#ifndef _NTEXAPI_H
#if (PHNT_MODE != PHNT_MODE_KERNEL)

/**
 * The NtQueryInformationAtom routine retrieves an atom's name/reference snapshot or a list of visible string
 * atoms. The layouts contain no pointers and are shared by native x64 and WoW64 callers.
 *
 * \param Atom Identifier for AtomBasicInformation (0); ignored for AtomTableInformation (1).
 * \param AtomInformationClass Basic information (0) or table enumeration (1).
 * \param AtomInformation Writable, 4-byte-aligned user buffer on x64 and its WoW64 path. 
 * See the selected structure for partial-result semantics.
 * \param AtomInformationLength Bytes available. Basic information requires at least
 * the 6-byte prefix; table information requires at least the 4-byte count prefix.
 * A shorter buffer returns STATUS_INFO_LENGTH_MISMATCH without updating ReturnLength.
 * \param ReturnLength Optional ULONG. For successful basic queries receives
 * 8 + NameLength (6-byte prefix, copied name, 2-byte terminator), not necessarily
 * the size required for the full name. On basic-query failure after the minimum
 * length check it receives 6. For table enumeration it receives 4 on insufficient
 * capacity, or 4 + 2 * NumberOfAtoms on success; it is not a universal sizing oracle.
 * \return NTSTATUS. Basic queries can succeed with a truncated name. A buffer with
 * no room for at least one WCHAR plus its terminator returns STATUS_BUFFER_TOO_SMALL
 * for a nonempty name. Table queries can return a partial array with
 * STATUS_INFO_LENGTH_MISMATCH and the total count in NumberOfAtoms.
 * \remarks Allocate enough for the maximum name when a complete string is needed:
 * 6 + 510 + 2 = 518 bytes. NULL/zero-length discovery does not report that size.
 * An unsupported class returns STATUS_INVALID_INFO_CLASS; native x64 writes
 * ReturnLength = 0, whereas the WoW64 thunk rejects it before the kernel
 * and leaves ReturnLength unchanged. Buffer probing can fail before class validation.
 */
_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryInformationAtom(
    _In_ RTL_ATOM Atom,
    _In_ ATOM_INFORMATION_CLASS AtomInformationClass,
    _Out_writes_bytes_(AtomInformationLength) PVOID AtomInformation,
    _In_ ULONG AtomInformationLength,
    _Out_opt_ PULONG ReturnLength
    );

#endif
#endif
View code on GitHub

#ifndef _NTZWAPI_H

_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwQueryInformationAtom(
    _In_ RTL_ATOM Atom,
    _In_ ATOM_INFORMATION_CLASS AtomInformationClass,
    _Out_writes_bytes_(AtomInformationLength) PVOID AtomInformation,
    _In_ ULONG AtomInformationLength,
    _Out_opt_ PULONG ReturnLength
    );

#endif
View code on GitHub