Help me with hooking IRP_MJ_DIRECTORY_CONTROL

NTFSD
1

I’m writing File System Hook for NT, which filters the IRPs, operating with
non-existing files and directories and processes them. So User apps are
sure that these files really exists. I’ve overcame the IRP_MJ_CREATE,
CLEANUP, WRITE, CLOSE, READ functions, but IRP_MJ_DIRECTORY_CONTROL and
IRP_MJ_QUERY_INFORMATION killed me. I ve seen nor structure definitions nor
help documentation on this.
Can You help me with this trouble (if You send me header files or links to
them, it will be fantastic).
Sincerely Yours, Andrew

2

what is meant by non-existing files ? does this mean that a request for any
file (whether it is physically existing or not)will succeed because your
filter hooks it and returns SUCESS ??
pl. clarify…

regds
RB
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of
andrew@at.pstu.ac.ru
Sent: Friday, August 25, 2000 12:00 AM
To: File Systems Developers
Subject: [ntfsd] Help me with hooking IRP_MJ_DIRECTORY_CONTROL

I’m writing File System Hook for NT, which filters the IRPs, operating with
non-existing files and directories and processes them. So User apps are
sure that these files really exists. I’ve overcame the IRP_MJ_CREATE,
CLEANUP, WRITE, CLOSE, READ functions, but IRP_MJ_DIRECTORY_CONTROL and
IRP_MJ_QUERY_INFORMATION killed me. I ve seen nor structure definitions nor
help documentation on this.
Can You help me with this trouble (if You send me header files or links to
them, it will be fantastic).
Sincerely Yours, Andrew

You are currently subscribed to ntfsd as: xxxxx@softhome.net
To unsubscribe send a blank email to $subst(‘Email.Unsub’)

3

Look in NTIFS.H header for FILE_XXX_INFORMATION structures.

----- Original Message -----
From:
To: File Systems Developers
Sent: Friday, August 25, 2000 12:00 AM
Subject: [ntfsd] Help me with hooking IRP_MJ_DIRECTORY_CONTROL

> I’m writing File System Hook for NT, which filters the IRPs, operating
with
> non-existing files and directories and processes them. So User apps are
> sure that these files really exists. I’ve overcame the IRP_MJ_CREATE,
> CLEANUP, WRITE, CLOSE, READ functions, but IRP_MJ_DIRECTORY_CONTROL and
> IRP_MJ_QUERY_INFORMATION killed me. I ve seen nor structure definitions
nor
> help documentation on this.
> Can You help me with this trouble (if You send me header files or links to
> them, it will be fantastic).
> Sincerely Yours, Andrew
>
> —
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to $subst(‘Email.Unsub’)
>

4

I would assume that the filter driver needs to insert some filename
in directory queries, for eg “readme.txt” would be inserted in
directory queries even though it does not really exists on disk.
It would seem that his driver already detects opens etc for this
“virtual” file and handles it correctly.

To decide when to insert this virtual filename, you would need to
check the wildcard specification of the directory query. This
should be easy.

Directory queries usually fills a supplied buffer with “linked
list” type entries of either FILE_BOTH_DIR_INFORMATION,
FILE_FULL_DIR_INFORMATION, FILE_DIRECTORY_INFORMATION or
FILE_NAMES_INFORMATION structures. If the buffer is not
large enough to contain all entries matching the wildcard,
the remaining entries will be returned on subsequent dir query
calls. Anyway, you would need to insert your virtual files
entry in this linked list structure. Of course, the buffer
may not be large enough to contain the extra info though.
Assuming that the order in which the filename entries
are returned does not matter (I don’t think it does, but what
do I know?), I would return the virtual files info on its
own on the first dir query call. Seems doable to me.
Could you replace the supplied buffer with a larger one
to accomodate the extra info? I wouldn’t bet on it …
but it might be possible.

Not sure if this helps …

-----Original Message-----
From: RB [mailto:xxxxx@softhome.net]
Sent: 27 August 2000 05:07
To: File Systems Developers
Subject: [ntfsd] RE: Help me with hooking IRP_MJ_DIRECTORY_CONTROL

what is meant by non-existing files ? does this mean that a
request for any
file (whether it is physically existing or not)will succeed
because your
filter hooks it and returns SUCESS ??
pl. clarify…

regds
RB
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of
andrew@at.pstu.ac.ru
Sent: Friday, August 25, 2000 12:00 AM
To: File Systems Developers
Subject: [ntfsd] Help me with hooking IRP_MJ_DIRECTORY_CONTROL

I’m writing File System Hook for NT, which filters the IRPs,
operating with
non-existing files and directories and processes them. So
User apps are
sure that these files really exists. I’ve overcame the IRP_MJ_CREATE,
CLEANUP, WRITE, CLOSE, READ functions, but
IRP_MJ_DIRECTORY_CONTROL and
IRP_MJ_QUERY_INFORMATION killed me. I ve seen nor structure
definitions nor
help documentation on this.
Can You help me with this trouble (if You send me header
files or links to
them, it will be fantastic).
Sincerely Yours, Andrew

You are currently subscribed to ntfsd as: xxxxx@softhome.net
To unsubscribe send a blank email to $subst(‘Email.Unsub’)

You are currently subscribed to ntfsd as: xxxxx@Nanoteq.co.za
To unsubscribe send a blank email to $subst(‘Email.Unsub’)