ZwQueryDirectoryFile usage to just get the attribtues of a file

I’m using ZwQueryDirectoryFile() to retrieve the Attributes of a file
under a directory. The thing is I’ve to keep the parent directory handle
open for long time.
When the request comes to get the attributes of a file ( foo.txt ) I
retrieve the attributes thru ZwQueryDirectoryFile() function. This works
fine first time. But when there is a request againt to retrieve the
attributes of the same file (foo.txt ) this funciton returns the error
STATUS_NO_MORE_FILES (0x80000006L), as if it is trying to look for another
existance of this file even though I’ve set the parameter RestartScan =
TRUE, so that it looks for the File from the begining again. It seems like
a bug in this API. It might reset the scan if the parent handle is closed
(which I haven’t tested it).

Can someone tell me if there I can reset the scan or
Is there another way to retrieve the attributes of a child File/directory
given the handle to the parent directory without having to close the
parent handle at the end.

Following are the parameters I’m passing.

Status = ZwQueryDirectoryFile( g_hAppfsDir, 0, //
Event 0, // ApcRoutine 0, //
ApcContext
&IoStatusBlock, pFileInformation, sizeof(FILE_BOTH_DIR_INFORMATION)+256, FileBothDirectoryInformation,
TRUE, // ReturnSingleEntry, &FileName, // FileName
, TRUE // RestartScan
);

Thanks,
Feroz

Re-opening the directory will help. If not possible, maybe it
helps to query a different (even if non existing) file before,
just to cause the FS to reset the query-pointer.

Tobias

----- Original Message -----
From: “Feroz Gora”
To: “File Systems Developers”
Sent: Thursday, October 10, 2002 11:32 PM
Subject: [ntfsd] ZwQueryDirectoryFile usage to just get the attribtues of a
file

>
> I’m using ZwQueryDirectoryFile() to retrieve the Attributes of a file
> under a directory. The thing is I’ve to keep the parent directory handle
> open for long time.
> When the request comes to get the attributes of a file ( foo.txt ) I
> retrieve the attributes thru ZwQueryDirectoryFile() function. This works
> fine first time. But when there is a request againt to retrieve the
> attributes of the same file (foo.txt ) this funciton returns the error
> STATUS_NO_MORE_FILES (0x80000006L), as if it is trying to look for another
> existance of this file even though I’ve set the parameter RestartScan =
> TRUE, so that it looks for the File from the begining again. It seems like
> a bug in this API. It might reset the scan if the parent handle is closed
> (which I haven’t tested it).

Tobias,
Thanks for the response.

  1. I can not close and open handles because the thread I’m doing this might be running in a context which
    might not have previlege to open the handle again. That is the reason I keep the handle chached in system context.
    But I did try close/open using FileObject method which failed . Following is the code I used.

HANDLE ReopenHandle( IN HANDLE hFile )
{
HANDLE FileHandle;
PFILE_OBJECT FileObject = NULL;

OBJECT_HANDLE_INFORMATION objHandle;

NTSTATUS Status;

Status = ObReferenceObjectByHandle( hFile ,
FILE_LIST_DIRECTORY | SYNCHRONIZE,
*IoFileObjectType,
KernelMode,
&FileObject,
&objHandle );

if( !NT_SUCCESS( Status ) )
{
return NULL;
}

ZwClose( hFile );

Status = ObOpenObjectByPointer( FileObject,
0,
NULL,
FILE_LIST_DIRECTORY | SYNCHRONIZE,
NULL,
KernelMode,
&FileHandle );

if( !NT_SUCCESS( Status ) )
{
return NULL;
}

if( FileObject )
{
ObDereferenceObject( FileObject);
}

return FileHandle;

}

This failed when I called ObOpenObjectByPointer() to convert the FileObject to Handle back.

Approach 2 to serch for a dummy file failed too. It still returned the same error. Even tried with existing Directory (current dir) “.” .
Maybe I should try to use the Event parameter which I’m not using it right now.

Let me know if there is anything I’m missing.

Thanks for the help.

Feroz

-----Original Message-----
From: Tobias [mailto:xxxxx@linkwave.org]
Sent: Friday, October 11, 2002 12:33 PM
To: File Systems Developers
Subject: [ntfsd] Re: ZwQueryDirectoryFile usage to just get the
attribtues of a file

Re-opening the directory will help. If not possible, maybe it
helps to query a different (even if non existing) file before,
just to cause the FS to reset the query-pointer.

