I am studing to windows 2000 file system filter driver.
I want to hide in specified folder.
How can I that? I think that associate with
IRP_MJ_DIRECTORY_CONTROL(IRP_MN_QUERY_DIRECTORY).
Can you give me more information?
Thanks in advance.
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
This one should hit the FAQ:-)
When you receive D_C/Q_D IRP, pass it down, with your completion
routine returning STATUS_MORE_PROCESSING_REQUIRED.
The dispatch routine of yours must wait for the completion routine
to finish (i.e. use KeWaitXXX on an event that would be signaled by the
completion routine).
After you wait for the completion routine, start filtering entries
(this one is pure maths).
If you filter out ALL the entries (i.e. there would be no files
returned to the caller), issue IoCallDriver again, with the same IRP.
Repeat previous 3 steps.
If some entries are left (i.e. some entries would be returned to the
caller), set the Irp->IoStatus.Information field to tell the caller how
many bytes were copied, call IoCompleteRequest and return to the caller.
IoCompleteRequest is required, because your completion routine returned
STATUS_MORE_PROCESSING_REQUIRED.
Of course, if the call fails (i.e. there are no files copied into
the buffer by the file system), then you’d have to just return, and do
nothing extra.
Regards, Dejan.
nicena wrote:
I am studing to windows 2000 file system filter driver.
I want to hide in specified folder.How can I that? I think that associate with
IRP_MJ_DIRECTORY_CONTROL(IRP_MN_QUERY_DIRECTORY).Can you give me more information?
Thanks in advance.
You are currently subscribed to ntfsd as: xxxxx@alfasp.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
–
Kind regards, Dejan M. www.alfasp.com
E-mail: xxxxx@alfasp.com ICQ#: 56570367
Alfa File Monitor - File monitoring library for Win32 developers.
Alfa File Protector - File protection and hiding library for Win32
developers.
Alfa Registry Monitor - Registry monitoring library for Win32
developers.
Alfa Registry Protector - Registry protection library for Win32
developers.
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
Thanks your advice.
I have one more question.
You tell me “When I receive D_C/Q_D IRP, pass it down”.
Should I create new IRP with IoAllocateIrp()?
Thank more once.
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
No, pass the one you got, just as you usually do.
Regards, Dejan.
nicena wrote:
Thanks your advice.
I have one more question.
You tell me “When I receive D_C/Q_D IRP, pass it down”.
Should I create new IRP with IoAllocateIrp()?Thank more once.
You are currently subscribed to ntfsd as: xxxxx@alfasp.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
–
Kind regards, Dejan M. www.alfasp.com
E-mail: xxxxx@alfasp.com ICQ#: 56570367
Alfa File Monitor - File monitoring library for Win32 developers.
Alfa File Protector - File protection and hiding library for Win32
developers.
Alfa Registry Monitor - Registry monitoring library for Win32
developers.
Alfa Registry Protector - Registry protection library for Win32
developers.
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
Thank again about your counsel.
My program did filemon to basis.
NTSTATUS SEFSHookRoutine() {
…
*nextIrpStack = *currentIrpStack;
…
IoSetCompletionRoutine( Irp, SEFSHookDone, (PVOID)seqNum, TRUE, TRUE,
TRUE);
return IoCallDriver(hookExt->FileSystem, Irp);
}
NTSTATUS SEFSHookDone() {
…
currentIrpStack = IoGetCurrentIrpStackLocation(Irp);
if( FilterOn ) {
…
}
if(Irp->PendingReturn) {
IoMarkIrpPending(Irp)
}
return Irp->IoStatus.Status;
}
For Example…
Have folders such as C:\Test\aa, bb, cc and If I wish to hide one of them.
How Can I do that?
Thanks in advance.
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com