hi, everyone
i have some questions about hide file in file system filter driver. i
find the method form ntfsd website. set the IoSetCompletionRoutine in the
dispatch function. and deal with the return data.
so I modify the filemon.c to achieve my purpose. as following:
NTSTATUS FilemonHookRoutine() {
…
*nextIrpStack = *currentIrpStack;
…
IoSetCompletionRoutine( Irp, FilemonHookDone, (PVOID)seqNum, TRUE,
TRUE,
TRUE);
return IoCallDriver(hookExt->FileSystem, Irp);
}
NTSTATUS FilemonHookDone() {
…
currentIrpStack = IoGetCurrentIrpStackLocation(Irp);
if( FilterOn ) {
…
}
if(Irp->PendingReturn) {
IoMarkIrpPending(Irp)
}
<---------------------------I add my code here for my purpose, only handle IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY IRP
return Irp->IoStatus.Status;
}
i can receive IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY IRP,but the
value of IrpSp->Parameters.QueryDirectory.FileInformationClass is a very
big interger not the FileBothDirectoryInformation that I want.
why does this problem occurs?
think you for your reply!