The ZwQuerySymbolicLinkObject routine returns a Unicode string containing the target of the symbolic link.
NTSTATUS
ZwQuerySymbolicLinkObject(
IN HANDLE LinkHandle,
IN OUT PUNICODE_STRING LinkTarget,
OUT PULONG ReturnedLength OPTIONAL
);
Declared in ntddk.h. Include ntddk.h.
ZwOpenSymbolicLinkObject returns either STATUS_SUCCESS to indicate the routine completed without error or STATUS_BUFFER_TOO_SMALL if the Unicode string provided at LinkTarget is too small to hold the returned string.
Before calling this routine, driver writers must ensure that the Unicode string at LinkTarget has been properly initialized and a buffer for the string has been allocated. The MaximumLength and Buffer members of the Unicode string must be set before calling ZwQuerySymbolicLinkObject or the call will fail.
If ZwQuerySymbolicLinkObject returns STATUS_BUFFER_TOO_SMALL drivers should examine the value returned at ReturnedLength. The number returned in this variable indicates the maximum length that the Unicode string for the target of the symbolic link.
Callers of this routine must be running at IRQL = PASSIVE_LEVEL.