Getting Parent Directory

Hello,

I want to Find the parent Directory of
IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY call.

I want to remove particular directory entries from the listing. Say I want
to remover bar.txt if bar.txt resides in Foo directory.

So full path is c:\foo\bar.txt , then if the directory path is c:\foo I
want to remove bar.txt from it.

So In the dir_ctl call, how do I assertain if directory is indeed c:\foo ???

thanks in avdance

Albert

FltGetFileNameInformation should do it. You may want to the path in a
context structure so you don’t need to look it up everytime.

Don Burn
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

“A P” wrote in message news:xxxxx@ntfsd:

> Hello,
>
> I want to Find the parent Directory of
> IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY call.
>
> I want to remove particular directory entries from the listing. Say I want
> to remover bar.txt if bar.txt resides in Foo directory.
>
> So full path is c:\foo\bar.txt , then if the directory path is c:\foo I
> want to remove bar.txt from it.
>
> So In the dir_ctl call, how do I assertain if directory is indeed c:\foo ???
>
>
> thanks in avdance
>
> Albert

hi Don,

I don’t know if I understand your answer correctly, please apologise my
incompetence with english.

you want me to cache the name so that i dont want to look it up everytime?
but that I will do in Pre/postcreate.

my qn is in dir_ctl, the mn_query_dir comes for a particular directory,
where the FSW sends a list of files to who ever erquested it, but the same
name of the file can be for several directories, how do i identify whether
it is the right directory listing where I am removing my file from?

e.g if i want to remove bar.txt, this file name might be in c:\foo and
c:\abcd\def. now i do i identify that i need to remove it freom C:\foo only
and not c:\abcd\def also…

On Mon, May 27, 2013 at 8:00 PM, Don Burn wrote:

> FltGetFileNameInformation should do it. You may want to the path in a
> context structure so you don’t need to look it up everytime.
>
>
> Don Burn
> Windows Filesystem and Driver Consulting
> Website: http://www.windrvr.com
> Blog: http://msmvps.com/blogs/ WinDrvr http:
>
>
>
> “A P” wrote in message news:xxxxx@ntfsd:
>
>
> Hello,
>>
>> I want to Find the parent Directory of
>> IRP_MJ_DIRECTORY_CONTROL/IRP_
MN_QUERY_DIRECTORY call.
>>
>> I want to remove particular directory entries from the listing. Say I want
>> to remover bar.txt if bar.txt resides in Foo directory.
>>
>> So full path is c:\foo\bar.txt , then if the directory path is c:\foo I
>> want to remove bar.txt from it.
>>
>> So In the dir_ctl call, how do I assertain if directory is indeed c:\foo
>> ???
>>
>>
>> thanks in avdance
>>
>> Albert
>>
>
>
> —
> NTFSD is sponsored by OSR
>
> OSR is hiring!! Info at http://www.osr.com/careers
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.**cfm?name=ListServerhttp:
></http:></http:>

Per Don’s email, you have two choices. You can call
FltGetFileNameInformation() in the pre-dir_control request to get the
parent name and make a determination that way. Or you can create a
stream context in the post-create handler and cache the name in the
context. Then in the pre-dir_control request query the context and get
the name.

Then in post-dir_control parse the returned buffer and remove the
information you want to remove.

Pete

On 5/27/2013 12:57 PM, A P wrote:

hi Don,

I don’t know if I understand your answer correctly, please apologise my
incompetence with english.

you want me to cache the name so that i dont want to look it up
everytime? but that I will do in Pre/postcreate.

my qn is in dir_ctl, the mn_query_dir comes for a particular directory,
where the FSW sends a list of files to who ever erquested it, but the
same name of the file can be for several directories, how do i identify
whether it is the right directory listing where I am removing my file from?

e.g if i want to remove bar.txt, this file name might be in c:\foo and
c:\abcd\def. now i do i identify that i need to remove it freom C:\foo
only and not c:\abcd\def also…

