666 lines
21 KiB
C
666 lines
21 KiB
C
/*
|
|
* Copyright (C) 2018 Alistair Leslie-Hughes
|
|
*
|
|
* This library is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU Lesser General Public
|
|
* License as published by the Free Software Foundation; either
|
|
* version 2.1 of the License, or (at your option) any later version.
|
|
*
|
|
* This library is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
* Lesser General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Lesser General Public
|
|
* License along with this library; if not, write to the Free Software
|
|
* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
|
|
*/
|
|
#ifndef __FLTKERNEL__
|
|
#define __FLTKERNEL__
|
|
|
|
#ifdef __cplusplus
|
|
extern "C" {
|
|
#endif
|
|
|
|
#include <ddk/ntifs.h>
|
|
|
|
typedef struct _FLT_FILTER *PFLT_FILTER;
|
|
typedef struct _FLT_INSTANCE *PFLT_INSTANCE;
|
|
typedef ULONG FLT_CALLBACK_DATA_FLAGS;
|
|
typedef USHORT FLT_CONTEXT_REGISTRATION_FLAGS;
|
|
typedef USHORT FLT_CONTEXT_TYPE;
|
|
typedef ULONG FLT_FILE_NAME_OPTIONS;
|
|
typedef ULONG FLT_FILTER_UNLOAD_FLAGS;
|
|
typedef ULONG FLT_INSTANCE_QUERY_TEARDOWN_FLAGS;
|
|
typedef ULONG FLT_INSTANCE_SETUP_FLAGS;
|
|
typedef ULONG FLT_INSTANCE_TEARDOWN_FLAGS;
|
|
typedef ULONG FLT_NORMALIZE_NAME_FLAGS;
|
|
typedef ULONG FLT_OPERATION_REGISTRATION_FLAGS;
|
|
typedef ULONG FLT_POST_OPERATION_FLAGS;
|
|
typedef ULONG FLT_REGISTRATION_FLAGS;
|
|
typedef void* PFLT_CONTEXT;
|
|
|
|
|
|
#define FLT_VOLUME_CONTEXT 0x0001
|
|
#define FLT_INSTANCE_CONTEXT 0x0002
|
|
#define FLT_FILE_CONTEXT 0x0004
|
|
#define FLT_STREAM_CONTEXT 0x0008
|
|
#define FLT_STREAMHANDLE_CONTEXT 0x0010
|
|
#define FLT_TRANSACTION_CONTEXT 0x0020
|
|
|
|
#define FLTFL_OPERATION_REGISTRATION_SKIP_PAGING_IO 0x00000001
|
|
#define FLTFL_OPERATION_REGISTRATION_SKIP_CACHED_IO 0x00000002
|
|
#define FLTFL_OPERATION_REGISTRATION_SKIP_NON_DASD_IO 0x00000004
|
|
|
|
#define FLTFL_INSTANCE_TEARDOWN_MANUAL 0x00000001
|
|
#define FLTFL_INSTANCE_TEARDOWN_FILTER_UNLOAD 0x00000002
|
|
#define FLTFL_INSTANCE_TEARDOWN_MANDATORY_FILTER_UNLOAD 0x00000004
|
|
#define FLTFL_INSTANCE_TEARDOWN_VOLUME_DISMOUNT 0x00000008
|
|
#define FLTFL_INSTANCE_TEARDOWN_INTERNAL_ERROR 0x00000010
|
|
|
|
/* Belongs in fltuserstructures.h */
|
|
typedef enum _FLT_FILESYSTEM_TYPE
|
|
{
|
|
FLT_FSTYPE_UNKNOWN,
|
|
FLT_FSTYPE_RAW,
|
|
FLT_FSTYPE_NTFS,
|
|
FLT_FSTYPE_FAT,
|
|
FLT_FSTYPE_CDFS,
|
|
FLT_FSTYPE_UDFS,
|
|
FLT_FSTYPE_LANMAN,
|
|
FLT_FSTYPE_WEBDAV,
|
|
FLT_FSTYPE_RDPDR,
|
|
FLT_FSTYPE_NFS,
|
|
