,
                        NULL,
                        NULL,
                        NULL,
@@ -4168,21 +4260,21 @@ CmiSaveTempHive (PREGISTRY_HIVE Hive,
                        NULL);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT1 ("NtWriteFile() failed (Status %lx)\n", Status);
+      DPRINT1 ("ZwWriteFile() failed (Status %lx)\n", Status);
       return Status;
     }
 
   DPRINT ("Saving %lu blocks\n", Hive->BlockListSize);
   for (BlockIndex = 0; BlockIndex < Hive->BlockListSize; BlockIndex++)
     {
-      BlockPtr = Hive->BlockList[BlockIndex];
+      BlockPtr = Hive->BlockList[BlockIndex].Block;
       DPRINT ("BlockPtr %p\n", BlockPtr);
 
-      FileOffset.QuadPart = (ULONGLONG)(BlockIndex + 1) * 4096ULL;
+      FileOffset.QuadPart = (ULONGLONG)(BlockIndex + 1) * (ULONGLONG)REG_BLOCK_SIZE;
       DPRINT ("File offset %I64x\n", FileOffset.QuadPart);
 
       /* Write hive block */
-      Status = NtWriteFile (FileHandle,
+      Status = ZwWriteFile (FileHandle,
                            NULL,
                            NULL,
                            NULL,
@@ -4193,16 +4285,16 @@ CmiSaveTempHive (PREGISTRY_HIVE Hive,
                            NULL);
       if (!NT_SUCCESS(Status))
        {
-         DPRINT1 ("NtWriteFile() failed (Status %lx)\n", Status);
+         DPRINT1 ("ZwWriteFile() failed (Status %lx)\n", Status);
          return Status;
        }
     }
 
-  Status = NtFlushBuffersFile (FileHandle,
+  Status = ZwFlushBuffersFile (FileHandle,
                               &IoStatusBlock);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT1 ("NtFlushBuffersFile() failed (Status %lx)\n", Status);
+      DPRINT1 ("ZwFlushBuffersFile() failed (Status %lx)\n", Status);
     }
 
   DPRINT ("CmiSaveTempHive() done\n");