CBFS Filter 2020 C++ Builder Edition

Questions / Feedback?

BeforeQueryFileInfo Event

Fires before information about a file or directory is retrieved.

Syntax

typedef struct {
  String FileName;
  int FileInformationClass;
  void* Buffer;
  int BufferLength;
  int ValidBytes;
  void* FileContext;
  void* HandleContext;
  bool ProcessRequest;
  int ResultCode;
} TcbfCBFilterBeforeQueryFileInfoEventParams;

typedef void __fastcall (__closure *TcbfCBFilterBeforeQueryFileInfoEvent)(System::TObject* Sender, TcbfCBFilterBeforeQueryFileInfoEventParams *e);

__property TcbfCBFilterBeforeQueryFileInfoEvent OnBeforeQueryFileInfo = { read=FOnBeforeQueryFileInfo, write=FOnBeforeQueryFileInfo };

Remarks

This event fires before information about the file or directory specified by FileName is retrieved; typically in response to the Windows API's NtQueryInformationFile function.

Applications may use this event to modify the request's data before it continues onward, or to handle the request entirely (preventing it from continuing onward). In these cases, applications must:

  1. Copy no more than BufferLength bytes into Buffer.
  2. Update the ValidBytes parameter's value afterwards so that it correctly reflects the amount of data in Buffer.
  3. If the request has been handled and should not continue onward: set ProcessRequest to false.

Applications only need to handle this event if they've added a standard filter rule that includes the FS_CE_BEFORE_QUERY_FILE_INFO flag.

The FileInformationClass parameter indicates what kind of file information is requested. Please refer to the NtQueryInformationFile function's documentation for more information about possible values.

The Buffer parameter points to a memory buffer that receives the requested file information. The BufferLength and ValidBytes parameters reflect the capacity of Buffer and the length of the data it contains (respectively), in bytes; ValidBytes may be less than BufferLength. Please refer to the Buffer Parameters topic for more information on how to work with memory buffer event parameters.

The format of the data itself is determined by the specified FileInformationClass; please refer to the NtQueryInformationFile function's documentation for more information.

The FileContext and HandleContext parameters are placeholders for application-defined data associated with the file and specific handle, respectively. Please refer to the Contexts topic for more information.

The ProcessRequest parameter controls whether the request is sent onwards for further processing by subsequent filter drivers and the filesystem; it is true by default.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason (e.g., a resource isn't available, security checks failed, etc.), set it to a non-zero value to report an appropriate error. Please refer to the Error Reporting and Handling topic for more information.

This event is fired synchronously; please refer to the Event Types topic for more information.

 
 
Copyright (c) 2020 Callback Technologies, Inc. - All rights reserved.
CBFS Filter 2020 C++ Builder Edition - Version 20.0 [Build 7543]