FLT_FSTYPE_MS_NETWARE,
|
|
FLT_FSTYPE_NETWARE,
|
|
FLT_FSTYPE_BSUDF,
|
|
FLT_FSTYPE_MUP,
|
|
FLT_FSTYPE_RSFX,
|
|
FLT_FSTYPE_ROXIO_UDF1,
|
|
FLT_FSTYPE_ROXIO_UDF2,
|
|
FLT_FSTYPE_ROXIO_UDF3,
|
|
FLT_FSTYPE_TACIT,
|
|
FLT_FSTYPE_FS_REC,
|
|
FLT_FSTYPE_INCD,
|
|
FLT_FSTYPE_INCD_FAT,
|
|
FLT_FSTYPE_EXFAT,
|
|
FLT_FSTYPE_PSFS,
|
|
FLT_FSTYPE_GPFS,
|
|
FLT_FSTYPE_NPFS,
|
|
FLT_FSTYPE_MSFS,
|
|
FLT_FSTYPE_CSVFS,
|
|
FLT_FSTYPE_REFS,
|
|
FLT_FSTYPE_OPENAFS
|
|
} FLT_FILESYSTEM_TYPE, *PFLT_FILESYSTEM_TYPE;
|
|
|
|
typedef struct _FLT_NAME_CONTROL
|
|
{
|
|
UNICODE_STRING Name;
|
|
} FLT_NAME_CONTROL, *PFLT_NAME_CONTROL;
|
|
|
|
typedef enum _FLT_PREOP_CALLBACK_STATUS
|
|
{
|
|
FLT_PREOP_SUCCESS_WITH_CALLBACK,
|
|
FLT_PREOP_SUCCESS_NO_CALLBACK,
|
|
FLT_PREOP_PENDING,
|
|
FLT_PREOP_DISALLOW_FASTIO,
|
|
FLT_PREOP_COMPLETE,
|
|
FLT_PREOP_SYNCHRONIZE,
|
|
FLT_PREOP_DISALLOW_FSFILTER_IO
|
|
} FLT_PREOP_CALLBACK_STATUS, *PFLT_PREOP_CALLBACK_STATUS;
|
|
|
|
typedef enum _FLT_POSTOP_CALLBACK_STATUS
|
|
{
|
|
FLT_POSTOP_FINISHED_PROCESSING,
|
|
FLT_POSTOP_MORE_PROCESSING_REQUIRED,
|
|
FLT_POSTOP_DISALLOW_FSFILTER_IO
|
|
} FLT_POSTOP_CALLBACK_STATUS, *PFLT_POSTOP_CALLBACK_STATUS;
|
|
|
|
typedef struct _FLT_RELATED_CONTEXTS
|
|
{
|
|
PFLT_CONTEXT VolumeContext;
|
|
PFLT_CONTEXT InstanceContext;
|
|
PFLT_CONTEXT FileContext;
|
|
PFLT_CONTEXT StreamContext;
|
|
PFLT_CONTEXT StreamHandleContext;
|
|
PFLT_CONTEXT TransactionContext;
|
|
} FLT_RELATED_CONTEXTS, *PFLT_RELATED_CONTEXTS;
|
|
|
|
typedef const struct _FLT_RELATED_OBJECTS *PCFLT_RELATED_OBJECTS;
|
|
|
|
typedef union _FLT_PARAMETERS
|
|
{
|
|
struct
|
|
{
|
|
PIO_SECURITY_CONTEXT SecurityContext;
|
|
ULONG Options;
|
|
USHORT POINTER_ALIGNMENT FileAttributes;
|
|
USHORT ShareAccess;
|
|
ULONG POINTER_ALIGNMENT EaLength;
|
|
void *EaBuffer;
|
|
LARGE_INTEGER AllocationSize;
|
|
} Create;
|
|
|
|
struct
|
|
{
|
|
PIO_SECURITY_CONTEXT SecurityContext;
|
|
ULONG Options;
|
|
USHORT POINTER_ALIGNMENT Reserved;
|
|
USHORT ShareAccess;
|
|
void *Parameters;
|
|
} CreatePipe;
|
|
|
|
#undef CreateMailslot
|
|
struct
|
|
{
|
|
PIO_SECURITY_CONTEXT SecurityContext;
|
|
ULONG Options;
|
|
USHORT POINTER_ALIGNMENT Reserved;
|
|
USHORT ShareAccess;
|
|
void *Parameters;
|
|
} CreateMailslot;
|
|
|
|
struct
|
|
{
|
|
ULONG Length;
|
|
ULONG POINTER_ALIGNMENT Key;
|
|
LARGE_INTEGER ByteOffset;
|
|
void *ReadBuffer;
|
|
PMDL MdlAddress;
|
|
} Read;
|
|
|
|
struct
|
|
{
|
|
ULONG Length;
|
|
ULONG POINTER_ALIGNMENT Key;
|
|
LARGE_INTEGER ByteOffset;
|
|
void *WriteBuffer;
|
|
