NtDeleteValueKey - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
#ifndef _NTREGAPI_H
/**
* Removes a named value entry and its data, leaving the containing key and other
* values intact. This is different from setting a value to zero-length data.
*
* \param[in] KeyHandle Key handle with KEY_SET_VALUE (0x2) in the ordinary path;
* DELETE access to the key is not required merely to delete one of its values.
* \param[in] ValueName Required readable counted UNICODE_STRING. An empty descriptor
* selects the default value. Matching is case-insensitive. The native
* path requires even Length and 2-byte-aligned nonempty user input, trims trailing
* WCHAR NULs and preserves embedded NULs as characters in the counted name.
* \return STATUS_SUCCESS if removed, STATUS_OBJECT_NAME_NOT_FOUND if absent,
* or an error such as STATUS_ACCESS_DENIED. Repeating deletion is not a successful no-op.
* \remarks Registry filters, transactions, virtualization and layered views can
* affect the result. This contract does not promise that a physical hive write is
* flushed to disk when the call returns.
* \sa https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-zwdeletevaluekey
*/
_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
NtDeleteValueKey(
_In_ HANDLE KeyHandle,
_In_ PCUNICODE_STRING ValueName
);
View code on GitHub#ifndef _NTZWAPI_H
_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwDeleteValueKey(
_In_ HANDLE KeyHandle,
_In_ PCUNICODE_STRING ValueName
);
View code on GitHub// wdm.h
NTSYSAPI NTSTATUS ZwDeleteValueKey(
[in] HANDLE KeyHandle,
[in] PUNICODE_STRING ValueName
);
View the official Windows Driver Kit DDI referenceNo description available.
The ZwDeleteValueKey routine deletes a value entry matching a name from an open key in the registry. If no such entry exists, an error is returned.
KeyHandle [in]The handle to the registry key containing the value entry of interest. This key must have been opened with KEY_SET_VALUE set for the desired access. This handle is created by a successful call to ZwCreateKey or ZwOpenKey.
ValueName [in]Pointer to a UNICODE_STRING structure that contains the name of the value entry to delete. This parameter can be an empty string if the value entry has no name.
ZwDeleteValueKey returns STATUS_SUCCESS or an appropriate error status representing the final completion status of the operation. Possible error status codes include the following:
| Return code | Description |
|---|---|
| STATUS_ACCESS_DENIED | The KeyHandle handle does not have the KEY_SET_VALUE access. |
| STATUS_INSUFFICIENT_RESOURCES | Additional resources required by this function were not available. |
| STATUS_INVALID_HANDLE | The specified KeyHandle parameter was a NULL pointer or not a valid pointer to an open registry key. |
| STATUS_OBJECT_NAME_NOT_FOUND | The ValueName registry key entry was not found. |
The KeyHandle passed to ZwDeleteValueKey must have been opened for delete access to succeed. The DesiredAccess values of KEY_SET_VALUE, KEY_WRITE, and KEY_ALL_ACCESS include the KEY_SET_VALUE access mask required for delete access. For a description of possible values for DesiredAccess, see ZwCreateKey.
If callback functions are registered for this registry key, then these callback functions will be called.
Device drivers should not attempt to call ZwDeleteValueKey directly to delete value entries in a subkey of the \Registry..\ResourceMap key. Only the system can write or delete value entries in the \Registry..\HardwareDescription tree.
If the call to this function occurs in user mode, you should use the name "NtDeleteValueKey" instead of "ZwDeleteValueKey".
For calls from kernel-mode drivers, the NtXxx and ZwXxx versions of a Windows Native System Services routine can behave differently in the way that they handle and interpret input parameters. For more information about the relationship between the NtXxx and ZwXxx versions of a routine, see Using Nt and Zw Versions of the Native System Services Routines.
Using Nt and Zw Versions of the Native System Services Routines