CreateFile in kernel32.dll has some additional overhead compared to the syscall NtCreateFile in ntdll.dll . This is a real function that calls CreateFile to ask the kernel to open the file. If you need to open a large number of files, NtOpenFile will be more efficient, avoiding special cases and transforming the path that Win32 has - things that in any case will not apply to a bunch of files in a directory.
NTSYSAPI NTSTATUS NTAPI NtOpenFile(OUT HANDLE *FileHandle, IN ACCESS_MASK DesiredAccess, IN OBJECT_ATTRIBUTES *ObjectAttributes, OUT IO_STATUS_BLOCK *IoStatusBlock, IN ULONG ShareAccess, IN ULONG OpenOptions); HANDLE Handle; OBJECT_ATTRIBUTES Oa = {0}; UNICODE_STRING Name_U; IO_STATUS_BLOCK IoSb; RtlInitUnicodeString(&Name_U, Name); Oa.Length = sizeof Oa; Oa.ObjectName = &Name_U; Oa.Attributes = CaseInsensitive ? OBJ_CASE_INSENSITIVE : 0; Oa.RootDirectory = ParentDirectoryHandle; Status = NtOpenFile(&Handle, FILE_READ_DATA, &Oa, &IoSb, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, FILE_SEQUENTIAL_ONLY);
Main disadvantage: this API is not supported by Microsoft for use in user mode. However, the equivalent function is documented to use kernel mode and has not changed since the first version of Windows NT in 1993.
NtOpenFile also allows you to open a file relative to an existing directory descriptor (ParentDirectoryHandle in the example), which should reduce some of the file system overhead when searching for a directory.
After all, NTFS can be too slow when processing directories with lots of files, as Carey Gregory said.
source share