NTSTATUS
ZwEnumerateKey(
IN HANDLE KeyHandle,
IN ULONG Index,
IN KEY_INFORMATION_CLASS KeyInformationClass,
OUT PVOID KeyInformation,
IN ULONG Length,
OUT PULONG ResultLength
);
ZwEnumerateKey returns information about the subkeys of an open key.
KeyBasicInformation
KeyNodeInformation
KeyFullInformation
ZwEnumerateKey returns STATUS_SUCCESS, together with the name of the Index subkey to the given KeyInformation buffer. Otherwise, ZwEnumerateKey can return one of the following values:
STATUS_NO_MORE_ENTRIES
STATUS_BUFFER_OVERFLOW
The KeyHandle passed to ZwEnumerateKey must have been opened with the KEY_ENUMERATE_SUB_KEY DesiredAccess flag set for this call to succeed. See ZwCreateKey for a description of possible values for DesiredAccess.
The Index parameter is simply a way to select among subkeys of the key referred to by the KeyHandle. Two calls to ZwEnumerateKey with the same Index are not guaranteed to return the same result.
Note that callers of the Rtl..Registry routines are required to provide the name of the key. Drivers can call ZwEnumerateKey to get unknown names of the subkeys for a key with a known name.
Callers of ZwEnumerateKey must be running at IRQL PASSIVE_LEVEL.
KEY_BASIC_INFORMATION, KEY_FULL_INFORMATION, KEY_NODE_INFORMATION, RtlCheckRegistryKey, RtlCreateRegistryKey, RtlDeleteRegistryValue, RtlQueryRegistryValues, RtlWriteRegistryValue, ZwCreateKey, ZwEnumerateValueKey, ZwOpenKey