#ifndef _NTREGAPI_H

/**
 * Selects metadata for NtQueryKey or NtEnumerateKey; use basic/node information
 * to identify a key and full/cached information to size later enumeration buffers.
 * Counts and maxima are observations, not reservations or stable snapshots.
 * \remarks The native x64 and WoW64 paths accept query
 * classes 0 through 8 and enumeration classes 0 through 2. Other classes return
 * STATUS_INVALID_PARAMETER; MaxKeyInfoClass is a sentinel, not a request class.
 * Enumeration requires KEY_ENUMERATE_SUB_KEYS. Queries require KEY_QUERY_VALUE
 * except KeyNameInformation and KeyHandleTagsInformation: these require a valid
 * key handle with any nonzero granted access mask, not a zero-access handle.
 *
 * Names, class strings, lengths and offsets use bytes, not WCHAR counts. Variable
 * records can be partial on STATUS_BUFFER_OVERFLOW while retaining the full
 * NameLength/ClassLength. ResultLength is then a required size, not a safe copy
 * length. Fixed query records require at least 40 bytes for cached information,
 * 12 for flags, and 4 for virtualization, handle tags and trust information.
 * Prefer naturally aligned buffers; see each API for WoW64 realignment behavior.
 * \sa https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/ne-wdm-_key_information_class
 */
typedef enum _KEY_INFORMATION_CLASS
{
    KeyBasicInformation, // q: KEY_BASIC_INFORMATION
    KeyNodeInformation, // q: KEY_NODE_INFORMATION
    KeyFullInformation, // q: KEY_FULL_INFORMATION
    KeyNameInformation, // q: KEY_NAME_INFORMATION
    KeyCachedInformation, // q: KEY_CACHED_INFORMATION
    KeyFlagsInformation, // q: KEY_FLAGS_INFORMATION
    KeyVirtualizationInformation, // q: KEY_VIRTUALIZATION_INFORMATION
    KeyHandleTagsInformation, // q: KEY_HANDLE_TAGS_INFORMATION
    KeyTrustInformation, // q: KEY_TRUST_INFORMATION
    KeyLayerInformation, // q: KEY_LAYER_INFORMATION; rejected by NtQueryKey on build 26100
    MaxKeyInfoClass
} KEY_INFORMATION_CLASS;

#endif
View code on GitHub

// wdm.h

typedef enum _KEY_INFORMATION_CLASS {
  KeyBasicInformation,
  KeyNodeInformation,
  KeyFullInformation,
  KeyNameInformation,
  KeyCachedInformation,
  KeyFlagsInformation,
  KeyVirtualizationInformation,
  KeyHandleTagsInformation,
  KeyTrustInformation,
  KeyLayerInformation,
  MaxKeyInfoClass
} KEY_INFORMATION_CLASS;
View the official Windows Driver Kit DDI reference

NtDoc

This enumeration is documented in Windows Driver Kit.

Edit description on GitHub

Windows Driver Kit DDI reference (ne-wdm-_key_information_class)

_KEY_INFORMATION_CLASS enumeration

Description

The KEY_INFORMATION_CLASS enumeration type represents the type of information to supply about a registry key.

Constants

`KeyBasicInformation`

A KEY_BASIC_INFORMATION structure is supplied.

`KeyNodeInformation`

A KEY_NODE_INFORMATION structure is supplied.

`KeyFullInformation`

A KEY_FULL_INFORMATION structure is supplied.

`KeyNameInformation`

A KEY_NAME_INFORMATION structure is supplied.

`KeyCachedInformation`

A KEY_CACHED_INFORMATION structure is supplied.

`KeyFlagsInformation`

Reserved for system use.

`KeyVirtualizationInformation`

A KEY_VIRTUALIZATION_INFORMATION structure is supplied.

`KeyHandleTagsInformation`

Reserved for system use.

`KeyTrustInformation`

`KeyLayerInformation`

`MaxKeyInfoClass`

The maximum value in this enumeration type.

Remarks

Use the KEY_INFORMATION_CLASS values to specify the type of data to be supplied by the ZwEnumerateKey and ZwQueryKey routines.

KEY_INFORMATION_CLASS - NtDoc