REG_QUERY_MULTIPLE_VALUE_KEY_INFORMATION - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
// wdm.h
typedef struct _REG_QUERY_MULTIPLE_VALUE_KEY_INFORMATION {
PVOID Object;
PKEY_VALUE_ENTRY ValueEntries;
ULONG EntryCount;
PVOID ValueBuffer;
PULONG BufferLength;
PULONG RequiredBufferLength;
PVOID CallContext;
PVOID ObjectContext;
PVOID Reserved;
} REG_QUERY_MULTIPLE_VALUE_KEY_INFORMATION, *PREG_QUERY_MULTIPLE_VALUE_KEY_INFORMATION;
View the official Windows Driver Kit DDI referenceNo description available.
The REG_QUERY_MULTIPLE_VALUE_KEY_INFORMATION structure describes the multiple value entries that are being retrieved for a key.
ObjectA pointer to the registry key object for the key whose value entries are being retrieved.
ValueEntriesA pointer to an array of KEY_VALUE_ENTRY structures, one for each value entry that is retrieved.
EntryCountThe number of entries in the ValueEntries array.
ValueBufferA pointer to a buffer that receives (from the system) the data for all the value entries specified by the ValueEntries array.
BufferLengthA pointer to a variable that contains the length, in bytes, of the ValueBuffer buffer.
RequiredBufferLengthA pointer to a variable that receives (from the system) the number of bytes required to hold the data for all the value entries that the ValueEntries array specifies. This member can be NULL.
CallContextOptional driver-defined context information that the driver's RegistryCallback routine can supply. This member is defined for Windows Vista and later versions of the Windows operating system.
ObjectContextA pointer to driver-defined context information that the driver has associated with a registry object by calling CmSetCallbackObjectContext. This member is defined for Windows Vista and later versions of the Windows operating system.
ReservedThis member is reserved for future use. This member is defined for Windows Vista and later versions of the Windows operating system.
The system passes this structure to the RegistryCallback routine every time a thread attempts to retrieve multiple value entries for a key at once—for example, when a user-mode thread calls RegQueryMultipleValues.
Each KEY_VALUE_ENTRY structure in the ValueEntries array describes one value entry in the ValueBuffer buffer. Specifically, the DataOffset member of KEY_VALUE_ENTRY contains the offset within ValueBuffer where the data for that value entry begins, and the DataLength member contains the length, in bytes, of the data for that value entry.
For more information about registry filtering operations, see Filtering Registry Calls.