RtlQueryRegistryValueWithFallback function (ntddk.h)
Retrieves a value entry for a registry key by using, a primary handle; if not found, uses the fallback handle.
Syntax
NTSYSAPI NTSTATUS RtlQueryRegistryValueWithFallback(
[in] HANDLE PrimaryHandle,
[in] HANDLE FallbackHandle,
[in] PUNICODE_STRING ValueName,
[in] ULONG ValueLength,
[Out] PULONG ValueType,
[out] PVOID ValueData,
[out] PULONG ResultLength
);
Parameters
[in] PrimaryHandle
The handle to the key that is first used to query the value entries. This handle is created by a successful call to ZwCreateKey or ZwOpenKey.
[in] FallbackHandle
The handle to use for querying the key if value is not found using the handle specified by PrimaryHandle.
[in] ValueName
A pointer to string that contains the name of the value for which to retrieve data.
[in] ValueLength
Specifies the size, in bytes, of the ValueName string.
[Out] ValueType
A pointer to a ULONG variable that receives the type of the value being queried.
[out] ValueData
A pointer to a buffer that receives the value data.
[out] ResultLength
A pointer to a variable that receives the value data size, in bytes. If the return value is STATUS_SUCCESS, indicates the number of bytes written to the ValueData buffer. If the call returns STATUS_BUFFER_OVERFLOW, indicates the number of bytes required. Callers can use that value to determine the size of ValueData buffer required to hold the data information.
Return value
Returns STATUS_SUCCESS on success, or the appropriate error code on failure.
Requirements
| Requirement | Value |
|---|---|
| Minimum supported client | Windows 10, version 1809 |
| Header | ntddk.h (include wdm.h) |
| Library | NtosKrnl.lib |
| IRQL | PASSIVE_LEVEL |