RtlQueryRegistryValueWithFallback function

Retrieves a value entry for a registry key by using, a primary handle; if not found, uses the fallback handle.

Syntax

NTSYSAPI NTSTATUS RtlQueryRegistryValueWithFallback(
  HANDLE          PrimaryHandle,
  HANDLE          FallbackHandle,
  PUNICODE_STRING ValueName,
  ULONG           ValueLength,
  PULONG          ValueType,
  PVOID           ValueData,
  PULONG          ResultLength
);

Parameters

PrimaryHandle

[in] The handle to the key that is first used to query the value entries. This handle is created by a successful call to ZwCreateKey or ZwOpenKey.

FallbackHandle

[in] The handle to use for querying the key if value is not found using the handle specified by PrimaryHandle.

ValueName

[in] A pointer to string that contains the name of the value for which to retrieve data.

ValueLength

[in] Specifies the size, in bytes, of the ValueName string.

ValueType

[Out] A pointer to a ULONG variable that receives the the type of the value being queried.

ValueData

[out] A pointer to a buffer that receives the value data.

ResultLength

[out] A pointer to a variable that receives the value data size, in bytes. If the return value is STATUS_SUCCESS, indicates the number of bytes written to the ValueData buffer. If the call returns STATUS_BUFFER_OVERFLOW, indicates the number of bytes required. Callers can use that value to determine the size of ValueData buffer required to hold the data information.

Return Value

Returns STATUS_SUCCESS on success, or the appropriate error code on failure.

Requirements

   
Minimum supported client Windows 10, version 1809
Header ntddk.h (include wdm.h)
Library NtosKrnl.lib
IRQL PASSIVE_LEVEL

See Also

Using the Registry in a Driver