#ifndef _NTREGAPI_H

/**
 * Returns the selected key's class, direct-subkey count, value count and maximum
 * name/class/data byte lengths. Use these maxima to plan buffers, but still handle
 * changes between calls. MaxNameLength/MaxClassLength describe direct subkeys;
 * MaxValueNameLength/MaxValueDataLength describe values of this key.
 * NtEnumerateKey returns these statistics for the selected child, not its parent.
 *
 * The fixed prefix before Class is 44 bytes. The ordinary path needs
 * 44 + ClassLength bytes, with ClassOffset = 44 for a nonempty class and
 * 0xFFFFFFFF when ClassLength = 0. Class is not NUL-terminated. No key name is
 * included. Overflow retains the full ClassLength, so it is not a copied count.
 * TitleIndex is 0 in ordinary output. LastWriteTime uses the absolute system-time
 * format (100-nanosecond intervals since January 1, 1601 UTC).
 * \sa https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/ns-wdm-_key_full_information
 */
typedef struct _KEY_FULL_INFORMATION
{
    LARGE_INTEGER LastWriteTime;
    ULONG TitleIndex;
    ULONG ClassOffset;
    ULONG ClassLength;
    ULONG SubKeys;
    ULONG MaxNameLength;
    ULONG MaxClassLength;
    ULONG Values;
    ULONG MaxValueNameLength;
    ULONG MaxValueDataLength;
    WCHAR Class[1];
} KEY_FULL_INFORMATION, *PKEY_FULL_INFORMATION;

#endif
View code on GitHub

// wdm.h

typedef struct _KEY_FULL_INFORMATION {
  LARGE_INTEGER LastWriteTime;
  ULONG         TitleIndex;
  ULONG         ClassOffset;
  ULONG         ClassLength;
  ULONG         SubKeys;
  ULONG         MaxNameLen;
  ULONG         MaxClassLen;
  ULONG         Values;
  ULONG         MaxValueNameLen;
  ULONG         MaxValueDataLen;
  WCHAR         Class[1];
} KEY_FULL_INFORMATION, *PKEY_FULL_INFORMATION;
View the official Windows Driver Kit DDI reference

NtDoc

This structure is documented in Windows Driver Kit.

Edit description on GitHub

Windows Driver Kit DDI reference (ns-wdm-_key_full_information)

_KEY_FULL_INFORMATION structure

Description

The KEY_FULL_INFORMATION structure defines the information available for a registry key, including information about its subkeys and the maximum length for their names and value entries. This information can be used to size buffers to get the names of subkeys and their value entries.

Members

`LastWriteTime`

The last time this key or any of its values changed. This time value is expressed in absolute system time format. Absolute system time is the number of 100-nanosecond intervals since the start of the year 1601 in the Gregorian calendar.

`TitleIndex`

Device and intermediate drivers should ignore this member.

`ClassOffset`

The byte offset from the start of this structure to the Class member.

`ClassLength`

The size, in bytes, of the key class name string in the Class array.

`SubKeys`

The number of subkeys for this key.

`MaxNameLen`

The maximum size, in bytes, of any name for a subkey.

`MaxClassLen`

The maximum size, in bytes, of a class name.

`Values`

The number of value entries for this key.

`MaxValueNameLen`

The maximum size, in bytes, of a value entry name.

`MaxValueDataLen`

The maximum size, in bytes, of a value entry data field.

`Class`

An array of wide characters that contains the name of the class of the key. This character string is not null-terminated. Only the first element in this array is included in the KEY_FULL_INFORMATION structure definition. The storage for the remaining elements in the array immediately follows this element.

Remarks

The ZwEnumerateKey and ZwQueryKey routines use the KEY_FULL_INFORMATION structure to contain the full information for a registry key. When the KeyInformationClass parameter of either routine is KeyFullInformation, the KeyInformation buffer is treated as a KEY_FULL_INFORMATION structure. For more information about the KeyFullInformation enumeration value, see KEY_INFORMATION_CLASS.

KEY_FULL_INFORMATION - NtDoc