2

i'v already posted a question [question] : Directory relative ZwCreateFile

but i am unable to build the driver. I have posted the error as well. So i was wondering is there any other way to list files in a directory(kernel space) without using "ZwQueryDirectoryFile" routine.

Community
  • 1
  • 1
Ansh David
  • 654
  • 1
  • 10
  • 26
  • 1
    Technically, there's `NtQueryDirectoryFile`, but it's essentially identical to `ZwQueryDirectoryFile`, so it's unlikely to be any real help. – Jerry Coffin Jun 21 '13 at 19:55
  • I'm sorry I couldn't help further, but I'm not in a position to set up a dev machine with a DDK just to answer a question. – Mats Petersson Jun 21 '13 at 20:02
  • @Mats Peterson its ok,i was just trying to find a way around it. :D – Ansh David Jun 21 '13 at 20:22
  • If yours is driver is minifilter (or file system filter driver) preferred API is `FltQueryDirectoryFile()` http://msdn.microsoft.com/en-us/library/windows/hardware/ff543433(v=vs.85).aspx – Rohan Jun 22 '13 at 08:33
  • @Rohan : when i just include `fltkernel.h` for the `FltQueryFile().... my` build shows errors – Ansh David Jun 22 '13 at 19:48
  • you must to post full errors messages if you want help. I think you didn`t include flt manager static library to project -> fltMgr.lib. – Evgenii Gostiukhin Jun 24 '13 at 06:23

1 Answers1

1

You can rollup your oqn IRP : IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY, but this that ZwQueryDirectoryFile doing internally.

Evgenii Gostiukhin
  • 970
  • 4
  • 8