#ifndef _NTREGAPI_H
NTSYSCALLAPI
NTSTATUS
NTAPI
NtLoadKey(
_In_ POBJECT_ATTRIBUTES TargetKey,
_In_ POBJECT_ATTRIBUTES SourceFile
);
View code on GitHub
#ifndef _NTZWAPI_H
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwLoadKey(
_In_ POBJECT_ATTRIBUTES TargetKey,
_In_ POBJECT_ATTRIBUTES SourceFile
);
View code on GitHub
Function NtLoadKey
is used to make available registry keys and values stored in Hive File. Hive file can be created by calling NtSaveKey
. If loaded Hive is no longer needed (for example when user logout for HKCU Hive), it can be unloaded by call NtUnloadKey
.
Pointer to OBJECT_ATTRIBUTES
structure contains destination key name and HANDLE
to root key. Root can be /REGISTRY/machine or /REGISTRY/user. All other keys are invalid.
Pointer to OBJECT_ATTRIBUTES
structure contains Hive file path and name.
Privilege: SE_RESTORE_PRIVILEGE