NtNotifyChangeDirectoryFile - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
#ifndef _NTIOAPI_H
NTSYSCALLAPI
NTSTATUS
NTAPI
NtNotifyChangeDirectoryFile(
_In_ HANDLE FileHandle,
_In_opt_ HANDLE Event,
_In_opt_ PIO_APC_ROUTINE ApcRoutine,
_In_opt_ PVOID ApcContext,
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
_Out_writes_bytes_(Length) PVOID Buffer, // FILE_NOTIFY_INFORMATION
_In_ ULONG Length,
_In_ ULONG CompletionFilter,
_In_ BOOLEAN WatchTree
);
View code on GitHub#ifndef _NTZWAPI_H
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwNotifyChangeDirectoryFile(
_In_ HANDLE FileHandle,
_In_opt_ HANDLE Event,
_In_opt_ PIO_APC_ROUTINE ApcRoutine,
_In_opt_ PVOID ApcContext,
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
_Out_writes_bytes_(Length) PVOID Buffer, // FILE_NOTIFY_INFORMATION
_In_ ULONG Length,
_In_ ULONG CompletionFilter,
_In_ BOOLEAN WatchTree
);
View code on GitHubNtNotifyChangeDirectoryFile is used to process changes to directory File Object. Because function returns immediately with STATUS_PENDING, you must decide to use Event Object or APC routine as notification form.
HANDLE to File Object opened with SYNCHRONIZE access and FILE_DIRECTORY_FILE option set.
HANDLE to Event Object. Event can be created as NotificationEvent or SynchronizationEvent, but second one is better in this situation.
Address of user's APC routine, queued when change complete.
Optional parameter for ApcRoutine.
IO result of call. Status member in IoStatusBlock can result STATUS_NOTIFY_ENUM_DIR when Buffer was to small.
User's allocated buffer for change information. It contains one or more of FILE_NOTIFY_INFORMATION structures.
Size of Buffer, in bytes.
Mask specifying what sort of changes should be monitored. Can be combination of:
FILE_NOTIFY_CHANGE_FILE_NAMEFILE_NOTIFY_CHANGE_DIR_NAMEFILE_NOTIFY_CHANGE_NAMEFILE_NOTIFY_CHANGE_ATTRIBUTESFILE_NOTIFY_CHANGE_SIZEFILE_NOTIFY_CHANGE_LAST_WRITEFILE_NOTIFY_CHANGE_LAST_ACCESSFILE_NOTIFY_CHANGE_CREATIONFILE_NOTIFY_CHANGE_EAFILE_NOTIFY_CHANGE_SECURITYFILE_NOTIFY_CHANGE_STREAM_NAMEFILE_NOTIFY_CHANGE_STREAM_SIZEFILE_NOTIFY_CHANGE_STREAM_WRITEIf set, all subdirectories of specified directory will be also monitored.