We help IT Professionals succeed at work.

We've partnered with Certified Experts, Carl Webster and Richard Faulkner, to bring you a podcast all about Citrix Workspace, moving to the cloud, and analytics & intelligence. Episode 2 coming soon!Listen Now


FindFirstFile in kernel-mode?

vinniew asked
Medium Priority
Last Modified: 2013-12-03
I just want to do something like a findfirstfile in kernel-mode so that I can get a directory listing using wildcards.  Is there a function already there that I can use to do this?  I looked through the ntddk.h but I couldn't find anything.  A quick snip of source code would be great.  I'm using NT 4.0
Watch Question


P.S. If my driver works, I'll let you try it out.  It's just going to be a command completion driver that will work throughout the system on any input box, windows or dos boxes alike.  That means that you press a key, say the capslock, and you get the filename filled in for you.
Well, you could use the function AX = 714Eh of the interruption 21h (FindFirst) and the function AX = 714Fh (FindNext).
It works with the long filename.

I can give you more detail on that if you want.

Another way could be to use the function FindFirstFile, which prototype look like this:
HANDLE FindFirstFile(LPCTSTR lpFileName,
      // pointer to name of file to search for  
    LPWIN32_FIND_DATA lpFindFileData
       // pointer to returned information

with FindNextFile. They are both define in the win32 API and are compatible with NT.

Hope this help,


Not the solution you were looking for? Getting a personalized solution is easy.

Ask the Experts


Okay, let me see if I understand you.  

If I just include the FindFirstFile prototype in my single .c file that I'm using, the operating system will know what to do to find that function when it starts?  Since this is kernel-mode, I won't need to include .libs or anything?

I'm new at this...



I tried to use the FindFirstFile function in my device driver, but the compiler said no way.  Are you sure you can use that win32 function in a device driver?



Well if I don't know if you can use the findfirstfile function provide by windows in the kernel-mode, but I don't think it will matter. In fact, its the kernel itself who defines it so it should work.
However, if it doesn't, you can still use the interrupt function which will do the same job.

Hope this help,


BTW:the import library is kernel32.lib and the header file is winbase.h.
Access more of Experts Exchange with a free account
Thanks for using Experts Exchange.

Create a free account to continue.

Limited access with a free account allows you to:

  • View three pieces of content (articles, solutions, posts, and videos)
  • Ask the experts questions (counted toward content limit)
  • Customize your dashboard and profile

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.


Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.