Path parameters in Hotline are formatted in a rather obscure way, and are not properly explained in the official protocol document. Fortunately, they were reverse-engineered and they are layed out in Virtual1's Hotline Server Protocol Guide as follows:
short (directory levels) • one or more directory levels • short (0) not sure what it's for • byte (length of dir name) • string (dir name)
Let's look at an example. Imagine we want to get the listing for the directory '/Uploads/Hutch' on the server. We will send a Get File Name List transaction (ID 200). The only parameter (binary) will contain 2 bytes stating the number of directory levels (two in this case). Then two zero bytes, then a byte stating the length of the first level name ("Uploads"), in this case 7 (note that strings are not null-terminated anywhere in the protocol). Then the string itself: "Uploads". For the next level we will add right after this string, another two zero bytes, one byte for the directory name length: 5, and the name itself: "Hutch".
News paths work the same way (for threaded news). Instead of directories, the levels are constituted by 'bundles' (collections of categories) and 'categories' (collections of news items), but the format for the path parameter is the same.
Remember that although all path parameters share the same structure, their IDs are different (202 for file paths and 325 for news paths).