#ifndef _NTREGAPI_H

/**
 * The KEY_VALUE_FULL_INFORMATION_ALIGN64 structure describes the 8-byte-aligned full-value query format.
 * \remarks The field offsets match KEY_VALUE_FULL_INFORMATION, including Name at offset 0x14.
 * KeyValueFullInformationAlign64 is supported by NtQueryValueKey, not NtEnumerateValueKey on build 26100.
 * DataOffset is relative to the complete record; it is not a pointer and need not immediately follow Name.
 */
typedef DECLSPEC_ALIGN(8) struct _KEY_VALUE_FULL_INFORMATION_ALIGN64
{
    ULONG TitleIndex;
    ULONG Type;
    ULONG DataOffset;
    ULONG DataLength;
    ULONG NameLength;
    _Field_size_bytes_(NameLength) WCHAR Name[1];
    // ...
    // UCHAR Data[1];
} KEY_VALUE_FULL_INFORMATION_ALIGN64, *PKEY_VALUE_FULL_INFORMATION_ALIGN64;

#endif
View code on GitHub