Skip to content

Latest commit

 

History

History
21 lines (16 loc) · 1.35 KB

ntqueryobject.md

File metadata and controls

21 lines (16 loc) · 1.35 KB
Raw

Retrieves various information about kernel handles and the objects they point to. This function is partially documented in Windows Driver Kit here and here.

Parameters

  • Handle - a kernel handle to query information about. The handle does not need to grant any specific access.
  • ObjectInformationClass - the type of information to retrieve.
  • ObjectInformation - a pointer to a user-allocated buffer that receives the requested information.
  • ObjectInformationLength - the size of the provided buffer in bytes.
  • ReturnLength - an optional pointer to a variable that receives the number of bytes written when the function succeeds or the number of bytes requires when the buffer is too small.

Information classes

For the list of supported information classes, see OBJECT_INFORMATION_CLASS.

Notable return values

  • STATUS_BUFFER_TOO_SMALL and STATUS_INFO_LENGTH_MISMATCH indicate that the requested information does not fit into the provided buffer.

Related Win32 API

See also

  • NtSetInformationObject
  • NtQuerySecurityObject