CODEWITHSUNDEEP
winapifile-io
BitParser
BitParser

Reputation: 3968

Does CreateFileMappingA write to file?

I was debugging some WinAPI application.
Right before the call to the function CreateFileMappingA the file's size was 0Kb. Immediately after the call to the function, the file got around 200Kb. I tried browsing the online Windows API documentation but didn't find anything (or not understand perhaps) whether a file write would occur after the function call. The flProtect parameter's value was PAGE_READWRITE.
I'd really like to know what the function really does, and especially why this write to the file.

Upvotes: 0

Views: 1766

Answers (1)

BitParser
BitParser

Reputation: 3968

After some research, I found out that the function CreateFileMappingA was being called like this:
CreateFileMappingA(fh, NULL, PAGE_READWRITE, 0, 0x336BC, "kll");
According to the documentation, if the file size would be lower than the length the mapping targets, the file would be extended to fit the size.
So in my case, the file was just created.

fh = CreateFileA("file2.dat", GENERIC_READ | GENERIC_WRITE, FILE_SHARE_WRITE,
        NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);


So first, the file "file2.dat" would be created with write privileges. It would be 0Kb. Then, right after the call above to CreateFileMappingA, the file size would be 0x336BC bytes, or 206Kb.

Upvotes: 1

Related Questions