NtQuerySymbolicLinkObject and ZwQuerySymbolicLinkObject are two versions of the same Windows Native System Services routine. The NtQuerySymbolicLinkObject routine in the Windows kernel is not directly accessible to kernel-mode drivers. However, kernel-mode drivers can access this routine indirectly by calling the ZwQuerySymbolicLinkObject routine. For more information, see ZwQuerySymbolicLinkObject.
For calls from kernel-mode drivers, the NtXxx and ZwXxx versions of a Windows Native System Services routine can behave differently in the way that they handle and interpret input parameters. For more information about the relationship between the NtXxx and ZwXxx versions of a routine, see Using Nt and Zw Versions of the Native System Services Routines.
Build date: 11/16/2013