Modify IRP_MN_QUERY_DIRECTORY

Hi,

I’m trying to filter directory listing, but am not sure how.
I would like to hide entries which are “protected” (files, which
must not be seen). But, there are cases where I don’t know how. For
example, if all returned filenames are protected, what to do?
Any samples?


Regards, Dejan M. CEO Alfa Co. http://www.alfaunits.co.yu and
www.register.co.yu
E-mail : xxxxx@alfaunits.co.yu ICQ# : 56570367
Professional file&system related components and libraries for Win32
developers.
Alfa Units - #1 file and system handling units for Delphi.
Alfa File Monitor - #1 file monitoring system for Win32 developers.
Alfa Interceptor - #1 file protection and hiding system for Win32
developers.

> example, if all returned filenames are protected, what to do?

Return STATUS_NO_SUCH_FILE or STATUS_NO_MORE_FILES - depending on whether
this is a first query on this file object or not.
Use FsRtlIsNameInExpression to filter the names.

Max

> Return STATUS_NO_SUCH_FILE or STATUS_NO_MORE_FILES - depending on whether

this is a first query on this file object or not.
Use FsRtlIsNameInExpression to filter the names.

That won’t be of use if there are more files that were not listed. I need
to call it again. How can this be done?


Regards, Dejan M. CEO Alfa Co. http://www.alfaunits.co.yu and
www.register.co.yu
E-mail : xxxxx@alfaunits.co.yu ICQ# : 56570367

Return STATUS_MORE_PROCESSING_REQUIRED from your completion routine. In your
dispatch routine, if you realize that all files are protected and there are
more files that were not listed, re-issue the irp again by calling
IoCallDriver to get the rest of the files.

Marc

-----Original Message-----
From: Dejan Maksimovic [mailto:xxxxx@ptt.yu]
Sent: Monday, September 25, 2000 5:25 AM
To: File Systems Developers
Subject: [ntfsd] Re: Modify IRP_MN_QUERY_DIRECTORY

> Return STATUS_NO_SUCH_FILE or STATUS_NO_MORE_FILES -
depending on whether
> this is a first query on this file object or not.
> Use FsRtlIsNameInExpression to filter the names.

That won’t be of use if there are more files that were
not listed. I need
to call it again. How can this be done?


Regards, Dejan M. CEO Alfa Co. http://www.alfaunits.co.yu and
www.register.co.yu
E-mail : xxxxx@alfaunits.co.yu ICQ# : 56570367


You are currently subscribed to ntfsd as: xxxxx@bionetrix.com
To unsubscribe send a blank email to $subst(‘Email.Unsub’)

> Return STATUS_MORE_PROCESSING_REQUIRED from your completion routine. In your

dispatch routine, if you realize that all files are protected and there are
more files that were not listed, re-issue the irp again by calling
IoCallDriver to get the rest of the files.

There is one problem to this : If I always return STATUS_MPR, NTVDM
processes never list all files.
I wanted to see in the DIOC whether a file is protected or not, but I cannot
use RtlUnicodeToAnsiString and DISPATCH_LEVEL?
Any ideas how to overcome this?


Regards, Dejan M. CEO Alfa Co. http://www.alfaunits.co.yu and www.register.co.yu

E-mail : xxxxx@alfaunits.co.yu ICQ# : 56570367
Professional file&system related components and libraries for Win32 developers.
Alfa Units - #1 file and system handling units for Delphi.
Alfa File Monitor - #1 file monitoring system for Win32 developers.
Alfa Interceptor - #1 file protection and hiding system for Win32 developers.

Dejan:

A straight forward solution to this would be for every QueryDir IRP that
your filter catches,
roll a sequence of your own QueryDir IRPs that you can pass to the filtering
driver. Then analyze
and copy or discard returned entries. Continue that process until there are
no more entries returned
from the call to the driver below you, our buffer of the main IRP is full.

Vladimir

-----Original Message-----
From: Dejan Maksimovic [mailto:xxxxx@ptt.yu]
Sent: Monday, September 25, 2000 11:14 AM
To: File Systems Developers
Subject: [ntfsd] Re: Modify IRP_MN_QUERY_DIRECTORY

Return STATUS_MORE_PROCESSING_REQUIRED from your completion routine. In
your
dispatch routine, if you realize that all files are protected and there
are
more files that were not listed, re-issue the irp again by calling
IoCallDriver to get the rest of the files.

