Additionally, when debugging custom Windows components, you can insert your own WNF states and query them via NtQueryWnfStateData from a separate process – a lightweight IPC alternative.
In simple terms: if some kernel component published data to a WNF state name, NtQueryWnfStateData retrieves the latest copy. ntquerywnfstatedata ntdlldll better
You need to know the specific (the ID) you want to query. These IDs are often discovered through reverse engineering tools or OS analysis. when debugging custom Windows components
Harnessing NtQueryWnfStateData in ntdll.dll: A Deep Dive into Windows Notification Facilities it carries significant risks: Cons
While using this function can make a program "better" in terms of performance and deep system integration, it carries significant risks: Cons