How does it work?

MagNumDB is a database that contains about 350,000 items. These items are constants, names, values all extracted from more than 6,000 header files (.h, .hxx, .hpp, .idl, etc.) provided by standard Windows and Visual Studio SDKs and WDKs.

Some values have been extracted from the very special uuid.lib file that contains the value of thousands of guids and property keys, not present anywhere else in header files. This can explain some duplicates (because names in uuid.lib are not always exactly the same as names in .h parsed files...).

It also contains around 36,0000 undocumented guids that we found ... meeeeep ...

 "C2P5"

To build this database, we have tried many existing parsers, things like CLANG or other fine tools, but they just don't suit our needs. They can't handle thousands of files that don't compile together, they can't handle some specific (or just very old) Microsoft constructs or annotations, they don't remember the stack of #define directives that led to a definition, they only give you a final AST, not a partial one, etc.

So, in the end, we have written a C/C++ parser named C2P5 (for C/CPP/PreProcessor/Parser), tailored specifically for computing constants. C2P5 is capable of preprocessing, parsing and partially evaluating all header files as if they were included in a one big virtual project (that of course, does not compile) on a 32G RAM machine. It currently supports the following preprocessor and C/C++ constructs:

  • #define preprocessor that define constants
  • #define preprocessor that define expression to compute constants
  • C and C++ constants, strings and enum definitions, and some level of pointerness
  • Special GUID constructs like DECLSPEC_UUID, DEFINE_GUIDSTRUCT, MIDL_INTERFACE, you name it
  • PROPERTYKEY constructs
  • Some IDL constructs
  • Etc.

The parser remembers dynamic preprocessor definitions (#if, #ifdef, etc.) that are conditions for constants definitions and expression computation. All parsed items are saved in the database, as well as the associated conditions. There may be more than one item corresponding to a given name, if there are differences in their associated conditions stack.

C2P5 supports the following types of constants, regardless of the way they are defined in source files:

  • integer, signed or unsigned, from 8-bit to 128-bit
  • floating point number, single (32-bit) or double (64-bit)
  • globally unique identifier, or guid, uuid, CLSID, IID, etc.
  • string, in narrow, wide, or utf-8/16/32 formats
  • character, in narrow, wide, or utf-8/16/32 formats
  • pointer, a constant cast as a pointer
  • property key, or PROPERTYKEY, or PKEY, a combination of a guid (fmtid) and a 32-bit integer (id).

 Powered by

C2P5 and this MagNumDB web site are written in C# and use a Lucene database as a full-text search engine. C2P5 uses a custom ANTLR4cs C grammar for expression parsing, not for preprocessor parsing.

 

 Frequently Asked Questions

  • Q: Can I run custom queries?
    A: Yes. You can use Lucene's query syntax. Note the Database is case insensitive. Check out the list of columns with their corresponding database column names:

    • Index: the item's index.
    • Name: the item's name, or title. For enum values, it's prefixed with the enum's name.
      Corresponding database field: title.
    • Type: the item's type, expressed in a specific, universal system.
      Corresponding database's field: valuetype, but use the value of the Storage type column for queries on items type.
    • Value: the item's value. For string values, it's displayed as is w/o quotes nor escaping.
      Corresponding database field: value. There is also a typedvalue field that can contain database's Int32, Int64, Float, Double or String typed values.
    • Hex Value: the item's hexadecimal value, only valid for integer types.
      There is no corresponding database field.
    • Signed Value: the item's signed value, only valid for integer and double types. Useful when you found a unsigned number and want to get the corresponding signed value (uint -> int for example).
      There is no corresponding database field.
    • Source lines(s): the source lines from which the item was extracted. Comments and characters such as TAB, CR are preserved.
      Corresponding database field: source.
    • File path: the file path from which the item was extracted, terminated by the line index.
      Corresponding database field: filepath. There are also directory and filename fields. filename is useful to query for values in a given file.
    • Score: Database's score value. Items are returned sorted by score.
    • Guid formats: a utility columns that proposes all possible guid formats. Only valid for guid types.
      There is no corresponding database field
    • Char type: the character encoding (narrow, wide, etc.). Only valid for char and string values.
      Corresponding database field: chartype.
    • Storage type: the exact storage type in the database. Only used for specific queries.
      Corresponding database field: valuetype.
    • Conditions: the list of preprocessor conditions for a given item. If a condition is surrounded with a REVERSE function, it means the reverse condition of what's surrounded was the condition.
      Corresponding database field: conditions. There may be multiple conditions fields for one item.

