#ifndef _NTREGAPI_H

/**
 * The KEY_VALUE_INFORMATION_CLASS enumeration selects information returned for a registry value.
 * \remarks The kernel implementation accepts classes 0 through 4 in NtQueryValueKey and only classes 0 through 2
 * in NtEnumerateValueKey. Other classes return STATUS_INVALID_PARAMETER. Both calls require KEY_QUERY_VALUE.
 * Use 8-byte-aligned buffers for the documented portable Align64 contract. The x64
 * entry checks only 4-byte alignment for all query classes; its WoW64 query thunk
 * realigns non-8-byte-aligned output through temporary storage. Enumeration checks 4-byte alignment
 * on both paths. These build-specific observations do not relax the portable Align64 recommendation.
 * Names and data lengths are byte counts.
 * STATUS_BUFFER_TOO_SMALL means the fixed header does not fit; STATUS_BUFFER_OVERFLOW can return a partial
 * record. ResultLength reports the required total size, which can exceed the supplied Length.
 * \sa https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/ne-wdm-_key_value_information_class
 */
typedef enum _KEY_VALUE_INFORMATION_CLASS
{
    KeyValueBasicInformation, // q: KEY_VALUE_BASIC_INFORMATION
    KeyValueFullInformation, // q: KEY_VALUE_FULL_INFORMATION
    KeyValuePartialInformation, // q: KEY_VALUE_PARTIAL_INFORMATION
    KeyValueFullInformationAlign64, // q: KEY_VALUE_FULL_INFORMATION_ALIGN64
    KeyValuePartialInformationAlign64,  // q: KEY_VALUE_PARTIAL_INFORMATION_ALIGN64
    KeyValueLayerInformation, // q: KEY_VALUE_LAYER_INFORMATION; rejected by the query/enumeration syscalls on build 26100
    MaxKeyValueInfoClass
} KEY_VALUE_INFORMATION_CLASS;

#endif
View code on GitHub

// wdm.h

typedef enum _KEY_VALUE_INFORMATION_CLASS {
  KeyValueBasicInformation,
  KeyValueFullInformation,
  KeyValuePartialInformation,
  KeyValueFullInformationAlign64,
  KeyValuePartialInformationAlign64,
  KeyValueLayerInformation,
  MaxKeyValueInfoClass
} KEY_VALUE_INFORMATION_CLASS;
View the official Windows Driver Kit DDI reference

NtDoc

This enumeration is documented in Windows Driver Kit.

Edit description on GitHub

Windows Driver Kit DDI reference (ne-wdm-_key_value_information_class)

_KEY_VALUE_INFORMATION_CLASS enumeration

Description

The KEY_VALUE_INFORMATION_CLASS enumeration type specifies the type of information to supply about the value of a registry key.

Constants

`KeyValueBasicInformation`

The information is stored as a KEY_VALUE_BASIC_INFORMATION structure.

`KeyValueFullInformation`

The information is stored as a KEY_VALUE_FULL_INFORMATION structure.

`KeyValuePartialInformation`

The information is stored as a KEY_VALUE_PARTIAL_INFORMATION structure.

`KeyValueFullInformationAlign64`

The information is stored as a KEY_VALUE_FULL_INFORMATION structure that is aligned to a 64-bit (that is, 8-byte) boundary in memory. If the caller-supplied buffer does not start on a 64-bit boundary, ZwQueryValueKey returns STATUS_DATATYPE_MISALIGNMENT.

`KeyValuePartialInformationAlign64`

The information is stored as a KEY_VALUE_PARTIAL_INFORMATION_ALIGN64 structure that is aligned to a 64-bit (that is, 8-byte) boundary in memory. If the caller-supplied buffer does not start on a 64-bit boundary, ZwQueryValueKey returns STATUS_DATATYPE_MISALIGNMENT.

`KeyValueLayerInformation`

`MaxKeyValueInfoClass`

The maximum value in this enumeration type.

Remarks

Use the KEY_VALUE_INFORMATION_CLASS values to specify the type of data to be supplied by the ZwEnumerateValueKey and ZwQueryValueKey routines.

KEY_VALUE_INFORMATION_CLASS - NtDoc