I wanted to look at how does the Windows API get the size of a file, so I opened kernel32.dll in a disassembler. I searched for GetFileSizeEx, and it seems to call a stub(?), but the disassembler cannot find the body of that function. Can you shed some light on what am I looking at?
.text:0000000180024D90 GetFileSizeEx proc near .text:0000000180024D90 .text:0000000180024D90 jmp cs:GetFileSizeEx_0 .text:0000000180024D90 GetFileSizeEx endp
Navigating to GetFileSizeEx_0 looks like this:
.idata:0000000180082078 ; BOOL __stdcall GetFileSizeEx_0(HANDLE hFile, PLARGE_INTEGER lpFileSize) .idata:0000000180082078 extrn GetFileSizeEx_0:qword
There is no function body whatsoever. Where can I find the functionality regarding this, or where does it call forward to?
Edit: The idata section seems to be for imports, but it is still uncreal where does it import the GetFileSizeEx_0 function. I have found the library it gets the import from, but the function body is not there.
.rdata:0000000180001A27 GetFileSizeEx db 'kernel32.GetFileSizeEx',0 .rdata:0000000180001088 off_180001088 rva GetFileSizeEx
What is this RVA part of the rdata section?
I found the actual function body in KernelBase.dll, but I don't understand from the above, how should I have come to this conclusion.