REG_LOAD_KEY_INFORMATION - NtDoc

Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers 
// wdm.h

typedef struct _REG_LOAD_KEY_INFORMATION {
  PVOID           Object;
  PUNICODE_STRING KeyName;
  PUNICODE_STRING SourceFile;
  ULONG           Flags;
  PVOID           TrustClassObject;
  PVOID           UserEvent;
  ACCESS_MASK     DesiredAccess;
  PHANDLE         RootHandle;
  PVOID           CallContext;
  PVOID           ObjectContext;
  PVOID           Reserved;
} REG_LOAD_KEY_INFORMATION, *PREG_LOAD_KEY_INFORMATION;
View the official Windows Driver Kit DDI reference

NtDoc

No description available.

Edit description on GitHub

Windows Driver Kit DDI reference (ns-wdm-_reg_load_key_information)

_REG_LOAD_KEY_INFORMATION structure

Description

The REG_LOAD_KEY_INFORMATION structure contains information about a registry hive that is being loaded.

Members

Object

A pointer to the registry key object for the root key of the hive that is about to be loaded.

KeyName

A pointer to a UNICODE_STRING structure that contains the name of the root key.

SourceFile

A pointer to a UNICODE_STRING structure that contains the path name of a file that contains the registry hive information that is being loaded.

Flags

Reserved for system use.

TrustClassObject

Reserved for system use.

UserEvent

A pointer to an event object that is signaled when the hive is unloaded.

DesiredAccess

The access mask that was specified by the thread that is trying to load the registry key. For more information about this access mask, see the description of the DesiredAccess parameter of the ZwCreateKey routine.

RootHandle

An optional pointer to a location that receives the handle to the root of the hive that is being loaded. This member can be non-NULL if an application hive is being loaded. In all other cases, this member should be NULL.

CallContext

Optional driver-defined context information that the driver's RegistryCallback routine can supply.

ObjectContext

A pointer to driver-defined context information that the driver has associated with a registry object by calling the CmSetCallbackObjectContext routine.

Reserved

Reserved for system use.

Remarks

The operating system passes the REG_LOAD_KEY_INFORMATION structure to a RegistryCallback routine every time a user-mode thread calls RegLoadKey to load a registry hive.

For more information about registry filtering operations, see Filtering Registry Calls.

See also

CmSetCallbackObjectContext

Filtering Registry Calls

RegLoadKey

RegistryCallback

REG_LOAD_KEY_INFORMATION_V2

UNICODE_STRING

ZwCreateKey

View the official Windows Driver Kit DDI reference

Edit description on GitHub