Hey guys, So currently I'm trying to hook NtQueryDirectoryFile in explorer to hide files, it works but the problem is in every folder, one file dosen't get included in the list of files in the returned buffer of the original function, but my hook code doesnt have problem i am traversing the entire returned linked list so i think its actually meant to be like this but i could be wrong
maybe before this another function is called and gets the first file then calls NtQueryDirectoryFile? i couldnt find anything useful on the internet about this
also I'm currently only hooking the FileInformationClass = 37, meaning the returned structure is PFILE_ID_BOTH_DIR_INFORMATION, but this is the only one that seems to be relevant, but i could be wrong, there are 9-10 more classes but the microsoft's great documentation isn't very clear
so anyone has any clue on this?
maybe before this another function is called and gets the first file then calls NtQueryDirectoryFile? i couldnt find anything useful on the internet about this
also I'm currently only hooking the FileInformationClass = 37, meaning the returned structure is PFILE_ID_BOTH_DIR_INFORMATION, but this is the only one that seems to be relevant, but i could be wrong, there are 9-10 more classes but the microsoft's great documentation isn't very clear
so anyone has any clue on this?