#ifndef _NTREGAPI_H

/**
 * The KEY_BASIC_INFORMATION structure defines a subset of the full information that is available for a registry key.
 * \sa https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/ns-wdm-_key_basic_information
 */
typedef struct _KEY_BASIC_INFORMATION
{
    LARGE_INTEGER LastWriteTime;                    // Number of 100-nanosecond intervals since this key or any of its values changed.
    ULONG TitleIndex;                               // Reserved // A legacy field originally intended for use with localization such as an index of a resource table.
    ULONG NameLength;                               // The size, in bytes, of the key name string in the Name array.
    _Field_size_bytes_(NameLength) WCHAR Name[1];   // The name of the registry key. This string is not null-terminated.
} KEY_BASIC_INFORMATION, *PKEY_BASIC_INFORMATION;

#endif
View code on GitHub

// wdm.h

typedef struct _KEY_BASIC_INFORMATION {
  LARGE_INTEGER LastWriteTime;
  ULONG         TitleIndex;
  ULONG         NameLength;
  WCHAR         Name[1];
} KEY_BASIC_INFORMATION, *PKEY_BASIC_INFORMATION;
View the official Windows Driver Kit DDI reference

NtDoc

This structure is documented in Windows Driver Kit.

Edit description on GitHub

Windows Driver Kit DDI reference (ns-wdm-_key_basic_information)

_KEY_BASIC_INFORMATION structure

Description

The KEY_BASIC_INFORMATION structure defines a subset of the full information that is available for a registry key.

Members

`LastWriteTime`

The last time this key or any of its values changed. This time value is expressed in absolute system time format. Absolute system time is the number of 100-nanosecond intervals since the start of the year 1601 in the Gregorian calendar.

`TitleIndex`

Device and intermediate drivers should ignore this member.

`NameLength`

The size, in bytes, of the key name string in the Name array.

`Name`

An array of wide characters that contains the name of the registry key. This character string is not null-terminated. Only the first element in this array is included in the KEY_BASIC_INFORMATION structure definition. The storage for the remaining elements in the array immediately follows this element.

Remarks

The ZwEnumerateKey and ZwQueryKey routines use the KEY_BASIC_INFORMATION structure to contain the basic information for a registry key. When the KeyInformationClass parameter of either routine is KeyBasicInformation, the KeyInformation buffer is treated as a KEY_BASIC_INFORMATION structure. For more information about the KeyBasicInformation enumeration value, see KEY_INFORMATION_CLASS.

KEY_BASIC_INFORMATION - NtDoc