#ifndef _NTREGAPI_H

/**
 * The KEY_VALUE_FULL_INFORMATION structure defines information available for a value entry of a registry key.
 * \remarks Name begins at offset 0x14 and is not null-terminated. DataOffset is relative to the start
 * of the returned record, not to Name. Use DataOffset and DataLength to locate data after name padding.
 * On the native x64 and WoW64 paths, nonempty data is placed at an
 * 8-byte-aligned offset for both Full classes. For empty data,
 * DataLength is zero and DataOffset is 0xffffffff; do not dereference that offset.
 * Required size is DataOffset + DataLength for nonempty data, or 20 + NameLength for empty data.
 * On STATUS_BUFFER_OVERFLOW these offsets/lengths describe the complete record, not necessarily
 * bytes present in the caller buffer. Check each range against the supplied capacity before reading.
 * \sa https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/ns-wdm-_key_value_full_information
 */
typedef struct _KEY_VALUE_FULL_INFORMATION
{
    ULONG TitleIndex;
    ULONG Type;
    ULONG DataOffset;
    ULONG DataLength;
    ULONG NameLength;
    _Field_size_bytes_(NameLength) WCHAR Name[1];
    // ...
    // UCHAR Data[1];
} KEY_VALUE_FULL_INFORMATION, *PKEY_VALUE_FULL_INFORMATION;

#endif
View code on GitHub

// wdm.h

typedef struct _KEY_VALUE_FULL_INFORMATION {
  ULONG TitleIndex;
  ULONG Type;
  ULONG DataOffset;
  ULONG DataLength;
  ULONG NameLength;
  WCHAR Name[1];
} KEY_VALUE_FULL_INFORMATION, *PKEY_VALUE_FULL_INFORMATION;
View the official Windows Driver Kit DDI reference

NtDoc

This structure is documented in Windows Driver Kit.

Edit description on GitHub

Windows Driver Kit DDI reference (ns-wdm-_key_value_full_information)

_KEY_VALUE_FULL_INFORMATION structure

Description

The KEY_VALUE_FULL_INFORMATION structure defines information available for a value entry of a registry key.

Members

`TitleIndex`

Device and intermediate drivers should ignore this member.

`Type`

Specifies the system-defined type for the registry value(s) following the Name member. For a summary of these types, see KEY_VALUE_BASIC_INFORMATION.

`DataOffset`

Specifies the offset from the start of this structure to the data immediately following the Name string.

`DataLength`

Specifies the number of bytes of registry information for the value entry identified by Name.

`NameLength`

Specifies the size in bytes of the following value entry name.

`Name`

A string of Unicode characters naming a value entry of the key.

KEY_VALUE_FULL_INFORMATION - NtDoc