-2

I'm using the Windows API function ReadFile() to read system metafiles. But what I'm confused about is how to actually process the data that is returned from that function. I'm assuming that it's stored in the lpBuffer parameter, and that I somehow need to decode the contents of that buffer in order to interpret the actual data.

I'm running Windows 10 and am using C# to make interop calls.

Here's my wrapper:

[DllImport("kernel32", CharSet = CharSet.Auto)]
public static extern bool ReadFile(SafeFileHandle hFile, IntPtr lpBuffer, uint nNumberOfBytesToRead, out uint lpNumberOfBytesRead, ref NativeOverlapped lpOverlapped);

And here's my call:

NativeMethods.ReadFile(_volumeHandle, (IntPtr)buffer, (uint)len, out read, ref overlapped)
//do something with the buffer???

The data contained in the buffer after the call is a pointer to an int - which is what I expected - but where is the actual file data?

Roman R.
  • 68,205
  • 6
  • 94
  • 158
Cade Bryant
  • 737
  • 2
  • 7
  • 19
  • lpbuffer should point to some actual buffer which need to be allocated ... you should change it to `byte[]` and point that `nNumberOfBytesToRead` points to its size – Selvin Jan 14 '19 at 18:39
  • 5
    You have read [the documentation](https://learn.microsoft.com/en-us/windows/desktop/api/fileapi/nf-fileapi-readfile)? – Some programmer dude Jan 14 '19 at 18:39
  • 4
    Why would you not simply use C# facilities to read the file? –  Jan 14 '19 at 18:44
  • @NeilButterworth because I'm trying to read the $SECURE file, which is an NTFS metafile. Trying to open this with C# functions (such as File.ReadAllBytes()) returns an access denied error......even when I'm logged into my machine as an administrator and running my IDE with elevated administrator privileges. – Cade Bryant Jan 14 '19 at 18:52
  • 1
    C++ doesn't have any special privileges that C# doesn't. –  Jan 14 '19 at 18:57

1 Answers1

-2

You need to supply the buffer. See https://learn.microsoft.com/en-us/windows/desktop/api/fileapi/nf-fileapi-readfile

Jay Buckman
  • 581
  • 5
  • 18
  • I'm passing in an initialized buffer to the function call as follows: uint bufferSize = (Environment.OSVersion.Version.Major >= 6 ? 256u : 64u) * 1024; byte[] data = new byte[bufferSize]; fixed (byte* buffer = data) – Cade Bryant Jan 14 '19 at 18:54