IRP_MN_QUERY_DIRECTORY buffer filter problem Resolved

NTFSD
1

Thank you very much Dejan. I have resolved the problem. And I have more question to ask:

1, Why filtering buffer in completion routine is useless? And why must I return STATUS_NEED_MORE_PROCESSING in completion roution and do actual job in dispatch routine?

2, Why IoSetCompletionRoutine must be after IoCopyCurrentIrpStackLocationToNext ?

Thanks in advance!

Best Regards,
Ken

2

> 1, Why filtering buffer in completion routine is useless? And why must

I return STATUS_NEED_MORE_PROCESSING in completion roution and do
actual job in dispatch routine?

Because it might be invalid there.

2, Why IoSetCompletionRoutine must be after
IoCopyCurrentIrpStackLocationToNext ?

I won’t answer this - just look at the IRP structure, and how
the two macros are implemented - all will be made clear then.

–
Kind regards, Dejan M. www.alfasp.com
E-mail: xxxxx@alfasp.com ICQ#: 56570367
Alfa File Monitor - File monitoring library for Win32 developers.
Alfa File Protector - File protection and hiding library for Win32
developers.

3

Hi Dejan,

The completionRoutine is binded to iostacklocation, so I have to set it
after copy current to next.

And I guess that all dispatch routines and completion routines are running
at any thread context and asynchronously. And after completion routine’s
being called, lower level device must complete their dispatch routine, we
can deal buffer now.

Thank you Dejan.

sincerely
Ken