    Some important points to note:

    • If you search for a negative number (like error codes expressed using signed integers), you can surround the search with double quotes, for example searching for "-2147009290" is equivalent to searching for 0x80073CF6, 80073CF6 (or even 3CF6 in this specific case). If you don't surround negative numbers with double quotes, the system will search for signed and unsigned corresponding values.
    • The full-text search uses items' name, value, hex value, guid formats, source lines, etc. so refine your search if you get back too many items.
    • You can search for guid binary values using just a part of their full definition. For example, if you search for '79eac9c5', it will get you 3 guid entries
    • Leading wild card search (*whatever) is allowed, but it may slow down the search significantly.

    Here are some example or custom queries:

    title:wm_user returns the WM_USER Windows message item, not all items that reference the WM_USER token.

    title:wm_u* returns all items (Windows messages probably) whose name starts with WM_U*.

    value:1024 AND title:wm_* returns all items (Windows messages probably) whose name starts with WM_U* and value is 1024. Note AND must be UPPERCASE for database to understand it as an AND operator.

    value:"00000002-0000-0000-C000-000000000046" returns the IMalloc IID guid value.

  • Q: I always get back 400 items at most. Why?
    A: The MagNumDb site currently limits the number of returned items to this value by design. This should be enough for most real search scenarios (like enums with a big list of values).

  • Q: Some values are empty. Why?
    A: The expression evaluator cannot always compute the final value, because it sometimes require contextual information (custom defines, compiler architecture, etc.) that the parser doesn't have at parsing time. You can enable the Source line(s) column to check what's the corresponding source and try to work it out by yourself. The origin file path and line number is also included.

  • Q: Can I get all values for a given enum?
    A: Sure. For example, __VSHPROPID is the name of an enum, and a query like this: parent:__VSHPROPID will get all the enum's values (66 entries).

  • Q: I sometimes get back items whose name starts with "__magnumdb__enum_". Why?
    A: C allows unnamed enums. The MagNumDb parser just gives them a name, using the defining file name and a counter.

  • Q: I sometimes get back the same item/name twice or more with different values. For example:  TARGET_IS_NT60_OR_LATER. Why?
    A: This can be the case with defines. Their value may be different if they were surrounded by # directives (#if, #else, etc.) in the original source code. You can enable the Condition(s) column to check what are the corresponding conditions for a given item.
    Note: if a condition is surrounded with a funny REVERSE function token, it means the reverse condition of what's surrounded.

 Database Metrics

  • Last update date: Thursday August 29, 2019
  • Items count: 350276
  • Parsed files count: 7563
  • Windows SDK version: 10.0.18362.0
  • NetFx SDK version: 4.8
  • MSVC Tools version: 14.22.27905

 

 Contact

We welcome feedback.
Seen anything missing? A bug? A wrong value? Do you have any suggestion for improvements? Do you have an idea for a cool new feature?

Please contact us here

 About MagNumDB

MagNumDB  2017-2019 Simon Mourier V1.3.1. All rights reserved.

Profile for Simon Mourier at Stack Overflow, Q&A for professional and enthusiast programmers


All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only.

All values, names, source code fragments displayed here have been extracted from files that are property of their respective owners.

