Edit

FsRtlQueryInformationFile function (ntifs.h)

  • Article

FsRtlQueryInformationFile builds an explicit file query information IRP (IRP_MJ_QUERY_INFORMATION), sends it down the stack, synchronously waits for it to complete, and returns the result. This function allows the caller to complete this action by FileObject instead of handle.

Syntax

NTSTATUS FsRtlQueryInformationFile(
  [in]  PFILE_OBJECT           FileObject,
  [out] PVOID                  FileInformation,
  [in]  ULONG                  Length,
  [in]  FILE_INFORMATION_CLASS FileInformationClass,
  [out] PULONG                 RetFileInformationSize
);

Parameters

[in] FileObject

Pointer to the FILE_OBJECT to send the operation on.

[out] FileInformation

Pointer to a caller-allocated buffer to receive the queried file information.

[in] Length

Size in bytes of the buffer that FileInformation points to.

[in] FileInformationClass

A FILE_INFORMATION_CLASS value that specifies the type of file information being queried.

[out] RetFileInformationSize

Receives the number of bytes written (returned) into the buffer that FileInformation points to.

Return value

FsRtlKernelFsControlFile returns STATUS_SUCCESS or an appropriate NTSTATUS value such as one of the following.

Value Meaning
STATUS_INSUFFICIENT_RESOURCES A pool allocation failure occurred.
STATUS_INVALID_PARAMETER An invalid parameter was provided (for example, an invalid FileObject).

Remarks

This routine assumes all passed in buffers are kernel mode buffers.

Requirements

Requirement Value
Header ntifs.h

See also

ZwQueryInformationFile