help!!!FltQueryInformationFile

NTFSD
1

I write a minifilter driver,in which i want to get the file stream information.
so i use FltQueryInformationFile to get FileStreamInformation.but something wrong happends.my code:
FILE_STREAM_INFORMATION fileStreamInformation = {0};
PFILE_STREAM_INFORMATION pFileStreamInformation;
status = FltQueryInformationFile(
FltObjects->Instance,
FltObjects->FileObject,
&fileStreamInformation,
sizeof(FILE_STREAM_INFORMATION),
FileStreamInformation,
NULL);
pFileStreamInformation = &fileStreamInformation;
every time i open a file ,i call the this code ,but the status alway shows a number -1073741811 (debug in softICE),i can not get the fileStreamInformation.
why this happens?
thanks

2

Are you querying this on a filesystem that supports streams such as NTFS?
The documentation indicates that for filesystems which do not support
streams, they should return the error code you indicate, 0xC000000D
STATUS_INVALID_PARAMETER, or STATUS_NOT_IMPLEMENTED.

Maybe you are querying this for a file or directory on a FAT volume?

Pete

Kernel Drivers
Windows Filesystem and Device Driver Consulting
www.KernelDrivers.com
(303)546-0300

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@psh.com.cn
Sent: Monday, November 27, 2006 8:37 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] help!!!FltQueryInformationFile

I write a minifilter driver,in which i want to get the file stream
information.
so i use FltQueryInformationFile to get FileStreamInformation.but something
wrong happends.my code:
FILE_STREAM_INFORMATION fileStreamInformation = {0};
PFILE_STREAM_INFORMATION pFileStreamInformation;
status = FltQueryInformationFile(
FltObjects->Instance,
FltObjects->FileObject,
&fileStreamInformation,
sizeof(FILE_STREAM_INFORMATION),
FileStreamInformation,
NULL);
pFileStreamInformation = &fileStreamInformation;
every time i open a file ,i call the this code ,but the status alway shows a
number -1073741811 (debug in softICE),i can not get the
fileStreamInformation.
why this happens?
thanks

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@kerneldrivers.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

When are you calling this, e.g., post-create callback? Are you sure the
file is open (FileObject is valid)?

Actually, you should be getting STATUS_BUFFER_OVERFLOW or
STATUS_BUFFER_TOO_SMALL, since you don’t have any room allocated for the
StreamName.

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@psh.com.cn
Sent: Monday, November 27, 2006 10:37 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] help!!!FltQueryInformationFile

I write a minifilter driver,in which i want to get the file stream
information.
so i use FltQueryInformationFile to get FileStreamInformation.but something
wrong happends.my code:
FILE_STREAM_INFORMATION fileStreamInformation = {0};
PFILE_STREAM_INFORMATION pFileStreamInformation;
status = FltQueryInformationFile(
FltObjects->Instance,
FltObjects->FileObject,
&fileStreamInformation,
sizeof(FILE_STREAM_INFORMATION),
FileStreamInformation,
NULL);
pFileStreamInformation = &fileStreamInformation;
every time i open a file ,i call the this code ,but the status alway shows a
number -1073741811 (debug in softICE),i can not get the
fileStreamInformation.
why this happens?
thanks

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@comcast.net
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

thanks a lot