nf-winternl-ntqueryobject.md

UID	title	description	helpviewer_keywords	old-location	tech.root	ms.assetid	ms.date	ms.keywords	req.header	req.include-header	req.target-type	req.target-min-winverclnt	req.target-min-winversvr	req.kmdf-ver	req.umdf-ver	req.ddi-compliance	req.unicode-ansi	req.idl	req.max-support	req.namespace	req.assembly	req.type-library	req.lib	req.dll	req.irql	targetos	req.typenames	req.redist	ms.custom	f1_keywords	dev_langs	topic_type	api_type	api_location	api_name
NF:winternl.NtQueryObject	NtQueryObject function (winternl.h)	Retrieves various kinds of object information.	NtQueryObject NtQueryObject function [Windows API] winprog.ntqueryobject winternl/NtQueryObject	winprog\ntqueryobject.htm	winprog	08c801b5-a315-413e-adc5-576e6a740465	12/05/2018	NtQueryObject, NtQueryObject function [Windows API], winprog.ntqueryobject, winternl/NtQueryObject	winternl.h		Windows												ntdll.lib	ntdll.dll		Windows			19H1	NtQueryObject winternl/NtQueryObject	c++	APIRef kbSyntax	DllExport	Ntdll.dll	NtQueryObject

NtQueryObject function

-description

[This function may be changed or removed from Windows without further notice.]

Retrieves various kinds of object information.

-parameters

-param Handle [in, optional]

The handle of the object for which information is being queried.

-param ObjectInformationClass [in]

One of the following values, as enumerated in OBJECT_INFORMATION_CLASS, indicating the kind of object information to be retrieved.

Term	Description
ObjectBasicInformation	Returns a PUBLIC_OBJECT_BASIC_INFORMATION structure as shown in the following Remarks section.
ObjectTypeInformation	Returns a PUBLIC_OBJECT_TYPE_INFORMATION structure as shown in the following Remarks section.

-param ObjectInformation [out, optional]

An optional pointer to a buffer where the requested information is to be returned. The size and structure of this information varies depending on the value of the ObjectInformationClass parameter.

-param ObjectInformationLength [in]

The size of the buffer pointed to by the ObjectInformation parameter, in bytes.

-param ReturnLength [out, optional]

An optional pointer to a location where the function writes the actual size of the information requested. If that size is less than or equal to the ObjectInformationLength parameter, the function copies the information into the ObjectInformation buffer; otherwise, it returns an NTSTATUS error code and returns in ReturnLength the size of the buffer required to receive the requested information.

-returns

Returns an NTSTATUS or error code.

The forms and significance of NTSTATUS error codes are listed in the Ntstatus.h header file available in the WDK, and are described in the WDK documentation.

-remarks

This function has no associated header file or import library. You must use the LoadLibrary or GetProcAddress function to dynamically link to Ntdll.dll.

If the ObjectInformationClass parameter is ObjectBasicInformation, the information is contained in the following structure.

typedef struct _PUBLIC_OBJECT_BASIC_INFORMATION {
    ULONG Attributes;
    ACCESS_MASK GrantedAccess;
    ULONG HandleCount;
    ULONG PointerCount;
    ULONG Reserved[10];    // reserved for internal use
 } PUBLIC_OBJECT_BASIC_INFORMATION, *PPUBLIC_OBJECT_BASIC_INFORMATION;

Available members for this structure include object attributes for the handle (Attributes), the access granted for the handle (GrantedAccess), the number of open handles to the object (HandleCount), and the number of kernel references to the object (PointerCount).

If the ObjectInformationClass parameter is ObjectTypeInformation, the information is contained in the following structure.

typedef struct __PUBLIC_OBJECT_TYPE_INFORMATION {
    UNICODE_STRING TypeName;
    ULONG Reserved [22];    // reserved for internal use
} PUBLIC_OBJECT_TYPE_INFORMATION, *PPUBLIC_OBJECT_TYPE_INFORMATION;

The only available member of this structure is the object-type name string (TypeName).