How to hide the directory?thx

NTFSD
1

I use the method of modifying the Irp->IoStatus.Information to hidden
file/directory,when the IRP_MN_QUERY_DIRECTORY returned only one entry,the
Querybuffer->NextEntryOffset==0,so can’t hide the direcotry. Can anyone
help me?

2

set Irp->UserBuffer = NULL in completion routien when only ont entry.

“znsoft” дÈëÏûÏ¢ÐÂÎÅ:xxxxx@ntfsd…
> I use the method of modifying the Irp->IoStatus.Information to hidden
> file/directory,when the IRP_MN_QUERY_DIRECTORY returned only one entry,the
> Querybuffer->NextEntryOffset==0,so can’t hide the direcotry. Can anyone
> help me?
>
>
>

3

Peter Scott said:

Directory information is obtained through the
IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY entry point. If you are an
FSD, then just don’t add the entries to the buffer returned. If you are a
filter, grab the directory information buffer in a completion routine and
mess it up there.

For deletion and rename processing, look at the IRP_MJ_SET_INFORMATION with
an information class of FileDispositionInformation and FileRenameInformation
respectively.

Pete
Peter Scott
xxxxx@KernelDrivers.com
http://www.KernelDrivers.com

“znsoft” дÈëÓʼþ news:xxxxx@ntfsd…
> I use the method of modifying the Irp->IoStatus.Information to hidden
> file/directory,when the IRP_MN_QUERY_DIRECTORY returned only one entry,the
> Querybuffer->NextEntryOffset==0,so can’t hide the direcotry. Can anyone
> help me?
>
>
>

4

If your Irp->IoStatus.Information is non-zero and the NextEntryOffset == 0
then the value in Irp->IoStatus.Information is the amount of returned data
in the buffer. If this is the entry which you are trying to hide, then zero
the data buffer, set the Irp->IoStatus.Information = 0 and return
STATUS_NO_SUCH_FILE, if it is a single query request.

If this is a multi-entry return but only a single entry is being returned at
a time, for whatever reason, then you will need to re-query the FSD to see
if there are more entries.

Pete

Kernel Drivers
Windows Filesystem and Device Driver Consulting
www.KernelDrivers.com
(303)546-0300

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of znsoft
Sent: Monday, April 04, 2005 2:32 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] How to hide the directory?thx

I use the method of modifying the Irp->IoStatus.Information to hidden
file/directory,when the IRP_MN_QUERY_DIRECTORY returned only one entry,the
Querybuffer->NextEntryOffset==0,so can’t hide the direcotry. Can anyone
help me?

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@kerneldrivers.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

5

You may use SL_RETURN_SINGLE_ENTRY flag to see if a single-entry query
was requested.
Pawan

On Apr 6, 2005 8:10 AM, Peter Scott wrote:
>
> If your Irp->IoStatus.Information is non-zero and the NextEntryOffset == 0
> then the value in Irp->IoStatus.Information is the amount of returned data
> in the buffer. If this is the entry which you are trying to hide, then zero
> the data buffer, set the Irp->IoStatus.Information = 0 and return
> STATUS_NO_SUCH_FILE, if it is a single query request.
>
> If this is a multi-entry return but only a single entry is being returned at
> a time, for whatever reason, then you will need to re-query the FSD to see
> if there are more entries.
>
> Pete
>
> Kernel Drivers
> Windows Filesystem and Device Driver Consulting
> www.KernelDrivers.com
> (303)546-0300
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of znsoft
> Sent: Monday, April 04, 2005 2:32 AM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] How to hide the directory?thx
>
> I use the method of modifying the Irp->IoStatus.Information to hidden
> file/directory,when the IRP_MN_QUERY_DIRECTORY returned only one entry,the
> Querybuffer->NextEntryOffset==0,so can’t hide the direcotry. Can anyone
> help me?
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@kerneldrivers.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
> —
> Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

6

Right, but this does not mean that if this flag is not set that a single
entry will not be returned. For instance, if the user buffer passed is large
enough to handle only a single entry.

Pete

Kernel Drivers
Windows Filesystem and Device Driver Consulting
www.KernelDrivers.com
(303)546-0300

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Pawan Khatri
Sent: Thursday, April 07, 2005 10:40 PM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] How to hide the directory?thx

You may use SL_RETURN_SINGLE_ENTRY flag to see if a single-entry query
was requested.
Pawan

On Apr 6, 2005 8:10 AM, Peter Scott wrote:
>
> If your Irp->IoStatus.Information is non-zero and the NextEntryOffset == 0
> then the value in Irp->IoStatus.Information is the amount of returned data
> in the buffer. If this is the entry which you are trying to hide, then
zero
> the data buffer, set the Irp->IoStatus.Information = 0 and return
> STATUS_NO_SUCH_FILE, if it is a single query request.
>
> If this is a multi-entry return but only a single entry is being returned
at
> a time, for whatever reason, then you will need to re-query the FSD to see
> if there are more entries.
>
> Pete
>
> Kernel Drivers
> Windows Filesystem and Device Driver Consulting
> www.KernelDrivers.com
> (303)546-0300
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of znsoft
> Sent: Monday, April 04, 2005 2:32 AM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] How to hide the directory?thx
>
> I use the method of modifying the Irp->IoStatus.Information to hidden
> file/directory,when the IRP_MN_QUERY_DIRECTORY returned only one entry,the
> Querybuffer->NextEntryOffset==0,so can’t hide the direcotry. Can anyone
> help me?
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@kerneldrivers.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@kerneldrivers.com
To unsubscribe send a blank email to xxxxx@lists.osr.com