#ifndef _NTEXAPI_H
#if (PHNT_MODE != PHNT_MODE_KERNEL)

/**
 * The NtOpenKeyedEvent routine opens an existing named keyed event without performing a wait or release.
 *
 * \param KeyedEventHandle Receives a handle owned by the caller; close it with NtClose.
 * \param DesiredAccess Requested access. KEYEDEVENT_WAIT (0x1) permits waits;
 * KEYEDEVENT_WAKE (0x2) permits releases. Opening does not perform either operation.
 * \param ObjectAttributes Identifies the existing object by name and optional root directory.
 * \return NTSTATUS indicating whether the object was opened.
 * \remarks On x64, a valid output slot is cleared before name lookup.
 * Even with a shared object, matching waits and releases must belong to the same process.
 */
_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenKeyedEvent(
    _Out_ PHANDLE KeyedEventHandle,
    _In_ ACCESS_MASK DesiredAccess,
    _In_ PCOBJECT_ATTRIBUTES ObjectAttributes
    );

#endif
#endif
View code on GitHub

#ifndef _NTZWAPI_H

_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwOpenKeyedEvent(
    _Out_ PHANDLE KeyedEventHandle,
    _In_ ACCESS_MASK DesiredAccess,
    _In_ PCOBJECT_ATTRIBUTES ObjectAttributes
    );

#endif
View code on GitHub