FltQueryInformationFile function

Download EaseFilter Filter Driver SDK Setup File
Download EaseFilter Filter Driver SDK Zip File

NTSTATUS FLTAPI FltQueryInformationFile(
  PFLT_INSTANCE          Instance,
  PFILE_OBJECT           FileObject,
  PVOID                  FileInformation,
  ULONG                  Length,
  FILE_INFORMATION_CLASS FileInformationClass,
  PULONG                 LengthReturned
);

Parameters

Instance

Opaque instance pointer for the caller. This parameter is required and cannot be NULL.

FileObject

File object pointer for the file. This parameter is required and cannot be NULL.

FileInformation

Pointer to a caller-allocated buffer that receives information about the file. The FileInformationClass parameter specifies the type of information. This parameter is required and cannot be NULL.

Length

Size, in bytes, of the FileInformation buffer.

FileInformationClass

A FILE_INFORMATION_CLASS value that specifies the type of file information to be returned in the FileInformation buffer.

LengthReturned

Pointer to a caller-allocated variable that receives the size, in bytes, of the information returned in the FileInformation buffer. This parameter is optional and can be NULL.

Return value

FltQueryInformationFile returns STATUS_SUCCESS or an appropriate NTSTATUS value such as the following:

Remarks

A minifilter driver calls FltQueryInformationFile to retrieve information for the file identified by FileObject. The file must currently be open.

FltQueryInformationFile returns zero in any member of a FILE_XXX_INFORMATION structure that is not supported by a particular file system.

Callers of FltQueryInformationFile must be running at IRQL = PASSIVE_LEVEL and with APCs enabled.

NOTE: Do not call this routine with a non-NULL top level IRP value, as this can cause a system deadlock.

Requirements