funcion calls extern function without body

Question

I wanted to look at how does the Windows API get the size of a file, so I opened kernel32.dll in a disassembler. I searched for GetFileSizeEx, and it seems to call a stub(?), but the disassembler cannot find the body of that function. Can you shed some light on what am I looking at?

GetFileSizeEx

.text:0000000180024D90 GetFileSizeEx   proc near          
.text:0000000180024D90                                     
.text:0000000180024D90                 jmp     cs:GetFileSizeEx_0
.text:0000000180024D90 GetFileSizeEx   endp

Navigating to GetFileSizeEx_0 looks like this:

.idata:0000000180082078 ; BOOL __stdcall GetFileSizeEx_0(HANDLE hFile, PLARGE_INTEGER lpFileSize)
.idata:0000000180082078                 extrn GetFileSizeEx_0:qword

There is no function body whatsoever. Where can I find the functionality regarding this, or where does it call forward to?

Edit: The idata section seems to be for imports, but it is still uncreal where does it import the GetFileSizeEx_0 function. I have found the library it gets the import from, but the function body is not there.

.rdata:0000000180001A27 GetFileSizeEx   db 'kernel32.GetFileSizeEx',0
.rdata:0000000180001088 off_180001088   rva GetFileSizeEx

What is this RVA part of the rdata section?

I found the actual function body in KernelBase.dll, but I don't understand from the above, how should I have come to this conclusion.

Answer 1

.idata section is similar to ELF's .got and contains pointers to external function, although IDA internally pretends that they're functions. They're normally grouped by a DLL/library from each they're imported.

Normally, if you scroll up from the import pointer, you should see something like

.idata:000000014008F030 ;
.idata:000000014008F030 ; Imports from KERNEL32.dll
.idata:000000014008F030 ;

Alternatively, look for GetFileSizeEx in the Imports view, the Library column should have the same information.

The export entry pointing to a string is a special case called export forwarding. In case of 'kernel32.GetFileSizeEx', it means that the actual implementation is GetFileSizeEx in kernel32.dll (here, the name matches, but it could be different too).