Question

I’m using NtQueryObject(handle, OBJECT_INFORMATION_CLASS.ObjectTypeInformation, IntPtr.Zero, 0, out length); in my program, but this executes returning length as -8…which is weird; I don’t see how a buffer size can be negative.

Does anyone know why this happens and how I may correct it?

Thanks!

NB:

I imported the NtQueryObject using:

[DllImport("ntdll.dll")]
internal static extern NT_STATUS NtQueryObject(
[In] IntPtr Handle,
[In] OBJECT_INFORMATION_CLASS ObjectInformationClass,
[In] IntPtr ObjectInformation,
[In] int ObjectInformationLength,
[Out] out uint ReturnLength);

Answer 1

I guess I should have changed the out to ref like this.

[DllImport("ntdll.dll")]
public static extern int NtQueryObject(IntPtr ObjectHandle, int ObjectInformationClass, IntPtr ObjectInformation, int ObjectInformationLength, ref int returnLength);

The problems seemed to have been from how I was making the call however. The correct way is:

NtQueryObject(pHandle, (int)ObjectInformationClass.ObjectBasicInformation, pBasic, Marshal.SizeOf(objBasic), ref Length);