NtQueryInformationTransaction - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
#ifndef _NTTMAPI_H
/**
* Queries KTM identity, outcome, properties or enlistment metadata. It is not a query interface for
* registry-only lightweight transaction objects.
*
* \param TransactionHandle KTM handle with TRANSACTION_QUERY_INFORMATION (0x1).
* \param TransactionInformationClass InfoClass. Native tm.sys accepts 0 (basic), 1 (properties), 2
* (enlistments), 3 (superior enlistment) and 5 (private DTC data); 4 (bind) is not a query class there. WoW64
* dispatches only 0, 1 and 4, so its forwarded class 4 is rejected by native code and native classes 2/3/5
* are unavailable through that thunk. Do not remove SDK infoclasses based on this.
* \param TransactionInformation Caller-owned output. Use naturally aligned storage; the native public records
* are probed at 4-byte alignment.
* \param TransactionInformationLength Capacity in bytes. Basic requires exactly 24 bytes, not merely at least
* 24. Superior information requires exactly 32. Properties requires at least 32; its description begins at
* offset 24, and the complete size is max(32, 24 + DescriptionLength). Enlistments requires at least 36 bytes
* even for zero entries; each returned pair occupies 32 bytes after the 4-byte count. Private DTC data has a
* separate opaque byte-buffer contract.
* \param ReturnLength Optional returned/required size, only meaningful for the actual completed path. Native
* too-small properties/enlistments below the fixed minimum return 0 here, not a usable allocation size. Early
* length/access/class failures can leave it unchanged. WoW64 properties has separate early checks.
* \return STATUS_SUCCESS, STATUS_INFO_LENGTH_MISMATCH for exact-size failures, STATUS_BUFFER_TOO_SMALL below
* native variable-record minima, STATUS_BUFFER_OVERFLOW for native partial variable records, or another
* status.
* \remarks Basic State was 1 for active, committed and rolled-back transactions Use Outcome (1 undetermined,
* 2 committed, 3 aborted), not State alone, to determine completion in these paths. Properties
* DescriptionLength is bytes, not WCHARs, and remains full on overflow. No general NUL-termination or
* padding-content guarantee should be inferred.
*
* WoW64 properties rejects NULL output or capacity below 32 with STATUS_INFO_LENGTH_MISMATCH before native
* query, and copies fields/description back only on NT_SUCCESS: overflow can update ReturnLength without
* returning the native partial record. Its temporary buffer permits unaligned properties output, but basic
* output is forwarded and still requires native alignment. Private DTC infoclasses are deprecated internal
* interfaces. Query only complete, capacity-bounded returned fields.
* \sa https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-zwqueryinformationtransaction
*/
_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryInformationTransaction(
_In_ HANDLE TransactionHandle,
_In_ TRANSACTION_INFORMATION_CLASS TransactionInformationClass,
_Out_writes_bytes_(TransactionInformationLength) PVOID TransactionInformation,
_In_ ULONG TransactionInformationLength,
_Out_opt_ PULONG ReturnLength
);
View code on GitHub#ifndef _NTZWAPI_H
_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwQueryInformationTransaction(
_In_ HANDLE TransactionHandle,
_In_ TRANSACTION_INFORMATION_CLASS TransactionInformationClass,
_Out_writes_bytes_(TransactionInformationLength) PVOID TransactionInformation,
_In_ ULONG TransactionInformationLength,
_Out_opt_ PULONG ReturnLength
);
View code on GitHub// wdm.h
__kernel_entry NTSYSCALLAPI NTSTATUS NtQueryInformationTransaction(
[in] HANDLE TransactionHandle,
[in] TRANSACTION_INFORMATION_CLASS TransactionInformationClass,
[out] PVOID TransactionInformation,
[in] ULONG TransactionInformationLength,
[out, optional] PULONG ReturnLength
);
View the official Windows Driver Kit DDI reference// wdm.h
NTSYSCALLAPI NTSTATUS ZwQueryInformationTransaction(
[in] HANDLE TransactionHandle,
[in] TRANSACTION_INFORMATION_CLASS TransactionInformationClass,
[out] PVOID TransactionInformation,
[in] ULONG TransactionInformationLength,
[out, optional] PULONG ReturnLength
);
View the official Windows Driver Kit DDI referenceThe ZwQueryInformationTransaction routine retrieves information about a specified transaction.
TransactionHandle [in]A handle to a transaction object that was obtained by a previous call to ZwCreateTransaction or ZwOpenTransaction. The handle must have TRANSACTION_QUERY_INFORMATION access to the object.
TransactionInformationClass [in]A TRANSACTION_INFORMATION_CLASS-typed value that specifies the information to obtain. The value must be one of the following values:
The TransactionFullInformation value is not used with ZwQueryInformationTransaction.
TransactionInformation [out]A pointer to a caller-allocated buffer that receives the information that the TransactionInformationClass parameter specifies. The buffer's structure type must be TRANSACTION_BASIC_INFORMATION, TRANSACTION_PROPERTIES_INFORMATION, or TRANSACTION_ENLISTMENTS_INFORMATION.
TransactionInformationLength [in]The length, in bytes, of the buffer that the TransactionInformation parameter points to, including the length of any additional array elements that the caller has allocated to receive information.
ReturnLength [out, optional]A pointer to a caller-allocated variable that receives the length, in bytes, of the information that KTM writes to the TransactionInformation buffer. This parameter is optional and can be NULL.
ZwQueryInformationTransaction returns STATUS_SUCCESS if the operation succeeds. Otherwise, this routine might return one of the following values:
| Return code | Description |
|---|---|
| STATUS_INVALID_INFO_CLASS | The TransactionInformationClass parameter's value is invalid. |
| STATUS_INFO_LENGTH_MISMATCH | The length of the buffer that is specified by the TransactionInformationLength parameter is incorrect. |
| STATUS_OBJECT_TYPE_MISMATCH | The handle that the TransactionHandle parameter specifies is not a handle to a transaction object. |
| STATUS_INVALID_HANDLE | An object handle is invalid. |
| STATUS_ACCESS_DENIED | The caller does not have appropriate access to the transaction object. |
| STATUS_BUFFER_OVERFLOW | The buffer that the TransactionInformation parameter specifies is too small. |
The routine might return other NTSTATUS values.
For more information about how to use ZwQueryInformationTransaction, see Creating a Transactional Client.
NtQueryInformationTransaction and ZwQueryInformationTransaction are two versions of the same Windows Native System Services routine.
For calls from kernel-mode drivers, the NtXxx and ZwXxx versions of a Windows Native System Services routine can behave differently in the way that they handle and interpret input parameters. For more information about the relationship between the NtXxx and ZwXxx versions of a routine, see Using Nt and Zw Versions of the Native System Services Routines.
TRANSACTION_ENLISTMENTS_INFORMATION
TRANSACTION_PROPERTIES_INFORMATION
Using Nt and Zw Versions of the Native System Services Routines
The ZwQueryInformationTransaction routine retrieves information about a specified transaction.
TransactionHandle [in]A handle to a transaction object that was obtained by a previous call to ZwCreateTransaction or ZwOpenTransaction. The handle must have TRANSACTION_QUERY_INFORMATION access to the object.
TransactionInformationClass [in]A TRANSACTION_INFORMATION_CLASS-typed value that specifies the information to obtain. The value must be one of the following values:
The TransactionFullInformation value is not used with ZwQueryInformationTransaction.
TransactionInformation [out]A pointer to a caller-allocated buffer that receives the information that the TransactionInformationClass parameter specifies. The buffer's structure type must be TRANSACTION_BASIC_INFORMATION, TRANSACTION_PROPERTIES_INFORMATION, or TRANSACTION_ENLISTMENTS_INFORMATION.
TransactionInformationLength [in]The length, in bytes, of the buffer that the TransactionInformation parameter points to, including the length of any additional array elements that the caller has allocated to receive information.
ReturnLength [out, optional]A pointer to a caller-allocated variable that receives the length, in bytes, of the information that KTM writes to the TransactionInformation buffer. This parameter is optional and can be NULL.
ZwQueryInformationTransaction returns STATUS_SUCCESS if the operation succeeds. Otherwise, this routine might return one of the following values:
| Return code | Description |
|---|---|
| STATUS_INVALID_INFO_CLASS | The TransactionInformationClass parameter's value is invalid. |
| STATUS_INFO_LENGTH_MISMATCH | The length of the buffer that is specified by the TransactionInformationLength parameter is incorrect. |
| STATUS_OBJECT_TYPE_MISMATCH | The handle that the TransactionHandle parameter specifies is not a handle to a transaction object. |
| STATUS_INVALID_HANDLE | An object handle is invalid. |
| STATUS_ACCESS_DENIED | The caller does not have appropriate access to the transaction object. |
| STATUS_BUFFER_OVERFLOW | The buffer that the TransactionInformation parameter specifies is too small. |
The routine might return other NTSTATUS values.
For more information about how to use ZwQueryInformationTransaction, see Creating a Transactional Client.
NtQueryInformationTransaction and ZwQueryInformationTransaction are two versions of the same Windows Native System Services routine.
For calls from kernel-mode drivers, the NtXxx and ZwXxx versions of a Windows Native System Services routine can behave differently in the way that they handle and interpret input parameters. For more information about the relationship between the NtXxx and ZwXxx versions of a routine, see Using Nt and Zw Versions of the Native System Services Routines.
TRANSACTION_ENLISTMENTS_INFORMATION
TRANSACTION_PROPERTIES_INFORMATION
Using Nt and Zw Versions of the Native System Services Routines