#ifndef _NTREGAPI_H

/**
 * Returns a key's final name component and optional class string. Both strings
 * are counted bytes without NUL termination. ClassOffset is relative to the
 * record start, not relative to Name. The fixed prefix before Name is 24 bytes.
 *
 * In the ordinary path, a nonempty class follows the name at
 * align_up(24 + NameLength, 4); total size is ClassOffset + ClassLength.
 * With no class, ClassLength = 0, ClassOffset = 0xFFFFFFFF, and total size is
 * 24 + NameLength. Never dereference the absent-class sentinel.
 * NameLength/ClassLength remain full lengths on overflow; bound both ranges by
 * the supplied capacity before reading them. TitleIndex is 0 in ordinary output.
 * \sa https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/ns-wdm-_key_node_information
 */
typedef struct _KEY_NODE_INFORMATION
{
    LARGE_INTEGER LastWriteTime;                    // Absolute last-write time, in 100-nanosecond intervals since January 1, 1601 (UTC).
    ULONG TitleIndex;                               // Legacy localization metadata; ordinary query/enumeration output sets this to 0.
    ULONG ClassOffset;                              // The byte offset from the start of this structure to the class name string. This string is not null-terminated.
    ULONG ClassLength;                              // The size, in bytes, in the class name string.
    ULONG NameLength;                               // The size, in bytes, of the key name string contained in the Name array.
    _Field_size_bytes_(NameLength) WCHAR Name[1];   // The name of the registry key. This string is not null-terminated.
    // ...
    // WCHAR Class[1];
} KEY_NODE_INFORMATION, *PKEY_NODE_INFORMATION;

#endif
View code on GitHub

// wdm.h

typedef struct _KEY_NODE_INFORMATION {
  LARGE_INTEGER LastWriteTime;
  ULONG         TitleIndex;
  ULONG         ClassOffset;
  ULONG         ClassLength;
  ULONG         NameLength;
  WCHAR         Name[1];
} KEY_NODE_INFORMATION, *PKEY_NODE_INFORMATION;
View the official Windows Driver Kit DDI reference

NtDoc

This structure is documented in Windows Driver Kit.

Edit description on GitHub

Windows Driver Kit DDI reference (ns-wdm-_key_node_information)

_KEY_NODE_INFORMATION structure

Description

The KEY_NODE_INFORMATION structure defines the basic information available for a registry (sub)key.

Members

`LastWriteTime`

The last time this key or any of its values changed. This time value is expressed in absolute system time format. Absolute system time is the number of 100-nanosecond intervals since the start of the year 1601 in the Gregorian calendar.

`TitleIndex`

Device and intermediate drivers should ignore this member.

`ClassOffset`

The byte offset from the start of this structure to the class name string, which is located in the Name array immediately following the key name string. Like the key name string, the class name string is not null-terminated.

`ClassLength`

The size, in bytes, in the class name string.

`NameLength`

The size, in bytes, of the key name string contained in the Name array.

`Name`

An array of wide characters that contains the name of the registry key. This character string is not null-terminated. Only the first element in this array is included in the KEY_NODE_INFORMATION structure definition. The storage for the remaining elements in the array immediately follows this element.

Remarks

The ZwEnumerateKey and ZwQueryKey routines use the KEY_NODE_INFORMATION structure to contain the registry key name and key class name. When the KeyInformationClass parameter of either routine is KeyNodeInformation, the KeyInformation buffer is treated as a KEY_NODE_INFORMATION structure. For more information about the KeyNodeInformation enumeration value, see KEY_INFORMATION_CLASS.

KEY_NODE_INFORMATION - NtDoc