REG_RESTORE_KEY_INFORMATION - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
// wdm.h
typedef struct _REG_RESTORE_KEY_INFORMATION {
PVOID Object;
HANDLE FileHandle;
ULONG Flags;
PVOID CallContext;
PVOID ObjectContext;
PVOID Reserved;
} REG_RESTORE_KEY_INFORMATION, *PREG_RESTORE_KEY_INFORMATION;
View the official Windows Driver Kit DDI referenceNo description available.
The REG_RESTORE_KEY_INFORMATION structure contains the information for a registry key that is about to be restored.
ObjectA pointer to a registry key object for the key that is about to be restored.
FileHandleA handle to the file from which the hive will be restored.
Flags0x00000008L
If specified, the restore operation is executed even if open handles exist at or beneath the location in the registry hierarchy to which the hKey parameter points.
0x00000001L
If specified, a new, volatile (memory-only) set of registry information, or hive, is created. If REG_WHOLE_HIVE_VOLATILE is specified, the key identified by the hKey parameter must be either the HKEY_USERS or HKEY_LOCAL_MACHINE value.
0x00000002
If set, the location of the subtree that the hKey parameter points to is restored to its state immediately following the last flush. The subtree must not be lazy flushed (by calling RegRestoreKey with REG_NO_LAZY_FLUSH specified as the value of this parameter); the caller must have the trusted computing base (TCB) privilege; and the handle to which the hKey parameter refers must point to the root of the subtree.
CallContextOptional driver-defined context information that the driver's RegistryCallback routine can supply. This member is defined for Windows Vista and later versions of the Windows operating system.
ObjectContextA pointer to driver-defined context information, which the driver has associated with a registry object by calling CmSetCallbackObjectContext. This member is defined for Windows Vista and later versions of the Windows operating system.
ReservedThis member is reserved for future use. This member is defined for Windows Vista and later versions of the Windows operating system.
The REG_REFRESH_HIVE flag is opaque and a filter should not attempt to change it.
For more information about registry filtering operations, see Filtering Registry Calls.