Undocumented functions of NTDLL

2OO1, 14 February

typedef enum _FILE_INFORMATION_CLASS {




    FileDirectoryInformation=1,
    FileFullDirectoryInformation,
    FileBothDirectoryInformation,
    FileBasicInformation,
    FileStandardInformation,
    FileInternalInformation,
    FileEaInformation,
    FileAccessInformation,
    FileNameInformation,
    FileRenameInformation,
    FileLinkInformation,
    FileNamesInformation,
    FileDispositionInformation,
    FilePositionInformation,
    FileFullEaInformation,
    FileModeInformation,
    FileAlignmentInformation,
    FileAllInformation,
    FileAllocationInformation,
    FileEndOfFileInformation,
    FileAlternateNameInformation,
    FileStreamInformation,
    FilePipeInformation,
    FilePipeLocalInformation,
    FilePipeRemoteInformation,
    FileMailslotQueryInformation,
    FileMailslotSetInformation,
    FileCompressionInformation,
    FileCopyOnWriteInformation,
    FileCompletionInformation,
    FileMoveClusterInformation,
    FileQuotaInformation,
    FileReparsePointInformation,
    FileNetworkOpenInformation,
    FileObjectIdInformation,
    FileTrackingInformation,
    FileOleDirectoryInformation,
    FileContentIndexInformation,
    FileInheritContentIndexInformation,
    FileOleInformation,
    FileMaximumInformation


} FILE_INFORMATION_CLASS, *PFILE_INFORMATION_CLASS;

• FileDirectoryInformation=1

• FileFullDirectoryInformation

• FileBothDirectoryInformation

• FileBasicInformation

• FileStandardInformation

• FileInternalInformation

• FileEaInformation

• FileAccessInformation     // 8 FILE_ACCESS_INFORMATION 0x04 NtQueryInformationFile

• FileNameInformation

• FileRenameInformation

• FileLinkInformation

• FileNamesInformation

• FileDispositionInformation

• FilePositionInformation

• FileFullEaInformation     // 15 FILE_FULL_EA_INFORMATION ??? ???

• FileModeInformation     // 16 FILE_MODE_INFORMATION 0x04 0x04 NtQueryInformationFile

• FileAlignmentInformation     // 17 FILE_ALIGNMENT_INFORMATION 0x04 NtQueryInformationFile

• FileAllInformation

• FileAllocationInformation     // 19 FILE_ALLOCATION_INFORMATION 0x08

• FileEndOfFileInformation

• FileAlternateNameInformation

• FileStreamInformation     // 22 FILE_STREAM_INFORMATION 0x20 NtQueryInformationFile

• FilePipeInformation     // 23 FILE_PIPE_INFORMATION 0x08 0x08 NtQueryInformationFile

• FilePipeLocalInformation     // 24 FILE_PIPE_LOCAL_INFORMATION 0x28 NtQueryInformationFile

• FilePipeRemoteInformation     // 25 FILE_PIPE_REMOTE_INFORMATION 0x10 0x10 NtQueryInformationFile

• FileMailslotQueryInformation     // 26 FILE_MAILSLOT_QUERY_INFORMATION 0x18 NtQueryInformationFile

• FileMailslotSetInformation     // 27 FILE_MAILSLOT_SET_INFORMATION 0x04

• FileCompressionInformation     // 28 FILE_COMPRESSION_INFORMATION 0x10 NtQueryInformationFile

• FileCopyOnWriteInformation     // 29 FILE_COPY_ON_WRITE_INFORMATION 0x10

• FileCompletionInformation

• FileMoveClusterInformation     // 31 0x10

• FileQuotaInformation     // 32 FILE_QUOTA_INFORMATION 0x10 -> FileOleClassIdInformation

• FileReparsePointInformation     // 33 0x08 -> FileOleStateBitsInformation

• FileNetworkOpenInformation

• FileObjectIdInformation     // 35 FILE_ATTRIBUTE_TAG_INFORMATION 0x14

• FileTrackingInformation     // 36 0xC0 NtQueryInformationFile -> FileOleAllInformation

• FileOleDirectoryInformation     // 37 0x60 NtQueryDirectoryFile

• FileContentIndexInformation     // 38 0x01

• FileInheritContentIndexInformation     // 39 0x01

• FileOleInformation     // 40 0x38 0x38 NtQueryInformationFile

• FileMaximumInformation     // 41
  
  
  

  Documented by:

  Tomasz Nowak

  Bo Branten

  SysInternals

  
  
  
  

Library: ntdll.lib

NtQueryDirectoryFile

NtQueryInformationFile

NtQueryOleDirectoryFile

NtSetInformationFile