PMDL MdlAddress;
|
|
} Write;
|
|
|
|
struct
|
|
{
|
|
ULONG Length;
|
|
FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass;
|
|
void *InfoBuffer;
|
|
} QueryFileInformation;
|
|
|
|
struct
|
|
{
|
|
ULONG Length;
|
|
FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass;
|
|
PFILE_OBJECT ParentOfTarget;
|
|
union
|
|
{
|
|
struct
|
|
{
|
|
BOOLEAN ReplaceIfExists;
|
|
BOOLEAN AdvanceOnly;
|
|
} DUMMYSTRUCTNAME;
|
|
ULONG ClusterCount;
|
|
HANDLE DeleteHandle;
|
|
} DUMMYUNIONNAME;
|
|
void *InfoBuffer;
|
|
} SetFileInformation;
|
|
|
|
struct
|
|
{
|
|
ULONG Length;
|
|
void *EaList;
|
|
ULONG EaListLength;
|
|
ULONG POINTER_ALIGNMENT EaIndex;
|
|
void *EaBuffer;
|
|
PMDL MdlAddress;
|
|
} QueryEa;
|
|
|
|
struct
|
|
{
|
|
ULONG Length;
|
|
void *EaBuffer;
|
|
PMDL MdlAddress;
|
|
} SetEa;
|
|
|
|
struct
|
|
{
|
|
ULONG Length;
|
|
FS_INFORMATION_CLASS POINTER_ALIGNMENT FsInformationClass;
|
|
void *VolumeBuffer;
|
|
} QueryVolumeInformation;
|
|
|
|
struct
|
|
{
|
|
ULONG Length;
|
|
FS_INFORMATION_CLASS POINTER_ALIGNMENT FsInformationClass;
|
|
void *VolumeBuffer;
|
|
} SetVolumeInformation;
|
|
|
|
union
|
|
{
|
|
struct
|
|
{
|
|
ULONG Length;
|
|
PUNICODE_STRING FileName;
|
|
FILE_INFORMATION_CLASS FileInformationClass;
|
|
ULONG POINTER_ALIGNMENT FileIndex;
|
|
void *DirectoryBuffer;
|
|
PMDL MdlAddress;
|
|
} QueryDirectory;
|
|
|
|
struct
|
|
{
|
|
ULONG Length;
|
|
ULONG POINTER_ALIGNMENT CompletionFilter;
|
|
ULONG POINTER_ALIGNMENT Spare1;
|
|
ULONG POINTER_ALIGNMENT Spare2;
|
|
void *DirectoryBuffer;
|
|
PMDL MdlAddress;
|
|
} NotifyDirectory;
|
|
|
|
struct
|
|
{
|
|
ULONG Length;
|
|
ULONG POINTER_ALIGNMENT CompletionFilter;
|
|
DIRECTORY_NOTIFY_INFORMATION_CLASS POINTER_ALIGNMENT DirectoryNotifyInformationClass;
|
|
ULONG POINTER_ALIGNMENT Spare2;
|
|
void *DirectoryBuffer;
|
|
PMDL MdlAddress;
|
|
} NotifyDirectoryEx;
|
|
} DirectoryControl;
|
|
|
|
union
|
|
{
|
|
struct
|
|
{
|
|
PVPB Vpb;
|
|
PDEVICE_OBJECT DeviceObject;
|
|
} VerifyVolume;
|
|
|
|
struct
|
|
{
|
|
ULONG OutputBufferLength;
|
|
ULONG POINTER_ALIGNMENT InputBufferLength;
|
|
ULONG POINTER_ALIGNMENT FsControlCode;
|
|
} Common;
|
|
|
|
struct
|
|
{
|
|
ULONG OutputBufferLength;
|
|
ULONG POINTER_ALIGNMENT InputBufferLength;
|
|
ULONG POINTER_ALIGNMENT FsControlCode;
|
|
void *InputBuffer;
|
|
void *OutputBuffer;
|
|
PMDL OutputMdlAddress;
|
|
} Neither;
|
|
|
|
struct
|
|
{
|
|
ULONG OutputBufferLength;
|
|
ULONG POINTER_ALIGNMENT InputBufferLength;
|
|
ULONG POINTER_ALIGNMENT FsControlCode;
|
|
void *SystemBuffer;
