#ifndef _NTEXAPI_H
#if (PHNT_MODE != PHNT_MODE_KERNEL)

/**
 * Basic atom snapshot. The fixed prefix is 6 bytes; sizeof is 8 because Name[1]
 * includes a WCHAR. On the native x64 and WoW64 paths, successful queries append
 * a NUL after the copied name. They can return STATUS_SUCCESS after truncation,
 * so NameLength is the copied byte count, not necessarily the complete name length.
 * Reserve 518 bytes (6 + 255 WCHARs + terminator) for an untruncated maximum name.
 */
typedef struct _ATOM_BASIC_INFORMATION
{
    USHORT UsageCount;   // Reference snapshot; integer atoms report 1. Not an ownership grant.
    USHORT Flags;        // Bit 0x1: pinned; bit 0x2: global-entry lowbox access flag. Not NtAddAtomEx input flags in general.
    USHORT NameLength;   // Bytes copied into Name, excluding the trailing WCHAR NUL; may be truncated.
    _Field_size_bytes_(NameLength) WCHAR Name[1]; // Variable-length name, followed by a NUL on successful query.
} ATOM_BASIC_INFORMATION, *PATOM_BASIC_INFORMATION;

#endif
#endif
View code on GitHub