RtlQueryRegistryValueWithFallback function (ntddk.h)

Retrieves a value entry for a registry key by using, a primary handle; if not found, uses the fallback handle.

Syntax

NTSYSAPI NTSTATUS RtlQueryRegistryValueWithFallback(
  [in]  HANDLE          PrimaryHandle,
  [in]  HANDLE          FallbackHandle,
  [in]  PUNICODE_STRING ValueName,
  [in]  ULONG           ValueLength,
  [Out] PULONG          ValueType,
  [out] PVOID           ValueData,
  [out] PULONG          ResultLength
);

Parameters

[in] PrimaryHandle

The handle to the key that is first used to query the value entries. This handle is created by a successful call to ZwCreateKey or ZwOpenKey.

[in] FallbackHandle

The handle to use for querying the key if value is not found using the handle specified by PrimaryHandle.

[in] ValueName

A pointer to string that contains the name of the value for which to retrieve data.

[in] ValueLength

Specifies the size, in bytes, of the ValueName string.

[Out] ValueType

A pointer to a ULONG variable that receives the type of the value being queried.

[out] ValueData

A pointer to a buffer that receives the value data.

[out] ResultLength

A pointer to a variable that receives the value data size, in bytes. If the return value is STATUS_SUCCESS, indicates the number of bytes written to the ValueData buffer. If the call returns STATUS_BUFFER_OVERFLOW, indicates the number of bytes required. Callers can use that value to determine the size of ValueData buffer required to hold the data information.

Return value

Returns STATUS_SUCCESS on success, or the appropriate error code on failure.

Requirements

Requirement	Value
Minimum supported client	Windows 10, version 1809
Header	ntddk.h (include wdm.h)
Library	NtosKrnl.lib
IRQL	PASSIVE_LEVEL

See also

Using the Registry in a Driver