|
|
} Buffered;
|
|
|
|
struct
|
|
{
|
|
ULONG OutputBufferLength;
|
|
ULONG POINTER_ALIGNMENT InputBufferLength;
|
|
ULONG POINTER_ALIGNMENT FsControlCode;
|
|
void *InputSystemBuffer;
|
|
void *OutputBuffer;
|
|
PMDL OutputMdlAddress;
|
|
} Direct;
|
|
} FileSystemControl;
|
|
|
|
union
|
|
{
|
|
struct
|
|
{
|
|
ULONG OutputBufferLength;
|
|
ULONG POINTER_ALIGNMENT InputBufferLength;
|
|
ULONG POINTER_ALIGNMENT IoControlCode;
|
|
} Common;
|
|
|
|
struct
|
|
{
|
|
ULONG OutputBufferLength;
|
|
ULONG POINTER_ALIGNMENT InputBufferLength;
|
|
ULONG POINTER_ALIGNMENT IoControlCode;
|
|
void *InputBuffer;
|
|
void *OutputBuffer;
|
|
PMDL OutputMdlAddress;
|
|
} Neither;
|
|
|
|
struct
|
|
{
|
|
ULONG OutputBufferLength;
|
|
ULONG POINTER_ALIGNMENT InputBufferLength;
|
|
ULONG POINTER_ALIGNMENT IoControlCode;
|
|
void *SystemBuffer;
|
|
} Buffered;
|
|
|
|
struct
|
|
{
|
|
ULONG OutputBufferLength;
|
|
ULONG POINTER_ALIGNMENT InputBufferLength;
|
|
ULONG POINTER_ALIGNMENT IoControlCode;
|
|
void *InputSystemBuffer;
|
|
void *OutputBuffer;
|
|
PMDL OutputMdlAddress;
|
|
} Direct;
|
|
|
|
struct
|
|
{
|
|
ULONG OutputBufferLength;
|
|
ULONG POINTER_ALIGNMENT InputBufferLength;
|
|
ULONG POINTER_ALIGNMENT IoControlCode;
|
|
void *InputBuffer;
|
|
void *OutputBuffer;
|
|
} FastIo;
|
|
} DeviceIoControl;
|
|
|
|
struct
|
|
{
|
|
PLARGE_INTEGER Length;
|
|
ULONG POINTER_ALIGNMENT Key;
|
|
LARGE_INTEGER ByteOffset;
|
|
PEPROCESS ProcessId;
|
|
BOOLEAN FailImmediately;
|
|
BOOLEAN ExclusiveLock;
|
|
} LockControl;
|
|
|
|
struct
|
|
{
|
|
SECURITY_INFORMATION SecurityInformation;
|
|
ULONG POINTER_ALIGNMENT Length;
|
|
void *SecurityBuffer;
|
|
PMDL MdlAddress;
|
|
} QuerySecurity;
|
|
|
|
struct
|
|
{
|
|
SECURITY_INFORMATION SecurityInformation;
|
|
PSECURITY_DESCRIPTOR SecurityDescriptor;
|
|
} SetSecurity;
|
|
|
|
struct
|
|
{
|
|
ULONG_PTR ProviderId;
|
|
void *DataPath;
|
|
ULONG BufferSize;
|
|
void *Buffer;
|
|
} WMI;
|
|
|
|
struct
|
|
{
|
|
ULONG Length;
|
|
PSID StartSid;
|
|
PFILE_GET_QUOTA_INFORMATION SidList;
|
|
ULONG SidListLength;
|
|
void *QuotaBuffer;
|
|
PMDL MdlAddress;
|
|
} QueryQuota;
|
|
|
|
struct
|
|
{
|
|
ULONG Length;
|
|
void *QuotaBuffer;
|
|
PMDL MdlAddress;
|
|
} SetQuota;
|
|
|
|
union
|
|
{
|
|
struct
|
|
{
|
|
PCM_RESOURCE_LIST AllocatedResources;
|
|
PCM_RESOURCE_LIST AllocatedResourcesTranslated;
|
|
} StartDevice;
|
|
|
|
struct
|
|
{
|
|
DEVICE_RELATION_TYPE Type;
|
|
} QueryDeviceRelations;
|
|
|
|
struct
|
|
{
|
|
const GUID *InterfaceType;
|
|
USHORT Size;
|
