NtOpenKey - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
#ifndef _NTREGAPI_H
/**
* Opens an existing registry key without creating missing keys. The native implementation forwards to NtOpenKeyEx with OpenOptions = 0.
*
* \param[out] KeyHandle Required writable output receiving a caller-owned key
* handle on success; close it with NtClose. Initialize it to NULL and check the
* return status rather than assuming every failure clears the output.
* \param[in] DesiredAccess Requested rights on the opened key. View infoclasses
* KEY_WOW64_32KEY (0x200) / KEY_WOW64_64KEY (0x100) are not key operation rights.
* The ordinary open with DesiredAccess = 0 returns STATUS_ACCESS_DENIED;
* this differs from reducing an existing handle to zero access by duplication.
* \param[in] ObjectAttributes Initialized native absolute path or a counted name
* relative to the key handle in RootDirectory. Use OBJ_CASE_INSENSITIVE as needed.
* \return STATUS_SUCCESS or a failure such as STATUS_OBJECT_NAME_NOT_FOUND for
* an absent final component. Opening a key does not reserve its name/lifetime.
* \remarks Security information supplied in ObjectAttributes does not replace
* the existing key's security descriptor. WoW64 constructs the appropriate path
* and may attach key-body tags; don't assume the same numeric handle or tags
* across opens, views or architectures. See NtOpenKeyEx for option/probing details.
* \sa https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-zwopenkeyex
*/
_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenKey(
_Out_ PHANDLE KeyHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes
);
View code on GitHub#ifndef _NTZWAPI_H
_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwOpenKey(
_Out_ PHANDLE KeyHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes
);
View code on GitHub// wdm.h
NTSYSAPI NTSTATUS ZwOpenKey(
[out] PHANDLE KeyHandle,
[in] ACCESS_MASK DesiredAccess,
[in] POBJECT_ATTRIBUTES ObjectAttributes
);
View the official Windows Driver Kit DDI referenceNo description available.
The ZwOpenKey routine opens an existing registry key.
KeyHandle [out]Pointer to the HANDLE variable that receives the handle to the key.
DesiredAccess [in]Specifies an ACCESS_MASK value that determines the requested access to the object. For more information, see the DesiredAccess parameter of ZwCreateKey.
ObjectAttributes [in]Pointer to an OBJECT_ATTRIBUTES structure that specifies the object name and other attributes. Use InitializeObjectAttributes to initialize this structure. If the caller is not running in a system thread context, it must set the OBJ_KERNEL_HANDLE attribute when it calls InitializeObjectAttributes.
ZwOpenKey returns STATUS_SUCCESS if the given key was opened. Otherwise, it can return an error status, including the following:
STATUS_INVALID_HANDLE
STATUS_ACCESS_DENIED
ZwOpenKey supplies a handle that the caller can use to manipulate a registry key. The routine provides a subset of the functionality of ZwCreateKey. For more information, see Using the Registry in a Driver.
If the specified key does not exist, ZwOpenKey returns an error status and does not return a key handle.
Once the handle pointed to by KeyHandle is no longer in use, the driver must call ZwClose to close it.
ZwOpenKey ignores the security information in the structure that the ObjectAttributes parameter points to.
If the caller is not running in a system thread context, it must ensure that any handles it creates are private handles. Otherwise, the handle can be accessed by the process in whose context the driver is running. For more information, see Object Handles.
For more information about working with registry keys, see Using the Registry in a Driver.
If the call to this function occurs in user mode, you should use the name "NtOpenKey" instead of "ZwOpenKey".
This function is documented in Windows Driver Kit.
See ZwOpenKey in NT DDK or 2000 DDK for detailed description.