ZwEnumerateValueKey

The ZwEnumerateValueKey routine returns information about the value entries of an open key.

NTSTATUS 
  ZwEnumerateValueKey(
    IN HANDLE  KeyHandle,
    IN ULONG  Index,
    IN KEY_VALUE_INFORMATION_CLASS  KeyValueInformationClass,
    OUT PVOID  KeyValueInformation,
    IN ULONG  Length,
    OUT PULONG  ResultLength
    );

Parameters

KeyHandle

Handle to the registry key whose value entries are to be enumerated. This handle is created by a successful call to ZwCreateKey or ZwOpenKey.

Index

Specifies the zero-based index of a subkey for which the value information is requested.

KeyValueInformationClass

Specifies a KEY_VALUE_INFORMATION_CLASS value that determines the type of information returned in the KeyValueInformation buffer.

KeyValueInformation

Pointer to a caller-allocated buffer to receive the requested data.

Length

Specifies the size, in bytes, of the KeyValueInformation buffer.

ResultLength

Pointer to a variable that receives the size, in bytes, of the key information. If the routine returns STATUS_SUCCESS, callers can use the value of this variable to determine the amount of data returned. If the routine returns STATUS_BUFFER_OVERFLOW or STATUS_BUFFER_TOO_SMALL, callers can use the value of this variable to determine the size of buffer required to hold the key information.

Headers

Declared in wdm.h and ntddk.h. Include wdm.h or ntddk.h.

Return Value

ZwEnumerateValueKey returns STATUS_SUCCESS on success, or the appropriate error code on failure. Possible error code values include:

STATUS_BUFFER_OVERFLOW

The buffer supplied is too small, and only partial data has been written to the buffer. *ResultLength is set to the minimum size required to hold the requested information.

STATUS_BUFFER_TOO_SMALL

The buffer supplied is too small, and no data has been written to the buffer. *ResultLength is set to the minimum size required to hold the requested information.

STATUS_INVALID_PARAMETER

The KeyInformationClass parameter is not a valid KEY_VALUE_INFORMATION_CLASS value.

STATUS_NO_MORE_ENTRIES

The Index value is out of range for the registry key specified by KeyHandle. For example, if a key has n subkeys, then for any value greater than n-1 the routine returns STATUS_NO_MORE_ENTRIES.

Comments

The KeyHandle passed to ZwEnumerateValueKey must have been opened with the KEY_QUERY_VALUE DesiredAccess flag set for this call to succeed. For a description of possible values for DesiredAccess, see ZwCreateKey.

The Index is simply a way to select among subkeys with value entries. Two calls to ZwEnumerateValueKey with the same Index are not guaranteed to return the same results.

Callers of ZwEnumerateValueKey must be running at IRQL = PASSIVE_LEVEL.

See Also

KEY_VALUE_BASIC_INFORMATION, KEY_VALUE_FULL_INFORMATION, KEY_VALUE_INFORMATION_CLASS, KEY_VALUE_PARTIAL_INFORMATION, ZwClose, ZwCreateKey, ZwOpenKey, ZwQueryValueKey