Where does InternetReadFile API save the data it reads?

Question

I am trying to hook the APIs InternetReadFile and InternetWriteFile. InternetReadFile reads data from a handle provided to it (acc. to documentation). Where this data is stored? In memory/RAM?

InternetWriteFile writes data to an open Internet file (acc. to documentation). Does that mean it stores data in disk? In temporary-internet-files folder maybe?

When I call InternetQueryOption function (with option=INTERNET_OPTION_DATAFILE_NAME) in Hook_InternetReadFile it returns a file name in temporary-internet-files folder. Whereas the function fails when called from Hook_InternetWriteFile with error code 12028 (=ERROR_INTERNET_ITEM_NOT_FOUND). Does this mean InternetReadFile writes data to disk?

I am confused. Please help.

Answer 1

If you read the documentation, it tells you that InternetReadFile() writes the received data to the user-provided memory buffer, AND also writes the data to the cache unless caching is explicitly disabled:

InternetReadFile function

To ensure all data is retrieved, an application must continue to call the InternetReadFile function until the function returns TRUE and the lpdwNumberOfBytesRead parameter equals zero. This is especially important if the requested data is written to the cache, because otherwise the cache will not be properly updated and the file downloaded will not be committed to the cache. Note that caching happens automatically unless the original request to open the data stream set the INTERNET_FLAG_NO_CACHE_WRITE flag.

InternetOpenUrl function

INTERNET_FLAG_NO_CACHE_WRITE
Does not add the returned entity to the cache.

Option Flags

INTERNET_OPTION_DATAFILE_NAME
33

Retrieves a string value that contains the name of the file backing a downloaded entity. This flag is valid after InternetOpenUrl, FtpOpenFile, GopherOpenFile, or HttpOpenRequest has completed. This option can only be queried by InternetQueryOption.