ZwEnumerateKey

NTSTATUS
    ZwEnumerateKey(
        IN HANDLE  KeyHandle,
        IN ULONG  Index,
        IN KEY_INFORMATION_CLASS  KeyInformationClass,
        OUT PVOID  KeyInformation,
        IN ULONG  Length,
        OUT PULONG  ResultLength
        );

ZwEnumerateKey returns information about the subkeys of an open key.

Parameters

KeyHandle

Is the handle, returned by a successful call to ZwCreateKey or ZwOpenKey, of the key whose subkeys are to be enumerated.

Index

Specifies the zero-based index of the subkey for which the information is requested.

KeyInformationClass

Specifies the type of information returned in the KeyInformation buffer as one of the following system-defined values:

KeyBasicInformation
KeyNodeInformation
KeyFullInformation

KeyInformation

Points to a caller-allocated buffer to receive the requested data.

Length

Is the size in bytes of the KeyInformation buffer, which the caller should set according to the given KeyInformationClass.

ResultLength

Points to the number of bytes actually returned to KeyInformation or, if the input Length is too small, points to the number of bytes required for the available information.

Return Value

ZwEnumerateKey returns STATUS_SUCCESS, together with the name of the Index subkey to the given KeyInformation buffer. Otherwise, ZwEnumerateKey can return one of the following values:

STATUS_NO_MORE_ENTRIES
STATUS_BUFFER_OVERFLOW

Comments

The KeyHandle passed to ZwEnumerateKey must have been opened with the KEY_ENUMERATE_SUB_KEY DesiredAccess flag set for this call to succeed. See ZwCreateKey for a description of possible values for DesiredAccess.

The Index parameter is simply a way to select among subkeys of the key referred to by the KeyHandle. Two calls to ZwEnumerateKey with the same Index are not guaranteed to return the same result.

Note that callers of the Rtl..Registry routines are required to provide the name of the key. Drivers can call ZwEnumerateKey to get unknown names of the subkeys for a key with a known name.

Callers of ZwEnumerateKey must be running at IRQL PASSIVE_LEVEL.

See Also

KEY_BASIC_INFORMATION, KEY_FULL_INFORMATION, KEY_NODE_INFORMATION, RtlCheckRegistryKey, RtlCreateRegistryKey, RtlDeleteRegistryValue, RtlQueryRegistryValues, RtlWriteRegistryValue, ZwCreateKey, ZwEnumerateValueKey, ZwOpenKey