Tobias

----- Original Message -----
From: “Feroz Gora”
To: “File Systems Developers”
Sent: Thursday, October 10, 2002 11:32 PM
Subject: [ntfsd] ZwQueryDirectoryFile usage to just get the attribtues of a
file

>
> I’m using ZwQueryDirectoryFile() to retrieve the Attributes of a file
> under a directory. The thing is I’ve to keep the parent directory handle
> open for long time.
> When the request comes to get the attributes of a file ( foo.txt ) I
> retrieve the attributes thru ZwQueryDirectoryFile() function. This works
> fine first time. But when there is a request againt to retrieve the
> attributes of the same file (foo.txt ) this funciton returns the error
> STATUS_NO_MORE_FILES (0x80000006L), as if it is trying to look for another
> existance of this file even though I’ve set the parameter RestartScan =
> TRUE, so that it looks for the File from the begining again. It seems like
> a bug in this API. It might reset the scan if the parent handle is closed
> (which I haven’t tested it).


You are currently subscribed to ntfsd as: xxxxx@softricity.com
To unsubscribe send a blank email to %%email.unsub%%

This whole thread is a can of worms in that I find it hard to believe that the RestartScan parameter of ZwQueryDirectoryFile doesn’t work. In spite of that, I’ll bravely respond to this second item. I think you need to call ObOpenObjectByPointer before you call ZwClose(File).

-----Original Message-----
From: Feroz Gora [mailto:xxxxx@softricity.com]
Sent: Friday, October 11, 2002 2:13 PM
To: File Systems Developers
Subject: [ntfsd] Re: ZwQueryDirectoryFile usage to just get the
attribtues of a file

Tobias,
Thanks for the response.

  1. I can not close and open handles because the thread I’m doing this might be running in a context which
    might not have previlege to open the handle again. That is the reason I keep the handle chached in system context.
    But I did try close/open using FileObject method which failed . Following is the code I used.

HANDLE ReopenHandle( IN HANDLE hFile )
{
HANDLE FileHandle;
PFILE_OBJECT FileObject = NULL;

OBJECT_HANDLE_INFORMATION objHandle;

NTSTATUS Status;

Status = ObReferenceObjectByHandle( hFile ,
FILE_LIST_DIRECTORY | SYNCHRONIZE,
*IoFileObjectType,
KernelMode,
&FileObject,
&objHandle );

if( !NT_SUCCESS( Status ) )
{
return NULL;
}

ZwClose( hFile );

Status = ObOpenObjectByPointer( FileObject,
0,
NULL,
FILE_LIST_DIRECTORY | SYNCHRONIZE,
NULL,
KernelMode,
&FileHandle );

if( !NT_SUCCESS( Status ) )
{
return NULL;
}

if( FileObject )
{
ObDereferenceObject( FileObject);
}

return FileHandle;

}

This failed when I called ObOpenObjectByPointer() to convert the FileObject to Handle back.

Approach 2 to serch for a dummy file failed too. It still returned the same error. Even tried with existing Directory (current dir) “.” .
Maybe I should try to use the Event parameter which I’m not using it right now.

Let me know if there is anything I’m missing.

Thanks for the help.

Feroz

-----Original Message-----
From: Tobias [mailto:xxxxx@linkwave.org]
Sent: Friday, October 11, 2002 12:33 PM
To: File Systems Developers
Subject: [ntfsd] Re: ZwQueryDirectoryFile usage to just get the
attribtues of a file

Re-opening the directory will help. If not possible, maybe it
helps to query a different (even if non existing) file before,
just to cause the FS to reset the query-pointer.

Tobias

----- Original Message -----
From: “Feroz Gora”
To: “File Systems Developers”
Sent: Thursday, October 10, 2002 11:32 PM
Subject: [ntfsd] ZwQueryDirectoryFile usage to just get the attribtues of a
file

>
> I’m using ZwQueryDirectoryFile() to retrieve the Attributes of a file
> under a directory. The thing is I’ve to keep the parent directory handle
> open for long time.
> When the request comes to get the attributes of a file ( foo.txt ) I
> retrieve the attributes thru ZwQueryDirectoryFile() function. This works
> fine first time. But when there is a request againt to retrieve the
> attributes of the same file (foo.txt ) this funciton returns the error
> STATUS_NO_MORE_FILES (0x80000006L), as if it is trying to look for another
> existance of this file even though I’ve set the parameter RestartScan =
> TRUE, so that it looks for the File from the begining again. It seems like
> a bug in this API. It might reset the scan if the parent handle is closed
> (which I haven’t tested it).


