C# Signature:

[DllImport("ntdll.dll")]
public static extern NtStatus NtQueryObject(IntPtr objectHandle, OBJECT_INFORMATION_CLASS informationClass, IntPtr informationPtr, uint informationLength, ref uint returnLength);

VB Signature:

Declare Function NtQueryObject Lib "ntdll.dll" (TODO) As TODO

User-Defined Types:

NtStatus, OBJECT_INFORMATION_CLASS

Alternative Managed API:

Do you know one? Please contribute it!

Notes:

None.

Tips & Tricks:

Please add some!

Sample Code:

//helper method with "dynamic" buffer allocation
public static IntPtr NtQueryObject(IntPtr handle, OBJECT_INFORMATION_CLASS infoClass, uint infoLength = 0)
{
    if (infoLength == 0)
        infoLength = (uint)Marshal.SizeOf(typeof(uint));

    IntPtr infoPtr = Marshal.AllocHGlobal((int)infoLength);
    int tries = 0;
    NtStatus result;

    while (true)
    {
        result = NtQueryObject(handle, infoClass, infoPtr, infoLength, ref infoLength);

        if (result == NtStatus.InfoLengthMismatch || result == NtStatus.BufferOverflow || result == NtStatus.BufferTooSmall)
        {
            Marshal.FreeHGlobal(infoPtr);
            infoPtr = Marshal.AllocHGlobal((int)infoLength);
            tries++;
            continue;
        }
        else if (result == NtStatus.Success || tries > 5)
            break;
        else
        {
            //throw new Exception("Unhandled NtStatus " + result);
            break;
        }
    }

    if (result == NtStatus.Success)
        return infoPtr;//don't forget to free the pointer with Marshal.FreeHGlobal after you're done with it
    else
        Marshal.FreeHGlobal(infoPtr);//free pointer when not Successful

    return IntPtr.Zero;
}

Please edit this page!

Do you have...

• helpful tips or sample code to share for using this API in managed code?
• corrections to the existing content?
• variations of the signature you want to share?
• additional languages you want to include?

Select "Edit This Page" on the right hand toolbar and edit it! Or add new pages containing supporting types needed for this API (structures, delegates, and more).