How to query file size when APCs are disabled?

Question

During my minifilter's PostCreate, I must use a global push lock to synchronize threads by design, and I must call FltQueryInformationFile to query file size.

However,

1, After I called FltAcquirePushLockExclusive, the APC delivery is disabled;

2, If the APC delivery is disabled, then FltQueryInformationFile will fail because it must be called at PASSIVE_LEVEL and APCs are enabled.

In such a case, how should I query the file size? Does building an IRP help?

Thanks in advance.

Easier would be to call `FltQueryInformationFile` before taking lock, I don't what are user constraints though. — Rohan, Jan 08 '13 at 04:38
Building your own irp is quite hard to get right and wouldnt be recommended. I would agree with @Rohan, Flt functions will also help you deal with the issue of re-entrancy ahead of the old Zw's. — Ironside, Jan 28 '13 at 19:54

score 3 · Answer 1 · answered Jan 19 '15 at 08:37

You can use this to get file size

NTSTATUS
GetFileSize (
    _In_ PFLT_INSTANCE Instance,
    _In_ PFILE_OBJECT FileObject,
    _Out_ PLONGLONG Size
    )
/*++

Routine Description:

    This routine obtains the size.

Arguments:

    Instance - Opaque filter pointer for the caller. This parameter is required and cannot be NULL.

    FileObject - File object pointer for the file. This parameter is required and cannot be NULL.

    Size - Pointer to a LONGLONG indicating the file size. This is the output.

Return Value:

    Returns statuses forwarded from FltQueryInformationFile.

--*/
{
    NTSTATUS status = STATUS_SUCCESS;
    FILE_STANDARD_INFORMATION standardInfo;

    //
    //  Querying for FileStandardInformation gives you the offset of EOF.
    //

    status = FltQueryInformationFile( Instance,
                                      FileObject,
                                      &standardInfo,
                                      sizeof(FILE_STANDARD_INFORMATION),
                                      FileStandardInformation,
                                      NULL );

    if (NT_SUCCESS( status )) {

        *Size = standardInfo.EndOfFile.QuadPart;
    }

    return status;
}

score 0 · Answer 2 · answered Nov 23 '17 at 06:50

0

This question is quite old, but if someone else stumbles upon it (like I did) they might like to know that the function to use in this instance is FsRtlGetFileSize

answered Nov 23 '17 at 06:50

Theodor Kleynhans

253
2
7

How to query file size when APCs are disabled?

2 Answers2