Question

I get to know from msdn documentations about ZWQueryDirectoryFile APIs usage.
I am puzzled with one particular functionality in it.

Case: My application only involves NT level APIs. I have to fetch the files and directories in a specified parent directory with ZwQueryDirectoryFile. I have to allocate buffer with a length which is unknown. So I would like to do it by allocating 4096 and get the entities fit for the size and have to allocate further to get the remaining till ERROR_NO_MORE_FILES.
FindNextFile uses the same concept by calling ZWQueryDirectoryFIle phase by Phase with buffer length 4096. So I assumed, the requirement is definitely feasible through querydirectoryfile api.
My problem is When I call Query directory file for the second time, I dont know how to inform the ZwQueryDirectoryFile api to resume from the previous fetching state.

Answer 1

You need to pass FALSE in the RestartScan argument. From the documentation:

RestartScan [in]

Set to TRUE if the scan is to start at the first entry in the
directory. Set to FALSE if resuming
the scan from a previous call.