The ZwNotifyChangeKey routine allows a driver to request notification when a registry key changes.

NTSTATUS
ZwNotifyChangeKey(
  __in HANDLE  KeyHandle,
  __in_opt HANDLE  Event,
  __in_opt PIO_APC_ROUTINE  ApcRoutine,
  __in_opt PVOID  ApcContext,
  __out PIO_STATUS_BLOCK  IoStatusBlock,
  __in ULONG  CompletionFilter,
  __in BOOLEAN  WatchTree,
  __out_bcount_opt(BufferSize) PVOID  Buffer,
  __in ULONG  BufferSize,
  __in BOOLEAN  Asynchronous
  );

Parameters

KeyHandle

Handle to the key to register a notification routine for. This handle is created by a successful call to ZwCreateKey or ZwOpenKey. The caller must have specified KEY_NOTIFY access.

Event

Handle to a caller-created event. If not NULL, the caller is placed into a wait state until the operation succeeds, at which time the event is set to the Signaled state.

ApcRoutine

Pointer to a caller-supplied APC routine that is executed once the operation completes. Can be NULL.

ApcContext

Pointer to a caller-specified context for the APC routine. This value is passed to the APC routine when it is executed.

IoStatusBlock

Pointer to an IO_STATUS_BLOCK structure that contains the final status and information about the operation. For successful calls that return data, the number of bytes written to Buffer is supplied in IoStatusBlock->Information.

CompletionFilter

Bitmap of operations that cause the driver to be notified. Specify one or more of the following flags:

REG_NOTIFY_CHANGE_NAME

Notify the caller if a subkey is added or deleted.

REG_NOTIFY_CHANGE_ATTRIBUTES

Notify the caller of changes to the attributes of the key, such as the security descriptor information.

REG_NOTIFY_CHANGE_LAST_SET

Notify the caller of changes to a value of the key. This can include adding or deleting a value, or changing an existing value.

REG_NOTIFY_CHANGE_SECURITY

Notify the caller of changes to the security descriptor of the key.

WatchTree

If TRUE, the driver is notified about changes to all subkeys of the specified key. If FALSE, the driver is only notified for changes to the specified key.

Buffer

Reserved. Specify NULL.

BufferSize

Reserved. Specify zero.

Asynchronous

If FALSE, the routine does not return until the specified event occurs. If TRUE, the routine returns immediately.

Return Value

The ZwNotifyChangeKey routine returns STATUS_SUCCESS on success, or the appropriate NTSTATUS value otherwise. If the caller specifies TRUE for the Asynchronous parameter, and the event has not yet occurred, the routine returns STATUS_PENDING.

Requirements

Versions: This routine is available on Microsoft Windows XP and later.

IRQL: PASSIVE_LEVEL

Headers: Declared in Ntifs.h. Include Ntifs.h.

See Also

ZwCreateKey, ZwOpenKey