On Mon, May 27, 2013 at 8:00 PM, Don Burn > mailto:xxxxx> wrote:
>
> FltGetFileNameInformation should do it. You may want to the path in
> a context structure so you don’t need to look it up everytime.
>
>
> Don Burn
> Windows Filesystem and Driver Consulting
> Website: http://www.windrvr.com
> Blog: http://msmvps.com/blogs/ WinDrvr
> http:
>
>
>
> “A P” > wrote
> in message news:xxxxx@ntfsd:
>
>
> Hello,
>
> I want to Find the parent Directory of
> IRP_MJ_DIRECTORY_CONTROL/IRP
_ MN_QUERY_DIRECTORY call.
>
> I want to remove particular directory entries from the listing.
> Say I want
> to remover bar.txt if bar.txt resides in Foo directory.
>
> So full path is c:\foo\bar.txt , then if the directory path is
> c:\foo I
> want to remove bar.txt from it.
>
> So In the dir_ctl call, how do I assertain if directory is
> indeed c:\foo ???
>
>
> thanks in avdance
>
> Albert
>
>
>
> —
> NTFSD is sponsored by OSR
>
> OSR is hiring!! Info at http://www.osr.com/careers
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.__cfm?name=ListServer
> http:
>
>
> — NTFSD is sponsored by OSR OSR is hiring!! Info at
> http://www.osr.com/careers For our schedule of debugging and file system
> seminars visit: http://www.osr.com/seminars To unsubscribe, visit the
> List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer


Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295</http:></http:></mailto:xxxxx>

Don, Peter,

Thank you for your replies and the explainations. I apologise for delay in
response, but I wanted to try out the suggestions to really see if I
understood properly. yes it works, thank you once again.

Just one final qn on this topic:

Does a query_directory also get preceeded by a create on that directory? or
is it possible to query contents without create operation?

On Tue, May 28, 2013 at 7:25 PM, Pete Scott wrote:

>
> Per Don’s email, you have two choices. You can call
> FltGetFileNameInformation() in the pre-dir_control request to get the
> parent name and make a determination that way. Or you can create a stream
> context in the post-create handler and cache the name in the context. Then
> in the pre-dir_control request query the context and get the name.
>
> Then in post-dir_control parse the returned buffer and remove the
> information you want to remove.
>
> Pete
>
>
> On 5/27/2013 12:57 PM, A P wrote:
>
>> hi Don,
>>
>> I don’t know if I understand your answer correctly, please apologise my
>> incompetence with english.
>>
>>
>> you want me to cache the name so that i dont want to look it up
>> everytime? but that I will do in Pre/postcreate.
>>
>> my qn is in dir_ctl, the mn_query_dir comes for a particular directory,
>> where the FSW sends a list of files to who ever erquested it, but the
>> same name of the file can be for several directories, how do i identify
>> whether it is the right directory listing where I am removing my file
>> from?
>>
>> e.g if i want to remove bar.txt, this file name might be in c:\foo and
>> c:\abcd\def. now i do i identify that i need to remove it freom C:\foo
>> only and not c:\abcd\def also…
>>
>>
>>
>> On Mon, May 27, 2013 at 8:00 PM, Don Burn >> mailto:xxxxx> wrote:
>>
>> FltGetFileNameInformation should do it. You may want to the path in
>> a context structure so you don’t need to look it up everytime.
>>
>>
>> Don Burn
>> Windows Filesystem and Driver Consulting
>> Website: http://www.windrvr.com
>> Blog: http://msmvps.com/blogs/ **WinDrvrhttp:
>> http:>
>>
>>
>>
>> “A P” >
>> wrote
>>
>> in message news:xxxxx@ntfsd:
>>
>>
>> Hello,
>>
>> I want to Find the parent Directory of
>> IRP_MJ_DIRECTORY_CONTROL/IRP
** _MN_QUERY_DIRECTORY call.
>>
>>
>> I want to remove particular directory entries from the listing.
>> Say I want
>> to remover bar.txt if bar.txt resides in Foo directory.
>>
>> So full path is c:\foo\bar.txt , then if the directory path is
>> c:\foo I
>> want to remove bar.txt from it.
>>
>> So In the dir_ctl call, how do I assertain if directory is
>> indeed c:\foo ???
>>
>>
>> thanks in avdance
>>
>> Albert
>>
>>
>>
>> —
>> NTFSD is sponsored by OSR
>>
>> OSR is hiring!! Info at http://www.osr.com/careers
>>
>> For our schedule of debugging and file system seminars visit:
>> http://www.osr.com/seminars
>>
>> To unsubscribe, visit the List Server section of OSR Online at
>> http://www.osronline.com/page. __cfm?name=ListServerhttp:
>> http:
>> >
>>
>>
>>
>> — NTFSD is sponsored by OSR OSR is hiring!! Info at
>> http://www.osr.com/careers For our schedule of debugging and file system
>> seminars visit: http://www.osr.com/seminars To unsubscribe, visit the
>> List Server section of OSR Online at
>> http://www.osronline.com/page.
cfm?name=ListServerhttp:
>>
>
> –
> Kernel Drivers
> Windows File System and Device Driver Consulting
> www.KernelDrivers.com
> 866.263.9295
>
>
> —
> NTFSD is sponsored by OSR
>
> OSR is hiring!! Info at http://www.osr.com/careers
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.**cfm?name=ListServerhttp:
></http:></http:></http:></http:></http:></http:></mailto:xxxxx>

