NtQueryInformationEnlistment - NtDoc

Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers 
#ifndef _NTTMAPI_H

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryInformationEnlistment(
    _In_ HANDLE EnlistmentHandle,
    _In_ ENLISTMENT_INFORMATION_CLASS EnlistmentInformationClass,
    _Out_writes_bytes_(EnlistmentInformationLength) PVOID EnlistmentInformation,
    _In_ ULONG EnlistmentInformationLength,
    _Out_opt_ PULONG ReturnLength
    );

#endif

View code on GitHub
#ifndef _NTZWAPI_H

NTSYSCALLAPI
NTSTATUS
NTAPI
ZwQueryInformationEnlistment(
    _In_ HANDLE EnlistmentHandle,
    _In_ ENLISTMENT_INFORMATION_CLASS EnlistmentInformationClass,
    _Out_writes_bytes_(EnlistmentInformationLength) PVOID EnlistmentInformation,
    _In_ ULONG EnlistmentInformationLength,
    _Out_opt_ PULONG ReturnLength
    );

#endif

View code on GitHub
// wdm.h

__kernel_entry NTSYSCALLAPI NTSTATUS NtQueryInformationEnlistment(
  [in]            HANDLE                       EnlistmentHandle,
  [in]            ENLISTMENT_INFORMATION_CLASS EnlistmentInformationClass,
  [out]           PVOID                        EnlistmentInformation,
  [in]            ULONG                        EnlistmentInformationLength,
  [out, optional] PULONG                       ReturnLength
);
View the official Windows Driver Kit DDI reference
// wdm.h

NTSYSCALLAPI NTSTATUS ZwQueryInformationEnlistment(
  [in]            HANDLE                       EnlistmentHandle,
  [in]            ENLISTMENT_INFORMATION_CLASS EnlistmentInformationClass,
  [out]           PVOID                        EnlistmentInformation,
  [in]            ULONG                        EnlistmentInformationLength,
  [out, optional] PULONG                       ReturnLength
);
View the official Windows Driver Kit DDI reference

NtDoc

This function is documented in Windows Driver Kit here and here.

Edit description on GitHub

Windows Driver Kit DDI reference (nf-wdm-ntqueryinformationenlistment)

NtQueryInformationEnlistment function

Description

The ZwQueryInformationEnlistment routine retrieves information about a specified enlistment object.

Parameters

EnlistmentHandle [in]

A handle to an enlistment object that was obtained by a previous call to ZwCreateEnlistment or ZwOpenEnlistment. The handle must have ENLISTMENT_QUERY_INFORMATION access to the object.

EnlistmentInformationClass [in]

An ENLISTMENT_INFORMATION_CLASS-typed enumeration value that specifies the information to be obtained. This value must be one of the following values:

The enumeration's EnlistmentFullInformation value is not used with ZwQueryInformationEnlistment.

EnlistmentInformation [out]

A pointer to a caller-allocated buffer that receives the information that the EnlistmentInformationClass parameter specifies. If the EnlistmentInformationClass parameter's value is EnlistmentBasicInformation, this buffer's structure type must be ENLISTMENT_BASIC_INFORMATION. If the EnlistmentInformationClass parameter's value is EnlistmentRecoveryInformation, this buffer's type must match the caller-defined type that the caller used when it called ZwSetInformationEnlistment.

EnlistmentInformationLength [in]

The length, in bytes, of the buffer that the EnlistmentInformation parameter points to.

ReturnLength [out, optional]

A pointer to a caller-allocated variable that receives the length, in bytes, of the information that KTM writes to the EnlistmentInformation buffer. This parameter is optional and can be NULL.

Return value

ZwQueryInformationEnlistment returns STATUS_SUCCESS if the operation succeeds. Otherwise, this routine might return one of the following values:

Return code Description
STATUS_OBJECT_TYPE_MISMATCH The specified handle is not a handle to an enlistment object.
STATUS_INVALID_HANDLE The object handle is invalid.
STATUS_INVALID_INFO_CLASS The EnlistmentInformationClass parameter's value is invalid.
STATUS_INFO_LENGTH_MISMATCH The EnlistmentInformationLength parameter's value is invalid.
STATUS_ACCESS_DENIED The caller does not have appropriate access to the enlistment object.

The routine might return other NTSTATUS values.

