title: Access HKCU from TAPI Service Provider
body: <p>I am writing an adapter TSP for a phone system. This system has a TAPI API but it is incompatible with the application I am trying to TAPI-enable. In order to place a call from the correct line, I need to know some information (from HKCU) about who is making the request. Since the TSP runs in the context of the Telephony service, I cannot access is directly. My plan was to use the functionality of LINE_CREATEDIALOGINSTANCE to read this information.</p>
  
  <p>The problem I'm having is that the Telephony service is crashing immediately after returning from TUISPI_providerGenericDialog with the following stack trace:</p>
  
  <pre><code>72004400() 
  tapisrv.dll!_FreeDialogInstance@20()  + 0xa93 bytes 
  tapisrv.dll!_ClientRequest@16()  + 0x8f bytes 
  rpcrt4.dll!_Invoke@12()  + 0x30 bytes 
  rpcrt4.dll!_NdrStubCall2@16()  + 0x217 bytes 
  rpcrt4.dll!_NdrServerCall2@4()  + 0x19 bytes 
  rpcrt4.dll!_DispatchToStubInCNoAvrf@12()  + 0x17 bytes 
  rpcrt4.dll!RPC_INTERFACE::DispatchToStubWorker()  + 0xae bytes 
  rpcrt4.dll!RPC_INTERFACE::DispatchToStub()  + 0x4b bytes 
  rpcrt4.dll!LRPC_SCALL::DealWithRequestMessage()  + 0x1d5 bytes 
  rpcrt4.dll!LRPC_ADDRESS::DealWithLRPCRequest()  + 0x90 bytes 
  rpcrt4.dll!LRPC_ADDRESS::ReceiveLotsaCalls()  + 0x20c bytes 
  rpcrt4.dll!RecvLotsaCallsWrapper()  + 0xd bytes 
  rpcrt4.dll!BaseCachedThreadRoutine()  + 0x92 bytes 
  rpcrt4.dll!ThreadStartRoutine()  + 0x1b bytes 
  kernel32.dll!_BaseThreadStart@8()  + 0x34 bytes
  </code></pre>
  
  <p>As per <a href="http://books.google.com/books?id=3M_mIvtdGqUC&amp;pg=PA215&amp;lpg=PA215&amp;dq=crash+after+TUISPI_providerGenericDialog&amp;source=bl&amp;ots=5TmvB7BREk&amp;sig=nB5Vqb_iib27kjPDSZoL1o8FHkg&amp;hl=en&amp;ei=FZjMSt3NEZWQtgfSl-jxAQ&amp;sa=X&amp;oi=book_result&amp;ct=result&amp;resnum=3#v=onepage&amp;q=&amp;f=false" rel="nofollow noreferrer">this book</a>, the Telephony service will crash if TSPI_providerFreeDialogInstance is not implemented. I have implemented this function and DepWalker shows it as being properly exported. ApiSpy32 shows that its address is correctly returned via GetProcAddress when my TSP is loaded. Why is it still crashing?</p>
  
  <p>The relevant code:</p>
  
  <pre><code>LONG TSPIAPI TSPI_lineMakeCall(DRV_REQUESTID dwRequestID, HDRVLINE hdLine, HTAPICALL htCall,
      LPHDRVCALL lphdCall, LPCWSTR lpszDestAddress, DWORD dwCountryCode, LPLINECALLPARAMS const lpCallParams)
  {
      OutputDebugString("TSPI_lineMakeCall\n");
      PDRVLINE pLine = (PDRVLINE) hdLine;
  
      *lphdCall = (HDRVCALL)hdLine;
  
      typedef TUISPICREATEDIALOGINSTANCEPARAMS PARAMS;
  
      pLine-&gt;htCall = htCall;
      DWORD lLength = (lstrlenW(lpszDestAddress) + 1) * sizeof(WCHAR);
  
      PARAMS* lParams = (PARAMS*)DrvAlloc(sizeof(PARAMS) + lLength);
      RtlZeroMemory(lParams, sizeof(PARAMS) + lLength);
  
      lParams-&gt;dwRequestID = dwRequestID;
      lParams-&gt;hdDlgInst = (HDRVDIALOGINSTANCE)1000;
      lParams-&gt;lpszUIDLLName = L"TapiAdapter.tsp";
      lParams-&gt;lpParams = lParams + 1;
      lParams-&gt;dwSize = lLength;
  
      lstrcpyW((LPWSTR)(lParams + 1), lpszDestAddress);
      (*pLine-&gt;pfnEventProc)(pLine-&gt;htLine, 0, LINE_CREATEDIALOGINSTANCE, (DWORD)lParams, 0, 0);
  
      return dwRequestID;
  }
  
  
  LONG TSPIAPI TSPI_providerGenericDialogData(DWORD_PTR dwObjectID, DWORD dwObjectType, LPVOID lpParams, DWORD dwSize)
  {
      OutputDebugString("TSPI_providerGenericDialogData\n");
      return 0;
  }
  
  LONG TSPIAPI TSPI_providerFreeDialogInstance(HDRVDIALOGINSTANCE hdDlgInst)
  {
      OutputDebugString("TSPI_providerFreeDialogInstance\n");
      return 0;
  }
  
  LONG TSPIAPI TUISPI_providerGenericDialog(TUISPIDLLCALLBACK lpfnUIDLLCallback, HTAPIDIALOGINSTANCE htDlgInst, LPVOID lpParams, DWORD dwSize, HANDLE hEvent)
  {
      SetEvent(hEvent);
  
      LPCWSTR lNumber = (LPCWSTR)lpParams;
      MessageBoxW(0, lNumber, L"Dial Number", MB_OK);
  
      return 0;
  }
  </code></pre>