Using NT’s Undocumented Object Manager Interface

Listing 1: objlst.h — Interface to NT object manager

//
// Author: Dieter Spaar <[email protected]>
// June 1997

// Object directory information returned by
// NtQueryDirectoryObject()

typedef struct _OBJDIR_INFORMATION
{
  UNICODE_STRING ObjectName;
  UNICODE_STRING ObjectTypeName; // e.g. Directory, Device ...
  UCHAR          Data[1];        // variable length
} OBJDIR_INFORMATION, *POBJDIR_INFORMATION;

// Open a directory object
//   Object Manager directory specific access rights are in
//   NTDDK.H e.g. DIRECTORY_QUERY

NTSYSAPI NTSTATUS NTAPI 
  NtOpenDirectoryObject(
    OUT PHANDLE             DirObjHandle, 
    IN ACCESS_MASK          DesiredAccess, 
    IN POBJECT_ATTRIBUTES   ObjectAttributes);

// Query information about the content of a directory object
//
//   DirObjInformation   buffer must be large enough to hold
//                       the name strings too
//
//   GetNextIndex=TRUE   return the index of the next object
//                       in this directory in ObjectIndex
//   GetNextIndex=FALSE  return the number of objects in
//                       this directory in ObjectIndex
//
//   IgnoreInputIndex=TRUE  ignore input value of ObjectIndex
//                          always start at index 0
//   IgnoreInputIndex=FALSE use input value of ObjectIndex
//
//   ObjectIndex  zero based index of object in the directory
//                depends on GetNextIndex and IgnoreInputIndex

NTSYSAPI NTSTATUS NTAPI 
  NtQueryDirectoryObject(
    IN HANDLE DirObjHandle,
    OUT POBJDIR_INFORMATION DirObjInformation, 
    IN ULONG                BufferLength, // size of info buffer
    IN BOOLEAN              GetNextIndex, 
    IN BOOLEAN              IgnoreInputIndex, 
    IN OUT PULONG           ObjectIndex,
    OUT PULONG              DataWritten); // can be NULL

// Open a symbolic link object
//   Object Manager symbolic link specific access rights are in
//   NTDDK.H e.g. SYMBOLIC_LINK_QUERY

NTSYSAPI NTSTATUS NTAPI 
  NtOpenSymbolicLinkObject(
    OUT PHANDLE             SymLinkObjHandle,
    IN ACCESS_MASK          DesiredAccess, 
    IN POBJECT_ATTRIBUTES   ObjectAttributes);

// Resolve a sysmbolic link

NTSYSAPI NTSTATUS NTAPI 
  NtQuerySymbolicLinkObject(
    IN HANDLE               SymLinkObjHandle,
    OUT PUNICODE_STRING     LinkName,     // resolved name of link
    OUT PULONG              DataWritten); // can be NULL

// Close a handle (not specific to Object Manager)

NTSYSAPI NTSTATUS NTAPI 
  NtClose(
    IN HANDLE               ObjectHandle);
//End of File