key.h

#pragma once

#pragma pack(push, 8)
#pragma region nt_key_information
using KEY_INFORMATION_CLASS = enum _KEY_INFORMATION_CLASS : std::uint32_t
{
	KeyBasicInformation = 0,
	KeyNodeInformation = 1,
	KeyFullInformation = 2,
	KeyNameInformation = 3,
	KeyCachedInformation = 4,
	KeyFlagsInformation = 5,
	KeyVirtualizationInformation = 6,
#if Q_NT_VERSION >= Q_NT_WIN7
	KeyHandleTagsInformation = 7,
#endif
#if Q_NT_VERSION >= Q_NT_WIN8
	KeyTrustInformation = 8,
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_RS1
	KeyLayerInformation = 9,
#endif
	MaxKeyInfoClass
};

struct KEY_BASIC_INFORMATION
{
	LARGE_INTEGER LastWriteTime; // 0x00
	std::uint32_t TitleIndex; // 0x08
	std::uint32_t NameLength; // 0x0C
	wchar_t Name[ANYSIZE_ARRAY]; // 0x10
};

struct KEY_NODE_INFORMATION
{
	LARGE_INTEGER LastWriteTime; // 0x00
	std::uint32_t TitleIndex; // 0x08
	std::uint32_t ClassOffset; // 0x0C
	std::uint32_t ClassLength; // 0x10
	std::uint32_t NameLength; // 0x14
	wchar_t Name[ANYSIZE_ARRAY]; // 0x18
	//wchar_t Class[ANYSIZE_ARRAY]; // 0x00 + ClassOffset / 0x18 + NameLength
};

struct KEY_FULL_INFORMATION
{
	LARGE_INTEGER LastWriteTime; // 0x00
	std::uint32_t TitleIndex; // 0x08
	std::uint32_t ClassOffset; // 0x0C
	std::uint32_t ClassLength; // 0x10
	std::uint32_t SubKeys; // 0x14
	std::uint32_t MaxNameLength; // 0x18
	std::uint32_t MaxClassLength; // 0x1C
	std::uint32_t Values; // 0x20
	std::uint32_t MaxValueNameLength; // 0x24
	std::uint32_t MaxValueDataLength; // 0x28
	wchar_t Class[ANYSIZE_ARRAY]; // 0x2C
};

struct KEY_NAME_INFORMATION
{
	std::uint32_t NameLength; // 0x0
	wchar_t Name[ANYSIZE_ARRAY]; // 0x4
};

struct KEY_CACHED_INFORMATION
{
	LARGE_INTEGER LastWriteTime; // 0x00
	std::uint32_t TitleIndex; // 0x08
	std::uint32_t SubKeys; // 0x0C
	std::uint32_t MaxNameLength; // 0x10
	std::uint32_t Values; // 0x14
	std::uint32_t MaxValueNameLength; // 0x18
	std::uint32_t MaxValueDataLength; // 0x1C
	std::uint32_t NameLength; // 0x20
	wchar_t Name[ANYSIZE_ARRAY]; // 0x24
};

struct KEY_FLAGS_INFORMATION
{
	std::uint32_t Wow64Flags; // 0x0
	std::uint32_t KeyFlags; // 0x4
	std::uint32_t ControlFlags; // 0x8
};
static_assert(sizeof(KEY_FLAGS_INFORMATION) == 0xC);

struct KEY_VIRTUALIZATION_INFORMATION
{
	std::uint32_t VirtualizationCandidate : 1;
	std::uint32_t VirtualizationEnabled : 1;
	std::uint32_t VirtualTarget : 1;
	std::uint32_t VirtualStore : 1;
	std::uint32_t VirtualSource : 1;
	std::uint32_t Reserved : 27;
};
static_assert(sizeof(KEY_VIRTUALIZATION_INFORMATION) == 0x4);

#if Q_NT_VERSION >= Q_NT_WIN7
struct KEY_HANDLE_TAGS_INFORMATION
{
	std::uint32_t HandleTags;
};
static_assert(sizeof(KEY_HANDLE_TAGS_INFORMATION) == 0x4);
#endif

#if Q_NT_VERSION >= Q_NT_WIN8
struct KEY_TRUST_INFORMATION
{
	std::uint32_t TrustedKey : 1;
	std::uint32_t Reserved : 31;
};
static_assert(sizeof(KEY_TRUST_INFORMATION) == 0x4);
#endif

#if Q_NT_VERSION >= Q_NT_WIN10_RS1
struct KEY_LAYER_INFORMATION
{
	std::uint32_t IsTombstone : 1;
	std::uint32_t IsSupersedeLocal : 1;
	std::uint32_t IsSupersedeTree : 1;
	std::uint32_t ClassIsInherited : 1;
	std::uint32_t Reserved : 28;
};
static_assert(sizeof(KEY_LAYER_INFORMATION) == 0x4);
#endif
#pragma endregion