You are currently subscribed to ntfsd as: xxxxx@softricity.com
To unsubscribe send a blank email to %%email.unsub%%


You are currently subscribed to ntfsd as: xxxxx@inin.com
To unsubscribe send a blank email to %%email.unsub%%

It returns a STATUS_ACCESS_DENIED when I do that.

-----Original Message-----
From: Fuller, Rob [mailto:xxxxx@inin.com]
Sent: Friday, October 11, 2002 3:21 PM
To: File Systems Developers
Subject: [ntfsd] Re: ZwQueryDirectoryFile usage to just get the
attribtues of a file

This whole thread is a can of worms in that I find it hard to believe that the RestartScan parameter of ZwQueryDirectoryFile doesn’t work. In spite of that, I’ll bravely respond to this second item. I think you need to call ObOpenObjectByPointer before you call ZwClose(File).

-----Original Message-----
From: Feroz Gora [mailto:xxxxx@softricity.com]
Sent: Friday, October 11, 2002 2:13 PM
To: File Systems Developers
Subject: [ntfsd] Re: ZwQueryDirectoryFile usage to just get the
attribtues of a file

Tobias,
Thanks for the response.

  1. I can not close and open handles because the thread I’m doing this might be running in a context which
    might not have previlege to open the handle again. That is the reason I keep the handle chached in system context.
    But I did try close/open using FileObject method which failed . Following is the code I used.

HANDLE ReopenHandle( IN HANDLE hFile )
{
HANDLE FileHandle;
PFILE_OBJECT FileObject = NULL;

OBJECT_HANDLE_INFORMATION objHandle;

NTSTATUS Status;

Status = ObReferenceObjectByHandle( hFile ,
FILE_LIST_DIRECTORY | SYNCHRONIZE,
*IoFileObjectType,
KernelMode,
&FileObject,
&objHandle );

if( !NT_SUCCESS( Status ) )
{
return NULL;
}

ZwClose( hFile );

Status = ObOpenObjectByPointer( FileObject,
0,
NULL,
FILE_LIST_DIRECTORY | SYNCHRONIZE,
NULL,
KernelMode,
&FileHandle );

if( !NT_SUCCESS( Status ) )
{
return NULL;
}

if( FileObject )
{
ObDereferenceObject( FileObject);
}

return FileHandle;

}

This failed when I called ObOpenObjectByPointer() to convert the FileObject to Handle back.

Approach 2 to serch for a dummy file failed too. It still returned the same error. Even tried with existing Directory (current dir) “.” .
Maybe I should try to use the Event parameter which I’m not using it right now.

Let me know if there is anything I’m missing.

Thanks for the help.

Feroz

-----Original Message-----
From: Tobias [mailto:xxxxx@linkwave.org]
Sent: Friday, October 11, 2002 12:33 PM
To: File Systems Developers
Subject: [ntfsd] Re: ZwQueryDirectoryFile usage to just get the
attribtues of a file

Re-opening the directory will help. If not possible, maybe it
helps to query a different (even if non existing) file before,
just to cause the FS to reset the query-pointer.

Tobias

----- Original Message -----
From: “Feroz Gora”
To: “File Systems Developers”
Sent: Thursday, October 10, 2002 11:32 PM
Subject: [ntfsd] ZwQueryDirectoryFile usage to just get the attribtues of a
file

>
> I’m using ZwQueryDirectoryFile() to retrieve the Attributes of a file
> under a directory. The thing is I’ve to keep the parent directory handle
> open for long time.
> When the request comes to get the attributes of a file ( foo.txt ) I
> retrieve the attributes thru ZwQueryDirectoryFile() function. This works
> fine first time. But when there is a request againt to retrieve the
> attributes of the same file (foo.txt ) this funciton returns the error
> STATUS_NO_MORE_FILES (0x80000006L), as if it is trying to look for another
> existance of this file even though I’ve set the parameter RestartScan =
> TRUE, so that it looks for the File from the begining again. It seems like
> a bug in this API. It might reset the scan if the parent handle is closed
> (which I haven’t tested it).


You are currently subscribed to ntfsd as: xxxxx@softricity.com
To unsubscribe send a blank email to %%email.unsub%%


You are currently subscribed to ntfsd as: xxxxx@inin.com
To unsubscribe send a blank email to %%email.unsub%%


You are currently subscribed to ntfsd as: xxxxx@softricity.com
To unsubscribe send a blank email to %%email.unsub%%