If you are asking whether the target of the directory query must always
be opened prior to a query then yes, you will always see an open on the
directory prior to a query directory call.

Pete

On 5/30/2013 6:53 AM, A P wrote:

Don, Peter,

Thank you for your replies and the explainations. I apologise for delay
in response, but I wanted to try out the suggestions to really see if I
understood properly. yes it works, thank you once again.

Just one final qn on this topic:

Does a query_directory also get preceeded by a create on that directory?
or is it possible to query contents without create operation?

On Tue, May 28, 2013 at 7:25 PM, Pete Scott > mailto:xxxxx> wrote:
>
>
> Per Don’s email, you have two choices. You can call
> FltGetFileNameInformation() in the pre-dir_control request to get
> the parent name and make a determination that way. Or you can create
> a stream context in the post-create handler and cache the name in
> the context. Then in the pre-dir_control request query the context
> and get the name.
>
> Then in post-dir_control parse the returned buffer and remove the
> information you want to remove.
>
> Pete
>
>
> On 5/27/2013 12:57 PM, A P wrote:
>
> hi Don,
>
> I don’t know if I understand your answer correctly, please
> apologise my
> incompetence with english.
>
>
> you want me to cache the name so that i dont want to look it up
> everytime? but that I will do in Pre/postcreate.
>
> my qn is in dir_ctl, the mn_query_dir comes for a particular
> directory,
> where the FSW sends a list of files to who ever erquested it,
> but the
> same name of the file can be for several directories, how do i
> identify
> whether it is the right directory listing where I am removing my
> file from?
>
> e.g if i want to remove bar.txt, this file name might be in
> c:\foo and
> c:\abcd\def. now i do i identify that i need to remove it freom
> C:\foo
> only and not c:\abcd\def also…
>
>
>
> On Mon, May 27, 2013 at 8:00 PM, Don Burn > mailto:xxxxx
> mailto:xxxxx>> wrote:
>
> FltGetFileNameInformation should do it. You may want to
> the path in
> a context structure so you don’t need to look it up everytime.
>
>
> Don Burn
> Windows Filesystem and Driver Consulting
> Website: http://www.windrvr.com
> Blog: http://msmvps.com/blogs/ __WinDrvr
> http:
> http:> http:>
>
>
>
> “A P” > mailto:xxxxx mailto:xxxxx> mailto:xxxxx
>> wrote
>
> in message news:xxxxx@ntfsd:
>
>
> Hello,
>
> I want to Find the parent Directory of
> IRP_MJ_DIRECTORY_CONTROL/IRP _____MN_QUERY_DIRECTORY call.
>
>
> I want to remove particular directory entries from the
> listing.
> Say I want
> to remover bar.txt if bar.txt resides in Foo directory.
>
> So full path is c:\foo\bar.txt , then if the directory
> path is
> c:\foo I
> want to remove bar.txt from it.
>
> So In the dir_ctl call, how do I assertain if directory is
> indeed c:\foo ???
>
>
> thanks in avdance
>
> Albert
>
>
>
> —
> NTFSD is sponsored by OSR
>
> OSR is hiring!! Info at http://www.osr.com/careers
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.____ cfm?name=ListServer
> http:
> http:> http:>
>
>
>
> — NTFSD is sponsored by OSR OSR is hiring!! Info at
> http://www.osr.com/careers For our schedule of debugging and
> file system
> seminars visit: http://www.osr.com/seminars To unsubscribe,
> visit the
> List Server section of OSR Online at
> http://www.osronline.com/page. __cfm?name=ListServer
> http:
>
>
> –
> Kernel Drivers
> Windows File System and Device Driver Consulting
> www.KernelDrivers.com http:
> 866.263.9295 tel:866.263.9295
>
>
> —
> NTFSD is sponsored by OSR
>
> OSR is hiring!! Info at http://www.osr.com/careers
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.__ cfm?name=ListServer
> http:
>
>
> — NTFSD is sponsored by OSR OSR is hiring!! Info at
> http://www.osr.com/careers For our schedule of debugging and file system
> seminars visit: http://www.osr.com/seminars To unsubscribe, visit the
> List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer


Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295</http:></tel:866.263.9295></http:></http:></http:></http:></http:></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx></http:></http:></http:></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx>

yes i was asking that. this is because as you suggested i created context
in post create if directory open suceeded and then in post op for query_dir
used that context to identify the directory was of my interest.

without a corresponding create on the directory every time, the logic wud
fail.

thank you for the help.

al

On Thu, May 30, 2013 at 7:50 PM, Peter Scott wrote:

>
> If you are asking whether the target of the directory query must always be
> opened prior to a query then yes, you will always see an open on the
> directory prior to a query directory call.
>
> Pete
>
>
> On 5/30/2013 6:53 AM, A P wrote:
>
>> Don, Peter,
>>
>> Thank you for your replies and the explainations. I apologise for delay
>> in response, but I wanted to try out the suggestions to really see if I
>> understood properly. yes it works, thank you once again.
>>
>> Just one final qn on this topic:
>>
>>
>> Does a query_directory also get preceeded by a create on that directory?
>> or is it possible to query contents without create operation?
>>
>>
>>
>>
>> On Tue, May 28, 2013 at 7:25 PM, Pete Scott >> mailto:xxxxx>> wrote:
>>
>>
>> Per Don’s email, you have two choices. You can call
>> FltGetFileNameInformation() in the pre-dir_control request to get
>> the parent name and make a determination that way. Or you can create
>> a stream context in the post-create handler and cache the name in
>> the context. Then in the pre-dir_control request query the context
>> and get the name.
>>
>> Then in post-dir_control parse the returned buffer and remove the
>> information you want to remove.
>>
>> Pete
>>
>>
>> On 5/27/2013 12:57 PM, A P wrote:
>>
>> hi Don,
>>
>> I don’t know if I understand your answer correctly, please
>> apologise my
>> incompetence with english.
>>
>>
>> you want me to cache the name so that i dont want to look it up
>> everytime? but that I will do in Pre/postcreate.
>>
>> my qn is in dir_ctl, the mn_query_dir comes for a particular
>> directory,
>> where the FSW sends a list of files to who ever erquested it,
>> but the
>> same name of the file can be for several directories, how do i
>> identify
>> whether it is the right directory listing where I am removing my
>> file from?
>>
>> e.g if i want to remove bar.txt, this file name might be in
>> c:\foo and
>> c:\abcd\def. now i do i identify that i need to remove it freom
>> C:\foo
>> only and not c:\abcd\def also…
>>
>>
>>
>> On Mon, May 27, 2013 at 8:00 PM, Don Burn >> mailto:xxxxx
>> mailto:xxxxx>> wrote:
>>
>> FltGetFileNameInformation should do it. You may want to
>> the path in
>> a context structure so you don’t need to look it up
>> everytime.
>>
>>
>> Don Burn