#pragma region nt_key_set_information
using KEY_SET_INFORMATION_CLASS = enum _KEY_SET_INFORMATION_CLASS : std::uint32_t
{
	KeyWriteTimeInformation = 0,
	KeyWow64FlagsInformation = 1,
	KeyControlFlagsInformation = 2,
	KeySetVirtualizationInformation = 3,
	KeySetDebugInformation = 4,
#if Q_NT_VERSION >= Q_NT_WIN7
	KeySetHandleTagsInformation = 5,
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_RS2
	KeySetLayerInformation = 6,
#endif
	MaxKeySetInfoClass
};

struct KEY_WRITE_TIME_INFORMATION
{
	LARGE_INTEGER LastWriteTime;
};
static_assert(sizeof(KEY_WRITE_TIME_INFORMATION) == 0x8);

struct KEY_WOW64_FLAGS_INFORMATION
{
	std::uint32_t UserFlags;
};
static_assert(sizeof(KEY_WOW64_FLAGS_INFORMATION) == 0x4);

struct KEY_CONTROL_FLAGS_INFORMATION
{
	std::uint32_t ControlFlags;
};
static_assert(sizeof(KEY_CONTROL_FLAGS_INFORMATION) == 0x4);

struct KEY_SET_VIRTUALIZATION_INFORMATION
{
	std::uint32_t VirtualTarget : 1;
	std::uint32_t VirtualStore : 1;
	std::uint32_t VirtualSource : 1;
	std::uint32_t Reserved : 29;
};
static_assert(sizeof(KEY_SET_VIRTUALIZATION_INFORMATION) == 0x4);

#if Q_NT_VERSION >= Q_NT_WIN10_RS2
using KEY_SET_LAYER_INFORMATION = KEY_LAYER_INFORMATION;
#endif
#pragma endregion

#pragma region nt_key_value_information
using KEY_VALUE_INFORMATION_CLASS = enum _KEY_VALUE_INFORMATION_CLASS : std::uint32_t
{
	KeyValueBasicInformation = 0,
	KeyValueFullInformation = 1,
	KeyValuePartialInformation = 2,
	KeyValueFullInformationAlign64 = 3,
	KeyValuePartialInformationAlign64 = 4,
#if Q_NT_VERSION >= Q_NT_WIN10_RS1
	KeyValueLayerInformation = 5,
#endif
	MaxKeyValueInfoClass
};

struct KEY_VALUE_BASIC_INFORMATION
{
	std::uint32_t TitleIndex; // 0x0
	std::uint32_t Type; // 0x4
	std::uint32_t NameLength; // 0x8
	wchar_t Name[ANYSIZE_ARRAY]; // 0xC
};

struct KEY_VALUE_FULL_INFORMATION
{
	std::uint32_t TitleIndex; // 0x00
	std::uint32_t Type; // 0x04
	std::uint32_t DataOffset; // 0x08
	std::uint32_t DataLength; // 0x0C
	std::uint32_t NameLength; // 0x10
	wchar_t Name[ANYSIZE_ARRAY]; // 0x14
	//std::uint8_t Data[ANYSIZE_ARRAY]; // 0x00 + DataOffset / 0x14 + NameLength
};

struct KEY_VALUE_PARTIAL_INFORMATION
{
	std::uint32_t TitleIndex; // 0x0
	std::uint32_t Type; // 0x4
	std::uint32_t DataLength; // 0x8
	std::uint8_t Data[ANYSIZE_ARRAY]; // 0xC
};

#if Q_NT_VERSION >= Q_NT_WIN10_RS1
struct KEY_VALUE_LAYER_INFORMATION
{
	std::uint32_t IsTombstone : 1;
	std::uint32_t Reserved : 31;
};
static_assert(sizeof(KEY_VALUE_LAYER_INFORMATION) == 0x4);
#endif
#pragma endregion

_Q_NT_BIT_TEMPLATE struct KEY_PID_ARRAY
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<HANDLE> ProcessId; // 0x0 // @note: originally "PID"
	UNICODE_STRING<nBitness> KeyName; // 0x4 / 0x8
};
_Q_NT_BIT_ASSERT(KEY_PID_ARRAY, 0xC, 0x18);

_Q_NT_BIT_TEMPLATE struct KEY_OPEN_SUBKEYS_INFORMATION
{
	std::uint32_t Count; // 0x0
	KEY_PID_ARRAY<nBitness> KeyArray[ANYSIZE_ARRAY]; // 0x4 / 0x8
};
#pragma pack(pop)