REG_LOAD_KEY_INFORMATION_V2 - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
// wdm.h
typedef struct _REG_LOAD_KEY_INFORMATION_V2 {
PVOID Object;
PUNICODE_STRING KeyName;
PUNICODE_STRING SourceFile;
ULONG Flags;
PVOID TrustClassObject;
PVOID UserEvent;
ACCESS_MASK DesiredAccess;
PHANDLE RootHandle;
PVOID CallContext;
PVOID ObjectContext;
ULONG_PTR Version;
PVOID FileAccessToken;
} REG_LOAD_KEY_INFORMATION_V2, *PREG_LOAD_KEY_INFORMATION_V2;
View the official Windows Driver Kit DDI referenceNo description available.
The REG_LOAD_KEY_INFORMATION_V2 structure contains information about a registry hive that is being loaded.
ObjectA pointer to the registry key object for the root key of the hive that is about to be loaded.
KeyNameA pointer to a UNICODE_STRING structure that contains the name of the root key.
SourceFileA pointer to a UNICODE_STRING structure that contains the path name of a file that contains the registry hive information that is being loaded.
FlagsReserved for system use.
TrustClassObjectReserved for system use.
UserEventA pointer to an event object that is signaled when the hive is unloaded.
DesiredAccessThe access mask that was specified by the thread that is trying to load the registry key. For more information about this access mask, see the description of the DesiredAccess parameter of the ZwCreateKey routine.
RootHandleAn optional pointer to a location that receives the handle to the root of the hive that is being loaded. This member can be non-NULL if an application hive is being loaded. In all other cases, this member should be NULL.
CallContextOptional driver-defined context information that the driver's RegistryCallback routine can supply.
ObjectContextA pointer to driver-defined context information that the driver has associated with a registry object by calling the CmSetCallbackObjectContext routine.
VersionA pointer to a numeric version identifier of REG_LOAD_KEY_INFORMATION_*.
FileAccessTokenA pointer to an access token (PACCESS_TOKEN) that impersonates its access level when accessing a file (this for security purposes). In this case, it is used when accessing the hive file being loaded into the registry.