Path: news.mitre.org!blanket.mitre.org!nntprelay.mathworks.com!news.maxwell.syr.edu!demos!news1.relcom.ru!news.nsk.su!tsiren!news.itfs.nsk.su!sky.inp.nsk.su!not-for-mail
From: Slava Monich <monich@ftp.com>
Newsgroups: comp.os.ms-windows.programmer.nt.kernel-mode
Subject: Re: NtOpenSymbolicLinkObject et al.
Date: Mon, 26 Jan 1998 15:26:25 -0500
Organization: FTP Software, Inc.
Lines: 38
Message-ID: <34CCF171.5A69A346@ftp.com>
References: <6a7a2s$25d@deun23.corp.newmont.com>
NNTP-Posting-Host: sky.inp.nsk.su
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Mailer: Mozilla 4.03 [en] (WinNT; U)
To: Klaus Gerlicher <klauspg@diamondmm.com>

Klaus Gerlicher wrote:
> 
> Does anybody have information about NT4.0 undocumented functions 
> like NtOpenSymbolicLinkObject. 

I'm sure they existed long before NT 4.0

> The only thing I now about this one is that it takes three params.

Many NtOpen* (or ZwOpen* for that matter) functions in NT take 
the same three parameters:

NTSYSAPI
NTSTATUS
NTAPI
ZwOpen*Something*(
    OUT PHANDLE Handle,
    IN ACCESS_MASK DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes );

(see ZwOpenSection, ZwOpenKey in NTDDK.H) and 
Zw/NtOpenSymbolicLinkObject seems to be one of those 
(at least it works for me this way). 
Another function you may find useful is

NTSYSAPI
NTSTATUS
NTAPI
NtQuerySymbolicLinkObject(
    HANDLE Handle,      /* from NtOpenSymbolicLinkObject */
    PUNICODE_STRING TargetName,    /* target device name */
    PULONG Length);     /* required length ? can be NULL */

returns the name of the device the link is pointing to. 
that's pretty much all I know about the subject.

Good luck,
-Slava