|
USHORT Version;
|
|
PINTERFACE Interface;
|
|
void *InterfaceSpecificData;
|
|
} QueryInterface;
|
|
|
|
struct
|
|
{
|
|
PDEVICE_CAPABILITIES Capabilities;
|
|
} DeviceCapabilities;
|
|
|
|
struct
|
|
{
|
|
PIO_RESOURCE_REQUIREMENTS_LIST IoResourceRequirementList;
|
|
} FilterResourceRequirements;
|
|
|
|
struct
|
|
{
|
|
ULONG WhichSpace;
|
|
void *Buffer;
|
|
ULONG Offset;
|
|
ULONG POINTER_ALIGNMENT Length;
|
|
} ReadWriteConfig;
|
|
|
|
struct
|
|
{
|
|
BOOLEAN Lock;
|
|
} SetLock;
|
|
|
|
struct {
|
|
BUS_QUERY_ID_TYPE IdType;
|
|
} QueryId;
|
|
|
|
struct
|
|
{
|
|
DEVICE_TEXT_TYPE DeviceTextType;
|
|
LCID POINTER_ALIGNMENT LocaleId;
|
|
} QueryDeviceText;
|
|
|
|
struct
|
|
{
|
|
BOOLEAN InPath;
|
|
BOOLEAN Reserved[3];
|
|
DEVICE_USAGE_NOTIFICATION_TYPE POINTER_ALIGNMENT Type;
|
|
} UsageNotification;
|
|
} Pnp;
|
|
|
|
struct
|
|
{
|
|
FS_FILTER_SECTION_SYNC_TYPE SyncType;
|
|
ULONG PageProtection;
|
|
PFS_FILTER_SECTION_SYNC_OUTPUT OutputInformation;
|
|
} AcquireForSectionSynchronization;
|
|
|
|
struct
|
|
{
|
|
PLARGE_INTEGER EndingOffset;
|
|
PERESOURCE *ResourceToRelease;
|
|
} AcquireForModifiedPageWriter;
|
|
|
|
struct
|
|
{
|
|
PERESOURCE ResourceToRelease;
|
|
} ReleaseForModifiedPageWriter;
|
|
|
|
struct
|
|
{
|
|
PIRP Irp;
|
|
void *FileInformation;
|
|
PULONG Length;
|
|
FILE_INFORMATION_CLASS FileInformationClass;
|
|
} QueryOpen;
|
|
|
|
struct
|
|
{
|
|
LARGE_INTEGER FileOffset;
|
|
ULONG Length;
|
|
ULONG POINTER_ALIGNMENT LockKey;
|
|
BOOLEAN POINTER_ALIGNMENT CheckForReadOperation;
|
|
} FastIoCheckIfPossible;
|
|
|
|
struct
|
|
{
|
|
PIRP Irp;
|
|
PFILE_NETWORK_OPEN_INFORMATION NetworkInformation;
|
|
} NetworkQueryOpen;
|
|
|
|
struct
|
|
{
|
|
LARGE_INTEGER FileOffset;
|
|
ULONG POINTER_ALIGNMENT Length;
|
|
ULONG POINTER_ALIGNMENT Key;
|
|
PMDL *MdlChain;
|
|
} MdlRead;
|
|
|
|
struct
|
|
{
|
|
PMDL MdlChain;
|
|
} MdlReadComplete;
|
|
|
|
struct
|
|
{
|
|
LARGE_INTEGER FileOffset;
|
|
ULONG POINTER_ALIGNMENT Length;
|
|
ULONG POINTER_ALIGNMENT Key;
|
|
PMDL *MdlChain;
|
|
} PrepareMdlWrite;
|
|
|
|
struct
|
|
{
|
|
LARGE_INTEGER FileOffset;
|
|
PMDL MdlChain;
|
|
} MdlWriteComplete;
|
|
|
|
struct
|
|
{
|
|
ULONG DeviceType;
|
|
} MountVolume;
|
|
|
|
struct
|
|
{
|
|
void *Argument1;
|
|
void *Argument2;
|
|
void *Argument3;
|
|
void *Argument4;
|
|
void *Argument5;
|
|
LARGE_INTEGER Argument6;
|
|
} Others;
|
|
} FLT_PARAMETERS, *PFLT_PARAMETERS;
|
|
|
|
typedef struct _FLT_IO_PARAMETER_BLOCK
|
|
{
|
|
ULONG IrpFlags;
|
|
UCHAR MajorFunction;
|
|
