Re: STATUS_ILLEGAL_INSTRUCTION returned by ZwQueryDirectoryFile()

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

Use GetFileInformationByHandle.


--PA


"Ernie Billing" <ErnieBilling@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message news:0305F5BA-4DC7-4B8E-A25D-73937440665D@xxxxxxxxxxxxxxxx
I'm calling ZwQueryDirectoryFile() from user mode code to get file ID and
change time during a directory scan, and its returning
STATUS_ILLEGAL_INSTRUCTION. Anyone see what I'm doing wrong?

NT::IO_STATUS_BLOCK iosb;
memset( &iosb, 0, sizeof( iosb ) );

NT::UNICODE_STRING name = { strPath.length()*sizeof( wchar_t ),
strPath.length()*sizeof( wchar_t ), const_cast< wchar_t * >( strPath.native()
) };
NT::OBJECT_ATTRIBUTES oa = { sizeof oa, 0, &name, OBJ_INHERIT, 0, 0 };

HANDLE hEvent( CreateEvent( 0, FALSE, FALSE, 0 ) );

NTSTATUS status = NTDLL::ZwOpenFile( &hDirectory,
GENERIC_READ | SYNCHRONIZE,
&oa,
&iosb,
FILE_SHARE_READ | FILE_SHARE_WRITE |
FILE_SHARE_DELETE,
FILE_SYNCHRONOUS_IO_NONALERT |
FILE_DIRECTORY_FILE);

if ( !NT_SUCCESS( status ) )
{
return status;
}

BYTE byBuffer[ sizeof( NT::PFILE_ID_FULL_DIR_INFORMATION ) +
_MAX_PATH ];

memset( &iosb, 0, sizeof( iosb ) );
status = NTDLL::ZwQueryDirectoryFile( hDirectory, hEvent, 0, 0,
&iosb, byBuffer, _countof( byBuffer ), NT::FileIdBothDirectoryInformation,
FALSE, 0, TRUE );

Puzzled,

Ernie

.