NTSTATUS RtlpNtQueryValueKey( IN HANDLE KeyHandle, OUT OPTIONAL PULONG KeyValueType, OUT OPTIONAL PVOID KeyValue, IN OUT OPTIONAL PULONG KeyValueLength, OUT OPTIONAL PLARGE_INTEGER LastWriteTime ); Routine Description: This function queries the value of a key. Arguments: KeyHandle - Handle of a key opened for GENERIC_READ access via NtOpenKey. KeyValueType - Optional pointer to variable that will receive the client-defined type of the key value (if any). If no value has been set for the key, 0 is returned. KeyValue - Optional pointer to buffer in which part or all of the key's value (as set on the most recent call to NtSetValueKey) will be returned. If the key's value is too large to fit into the supplied buffer, as much of the value as will fit into the buffer will be returned and the warning STATUS_BUFFER_OVERFLOW is returned. If no value has ever been set, nothing is returned. If NULL is specified for this parameter, no Key Value is returned. KeyValueLength - On input, this optional parameter points to a variable that contains the length in bytes of the KeyValue buffer (if any). If no KeyValue buffer is specified, the variable content on entry is ignored. On return, the referenced variable (if any) receives the FULL length in bytes of the key value. If the key's value is too large to fit into the supplied buffer, as much of the value as will fit into the buffer will be returned and the warning STATUS_BUFFER_OVERFLOW is returned. The returned length is intended for use by calling code in allocating a buffer of sufficient size to hold the key's value. After receiving STATUS_BUFFER_OVERFLOW from NtQueryValueKey, calling code may make a subsequent call to NtQueryValueKey with a buffer of size equal to the length returned by the prior call. If no value has been set for the key, 0 is returned. LastWriteTime - Optional parameter to variable which receives a time stamp specifying the last time that the key was written. Return Value: NTSTATUS - Result code STATUS_SUCCESS - Call was successful STATUS_INVALID_PARAMETER - Invalid parameter STATUS_ACCESS_DENIED - Caller does not have GENERIC_READ access to the specified key STATUS_BUFFER_OVERFLOW - This is a warning that the key's value is too large for the buffer specified by the KeyValue and KeyValueLength parameters. Use the length returned to determine the size of buffer to allocate for a subsequent call of NtQueryValueKey.