THIS SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND OTHER THAN AS SPECIFICALLY SET FORTH IN THE LICENSE AGREEMENT, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Index Score Name Type Value Hex value Signed value Guid formats Char type Storage type Source line(s) File path Condition(s)
Index Score Name Type Value Hex value Signed value Guid formats Char type Storage type Source line(s) File path Condition(s)
1 9.639342 REG_NOTIFY_CLASS::RegNtDeleteKey Int32 0 0x00000000 0 System.Int32
RegNtDeleteKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25512,0)
2 9.639342 REG_NOTIFY_CLASS::RegNtPreDeleteKey Int32 0 0x00000000 0 System.Int32
RegNtPreDeleteKey = RegNtDeleteKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25513,0)
3 9.639342 REG_NOTIFY_CLASS::RegNtSetValueKey Int32 1 0x00000001 1 System.Int32
RegNtSetValueKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25514,0)
4 9.639342 REG_NOTIFY_CLASS::RegNtPreSetValueKey Int32 1 0x00000001 1 System.Int32
RegNtPreSetValueKey = RegNtSetValueKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25515,0)
5 9.639342 REG_NOTIFY_CLASS::RegNtDeleteValueKey Int32 2 0x00000002 2 System.Int32
RegNtDeleteValueKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25516,0)
6 9.639342 REG_NOTIFY_CLASS::RegNtPreDeleteValueKey Int32 2 0x00000002 2 System.Int32
RegNtPreDeleteValueKey = RegNtDeleteValueKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25517,0)
7 9.639342 REG_NOTIFY_CLASS::RegNtSetInformationKey Int32 3 0x00000003 3 System.Int32
RegNtSetInformationKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25518,0)
8 9.639342 REG_NOTIFY_CLASS::RegNtPreSetInformationKey Int32 3 0x00000003 3 System.Int32
RegNtPreSetInformationKey = RegNtSetInformationKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25519,0)
9 9.639342 REG_NOTIFY_CLASS::RegNtRenameKey Int32 4 0x00000004 4 System.Int32
RegNtRenameKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25520,0)
10 9.639342 REG_NOTIFY_CLASS::RegNtPreRenameKey Int32 4 0x00000004 4 System.Int32
RegNtPreRenameKey = RegNtRenameKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25521,0)
11 9.639342 REG_NOTIFY_CLASS::RegNtEnumerateKey Int32 5 0x00000005 5 System.Int32
RegNtEnumerateKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25522,0)
12 9.639342 REG_NOTIFY_CLASS::RegNtPreEnumerateKey Int32 5 0x00000005 5 System.Int32
RegNtPreEnumerateKey = RegNtEnumerateKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25523,0)
13 9.639342 REG_NOTIFY_CLASS::RegNtEnumerateValueKey Int32 6 0x00000006 6 System.Int32
RegNtEnumerateValueKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25524,0)
14 9.639342 REG_NOTIFY_CLASS::RegNtPreEnumerateValueKey Int32 6 0x00000006 6 System.Int32
RegNtPreEnumerateValueKey = RegNtEnumerateValueKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25525,0)
15 9.639342 REG_NOTIFY_CLASS::RegNtQueryKey Int32 7 0x00000007 7 System.Int32
RegNtQueryKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25526,0)
16 9.639342 REG_NOTIFY_CLASS::RegNtPreQueryKey Int32 7 0x00000007 7 System.Int32
RegNtPreQueryKey = RegNtQueryKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25527,0)
17 9.639342 REG_NOTIFY_CLASS::RegNtQueryValueKey Int32 8 0x00000008 8 System.Int32
RegNtQueryValueKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25528,0)
18 9.639342 REG_NOTIFY_CLASS::RegNtPreQueryValueKey Int32 8 0x00000008 8 System.Int32
RegNtPreQueryValueKey = RegNtQueryValueKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25529,0)
19 9.639342 REG_NOTIFY_CLASS::RegNtQueryMultipleValueKey Int32 9 0x00000009 9 System.Int32
RegNtQueryMultipleValueKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25530,0)
20 9.639342 REG_NOTIFY_CLASS::RegNtPreQueryMultipleValueKey Int32 9 0x00000009 9 System.Int32
RegNtPreQueryMultipleValueKey = RegNtQueryMultipleValueKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25531,0)
21 9.639342 REG_NOTIFY_CLASS::RegNtPreCreateKey Int32 10 0x0000000A 10 System.Int32
RegNtPreCreateKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25532,0)
22 9.639342 REG_NOTIFY_CLASS::RegNtPostCreateKey Int32 11 0x0000000B 11 System.Int32
RegNtPostCreateKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25533,0)
23 9.639342 REG_NOTIFY_CLASS::RegNtPreOpenKey Int32 12 0x0000000C 12 System.Int32
RegNtPreOpenKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25534,0)
24 9.639342 REG_NOTIFY_CLASS::RegNtPostOpenKey Int32 13 0x0000000D 13 System.Int32
RegNtPostOpenKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25535,0)
25 9.639342 REG_NOTIFY_CLASS::RegNtKeyHandleClose Int32 14 0x0000000E 14 System.Int32
RegNtKeyHandleClose,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25536,0)
26 9.639342 REG_NOTIFY_CLASS::RegNtPreKeyHandleClose Int32 14 0x0000000E 14 System.Int32
RegNtPreKeyHandleClose = RegNtKeyHandleClose,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25537,0)
27 9.639342 REG_NOTIFY_CLASS::RegNtPostDeleteKey Int32 15 0x0000000F 15 System.Int32
RegNtPostDeleteKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25541,0)
28 9.639342 REG_NOTIFY_CLASS::RegNtPostSetValueKey Int32 16 0x00000010 16 System.Int32
RegNtPostSetValueKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25542,0)
29 9.639342 REG_NOTIFY_CLASS::RegNtPostDeleteValueKey Int32 17 0x00000011 17 System.Int32
RegNtPostDeleteValueKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25543,0)
30 9.639342 REG_NOTIFY_CLASS::RegNtPostSetInformationKey Int32 18 0x00000012 18 System.Int32
RegNtPostSetInformationKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25544,0)
31 9.639342 REG_NOTIFY_CLASS::RegNtPostRenameKey Int32 19 0x00000013 19 System.Int32
RegNtPostRenameKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25545,0)
32 9.639342 REG_NOTIFY_CLASS::RegNtPostEnumerateKey Int32 20 0x00000014 20 System.Int32
RegNtPostEnumerateKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25546,0)
33 9.639342 REG_NOTIFY_CLASS::RegNtPostEnumerateValueKey Int32 21 0x00000015 21 System.Int32
RegNtPostEnumerateValueKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25547,0)
34 9.639342 REG_NOTIFY_CLASS::RegNtPostQueryKey Int32 22 0x00000016 22 System.Int32
RegNtPostQueryKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25548,0)
35 9.639342 REG_NOTIFY_CLASS::RegNtPostQueryValueKey Int32 23 0x00000017 23 System.Int32
RegNtPostQueryValueKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25549,0)
36 9.639342 REG_NOTIFY_CLASS::RegNtPostQueryMultipleValueKey Int32 24 0x00000018 24 System.Int32
RegNtPostQueryMultipleValueKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25550,0)
37 9.639342 REG_NOTIFY_CLASS::RegNtPostKeyHandleClose Int32 25 0x00000019 25 System.Int32
RegNtPostKeyHandleClose,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25551,0)
38 9.639342 REG_NOTIFY_CLASS::RegNtPreCreateKeyEx Int32 26 0x0000001A 26 System.Int32
RegNtPreCreateKeyEx,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25552,0)
39 9.639342 REG_NOTIFY_CLASS::RegNtPostCreateKeyEx Int32 27 0x0000001B 27 System.Int32
RegNtPostCreateKeyEx,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25553,0)
40 9.639342 REG_NOTIFY_CLASS::RegNtPreOpenKeyEx Int32 28 0x0000001C 28 System.Int32
