Undocumented functions of NTDLL

2OO1, 1O February


Gridstore - NonStop Storage

NtNotifyChangeDirectoryFile
NtNotifyChangeDirectoryFile

NTSYSAPI 
NTSTATUS
NTAPI

NtNotifyChangeDirectoryFile(


  IN HANDLE               FileHandle,
  IN HANDLE               Event OPTIONAL,
  IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
  IN PVOID                ApcContext OPTIONAL,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  OUT PVOID               Buffer,
  IN ULONG                BufferSize,
  IN ULONG                CompletionFilter,
  IN BOOLEAN              WatchTree );



NtNotifyChangeDirectoryFile is used to process changes to directory File Object. Becouse function returns immediatelly with STATUS_PENDING, you must decide to use Event Object or APC routine as notification form.


  • FileHandle
    •     HANDLE to File Object opened with SYNCHRONIZE access and FILE_DIRECTORY_FILE option set.
  • Event
    •     HANDLE to Event Object. Event can be created as NotificationEvent or SynchronizationEvent, but second one is better in this situation.
  • ApcRoutine
    •     Address of user's APC routine, queued when change complete.
  • ApcContext
    •     Optional parameter for ApcRoutine.
  • IoStatusBlock
    •     IO result of call. Status member in IoStatusBlock can result STATUS_NOTIFY_ENUM_DIR when Buffer was to small.
  • Buffer
    •     User's allocated buffer for change informations. It contains one or more of FILE_NOTIFY_INFORMATION structures.
  • BufferSize
    •     Size of Buffer, in bytes.
  • CompletionFilter
    •     Mask specifing what sort of changes should be monitored. Can be combination of:
  • WatchTree
    •     If set, all subdirectiories of specified directory will be also monitored.


    Documented by:
    Tomasz Nowak
    Bo Branten



    Requirements:
    Library: ntdll.lib


    See also:
    EVENT_TYPE
    FILE_NOTIFY_INFORMATION