Key Operations
NtOpenKey
Opens an existing registry key.Receives a handle to the registry key
Access rights for the key
Attributes identifying the key
- Key path
- Key handle (after successful operation)
- Operation success status
NtOpenKeyEx
Extended version of NtOpenKey with additional options.Receives a handle to the registry key
Access rights for the key
Attributes identifying the key
Options for opening the key
- Key path
- Key handle (after successful operation)
- Operation success status
NtCreateKey
Creates a new registry key or opens an existing one.Receives a handle to the registry key
Access rights for the key
Attributes of the key to create
Options for creating the key
Receives whether a new key was created or existing one opened
- Key path
- Key handle (after successful operation)
- Operation success status
NtDeleteKey
Deletes a registry key.Handle to the key to delete
Value Operations
NtSetValueKey
Sets the data for a value entry in a registry key.Handle to the registry key
Name of the value to set
Type of data (REG_SZ, REG_DWORD, etc.)
Pointer to the data to set
Size of the data in bytes
NtQueryValueKey
Retrieves data for a value entry in a registry key.Handle to the registry key
Name of the value to query
Type of information to retrieve
NtDeleteValueKey
Deletes a value entry from a registry key.Handle to the registry key
Name of the value to delete
Enumeration Operations
NtEnumerateKey
Enumerates subkeys of a registry key.Handle to the registry key
Zero-based index of the subkey
Type of information to return
- Key path
- Operation success status
NtEnumerateValueKey
Enumerates value entries in a registry key.Handle to the registry key
Zero-based index of the value
Type of information to return
NtQueryKey
Retrieves information about a registry key.Handle to the registry key
Type of information to retrieve
- Key path
- Operation success status
Advanced Key Operations
NtQueryMultipleValueKey
Retrieves data for multiple value entries in a single call.Handle to the registry key
Array of value entries to query
Number of entries in the array
NtNotifyChangeKey
Monitors a registry key for changes.Handle to the registry key to monitor
Event to signal when changes occur
Types of changes to monitor
Whether to monitor the entire subtree
NtNotifyChangeMultipleKeys
Monitors multiple registry keys for changes.Handle to the master key
Array of subordinate keys to monitor
Types of changes to monitor
Transacted Registry Operations
NtCreateKeyTransacted
Creates a registry key as part of a transaction.Receives a handle to the registry key
Access rights for the key
Attributes of the key to create
Handle to the transaction
NtOpenKeyTransacted
Opens a registry key as part of a transaction.Receives a handle to the registry key
Access rights for the key
Attributes identifying the key
Handle to the transaction
NtOpenKeyTransactedEx
Extended version of NtOpenKeyTransacted.Receives a handle to the registry key
Access rights for the key
Attributes identifying the key
Options for opening the key
Handle to the transaction
Administrative Operations
NtFlushKey
Flushes registry changes to disk.Handle to the registry key to flush
NtCompactKeys
Compacts one or more registry keys.Number of keys in the array
Array of key handles to compact
NtCompressKey
Compresses a registry key.Handle to the key to compress
NtFreezeRegistry
Freezes the registry to prevent modifications.Timeout duration in seconds
NtInitializeRegistry
Initializes the registry.Boot condition flags
Key Loading and Saving
NtLoadKey
Loads a registry hive from a file.Target location in the registry
Path to the hive file
NtLoadKey2
Extended version of NtLoadKey with flags.Target location in the registry
Path to the hive file
Load flags
NtLoadKeyEx
Fully extended version of NtLoadKey.Target location in the registry
Path to the hive file
Load flags
Desired access to the loaded hive
NtSaveKey
Saves a registry key to a file.Handle to the key to save
Handle to the destination file
NtSaveKeyEx
Extended version of NtSaveKey with format option.Handle to the key to save
Handle to the destination file
Save format
NtLockRegistryKey
Locks a registry key to prevent deletion.Handle to the key to lock
NtQueryOpenSubKeys
Queries the number of open subkeys.Target key to query
Receives the count of open handles
NtQueryOpenSubKeysEx
Extended version of NtQueryOpenSubKeys.Target key to query
Length of the output buffer
Buffer to receive information
Receives the required buffer size