about IRP_MN_QUERY_DIRECTORY

NTFSD
1

hi,
when the IRP_MN_QUERY_DIRECTORY irp comes,the query length is more than
total entrys’ length

e.g.
when FileInformationClass is FileBothDirectoryInformation,
the length(IrpSp->Parameters.QueryDirectory.Length) is 0x268,
but all the entrys’(include .and …)size is less than 0x268 may be 0x250,why??

the method i caculate the entrys’ size is that:

add all entrys’ nextentryoffset together and add the last one entry’s
size,is there something wrong?

i try to hide some of entry,it seems works well but
when the entry is the last one and the total entry
is more than all entrys’ size,it can not hide.

why??

thank you

ildee

2

There is nothing wrong with the file system.
IrpSp->Parameters.QueryDirectory.Length represents the
length of the input buffer. The file system will
return as many entries as it can fit into the input
buffer. The returned entries do not have a fixed size.
You might be thinking all entries have the same size
(thus your confusion), but they in fact don’t. That’s
why the returned length (the total entries length you
compute) is less than or equal with the input buffer’s
size.

Check you filtering algorithm as it is wrong. Also
check the IFS FAQ and the list archive as this topic
has been discussed before.

Best regards,
Razvan

— ildee263 wrote:

> hi,
> when the IRP_MN_QUERY_DIRECTORY irp comes,the query
> length is more than
> total entrys’ length
>
> e.g.
> when FileInformationClass is
> FileBothDirectoryInformation,
> the length(IrpSp->Parameters.QueryDirectory.Length)
> is 0x268,
> but all the entrys’(include .and …)size is less
> than 0x268 may be 0x250,why??
>
> the method i caculate the entrys’ size is that:
>
> add all entrys’ nextentryoffset together and add the
> last one entry’s
> size,is there something wrong?
>
> i try to hide some of entry,it seems works well but
> when the entry is the last one and the total entry
> is more than all entrys’ size,it can not hide.
>
> why??
>
> thank you
>
> ildee

__________________________________
Do you Yahoo!?
All your favorites on one personal page – Try My Yahoo!
http://my.yahoo.com

3

Razvan,
But of course,the entry’s size is not the same because the file name length,
so i calc the entry size as sizeof(FILE_BOTH_DIR_INFORMATION) + XXX->FileNameLength - 2.
the 2 bytes i decreased is the size of WCHAR FileName[1].
is there anything wrong??

thanks in advance
ildee
----- Original Message -----
From: “Razvan Hobeanu”
To: “Windows File Systems Devs Interest List”
Sent: Saturday, December 04, 2004 12:34 AM
Subject: Re: [ntfsd] about IRP_MN_QUERY_DIRECTORY

> There is nothing wrong with the file system.
> IrpSp->Parameters.QueryDirectory.Length represents the
> length of the input buffer. The file system will
> return as many entries as it can fit into the input
> buffer. The returned entries do not have a fixed size.
> You might be thinking all entries have the same size
> (thus your confusion), but they in fact don’t. That’s
> why the returned length (the total entries length you
> compute) is less than or equal with the input buffer’s
> size.
>
> Check you filtering algorithm as it is wrong. Also
> check the IFS FAQ and the list archive as this topic
> has been discussed before.
>
> Best regards,
> Razvan
>
> — ildee263 wrote:
>
> > hi,
> > when the IRP_MN_QUERY_DIRECTORY irp comes,the query
> > length is more than
> > total entrys’ length
> >
> > e.g.
> > when FileInformationClass is
> > FileBothDirectoryInformation,
> > the length(IrpSp->Parameters.QueryDirectory.Length)
> > is 0x268,
> > but all the entrys’(include .and …)size is less
> > than 0x268 may be 0x250,why??
> >
> > the method i caculate the entrys’ size is that:
> >
> > add all entrys’ nextentryoffset together and add the
> > last one entry’s
> > size,is there something wrong?
> >
> > i try to hide some of entry,it seems works well but
> > when the entry is the last one and the total entry
> > is more than all entrys’ size,it can not hide.
> >
> > why??
> >
> > thank you
> >
> > ildee
>
>
>
>
> __________________________________
> Do you Yahoo!?
> All your favorites on one personal page - Try My Yahoo!
> http://my.yahoo.com
>
> —
> Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: ildee@263.net
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

4

When ever you post questions it is very helpful if you will identify the
version of the OS you are working with (including service pack) and the
file system you are seeing problems with.

There is a known issue with the FAT file system no returning the correct
length based on the data. I don’t remember exactly which OS released
the fix but I believe it was fixed in XP SP1 and later.

Neal Christiansen
Microsoft File System Filter Group Lead
This posting is provided “AS IS” with no warranties, and confers no
rights

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of ildee263
Sent: Sunday, December 05, 2004 5:38 PM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] about IRP_MN_QUERY_DIRECTORY

Razvan,
But of course,the entry’s size is not the same because the file name
length,
so i calc the entry size as sizeof(FILE_BOTH_DIR_INFORMATION) +
XXX->FileNameLength - 2.
the 2 bytes i decreased is the size of WCHAR FileName[1].
is there anything wrong??

thanks in advance
ildee
----- Original Message -----
From: “Razvan Hobeanu”
To: “Windows File Systems Devs Interest List”
Sent: Saturday, December 04, 2004 12:34 AM
Subject: Re: [ntfsd] about IRP_MN_QUERY_DIRECTORY

> There is nothing wrong with the file system.
> IrpSp->Parameters.QueryDirectory.Length represents the
> length of the input buffer. The file system will
> return as many entries as it can fit into the input
> buffer. The returned entries do not have a fixed size.
> You might be thinking all entries have the same size
> (thus your confusion), but they in fact don’t. That’s
> why the returned length (the total entries length you
> compute) is less than or equal with the input buffer’s
> size.
>
> Check you filtering algorithm as it is wrong. Also
> check the IFS FAQ and the list archive as this topic
> has been discussed before.
>
> Best regards,
> Razvan
>
> — ildee263 wrote:
>
> > hi,
> > when the IRP_MN_QUERY_DIRECTORY irp comes,the query
> > length is more than
> > total entrys’ length
> >
> > e.g.
> > when FileInformationClass is
> > FileBothDirectoryInformation,
> > the length(IrpSp->Parameters.QueryDirectory.Length)
> > is 0x268,
> > but all the entrys’(include .and …)size is less
> > than 0x268 may be 0x250,why??
> >
> > the method i caculate the entrys’ size is that:
> >
> > add all entrys’ nextentryoffset together and add the
> > last one entry’s
> > size,is there something wrong?
> >
> > i try to hide some of entry,it seems works well but
> > when the entry is the last one and the total entry
> > is more than all entrys’ size,it can not hide.
> >
> > why??
> >
> > thank you
> >
> > ildee
>
>
>
>
> __________________________________
> Do you Yahoo!?
> All your favorites on one personal page - Try My Yahoo!
> http://my.yahoo.com
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: ildee@263.net
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to $subst(‘List.Name’) as:
$subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to $subst(‘Email.UnSub’)