NtReadFile - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
#ifndef _NTIOAPI_H
NTSYSCALLAPI
NTSTATUS
NTAPI
NtReadFile(
_In_ HANDLE FileHandle,
_In_opt_ HANDLE Event,
_In_opt_ PIO_APC_ROUTINE ApcRoutine,
_In_opt_ PVOID ApcContext,
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
_Out_writes_bytes_(Length) PVOID Buffer,
_In_ ULONG Length,
_In_opt_ PLARGE_INTEGER ByteOffset,
_In_opt_ PULONG Key
);
View code on GitHub#ifndef _NTZWAPI_H
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwReadFile(
_In_ HANDLE FileHandle,
_In_opt_ HANDLE Event,
_In_opt_ PIO_APC_ROUTINE ApcRoutine,
_In_opt_ PVOID ApcContext,
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
_Out_writes_bytes_(Length) PVOID Buffer,
_In_ ULONG Length,
_In_opt_ PLARGE_INTEGER ByteOffset,
_In_opt_ PULONG Key
);
View code on GitHubThis function is documented in Windows Driver Kit here and here.
(Also described in Win2000 DDK)
HANDLE to File Object opened with FILE_READ_DATA access.
Optional HANDLE to Event Object signaled when reading is done.
User defined APC routine queued for execute after reading is done.
User parameter to ApcRoutine.
Pointer to IO_STATUS structure received IO status of file reading.
User-allocated buffer for read data.
Length of Buffer, in bytes.
Offset from beginning of file, in bytes.
??? (In my opinion: use this, if you previously lock file, and now you want read it, but without unlocking).
ReadFile (Although it does more than just forwarding the arguments and invoking this procedure.)