NTSTATUS
ZwQueryKey(
IN HANDLE KeyHandle,
IN KEY_INFORMATION_CLASS KeyInformationClass,
OUT PVOID KeyInformation,
IN ULONG Length,
OUT PULONG ResultLength
);
ZwQueryKey provides data about the class of a key, and the number and sizes of its subkeys.
KeyBasicInformation
KeyFullInformation
KeyNodeInformation
ZwQueryKey returns STATUS_SUCCESS if it returned the requested information in the KeyInformation buffer. Otherwise, ZwQueryKey can return one of the following values:
STATUS_BUFFER_OVERFLOW
STATUS_INVALID_PARAMETER
The KeyHandle passed to ZwQueryKey must have been opened with the KEY_QUERY_KEY DesiredAccess flag set for this call to succeed. See ZwCreateKey for a description of possible values for DesiredAccess.
ZwQueryKey returns information about the size of the value entries, the number of subkeys, the length of their names, and the size of their value entries that its caller can use to allocate buffers for registry data.
For example, a successful caller of ZwQueryKey might allocate a buffer for a subkey, call ZwEnumerateKey to get the name of the subkey, and pass that name to an Rtl..Registry routine.
Callers of ZwQueryKey must be running at IRQL PASSIVE_LEVEL.
KEY_BASIC_INFORMATION, KEY_FULL_INFORMATION, KEY_NODE_INFORMATION, ZwClose, ZwEnumerateKey, ZwOpenKey