RtlWriteRegistryValue - NtDoc

Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers 
#ifndef _NTRTL_H

NTSYSAPI
NTSTATUS
NTAPI
RtlWriteRegistryValue(
    _In_ ULONG RelativeTo,
    _In_ PCWSTR Path,
    _In_z_ PCWSTR ValueName,
    _In_ ULONG ValueType,
    _In_ PVOID ValueData,
    _In_ ULONG ValueLength
    );

#endif

View code on GitHub
// wdm.h

NTSYSAPI NTSTATUS RtlWriteRegistryValue(
  [in]           ULONG  RelativeTo,
  [in]           PCWSTR Path,
  [in]           PCWSTR ValueName,
  [in]           ULONG  ValueType,
  [in, optional] PVOID  ValueData,
  [in]           ULONG  ValueLength
);
View the official Windows Driver Kit DDI reference

NtDoc

This function is documented in Windows Driver Kit.

Edit description on GitHub

Windows Driver Kit DDI reference (nf-wdm-rtlwriteregistryvalue)

RtlWriteRegistryValue function

Description

The RtlWriteRegistryValue routine writes caller-supplied data into the registry along the specified relative path at the given value name.

Parameters

RelativeTo [in]

Specifies whether Path is an absolute registry path or is relative to a predefined path as one of the following.

Value Meaning
RTL_REGISTRY_ABSOLUTE Path is an absolute registry path.
RTL_REGISTRY_SERVICES Path is relative to \Registry\Machine\System\CurrentControlSet\Services.
RTL_REGISTRY_CONTROL Path is relative to \Registry\Machine\System\CurrentControlSet\Control.
RTL_REGISTRY_WINDOWS_NT Path is relative to \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion.
RTL_REGISTRY_DEVICEMAP Path is relative to \Registry\Machine\Hardware\DeviceMap.
RTL_REGISTRY_USER Path is relative to \Registry\User\CurrentUser. (For a system process, this is \Users.Default.)
RTL_REGISTRY_OPTIONAL Specifies that the key referenced by this parameter and the Path parameter are optional.
RTL_REGISTRY_HANDLE Specifies that the Path parameter is actually a registry handle to use. This value is optional.

Path [in]

Pointer to either an absolute registry path or a path relative to the known location specified by the RelativeTo parameter. If the RTL_REGISTRY_HANDLE flag is specified, this parameter is a registry handle for an already opened key to be used directly.

ValueName [in]

Pointer to the name of a subkey or value entry to be written into the registry.

ValueType [in]

Specifies a REG_XXX value that determines the type of the ValueName parameter. For a list of the possible values, see the Type parameter of ZwSetValueKey.

ValueData [in, optional]

Pointer to the name of a subkey or values for its value entries (or both) to be written into the registry.

ValueLength [in]

Specifies the number of bytes of ValueData to be written into the registry.

Return value

RtlWriteRegistryValue returns the status of the operation, either STATUS_SUCCESS or an error status.

Remarks

If the specified key does not exist, the routine attempts to create the key. For this attempt to succeed, the new key must be a direct subkey of the key that is referred to by the Path parameter, and the key that Path refers to must have been opened for KEY_CREATE_SUB_KEY access.

See also

RtlCheckRegistryKey

RtlCreateRegistryKey

RtlDeleteRegistryValue

RtlQueryRegistryValues

ZwCreateKey

ZwOpenKey

ZwSetValueKey

View the official Windows Driver Kit DDI reference

Edit description on GitHub