Remarks

A resource manager can call ZwSetInformationEnlistment to set enlistment-specific recovery information for an enlistment object and then call ZwQueryInformationEnlistment to retrieve the recovery information.

For more information about ZwQueryInformationEnlistment, see Handling Recovery Operations.

Callers of ZwQueryInformationEnlistment must be running at IRQL = PASSIVE_LEVEL.

NtQueryInformationEnlistment and ZwQueryInformationEnlistment are two versions of the same Windows Native System Services routine.

For calls from kernel-mode drivers, the Nt*Xxx* and Zw*Xxx* versions of a Windows Native System Services routine can behave differently in the way that they handle and interpret input parameters. For more information about the relationship between the Nt*Xxx* and Zw*Xxx* versions of a routine, see Using Nt and Zw Versions of the Native System Services Routines.

See also

ENLISTMENT_BASIC_INFORMATION

ENLISTMENT_INFORMATION_CLASS

Using Nt and Zw Versions of the Native System Services Routines

ZwCreateEnlistment

ZwOpenEnlistment

ZwSetInformationEnlistment

View the official Windows Driver Kit DDI reference

Edit description on GitHub

Windows Driver Kit DDI reference (nf-wdm-zwqueryinformationenlistment)

ZwQueryInformationEnlistment function

Description

The ZwQueryInformationEnlistment routine retrieves information about a specified enlistment object.

Parameters

EnlistmentHandle [in]

A handle to an enlistment object that was obtained by a previous call to ZwCreateEnlistment or ZwOpenEnlistment. The handle must have ENLISTMENT_QUERY_INFORMATION access to the object.

EnlistmentInformationClass [in]

An ENLISTMENT_INFORMATION_CLASS-typed enumeration value that specifies the information to be obtained. This value must be one of the following values:

The enumeration's EnlistmentFullInformation value is not used with ZwQueryInformationEnlistment.

EnlistmentInformation [out]

A pointer to a caller-allocated buffer that receives the information that the EnlistmentInformationClass parameter specifies. If the EnlistmentInformationClass parameter's value is EnlistmentBasicInformation, this buffer's structure type must be ENLISTMENT_BASIC_INFORMATION. If the EnlistmentInformationClass parameter's value is EnlistmentRecoveryInformation, this buffer's type must match the caller-defined type that the caller used when it called ZwSetInformationEnlistment.

EnlistmentInformationLength [in]

The length, in bytes, of the buffer that the EnlistmentInformation parameter points to.

ReturnLength [out, optional]

A pointer to a caller-allocated variable that receives the length, in bytes, of the information that KTM writes to the EnlistmentInformation buffer. This parameter is optional and can be NULL.

Return value

ZwQueryInformationEnlistment returns STATUS_SUCCESS if the operation succeeds. Otherwise, this routine might return one of the following values:

Return code Description
STATUS_OBJECT_TYPE_MISMATCH The specified handle is not a handle to an enlistment object.
STATUS_INVALID_HANDLE The object handle is invalid.
STATUS_INVALID_INFO_CLASS The EnlistmentInformationClass parameter's value is invalid.
STATUS_INFO_LENGTH_MISMATCH The EnlistmentInformationLength parameter's value is invalid.
STATUS_ACCESS_DENIED The caller does not have appropriate access to the enlistment object.

The routine might return other NTSTATUS values.

Remarks

A resource manager can call ZwSetInformationEnlistment to set enlistment-specific recovery information for an enlistment object and then call ZwQueryInformationEnlistment to retrieve the recovery information.

For more information about ZwQueryInformationEnlistment, see Handling Recovery Operations.

Callers of ZwQueryInformationEnlistment must be running at IRQL = PASSIVE_LEVEL.

NtQueryInformationEnlistment and ZwQueryInformationEnlistment are two versions of the same Windows Native System Services routine.

For calls from kernel-mode drivers, the Nt*Xxx* and Zw*Xxx* versions of a Windows Native System Services routine can behave differently in the way that they handle and interpret input parameters. For more information about the relationship between the Nt*Xxx* and Zw*Xxx* versions of a routine, see Using Nt and Zw Versions of the Native System Services Routines.

See also

ENLISTMENT_BASIC_INFORMATION

ENLISTMENT_INFORMATION_CLASS

Using Nt and Zw Versions of the Native System Services Routines

ZwCreateEnlistment

ZwOpenEnlistment

ZwSetInformationEnlistment

View the official Windows Driver Kit DDI reference

Edit description on GitHub