1

I wanted to look at how does the Windows API get the size of a file, so I opened kernel32.dll in a disassembler. I searched for GetFileSizeEx, and it seems to call a stub(?), but the disassembler cannot find the body of that function. Can you shed some light on what am I looking at?

GetFileSizeEx

.text:0000000180024D90 GetFileSizeEx   proc near          
.text:0000000180024D90                                     
.text:0000000180024D90                 jmp     cs:GetFileSizeEx_0
.text:0000000180024D90 GetFileSizeEx   endp

Navigating to GetFileSizeEx_0 looks like this:

.idata:0000000180082078 ; BOOL __stdcall GetFileSizeEx_0(HANDLE hFile, PLARGE_INTEGER lpFileSize)
.idata:0000000180082078                 extrn GetFileSizeEx_0:qword

There is no function body whatsoever. Where can I find the functionality regarding this, or where does it call forward to?

Edit: The idata section seems to be for imports, but it is still uncreal where does it import the GetFileSizeEx_0 function. I have found the library it gets the import from, but the function body is not there.

.rdata:0000000180001A27 GetFileSizeEx   db 'kernel32.GetFileSizeEx',0
.rdata:0000000180001088 off_180001088   rva GetFileSizeEx

What is this RVA part of the rdata section?

I found the actual function body in KernelBase.dll, but I don't understand from the above, how should I have come to this conclusion.

2
  • most of the apis in kernel32.dll are stub to thier implementation in kernelbase.dll
    – blabb
    Feb 15 at 16:17
  • Please don’t edit questions so much as to invalidate answers. Better add new information or ask a new question if it changed completely. Do you see GetFileSizeEx in the Imports list of kernel32.dll?
    – Igor Skochinsky
    Feb 16 at 22:18

1 Answer 1

2

.idata section is similar to ELF's .got and contains pointers to external function, although IDA internally pretends that they're functions. They're normally grouped by a DLL/library from each they're imported.

Normally, if you scroll up from the import pointer, you should see something like

.idata:000000014008F030 ;
.idata:000000014008F030 ; Imports from KERNEL32.dll
.idata:000000014008F030 ;

Alternatively, look for GetFileSizeEx in the Imports view, the Library column should have the same information.

The export entry pointing to a string is a special case called export forwarding. In case of 'kernel32.GetFileSizeEx', it means that the actual implementation is GetFileSizeEx in kernel32.dll (here, the name matches, but it could be different too).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.