NtQueryValueKey uses a
KEY_VALUE_INFORMATION_CLASS enum you have
defined in JwaNative. The elements of this enum denote
which struct type is returned in KeyValueInformation.
NtQueryValueKey :
http://www.osronline.com/ddkx/kmarch/k111_9qya.htm
KEY_VALUE_INFORMATION_CLASS :
http://www.osronline.com/ddkx/kmarch/k112_07n6.htm
...
KEY_VALUE_BASIC_INFORMATION :
http://www.osronline.com/ddkx/kmarch/k112_01bm.htm
KEY_VALUE_FULL_INFORMATION :
http://www.osronline.com/ddkx/kmarch/k112_70z7.htm
KEY_VALUE_PARTIAL_INFORMATION :
http://www.osronline.com/ddkx/kmarch/k112_529e.htm
...
The above 3 structs are nowhere to be found in
win32api/ntapi. If added I suppose you will also want to
add the two "Align64" information classes I see in
JwaNative as well (not listed on orsonline).
...KeyValueFullInformationAlign64,
...KeyValuePartialInformationAlign64
Logged In: YES
user_id=559878
Here's one... (the only one I've seen used)
_KEY_VALUE_PARTIAL_INFORMATION = record
TitleIndex:ULONG;
Type_:ULONG;
DataLength:ULONG;
Data: array[0..0] of UCHAR;
end;
KEY_VALUE_PARTIAL_INFORMATION =
_KEY_VALUE_PARTIAL_INFORMATION;
PKEY_VALUE_PARTIAL_INFORMATION =
^KEY_VALUE_PARTIAL_INFORMATION;
Logged In: YES
user_id=559878
One to add that is.