IPR_MJ_DIRECTORY_CONTROL - FILE_BOTH_DIR_INFORMATION - First entry problem!

NTFSD
1

Hi everyone!

I want to hide in my minifilter files with a certain extension (eg. *.txt).
The code below seems to work fine with one exception. I am unable
to hide the first entry. I know that the problem is in the “SL_RETURN_SINGLE_ENTRY” part of the code but unfortunately i don’t know how to treat this issue right.

while (LastDirectoryBuffer != DirectoryBuffer){
BufferPosition += DirectoryBuffer->NextEntryOffset;

EntryName.MaximumLength=EntryName.Length= (USHORT) DirectoryBuffer->FileNameLength;
EntryName.Buffer = &DirectoryBuffer->FileName[0];

if(FsRtlIsNameInExpression(&FileToHide, &EntryName, TRUE, NULL)==FALSE){
//NO MATCH
DbgPrint(“File: %Z read:%Z \n”,&FileToHide, &EntryName);
} else {
//MATCH
DbgPrint("File: %Z read:%Z MATCH ",&FileToHide, &EntryName);

if(DirectoryBuffer->NextEntryOffset > 0){
DbgPrint(“first or middle entry \n”); //seems to work fine
len=Data->Iopb->Parameters.DirectoryControl.QueryDirectory.Length - BufferPosition;

TempBuffer=ExAllocatePoolWithTag( NonPagedPool,
len,
POOL_TAG_TEMPORARY_BUFFER);

try{
RtlCopyMemory(TempBuffer, ((PUCHAR)DirectoryBuffer + DirectoryBuffer->NextEntryOffset), len);
RtlZeroMemory(DirectoryBuffer, len + DirectoryBuffer->NextEntryOffset);
RtlCopyMemory(DirectoryBuffer, TempBuffer, len);
}except(EXCEPTION_EXECUTE_HANDLER){
Data->IoStatus.Status = GetExceptionCode();
Data->IoStatus.Information=0;
}

ExFreePoolWithTag(TempBuffer, POOL_TAG_TEMPORARY_BUFFER);
FltSetCallbackDataDirty(Data);
LastDirectoryBuffer=NULL;
continue;
}
else if(FlagOn(SL_RETURN_SINGLE_ENTRY, Data->Iopb->OperationFlags) && LastDirectoryBuffer==NULL) {
DbgPrint(“SL_RETURN_SINGLE_ENTRY \n”);
//PROBLEM: Want to hide first entry too … but how?

//RtlZeroMemory(DirectoryBuffer, sizeof(FILE_BOTH_DIR_INFORMATION));
Data->IoStatus.Information =0;
LastDirectoryBuffer=DirectoryBuffer;
/*Data->Iopb->Parameters.DirectoryControl.QueryDirectory.DirectoryBuffer=NULL;
Data->Iopb->Parameters.DirectoryControl.QueryDirectory.Length=0;
Data->Iopb->Parameters.DirectoryControl.QueryDirectory.MdlAddress=NULL; */
FltSetCallbackDataDirty(Data);
}else if(DirectoryBuffer->NextEntryOffset ==0){ //
DbgPrint(“Delete last Entry \n”);
DirectoryBuffer=(PFILE_BOTH_DIR_INFORMATION)((PCHAR) DirectoryBuffer - OffsetToPreviousEntry);
DirectoryBuffer->NextEntryOffset=0;
FltSetCallbackDataDirty(Data);
}
}
OffsetToPreviousEntry=DirectoryBuffer->NextEntryOffset;
LastDirectoryBuffer = DirectoryBuffer;
DirectoryBuffer=(PFILE_BOTH_DIR_INFORMATION)((PCHAR) DirectoryBuffer + DirectoryBuffer->NextEntryOffset);
}

return FLT_POSTOP_FINISHED_PROCESSING;

Could you please bring some clarity in my life and tell me how to deal with this and/or where to find more information on this issue.
Im sorry for bothering you with this lousy newbie question.

Thanks a lot in advance for your help!

Regards
Klaus