help required for IRP_MJ_DIRECTORY_CONTROL / IRP_MN_QUERY_DIRECTORY

NTFSD
1

hello All,

i am working on a minifilter driver and trying to handle
IRP_MJ_DIRECTORY_CONTROL with minor function IRP_MN_QUERY_DIRECTORY.

Objective is to display / modify the file names present in the
DirectoryBuffer.

i have
Data->Iopb->Parameters.DirectoryControl.QueryDirectory.FileInformationClass
= FileBothDirectoryInformation .

Now according to WDK Docs FILE_BOTH_DIR_INFORMATION will give me the
information i require, but i don’t know

how can i get this information as
FILE_BOTH_DIR_INFORMATION info =
(FILE_BOTH_DIR_INFORMATION)Data->Iopb->Parameters.DirectoryControl.QueryDirectory.FileInformationClass;

gives cast error.

i shall be very thank full for the help.
regards,
laiq

2

Data->Iopb->Parameters.DirectoryControl.QueryDirectory.FileInformationCl
ass is not necessarily FileBothDirectoryInformation
This should be checked before the cast.

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Laiq
Sent: 28 May 2008 23:47
To: Windows File Systems Devs Interest List
Subject: [ntfsd] help required for IRP_MJ_DIRECTORY_CONTROL /
IRP_MN_QUERY_DIRECTORY

*** WARNING ***

This mail has originated outside your organization,
either from an external partner or the Global Internet.
Keep this in mind if you answer this message.

hello All,

i am working on a minifilter driver and trying to handle
IRP_MJ_DIRECTORY_CONTROL with minor function IRP_MN_QUERY_DIRECTORY.

Objective is to display / modify the file names present in the
DirectoryBuffer.

i have
Data->Iopb->Parameters.DirectoryControl.QueryDirectory.FileInformationCl
ass = FileBothDirectoryInformation .

Now according to WDK Docs FILE_BOTH_DIR_INFORMATION will give me the
information i require, but i don’t know

how can i get this information as
FILE_BOTH_DIR_INFORMATION info =
(FILE_BOTH_DIR_INFORMATION)Data->Iopb->Parameters.DirectoryControl.Query
Directory.FileInformationClass;

gives cast error.

i shall be very thank full for the help.
regards,
laiq
— NTFSD is sponsored by OSR For our schedule debugging and file system
seminars (including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars You are currently subscribed to ntfsd as:
xxxxx@baesystems.com To unsubscribe send a blank email to
xxxxx@lists.osr.com

********************************************************************
This email and any attachments are confidential to the intended
recipient and may also be privileged. If you are not the intended
recipient please delete it from your system and notify the sender.
You should not copy it or use it for any purpose nor disclose or
distribute its contents to any other person.
********************************************************************

3

>FILE_BOTH_DIR_INFORMATION info =

(FILE_BOTH_DIR_INFORMATION)Data->Iopb->Parameters.DirectoryControl.QueryDirectory
.FileInformationClass;

You typecast enum type into pointer type (FileInformationClass should be DirectoryBuffer).

4

It’s also virtually guaranteed that it’s not a FILE_BOTH_DIR_INFORMATION
struct, which is what the OP is trying to cast it to. The OP needs to
read the fine manual and/or make sure he actually knows C, because there
isn’t a snowball’s chance in hell of that line of code ever working.

~Eric

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Oliver, Jonathan
(UK)
Sent: Thursday, May 29, 2008 2:11 AM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] help required for IRP_MJ_DIRECTORY_CONTROL /
IRP_MN_QUERY_DIRECTORY

Data->Iopb->Parameters.DirectoryControl.QueryDirectory.FileInformationCl
ass is not necessarily FileBothDirectoryInformation
This should be checked before the cast.

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Laiq
Sent: 28 May 2008 23:47
To: Windows File Systems Devs Interest List
Subject: [ntfsd] help required for IRP_MJ_DIRECTORY_CONTROL /
IRP_MN_QUERY_DIRECTORY

*** WARNING ***

This mail has originated outside your organization,
either from an external partner or the Global Internet.
Keep this in mind if you answer this message.

hello All,

i am working on a minifilter driver and trying to handle
IRP_MJ_DIRECTORY_CONTROL with minor function IRP_MN_QUERY_DIRECTORY.

Objective is to display / modify the file names present in the
DirectoryBuffer.

i have
Data->Iopb->Parameters.DirectoryControl.QueryDirectory.FileInformationCl
ass = FileBothDirectoryInformation .

Now according to WDK Docs FILE_BOTH_DIR_INFORMATION will give me the
information i require, but i don’t know

how can i get this information as
FILE_BOTH_DIR_INFORMATION info =
(FILE_BOTH_DIR_INFORMATION)Data->Iopb->Parameters.DirectoryControl.Query
Directory.FileInformationClass;

gives cast error.

5

you are type casting wrong member. you should verify first that which type of buffer is this (compare Data->Iopb->Parameters.DirectoryControl.QueryDirectory.FileInformationClass) and than typecast Data->Iopb->Parameters.DirectoryControl.QueryDirectory.DirectoryBuffer to that type structure.