NtQuerySymbolicLinkObject - NtDoc

Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers 
#ifndef _NTOBAPI_H
//
// Symbolic links
//
#if (PHNT_MODE != PHNT_MODE_KERNEL)

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQuerySymbolicLinkObject(
    _In_ HANDLE LinkHandle,
    _Inout_ PUNICODE_STRING LinkTarget,
    _Out_opt_ PULONG ReturnedLength
    );

#endif
#endif

View code on GitHub
#ifndef _NTZWAPI_H

NTSYSCALLAPI
NTSTATUS
NTAPI
ZwQuerySymbolicLinkObject(
    _In_ HANDLE LinkHandle,
    _Inout_ PUNICODE_STRING LinkTarget,
    _Out_opt_ PULONG ReturnedLength
    );

#endif

View code on GitHub
// wdm.h

NTSYSAPI NTSTATUS ZwQuerySymbolicLinkObject(
  [in]            HANDLE          LinkHandle,
  [in, out]       PUNICODE_STRING LinkTarget,
  [out, optional] PULONG          ReturnedLength
);
View the official Windows Driver Kit DDI reference
NTSTATUS WINAPI NtQuerySymbolicLinkObject(
  _In_      HANDLE          LinkHandle,
  _Inout_   PUNICODE_STRING LinkTarget,
  _Out_opt_ PULONG          ReturnedLength
);
View the official Win32 development documentation

NtDoc

No description available.

Edit description on GitHub

Windows Driver Kit DDI reference (nf-wdm-zwquerysymboliclinkobject)

Description

The ZwQuerySymbolicLinkObject routine returns a Unicode string that contains the target of a symbolic link.

Parameters

LinkHandle [in]

Handle to the symbolic-link object that you want to query. This handle is created by a successful call to ZwOpenSymbolicLinkObject.

LinkTarget [in, out]

Pointer to an initialized Unicode string that receives the target of the symbolic link.

ReturnedLength [out, optional]

contains the maximum number of bytes to copy into the Unicode string at LinkTarget. On output, the unsigned long integer contains the length of the Unicode string naming the target of the symbolic link.

Return value

ZwQuerySymbolicLinkObject returns either STATUS_SUCCESS to indicate the routine completed without error or STATUS_BUFFER_TOO_SMALL if the Unicode string provided at LinkTarget is too small to hold the returned string.

Remarks

Before calling this routine, driver writers must ensure that the Unicode string at LinkTarget has been properly initialized and a buffer for the string has been allocated. The MaximumLength and Buffer members of the Unicode string must be set before calling ZwQuerySymbolicLinkObject or the call will fail.

If ZwQuerySymbolicLinkObject returns STATUS_BUFFER_TOO_SMALL drivers should examine the value returned at ReturnedLength. The number returned in this variable indicates the maximum length that the Unicode string for the target of the symbolic link.

If the call to this function occurs in user mode, you should use the name "NtQuerySymbolicLinkObject" instead of "ZwQuerySymbolicLinkObject".

For calls from kernel-mode drivers, the Nt*Xxx* and Zw*Xxx* versions of a Windows Native System Services routine can behave differently in the way that they handle and interpret input parameters. For more information about the relationship between the Nt*Xxx* and Zw*Xxx* versions of a routine, see Using Nt and Zw Versions of the Native System Services Routines.

See also

Using Nt and Zw Versions of the Native System Services Routines

ZwOpenSymbolicLinkObject

View the official Windows Driver Kit DDI reference

Edit description on GitHub

Win32 development documentation (ntquerysymboliclinkobject)

NtQuerySymbolicLinkObject function

[This function may be altered or unavailable in the future.]

Retrieves the target of a symbolic link.

Parameters

LinkHandle [in]

A handle to the symbolic link object.

LinkTarget [in, out]

A pointer to an initialized Unicode string that receives the target of the symbolic link. The MaximumLength and Buffer members must be set if the call fails.

ReturnedLength [out, optional]

A pointer to a variable that receives the length of the Unicode string returned in the LinkTarget parameter. If the function returns STATUS_BUFFER_TOO_SMALL, this variable receives the required buffer size.

Return value

The function returns STATUS_SUCCESS or an error status.

Remarks

This function has no associated import library or header file; you must call it using the LoadLibrary and GetProcAddress functions.

Requirements

Requirement Value
DLL
 Ntdll.dll

See also

NtOpenSymbolicLinkObject

View the official Win32 development documentation

Edit description on GitHub

NTinternals.net (undocumented.ntinternals.net)

This function is documented in Windows Driver Kit.

pLinkName

Received path to destination object.

pDataWritten

???

See also

Edit description on GitHub