How to get file size in Windows kernel

Question

I need to get file size in Windows kernel. I read the file into a buffer in kernel, while the code is as below. And I dig out a lot.

// read file
//LARGE_INTEGER byteOffset;
ntstatus = ZwCreateFile(&handle,
    GENERIC_READ,
    &objAttr, &ioStatusBlock,
    NULL,
    FILE_ATTRIBUTE_NORMAL,
    0,
    FILE_OPEN,
    FILE_SYNCHRONOUS_IO_NONALERT,
    NULL, 0);

if (NT_SUCCESS(ntstatus)) {
    byteOffset.LowPart = byteOffset.HighPart = 0;
    ntstatus = ZwReadFile(handle, NULL, NULL, NULL, &ioStatusBlock,
        Buffer, (ULONG)BufferLength, &byteOffset, NULL);

    if (NT_SUCCESS(ntstatus)) {
        //Buffer[BufferLength - 1] = '\0';
        //DbgPrint("%s\n", Buffer);
    }
    ZwClose(handle);
}

Someone suggested to use GetFileSize(), but my VS2019 reported below error:

    Severity    Code    Description Project File    Line    Suppression State
Error (active)  E0020   identifier "GetFileSize" is undefined   TabletAudioSample   D:\workspace\4\Windows-driver-samples\audio\sysvad\adapter.cpp  702

If I add the header file:

#include <fileapi.h>

Then I got another error reported:

    Severity    Code    Description Project File    Line    Suppression State
Error (active)  E1696   cannot open source file "fileapi.h" TabletAudioSample   D:\workspace\4\Windows-driver-samples\audio\sysvad\adapter.cpp  24

Thanks!

you need ZwQueryInformationFile or NtQueryInformationFile (depend from previous mode) with FileStandardInformation — RbMm
– RbMm, Commented Jun 22, 2020 at 13:04

Michael Kim · Accepted Answer · 2020-07-14 15:01:04Z

3

GetFileSize is not a WDK function. Use ZwQueryInformationFile instead of GetFileSize.

Use the codes below

    FILE_STANDARD_INFORMATION fileInfo = {0};
    ntStatus = ZwQueryInformationFile(
        handle,
        &ioStatusBlock,
        &fileInfo,
        sizeof(fileInfo),
        FileStandardInformation
        );
    if (NT_SUCCESS(ntstatus)) {
        //. fileInfo.EndOfFile is the file size of handle.
    }

instead of ZwReadFile in your codes. And include <wdm.h>, not a <fileapi.h>.

The is all the same as RbMm commented, And I hope my example codes can help you too.

answered Jul 14, 2020 at 15:01

Michael Kim

3685 silver badges20 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

How to get file size in Windows kernel

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related