There is one problem to this : If I always return STATUS_MPR, NTVDM
processes never list all files.
I wanted to see in the DIOC whether a file is protected or not, but I
cannot
use RtlUnicodeToAnsiString and DISPATCH_LEVEL?
Any ideas how to overcome this?


Regards, Dejan M. CEO Alfa Co. http://www.alfaunits.co.yu and
www.register.co.yu

E-mail : xxxxx@alfaunits.co.yu ICQ# : 56570367
Professional file&system related components and libraries for Win32
developers.
Alfa Units - #1 file and system handling units for Delphi.
Alfa File Monitor - #1 file monitoring system for Win32 developers.
Alfa Interceptor - #1 file protection and hiding system for Win32
developers.


You are currently subscribed to ntfsd as: xxxxx@Starbase.com
To unsubscribe send a blank email to $subst(‘Email.Unsub’)

> A straight forward solution to this would be for every QueryDir IRP

that your filter catches, roll a sequence of your own QueryDir IRPs
that you can pass to the filtering driver. Then analyze and copy or
discard returned entries. Continue that process until there are no
more entries returned from the call to the driver below you, our
buffer of the main IRP is full.

Probably a very hard idea to implement vs. previous try
(STATUS_MPR…).
It would be a great drawback for the system to do so, and a very
“easy to use miss something”, but thanks for the idea.


Regards, Dejan M. CEO Alfa Co. http://www.alfaunits.co.yu and
www.register.co.yu
E-mail : xxxxx@alfaunits.co.yu ICQ# : 56570367
Professional file&system related components and libraries for Win32
developers.
Alfa Units - #1 file and system handling units for Delphi.
Alfa File Monitor - #1 file monitoring system for Win32 developers.
Alfa Interceptor - #1 file protection and hiding system for Win32
developers.

> > Return STATUS_MORE_PROCESSING_REQUIRED from your completion

routine. In your
> dispatch routine, if you realize that all files are
protected and there are
> more files that were not listed, re-issue the irp again by calling
> IoCallDriver to get the rest of the files.

There is one problem to this : If I always return
STATUS_MPR, NTVDM
processes never list all files.

Do you mean *any* files? Anyway, once you’re done re-issuing the irp, call
IoCompleteRequest in your dispatch routine. You’re completion will *not* get
called, only the completion routines of filter drivers above you will be
called.

I wanted to see in the DIOC whether a file is protected
or not, but I cannot
use RtlUnicodeToAnsiString and DISPATCH_LEVEL?
Any ideas how to overcome this?

If DIOC means your completion routine, then returning
STATUS_MORE_PROCESSING_REQUIRED and doing the check in your disptach routine
is the way to go.

Marc


Regards, Dejan M. CEO Alfa Co. http://www.alfaunits.co.yu and
www.register.co.yu

> Do you mean *any* files?

No, I meant some files (exactly 8-9 of them) in a directory are listed, and
no other.

Anyway, once you’re done re-issuing the irp, call IoCompleteRequest in your
dispatch routine. You’re completion will *not* get called, only the completion
routines of filter drivers above you will be called.

I already did that, and it did solve the issue, however, I needed to add
some checks, otherwise a MULTIPLE_IRP_COMPLETE_REQUEST bugcheck. Thanks, anyway.

If DIOC means your completion routine, then returning
STATUS_MORE_PROCESSING_REQUIRED and doing the check in your disptach routine
is the way to go.

Yes, it it. Thanks.


Regards, Dejan M. CEO Alfa Co. http://www.alfaunits.co.yu and www.register.co.yu

E-mail : xxxxx@alfaunits.co.yu ICQ# : 56570367
Professional file&system related components and libraries for Win32 developers.
Alfa Units - #1 file and system handling units for Delphi.
Alfa File Monitor - #1 file monitoring system for Win32 developers.
Alfa Interceptor - #1 file protection and hiding system for Win32 developers.