ZwEnumerateValueKey

NTSTATUS
ZwEnumerateValueKey(
IN HANDLE KeyHandle,
IN ULONG Index,
IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
OUT PVOID KeyValueInformation,
IN ULONG Length,
OUT PULONG ResultLength
);

ZwEnumerateValueKey returns information about the value entries of an open key.

Parameters

KeyHandle: Is the handle, returned by a successful call to ZwCreateKey or ZwOpenKey, of the key whose value entries are to be enumerated.
Index: Specifies the zero-based index of a subkey for which the value information is requested.
KeyValueInformationClass: Specifies the type of information returned in the KeyValueInformation buffer as one of the following:
KeyValueBasicInformation
KeyValueFullInformation
KeyValuePartialInformation
KeyValueInformation: Points to a caller-allocated buffer to receive the requested data.
Length: Is the size in bytes of the KeyValueInformation buffer, which the caller should set according to the given KeyValueInformationClass.
ResultLength: Points to number of bytes actually returned to KeyValueInformation or, if the input Length is too small, points to the number of bytes required for the available information.

Return Value

ZwEnumerateValueKey returns STATUS_SUCCESS, together with the name of the Index subkey to the given KeyValueInformation buffer. Otherwise, ZwEnumerateValueKey can return one of the following values:

STATUS_NO_MORE_VALUES
STATUS_BUFFER_OVERFLOW
STATUS_INVALID_PARAMETER

Comments

The KeyHandle passed to ZwEnumerateValueKey must have been opened with the KEY_QUERY_VALUE DesiredAccess flag set for this call to succeed. See ZwCreateKey for a description of possible values for DesiredAccess.

The Index is simply a way to select among subkeys with value entries. Two calls to ZwEnumerateValueKey with the same Index are not guaranteed to return the same results.

Callers of ZwEnumerateValueKey must be running at IRQL PASSIVE_LEVEL.