Undocumented functions of NTDLL

2OO1, 11 February



FILE_NETWORK_OPEN_INFORMATION
FILE_NETWORK_OPEN_INFORMATION

typedef struct _FILE_NETWORK_OPEN_INFORMATION {


  LARGE_INTEGER           CreationTime;
  LARGE_INTEGER           LastAccessTime;
  LARGE_INTEGER           LastWriteTime;
  LARGE_INTEGER           ChangeTime;
  LARGE_INTEGER           AllocationSize;
  LARGE_INTEGER           EndOfFile;
  ULONG                   FileAttributes;
  ULONG                   Unknown;


} FILE_NETWORK_OPEN_INFORMATION, *PFILE_NETWORK_OPEN_INFORMATION;



FILE_NETWORK_OPEN_INFORMATION structure is used with two file functions:

1) NtQueryFullAttributesFile,
2) NtQueryInformationFile with FileNetworkOpenInformation information class.


  • CreationTime
    •     Indicates time of file creation.
  • LastAccessTime
    •     Time of last open file.
  • LastWriteTime
    •     Time of last write operation.
  • ChangeTime
    •     Time of any last change.
  • AllocationSize
    •     Number of bytes that file use on storage, equal or greater to EndOfFile.
  • EndOfFile
    •     Length of file, in bytes.
  • FileAttributes
    •     File attributes.
  • Unknown
    •     - ???


    Documented by:
    Tomasz Nowak
    Bo Branten



    Requirements:
    Library: ntdll.lib


    See also:
    FILE_BASIC_INFORMATION
    FILE_INFORMATION_CLASS
    FILE_STANDARD_INFORMATION
    NtCreateFile
    NtOpenFile
    NtQueryAttributesFile
    NtQueryFullAttributesFile
    NtQueryInformationFile
    NtWriteFile