Undocumented functions of NTDLL

2OO1, 1O February



FILE_NOTIFY_INFORMATION
FILE_NOTIFY_INFORMATION

typedef struct _FILE_NOTIFY_INFORMATION {


  ULONG                   NextEntryOffset;
  ULONG                   Action;
  ULONG                   FileNameLength;
  WCHAR                   FileName[1];


} FILE_NOTIFY_INFORMATION, *PFILE_NOTIFY_INFORMATION;



FILE_NOTIFY_INFORMATION structure is used in processing results of call NtNotifyChangeDirectoryFile. It is defined in <WinNT.h> include file.
  • NextEntryOffset
    •     Offset to next FILE_NOTIFY_INFORMATION structure or zero, if last.
  • Action
    •     Action indicates notification purpose. Can be one of:
  • FileNameLength
    •     Length of FileName array, in bytes.
  • FileName[1]
    •     Unicode file name.


    Only some of notification reasons can be readed from Action member. In most cases is contains FILE_ACTION_MODIFIED value, and user must check sort of notitication manually.


    Documented by:
    Tomasz Nowak



    Requirements:
    Library: ntdll.lib


    See also:
    NtNotifyChangeDirectoryFile