0

I was testing NtReadFile() function on my Win7 against NTFS volume and noticed that in following code (handle was opened with FILE_SYNCHRONOUS_IO_NONALERT flag):

IO_STATUS_BLOCK io;
NTSTATUS r = NtReadFile(h, NULL, NULL, NULL, &io, buf, buf_size, &pos, NULL);

io.Information (which supposed to contain number of bytes received) gets populated only if r == STATUS_SUCCESS. If r == STATUS_END_OF_FILE io.Information contains original garbage and (it seems) no data was read in that call.

So, can I assume if r == STATUS_SUCCESS and io.Information < buf_size -- we've reached end of file? Or should I keep calling NtReadFile until it returns STATUS_END_OF_FILE? (i.e. short read is possible).

On one hand Microsoft claims short reads aren't possible:

NtReadFile ... terminates the read operation under one of the following conditions:

  • The buffer is full because the number of bytes specified by the Length parameter has been read. Therefore, no more data can be placed into the buffer without an overflow.
  • The end of file is reached during the read operation, so there is no more data in the file to be transferred into the buffer.

... and I would like to avoid unnecessary NtReadFile call. On the other hand, my experience suggests to never trust Microsoft 100%.

C.M.
  • 3,071
  • 1
  • 14
  • 33
  • yes, if `io.Information < buf_size` end of file is reached during the read operation. and how you already noted - `IO_STATUS_BLOCK` is filled only if `!NT_ERROR(status)` returned – RbMm Jun 17 '20 at 20:48
  • @RbMm Are you saying "short read" (reading less that requested and yet not reaching eof) is not possible? – C.M. Jun 17 '20 at 20:50
  • it possible only if eof reached – RbMm Jun 17 '20 at 20:51
  • your quote from documentation is correct and already answer on your question – RbMm Jun 17 '20 at 20:53
  • @RbMm Thank you. Unfortunately this means if my file is 1kb and `buf_size == 1kb` -- I'll end up with two `NtReadFile` calls... :-\ – C.M. Jun 17 '20 at 21:00
  • you can at begin query file size for example for know exactly how many read. also possibility that you random read exactly until eof also low. not understand in what problem – RbMm Jun 17 '20 at 22:13
  • it isn't a big problem -- just a nuisance – C.M. Jun 17 '20 at 22:17

0 Answers0