RegNtPreOpenKeyEx,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25554,0)
41 9.639342 REG_NOTIFY_CLASS::RegNtPostOpenKeyEx Int32 29 0x0000001D 29 System.Int32
RegNtPostOpenKeyEx,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25555,0)
42 9.639342 REG_NOTIFY_CLASS::RegNtPreFlushKey Int32 30 0x0000001E 30 System.Int32
RegNtPreFlushKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25559,0)
43 9.639342 REG_NOTIFY_CLASS::RegNtPostFlushKey Int32 31 0x0000001F 31 System.Int32
RegNtPostFlushKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25560,0)
44 9.639342 REG_NOTIFY_CLASS::RegNtPreLoadKey Int32 32 0x00000020 32 System.Int32
RegNtPreLoadKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25561,0)
45 9.639342 REG_NOTIFY_CLASS::RegNtPostLoadKey Int32 33 0x00000021 33 System.Int32
RegNtPostLoadKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25562,0)
46 9.639342 REG_NOTIFY_CLASS::RegNtPreUnLoadKey Int32 34 0x00000022 34 System.Int32
RegNtPreUnLoadKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25563,0)
47 9.639342 REG_NOTIFY_CLASS::RegNtPostUnLoadKey Int32 35 0x00000023 35 System.Int32
RegNtPostUnLoadKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25564,0)
48 9.639342 REG_NOTIFY_CLASS::RegNtPreQueryKeySecurity Int32 36 0x00000024 36 System.Int32
RegNtPreQueryKeySecurity,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25565,0)
49 9.639342 REG_NOTIFY_CLASS::RegNtPostQueryKeySecurity Int32 37 0x00000025 37 System.Int32
RegNtPostQueryKeySecurity,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25566,0)
50 9.639342 REG_NOTIFY_CLASS::RegNtPreSetKeySecurity Int32 38 0x00000026 38 System.Int32
RegNtPreSetKeySecurity,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25567,0)
51 9.639342 REG_NOTIFY_CLASS::RegNtPostSetKeySecurity Int32 39 0x00000027 39 System.Int32
RegNtPostSetKeySecurity,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25568,0)
52 9.639342 REG_NOTIFY_CLASS::RegNtCallbackObjectContextCleanup Int32 40 0x00000028 40 System.Int32
RegNtCallbackObjectContextCleanup,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25572,0)
53 9.639342 REG_NOTIFY_CLASS::RegNtPreRestoreKey Int32 41 0x00000029 41 System.Int32
RegNtPreRestoreKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25576,0)
54 9.639342 REG_NOTIFY_CLASS::RegNtPostRestoreKey Int32 42 0x0000002A 42 System.Int32
RegNtPostRestoreKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25577,0)
55 9.639342 REG_NOTIFY_CLASS::RegNtPreSaveKey Int32 43 0x0000002B 43 System.Int32
RegNtPreSaveKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25578,0)
56 9.639342 REG_NOTIFY_CLASS::RegNtPostSaveKey Int32 44 0x0000002C 44 System.Int32
RegNtPostSaveKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25579,0)
57 9.639342 REG_NOTIFY_CLASS::RegNtPreReplaceKey Int32 45 0x0000002D 45 System.Int32
RegNtPreReplaceKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25580,0)
58 9.639342 REG_NOTIFY_CLASS::RegNtPostReplaceKey Int32 46 0x0000002E 46 System.Int32
RegNtPostReplaceKey,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25581,0)
59 9.639342 REG_NOTIFY_CLASS::RegNtPreQueryKeyName Int32 47 0x0000002F 47 System.Int32
RegNtPreQueryKeyName,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25585,0)
60 9.639342 REG_NOTIFY_CLASS::RegNtPostQueryKeyName Int32 48 0x00000030 48 System.Int32
RegNtPostQueryKeyName,
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25586,0)
61 9.639342 REG_NOTIFY_CLASS::MaxRegNtNotifyClass Int32 49 0x00000031 49 System.Int32
MaxRegNtNotifyClass //should always be the last enum
%ProgramFiles(x86)%\Windows Kits\10\Include\10.0.18362.0\km\wdm.h(25588,0)