NtOpenSymbolicLinkObject - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
#ifndef _NTOBAPI_H
//
// Symbolic links
//
#if (PHNT_MODE != PHNT_MODE_KERNEL)
NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenSymbolicLinkObject(
_Out_ PHANDLE LinkHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes
);
View code on GitHub#ifndef _NTZWAPI_H
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwOpenSymbolicLinkObject(
_Out_ PHANDLE LinkHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes
);
View code on GitHub// wdm.h
NTSYSAPI NTSTATUS ZwOpenSymbolicLinkObject(
[out] PHANDLE LinkHandle,
[in] ACCESS_MASK DesiredAccess,
[in] POBJECT_ATTRIBUTES ObjectAttributes
);
View the official Windows Driver Kit DDI referenceNTSTATUS WINAPI NtOpenSymbolicLinkObject(
_Out_ PHANDLE LinkHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes
);
View the official Win32 development documentationNo description available.
The ZwOpenSymbolicLinkObject routine opens an existing symbolic link.
LinkHandle [out]Pointer to a HANDLE variable that receives a handle to the symbolic link object.
DesiredAccess [in]Specifies an ACCESS_MASK value that determines the requested access to the object. The caller usually specified GENERIC_READ, so that the handle can be passed to ZwQuerySymbolicLinkObject.
ObjectAttributes [in]Pointer to an OBJECT_ATTRIBUTES structure that specifies the object name and other attributes. Use InitializeObjectAttributes to initialize this structure. If the caller is not running in a system thread context, it must set the OBJ_KERNEL_HANDLE attribute when it calls InitializeObjectAttributes.
ZwOpenSymbolicLinkObject returns STATUS_SUCCESS on success or the appropriate error status.
Once the handle pointed to by LinkHandle is no longer in use, the driver must call ZwClose to close it.
If the caller is not running in a system thread context, it must ensure that any handles it creates are private handles. Otherwise, the handle can be accessed by the process in whose context the driver is running. For more information, see Object Handles.
If the call to the ZwOpenSymbolicLinkObject function occurs in user mode, you should use the name "NtOpenSymbolicLinkObject" instead of "ZwOpenSymbolicLinkObject".
NtOpenSymbolicLinkObject and ZwOpenSymbolicLinkObject are two versions of the same Windows Native System Services routine. The NtOpenSymbolicLinkObject routine in the Windows kernel is not directly accessible to kernel-mode drivers. However, kernel-mode drivers can access this routine indirectly by calling the ZwOpenSymbolicLinkObject routine.
For calls from kernel-mode drivers, the Nt*Xxx* and Zw*Xxx* versions of a Windows Native System Services routine can behave differently in the way that they handle and interpret input parameters. For more information about the relationship between the Nt*Xxx* and Zw*Xxx* versions of a routine, see Using Nt and Zw Versions of the Native System Services Routines.
Using Nt and Zw Versions of the Native System Services Routines
[This function may be altered or unavailable in the future.]
Opens an existing symbolic link.
LinkHandle [out]
A handle to the newly opened symbolic link object.
DesiredAccess [in]
An ACCESS_MASK that specifies the requested access to the directory object. It is typical to use GENERIC_READ so the handle can be passed to the NtQueryDirectoryObject function.
ObjectAttributes [in]
The attributes for the directory object. To initialize the OBJECT_ATTRIBUTES structure, use the InitializeObjectAttributes macro. If the caller is not running in a system thread context, it must specify the OBJ_KERNEL_HANDLE flag when initializing the structure. For more information, see the documentation for these items in the documentation for the WDK.
The function returns STATUS_SUCCESS or an error status.
This function has no associated import library or header file; you must call it using the LoadLibrary and GetProcAddress functions.
| Requirement | Value |
|---|---|
| DLL |
Ntdll.dll |