#ifndef _NTREGAPI_H

/**
 * Identifies a queried key or an enumerated child by its final path component
 * and last-write time. Name is not a full registry path and is not NUL-terminated.
 * The fixed prefix is 16 bytes; the complete record requires 16 + NameLength.
 * NameLength remains the full byte length on overflow, even when less is copied.
 * Do not use sizeof(KEY_BASIC_INFORMATION) as the variable-record prefix size.
 * The ordinary output sets TitleIndex to 0; ignore it as legacy metadata.
 * \sa https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/ns-wdm-_key_basic_information
 */
typedef struct _KEY_BASIC_INFORMATION
{
    LARGE_INTEGER LastWriteTime;                    // Absolute last-write time, in 100-nanosecond intervals since January 1, 1601 (UTC).
    ULONG TitleIndex;                               // Legacy localization metadata; ordinary query/enumeration output sets this to 0.
    ULONG NameLength;                               // The size, in bytes, of the key name string in the Name array.
    _Field_size_bytes_(NameLength) WCHAR Name[1];   // The name of the registry key. This string is not null-terminated.
} KEY_BASIC_INFORMATION, *PKEY_BASIC_INFORMATION;

#endif
View code on GitHub

// wdm.h

typedef struct _KEY_BASIC_INFORMATION {
  LARGE_INTEGER LastWriteTime;
  ULONG         TitleIndex;
  ULONG         NameLength;
  WCHAR         Name[1];
} KEY_BASIC_INFORMATION, *PKEY_BASIC_INFORMATION;
View the official Windows Driver Kit DDI reference

NtDoc

This structure is documented in Windows Driver Kit.

Edit description on GitHub

Windows Driver Kit DDI reference (ns-wdm-_key_basic_information)

_KEY_BASIC_INFORMATION structure

Description

The KEY_BASIC_INFORMATION structure defines a subset of the full information that is available for a registry key.

Members

`LastWriteTime`

The last time this key or any of its values changed. This time value is expressed in absolute system time format. Absolute system time is the number of 100-nanosecond intervals since the start of the year 1601 in the Gregorian calendar.

`TitleIndex`

Device and intermediate drivers should ignore this member.

`NameLength`

The size, in bytes, of the key name string in the Name array.

`Name`

An array of wide characters that contains the name of the registry key. This character string is not null-terminated. Only the first element in this array is included in the KEY_BASIC_INFORMATION structure definition. The storage for the remaining elements in the array immediately follows this element.

Remarks

The ZwEnumerateKey and ZwQueryKey routines use the KEY_BASIC_INFORMATION structure to contain the basic information for a registry key. When the KeyInformationClass parameter of either routine is KeyBasicInformation, the KeyInformation buffer is treated as a KEY_BASIC_INFORMATION structure. For more information about the KeyBasicInformation enumeration value, see KEY_INFORMATION_CLASS.

KEY_BASIC_INFORMATION - NtDoc