FYI. In ntifs.h (also in latest IFSKit XP-SP1) there is a wrong declaration
of FileName member of QueryDirectory (IO_STACK_LOCATION typedef). It is
PUNICODE_STRING and NOT PSTRING as declared. Since I’m a kind of “paranoid
developer” (threat warnings as errors!) I crashed into this problem. For my
luck, there was already a message on NTFSD list last year (2002) pointing to
this ntifs.h bug, so after search on NTFSD history, I found why I can’t make
my filter driver IRP_MJ_DIRECTORY_CONTROL code work (query for SFN to LFN).
I would expect at least a notice at description of
IrpSp->Parameters.QueryDirectory.FileName in IRP_MY_DIRECORY_CONTROL IFSKit
documentation, if fixing ntifs.h is so hard to do.
WBR Primoz