>> Windows Filesystem and Driver Consulting
>> Website: http://www.windrvr.com
>> Blog: http://msmvps.com/blogs/ _**WinDrvrhttp:
>> http:>
>>
>>
>> http:
>> http:
>> >>
>>
>>
>>
>> “A P” >> mailto:xxxxx mailto:xxxxx>> mailto:xxxxx
>> wrote
>>
>>
>> in message news:xxxxx@ntfsd:
>>
>>
>> Hello,
>>
>> I want to Find the parent Directory of
>> IRP_MJ_DIRECTORY_CONTROL/IRP **
MN_QUERY_DIRECTORY
>> call.
>>
>>
>>
>> I want to remove particular directory entries from the
>> listing.
>> Say I want
>> to remover bar.txt if bar.txt resides in Foo directory.
>>
>> So full path is c:\foo\bar.txt , then if the directory
>> path is
>> c:\foo I
>> want to remove bar.txt from it.
>>
>> So In the dir_ctl call, how do I assertain if directory
>> is
>> indeed c:\foo ???
>>
>>
>> thanks in avdance
>>
>> Albert
>>
>>
>>
>> —
>> NTFSD is sponsored by OSR
>>
>> OSR is hiring!! Info at http://www.osr.com/careers
>>
>> For our schedule of debugging and file system seminars visit:
>> http://www.osr.com/seminars
>>
>> To unsubscribe, visit the List Server section of OSR Online
>> at
>> http://www.osronline.com/page. ** ____cfm?name=ListServerhttp:
>> http:
>> >
>> http:
>>
>> http:
>> >>
>>
>>
>>
>> — NTFSD is sponsored by OSR OSR is hiring!! Info at
>> http://www.osr.com/careers For our schedule of debugging and
>> file system
>> seminars visit: http://www.osr.com/seminars To unsubscribe,
>> visit the
>> List Server section of OSR Online at
>> http://www.osronline.com/page.**__ cfm?name=ListServerhttp:
>>
>> http:
>> >
>>
>>
>> –
>> Kernel Drivers
>> Windows File System and Device Driver Consulting
>> www.KernelDrivers.com http:</http:> <
>> http://www.KernelDrivers.com http:</http:>>
>> 866.263.9295 tel:866.263.9295
>>
>>
>>
>> —
>> NTFSD is sponsored by OSR
>>
>> OSR is hiring!! Info at http://www.osr.com/careers
>>
>> For our schedule of debugging and file system seminars visit:
>> http://www.osr.com/seminars
>>
>> To unsubscribe, visit the List Server section of OSR Online at
>> http://www.osronline.com/page. __cfm?name=ListServerhttp:
>> http:
>> >
>>
>>
>> — NTFSD is sponsored by OSR OSR is hiring!! Info at
>> http://www.osr.com/careers For our schedule of debugging and file system
>> seminars visit: http://www.osr.com/seminars To unsubscribe, visit the
>> List Server section of OSR Online at
>> http://www.osronline.com/page.
cfm?name=ListServerhttp:
>>
>
> –
> Kernel Drivers
> Windows File System and Device Driver Consulting
> www.KernelDrivers.com http:</http:>
> 866.263.9295
>
> —
> NTFSD is sponsored by OSR
>
> OSR is hiring!! Info at http://www.osr.com/careers
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.**cfm?name=ListServerhttp:
></http:></http:></http:></http:></tel:866.263.9295></http:></http:></http:></http:></http:></http:></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx></http:></http:></http:></http:></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx>