Export (0) Print
Expand All

ZwQueryValueKey routine

The ZwQueryValueKey routine returns a value entry for a registry key.

Syntax


NTSTATUS ZwQueryValueKey(
  _In_       HANDLE KeyHandle,
  _In_       PUNICODE_STRING ValueName,
  _In_       KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
  _Out_opt_  PVOID KeyValueInformation,
  _In_       ULONG Length,
  _Out_      PULONG ResultLength
);

Parameters

KeyHandle [in]

Handle to the key to read value entries from. This handle is created by a successful call to ZwCreateKey or ZwOpenKey.

ValueName [in]

Pointer to the name of the value entry to obtain data for.

KeyValueInformationClass [in]

A KEY_VALUE_INFORMATION_CLASS value that determines the type of information returned in the KeyValueInformation buffer.

KeyValueInformation [out, optional]

Pointer to a caller-allocated buffer that receives the requested information.

Length [in]

Specifies the size, in bytes, of the KeyValueInformation buffer.

ResultLength [out]

Pointer to a variable that receives the size, in bytes, of the key information. If the ZwQueryValueKey routine returns STATUS_SUCCESS, callers can use the value of this variable to determine the amount of data returned. If the routine returns STATUS_BUFFER_OVERFLOW or STATUS_BUFFER_TOO_SMALL, callers can use the value of this variable to determine the size of buffer required to hold the key information.

Return value

ZwQueryValueKey returns STATUS_SUCCESS on success, or the appropriate error code on failure. Possible error code values include:

Return codeDescription
STATUS_OBJECT_NAME_NOT_FOUND

The registry value was not available.

STATUS_BUFFER_OVERFLOW

The buffer supplied is too small, and only partial data has been written to the buffer. *ResultLength is set to the minimum size required to hold the requested information.

STATUS_BUFFER_TOO_SMALL

The buffer supplied is too small, and no data has been written to the buffer. *ResultLength is set to the minimum size required to hold the requested information.

STATUS_INVALID_PARAMETER

The KeyInformationClass parameter is not a valid KEY_VALUE_INFORMATION_CLASS value.

Warning   If you specify KeyValueBasicInformation for KeyValueInformationClass, Windows 98 and Windows Me return STATUS_SUCCESS even if the registry key or value name does not exist.

 

Remarks

The KeyHandle passed to ZwQueryValueKey must have been opened with KEY_QUERY_VALUE access. This is accomplished by passing KEY_QUERY_VALUE, KEY_READ, or KEY_ALL_ACCESS as the DesiredAccess parameter to ZwCreateKey or ZwOpenKey.

For more information about working with registry keys, see Using the Registry in a Driver.

Note  If the call to this function occurs in user mode, you should use the name "NtQueryValueKey" instead of "ZwQueryValueKey".

Requirements

Version

Available starting with Windows 2000.

Header

Wdm.h (include Wdm.h, Ntddk.h, or Ntifs.h)

Library

Ntoskrnl.lib

IRQL

PASSIVE_LEVEL

DDI compliance rules

IrqlZwPassive, PowerIrpDDis, ZwRegistryCreate, ZwRegistryOpen, HwStorPortProhibitedDDIs, ZwRegistryCreate(storport), ZwRegistryOpen(storport)

See also

KEY_VALUE_BASIC_INFORMATION
KEY_VALUE_FULL_INFORMATION
KEY_VALUE_INFORMATION_CLASS
KEY_VALUE_PARTIAL_INFORMATION
ZwCreateKey
ZwEnumerateValueKey
ZwOpenKey

 

 

Send comments about this topic to Microsoft

Show:
© 2014 Microsoft