Hello,
I am having a problem with my filter driver. I am trying to hide certain
directories from being returned by an IRP_MN_QUERY_DIRECTORY request. I am
using a completion routine and I am setting new offests in their
FILE_BOTH_DIR_INFROMATION structures to hide them, skipping over old ones I
dont want. The problem is how do I hide the first entry, or how do I hide
the item if there is only one? Please help! Thanks in advance.
Sincerely,
Chris Whitten
Get your FREE download of MSN Explorer at http://explorer.msn.com
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
Hello Chris,
cW> I am having a problem with my filter driver. I am trying to hide certain
cW> directories from being returned by an IRP_MN_QUERY_DIRECTORY request. I am
cW> using a completion routine and I am setting new offests in their
cW> FILE_BOTH_DIR_INFROMATION structures to hide them, skipping over old ones I
cW> dont want. The problem is how do I hide the first entry, or how do I hide
cW> the item if there is only one? Please help! Thanks in advance.
I think, that You can call zw functions, querying the contents of the
directory from your hooking routine, without sending the IRP down via
CallDriver. When you do this, you can load the necessary directiry
entries to your output buffer.
You can see the undelete sample from sysinternals for some info on
this topic.
–
Best regards,
Andrew mailto:xxxxx@perm.raid.ru
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
cW> I am having a problem with my filter driver. I am trying to hide certain
cW> directories from being returned by an IRP_MN_QUERY_DIRECTORY request. I am
cW> using a completion routine and I am setting new offests in their
cW> FILE_BOTH_DIR_INFROMATION structures to hide them, skipping over old ones I
cW> dont want. The problem is how do I hide the first entry, or how do I hide
cW> the item if there is only one? Please help! Thanks in advance.
I think, that You can call zw functions, querying the contents of the
directory from your hooking routine, without sending the IRP down via
CallDriver. When you do this, you can load the necessary directiry
entries to your output buffer.
You can see the undelete sample from sysinternals for some info on
this topic.-
Best regards,
Andrew mailto:xxxxx@perm.raid.ru
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com