FltQueryInformationFile - NtDoc

Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers 
// fltkernel.h

NTSTATUS FLTAPI FltQueryInformationFile(
  [in]            PFLT_INSTANCE          Instance,
  [in]            PFILE_OBJECT           FileObject,
  [out]           PVOID                  FileInformation,
  [in]            ULONG                  Length,
  [in]            FILE_INFORMATION_CLASS FileInformationClass,
  [out, optional] PULONG                 LengthReturned
);
View the official Windows Driver Kit DDI reference

NtDoc

No description available.

Edit description on GitHub

Windows Driver Kit DDI reference (nf-fltkernel-fltqueryinformationfile)

FltQueryInformationFile function

Description

FltQueryInformationFile retrieves information for a given file.

Parameters

Instance [in]

Opaque instance pointer for the caller. This parameter is required and cannot be NULL.

FileObject [in]

File object pointer for the file. This parameter is required and cannot be NULL.

FileInformation [out]

Pointer to a caller-allocated buffer that receives information about the file. The FileInformationClass parameter specifies the type of information. This parameter is required and cannot be NULL.

Length [in]

Size, in bytes, of the FileInformation buffer.

FileInformationClass [in]

A FILE_INFORMATION_CLASS value that specifies the type of file information to be returned in the FileInformation buffer.

LengthReturned [out, optional]

Pointer to a caller-allocated variable that receives the size, in bytes, of the information returned in the FileInformation buffer. This parameter is optional and can be NULL.

Return value

FltQueryInformationFile returns STATUS_SUCCESS or an appropriate NTSTATUS value such as the following:

Return code Description
STATUS_VOLUME_DISMOUNTED The file resides on a volume that is not currently mounted. This is an error code.

Remarks

A minifilter driver calls FltQueryInformationFile to retrieve information for the file identified by FileObject. The file must currently be open.

FltQueryInformationFile returns zero in any member of a FILE_XXX_INFORMATION structure that is not supported by a particular file system.

Callers of FltQueryInformationFile must be running at IRQL = PASSIVE_LEVEL and with special kernel APCs enabled.

NOTE: Do not call this routine with a non-NULL top level IRP value, as this can cause a system deadlock.

See also

FILE_INFORMATION_CLASS

FltQueryVolumeInformationFile

FltSetInformationFile

ZwQueryInformationFile

View the official Windows Driver Kit DDI reference

Edit description on GitHub