Before diving into NtQueryWnfStateData , you must understand WNF.
int main() HMODULE hNtdll = GetModuleHandleA("ntdll.dll"); pNtOpenWnfState NtOpenWnfState = (pNtOpenWnfState)GetProcAddress(hNtdll, "NtOpenWnfState"); pNtQueryWnfStateData NtQueryWnfStateData = (pNtQueryWnfStateData)GetProcAddress(hNtdll, "NtQueryWnfStateData");
NTSTATUS NtQueryWnfStateData( HANDLE StateHandle, // Handle to WNF state PCWNF_TYPE_ID TypeId, // Type ID (like a GUID) PCWNF_CHANGE_STAMP ChangeStamp, // Optional version check PVOID Buffer, // Output buffer ULONG BufferSize, // Size PULONG ReturnLength // Actual bytes written );