Something strange in QUERY_DIRECTORY

NTFSD
1

Hi,

It seems I misunderstand something… and need your help.
Sorry for stupid question.

When I pass a query directory request to the FSD (FAT on NT 4.0 SP6)
I receive the following information from it:

FileInformationClass = FileBothDirectoryInformation

Irp->IoStatus.Status = 0x0;
Irp->IoStatus.Information = 0x144;

And the contents of the buffer is (from WinDbg):

00154fa0 68 00 00 00 80 00 00 00 20 8b 95 23 fa 0a c2 01 h… …#…
00154fb0 00 a0 86 13 70 0a c2 01 00 5d e3 23 fa 0a c2 01 …p…].#…
00154fc0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 …
00154fd0 00 00 00 00 00 00 00 00 10 00 00 00 06 00 00 00 …
00154fe0 00 00 00 00 06 00 54 00 4d 00 50 00 00 00 00 00 …T.M.P…
00154ff0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 00 …T.
00155000 6d 00 70 00 00 00 00 00 70 00 00 00 40 0b 00 00 m.p…p…@…
00155010 c0 83 d0 34 1e 2f c2 01 00 20 87 b2 95 2e c2 01 …4./… …
00155020 00 54 ec 35 1e 2f c2 01 00 00 00 00 00 00 00 00 .T.5./…
00155030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 …
00155040 16 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 …
00155050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 …
00155060 00 00 00 00 00 00 52 00 45 00 43 00 59 00 43 00 …R.E.C.Y.C.
00155070 4c 00 45 00 44 00 00 00 00 00 00 00 c0 16 00 00 L.E.D…
00155080 e0 83 d6 53 c0 33 c2 01 00 a0 01 b1 4c 33 c2 01 …S.3…L3…
00155090 00 cd 3f 54 c0 33 c2 01 00 00 00 00 00 00 00 00 …?T.3…
001550a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 …
001550b0 10 00 00 00 10 00 00 00 00 00 00 00 10 00 49 00 …I.
001550c0 32 00 4b 00 43 00 41 00 43 00 48 00 45 00 00 00 2.K.C.A.C.H.E…
001550d0 00 00 00 00 00 00 49 00 32 00 6b 00 43 00 61 00 …I.2.k.C.a.
001550e0 63 00 68 00 65 00 00 00 00 00 00 00 00 00 00 00 c.h.e…

It seems that FSD returns 2 bytes less than it should be.
Am I right?

As I understand the size of CCHAR ShortNameLength field is 1 byte,
but from the dump it is 2 bytes long. At the same time the expression
NameBuffer = ((PFILE_BOTH_DIR_INFORMATION) Buffer)->FileName;
gets the correct address. Where is my mistake?

Thank you very much in advance,
Leonid.

2

Hi,

As I understand the size of CCHAR ShortNameLength field is 1 byte,
but from the dump it is 2 bytes long. At the same time the expression
NameBuffer = ((PFILE_BOTH_DIR_INFORMATION) Buffer)->FileName;
gets the correct address. Where is my mistake?

ShortName field in FILE_BOTH_DIR_INFORMATION aligned on 2-byte bundary
because it is WCHAR. Use FIELD_OFFSET macros to get relative offset in a
structure, don’t try to calculate it as a sum of field lengths.

Alexei.