How to get the returned file list of a directory in IRP_MJ_DIRECTORY_CONTROL

NTFSD
1

As I click a certain directory in Explorer.EXE, the FileMon filter driver
catches three requests to complete.

IRP_MJ_DIRECTORY_CONTROL STATUS_SUCCESS FileBothDirectoryInformation *
IRP_MJ_DIRECTORY_CONTROL STATUS_SUCCESS FileBothDirectoryInformation
IRP_MJ_DIRECTORY_CONTROL STATUS_NO_MORE_FILES FileBothDirectoryInformation

How can I get the returned file list after passing the IRP by
IoCallDriver()?

B.R.,

Wing Lee

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com