NtQueryMultipleValueKey - NtDoc

Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers 
#ifndef _NTREGAPI_H

/**
 * Queries multiple values of a registry key.
 *
 * @param[in] KeyHandle A handle to the key to be queried.
 * @param[in, out] ValueEntries A pointer to an array of KEY_VALUE_ENTRY structures that specify the values to be queried.
 * @param[in] EntryCount The number of entries in the array.
 * @param[out] ValueBuffer A pointer to a buffer that receives the value data.
 * @param[in, out] BufferLength A pointer to a variable that specifies the size of the buffer and receives the size of the data returned.
 * @param[out, optional] RequiredBufferLength A pointer to a variable that receives the size of the buffer required to hold the data.
 * @return NTSTATUS Successful or errant status.
 */
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryMultipleValueKey(
    _In_ HANDLE KeyHandle,
    _Inout_updates_(EntryCount) PKEY_VALUE_ENTRY ValueEntries,
    _In_ ULONG EntryCount,
    _Out_writes_bytes_(*BufferLength) PVOID ValueBuffer,
    _Inout_ PULONG BufferLength,
    _Out_opt_ PULONG RequiredBufferLength
    );

#endif

View code on GitHub
#ifndef _NTZWAPI_H

NTSYSCALLAPI
NTSTATUS
NTAPI
ZwQueryMultipleValueKey(
    _In_ HANDLE KeyHandle,
    _Inout_updates_(EntryCount) PKEY_VALUE_ENTRY ValueEntries,
    _In_ ULONG EntryCount,
    _Out_writes_bytes_(*BufferLength) PVOID ValueBuffer,
    _Inout_ PULONG BufferLength,
    _Out_opt_ PULONG RequiredBufferLength
    );

#endif

View code on GitHub
// winternl.h

__kernel_entry NTSTATUS NtQueryMultipleValueKey(
  [in]            HANDLE           KeyHandle,
  [in, out]       PKEY_VALUE_ENTRY ValueEntries,
  [in]            ULONG            EntryCount,
  [out]           PVOID            ValueBuffer,
  [in, out]       PULONG           BufferLength,
  [out, optional] PULONG           RequiredBufferLength
);
View the official Win32 API reference

NtDoc

No description available.

Edit description on GitHub

Win32 API reference (nf-winternl-ntquerymultiplevaluekey)

NtQueryMultipleValueKey function

Description

[This function may be changed or removed from Windows without further notice.]

Retrieves values for the specified multiple-value key.

Parameters

KeyHandle [in]

A handle to the key for which to retrieve values. The handle must be opened with the KEY_QUERY_VALUE access right.

ValueEntries [in, out]

A pointer to an array of [KEY_VALUE_ENTRY] structures containing the names of values to retrieve.

EntryCount [in]

The number of elements in the ValueEntries array.

ValueBuffer [out]

A pointer to a buffer to receive the values.

BufferLength [in, out]

A pointer to a variable that contains the size of the buffer at ValueBuffer, in bytes. When the function returns, the BufferLength parameter contains the number of bytes written to the buffer at ValueBuffer.

RequiredBufferLength [out, optional]

A pointer to a variable to receive the number of bytes required for all of the values to be returned by the function. This parameter can be NULL.

Return value

Returns an NTSTATUS or error code.

If the buffer is too small to hold the information to be retrieved, the function returns STATUS_BUFFER_OVERFLOW and, if the RequiredBufferLength parameter is specified, sets it to the buffer size required.

The forms and significance of NTSTATUS error codes are listed in the Ntstatus.h header file available in the WDK, and are described in the WDK documentation.

Remarks

This function has no associated header file. You can also use the LoadLibrary and GetProcAddress functions to dynamically link to Ntdll.dll.

See also

Registry Key Security and Access Rights

View the official Win32 API reference

Edit description on GitHub

NTinternals.net (undocumented.ntinternals.net)

This function is documented in Windows SDK.

Function NtQueryMultipleValueKey returns data of one or more values under specified Key Object.

KeyHandle

HANDLE to Key Object opened with KEY_READ access.

ValuesList

Array of KEY_MULTIPLE_VALUE_INFORMATION structures contains names of values to query.

NumberOfValues

Number of members in ValueList array.

DataBuffer

User's allocated buffer receiving queried value's data.

BufferLength

Pointer to value specifying length of DataBuffer, in bytes.

RequiredLength

Optionally pointer to value receiving required DataBuffer length, in bytes.

Documented by

See also

Edit description on GitHub