what is wrong with my IRP_MJ_DIRECTORY_CONTROL

NTFSD
1

hi,
i am using a IFS XP SP1 kit, filespy.

I am handling IRP_MJ_DIRECTORY_CONTROL in SpyPassThrough ,where i am using

IoSetCompletionRoutine( Irp, SpyPassThroughCompletion,recordList, TRUE,
TRUE, TRUE);
(do i need something more in this?)

SpyLogIrpCompletion (from fspyhash.c), i am handling
IRP_MJ_DIRECTORY_CONTROL.
In this when i try to use NextEntryOffset of FILE_BOTH_DIR_INFORMATION
my pc get crash!
UserBuffer and NextEntryOffset is not NULL. and if i print first value is
shows it correctly!

Any idea why it is happning? My driver is a boot time driver.

Thanks and Regards,
Naren

2

How are you calculating the location of the next
entry?

— “narendra.bhongale”
wrote:

> hi,
> i am using a IFS XP SP1 kit, filespy.
>
> I am handling IRP_MJ_DIRECTORY_CONTROL in
> SpyPassThrough ,where i am using
>
> IoSetCompletionRoutine( Irp,
> SpyPassThroughCompletion,recordList, TRUE,
> TRUE, TRUE);
> (do i need something more in this?)
>
> SpyLogIrpCompletion (from fspyhash.c), i am handling
> IRP_MJ_DIRECTORY_CONTROL.
> In this when i try to use NextEntryOffset of
> FILE_BOTH_DIR_INFORMATION
> my pc get crash!
> UserBuffer and NextEntryOffset is not NULL. and if i
> print first value is
> shows it correctly!
>
> Any idea why it is happning? My driver is a boot
> time driver.
>
> Thanks and Regards,
> Naren
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>

__________________________________
Do you Yahoo!?
New and Improved Yahoo! Mail - 100MB free storage!
http://promotions.yahoo.com/new_mail

3

This is only pure guess, but based on my experiences

If you cast the system buffer to
PFILE_BOTH_DIR_INFORMATION
and then you add the NextByteOffset,
you will get a wrong value:

PFILE_BOTH_DIR_INFORMATION BothDirInfo
= (PFILE_BOTH_DIR_INFORMATION)Irp->UserBuffer

then BothDirInfo + BothDirInfo->NextByteOffset
doesn’t give you shift by “NextByteOffset” bytes,
but by “NextByteOffset” * sizeof(FILE_BOTH_DIR_INFORMATION)
bytes.

First of all, check the pointer after calculating
the address of the next structure, it should be
right after the first one.

L.

4

The pointer is of that DS type, so any increment/decrement will shift by
sizeof(DS), first you cast the pointer to whatever scale (byte, word, dword)
then do the operation …

-pro

----- Original Message -----
From: “Ladislav Zezula”
To: “Windows File Systems Devs Interest List”
Sent: Thursday, August 26, 2004 10:29 PM
Subject: Re: [ntfsd] what is wrong with my IRP_MJ_DIRECTORY_CONTROL

> This is only pure guess, but based on my experiences
>
> If you cast the system buffer to
> PFILE_BOTH_DIR_INFORMATION
> and then you add the NextByteOffset,
> you will get a wrong value:
>
> PFILE_BOTH_DIR_INFORMATION BothDirInfo
> = (PFILE_BOTH_DIR_INFORMATION)Irp->UserBuffer
>
> then BothDirInfo + BothDirInfo->NextByteOffset
> doesn’t give you shift by “NextByteOffset” bytes,
> but by “NextByteOffset” * sizeof(FILE_BOTH_DIR_INFORMATION)
> bytes.
>
> First of all, check the pointer after calculating
> the address of the next structure, it should be
> right after the first one.
>
> L.
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@garlic.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

5

hi,
thanks for reply.

i am getting NextEntryOffset only if current request is for “…” dir.(Why?)
and in this i am able to print the directory structure.
For root directory (eg. c:), this is not working.
And also I am trying to get full path name.

what is a problem?
Why it is ?

thanks and regards,
Naren.

>>>
This is only pure guess, but based on my experiences

If you cast the system buffer to
PFILE_BOTH_DIR_INFORMATION
and then you add the NextByteOffset,
you will get a wrong value:

PFILE_BOTH_DIR_INFORMATION BothDirInfo
= (PFILE_BOTH_DIR_INFORMATION)Irp->UserBuffer

then BothDirInfo + BothDirInfo->NextByteOffset
doesn’t give you shift by “NextByteOffset” bytes,
but by “NextByteOffset” * sizeof(FILE_BOTH_DIR_INFORMATION) bytes.

First of all, check the pointer after calculating
the address of the next structure, it should be
right after the first one.

L.