UCHAR MinorFunction;
|
|
UCHAR OperationFlags;
|
|
UCHAR Reserved;
|
|
PFILE_OBJECT TargetFileObject;
|
|
PFLT_INSTANCE TargetInstance;
|
|
FLT_PARAMETERS Parameters;
|
|
} FLT_IO_PARAMETER_BLOCK, *PFLT_IO_PARAMETER_BLOCK;
|
|
|
|
typedef struct _FLT_CALLBACK_DATA
|
|
{
|
|
FLT_CALLBACK_DATA_FLAGS Flags;
|
|
PETHREAD const Thread;
|
|
PFLT_IO_PARAMETER_BLOCK const Iopb;
|
|
IO_STATUS_BLOCK IoStatus;
|
|
struct _FLT_TAG_DATA_BUFFER *TagData;
|
|
|
|
union
|
|
{
|
|
struct
|
|
{
|
|
LIST_ENTRY QueueLinks;
|
|
void *QueueContext[2];
|
|
} DUMMYSTRUCTNAME;
|
|
void *FilterContext[4];
|
|
} DUMMYUNIONNAME;
|
|
KPROCESSOR_MODE RequestorMode;
|
|
} FLT_CALLBACK_DATA, *PFLT_CALLBACK_DATA;
|
|
|
|
typedef void* (WINAPI *PFLT_CONTEXT_ALLOCATE_CALLBACK)(POOL_TYPE,SIZE_T,FLT_CONTEXT_TYPE);
|
|
typedef void (WINAPI *PFLT_CONTEXT_CLEANUP_CALLBACK)(PFLT_CONTEXT, FLT_CONTEXT_TYPE);
|
|
typedef void (WINAPI *PFLT_CONTEXT_FREE_CALLBACK)(void *, FLT_CONTEXT_TYPE);
|
|
typedef NTSTATUS (WINAPI *PFLT_FILTER_UNLOAD_CALLBACK)(FLT_FILTER_UNLOAD_FLAGS);
|
|
typedef NTSTATUS (WINAPI *PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK)(PCFLT_RELATED_OBJECTS,
|
|
FLT_INSTANCE_QUERY_TEARDOWN_FLAGS);
|
|
typedef NTSTATUS (WINAPI *PFLT_GENERATE_FILE_NAME)(PFLT_INSTANCE, PFILE_OBJECT,PFLT_CALLBACK_DATA,
|
|
FLT_FILE_NAME_OPTIONS,PBOOLEAN, PFLT_NAME_CONTROL);
|
|
typedef NTSTATUS (WINAPI *PFLT_INSTANCE_SETUP_CALLBACK)(PCFLT_RELATED_OBJECTS,FLT_INSTANCE_SETUP_FLAGS,
|
|
DEVICE_TYPE,FLT_FILESYSTEM_TYPE);
|
|
typedef void (WINAPI *PFLT_INSTANCE_TEARDOWN_CALLBACK)(PCFLT_RELATED_OBJECTS, FLT_INSTANCE_TEARDOWN_FLAGS);
|
|
typedef void (WINAPI *PFLT_NORMALIZE_CONTEXT_CLEANUP)(void**);
|
|
typedef NTSTATUS (WINAPI *PFLT_NORMALIZE_NAME_COMPONENT)(PFLT_INSTANCE, PCUNICODE_STRING, USHORT,
|
|
PCUNICODE_STRING,PFILE_NAMES_INFORMATION,ULONG,FLT_NORMALIZE_NAME_FLAGS, void **);
|
|
typedef NTSTATUS (WINAPI *PFLT_NORMALIZE_NAME_COMPONENT_EX)(PFLT_INSTANCE, PFILE_OBJECT, PCUNICODE_STRING,
|
|
USHORT, PCUNICODE_STRING,PFILE_NAMES_INFORMATION, ULONG, FLT_NORMALIZE_NAME_FLAGS Flags,
|
|
void **NormalizationContext);
|
|
typedef FLT_PREOP_CALLBACK_STATUS (WINAPI *PFLT_PRE_OPERATION_CALLBACK)(PFLT_CALLBACK_DATA,
|
|
PCFLT_RELATED_OBJECTS, void**);
|
|
typedef FLT_POSTOP_CALLBACK_STATUS (WINAPI *PFLT_POST_OPERATION_CALLBACK)(PFLT_CALLBACK_DATA,
|
|
PCFLT_RELATED_OBJECTS, void*, FLT_POST_OPERATION_FLAGS);
|
|
typedef NTSTATUS (WINAPI *PFLT_SECTION_CONFLICT_NOTIFICATION_CALLBACK)(PFLT_INSTANCE, PFLT_CONTEXT,
|
|
PFLT_CALLBACK_DATA);
|
|
typedef NTSTATUS (WINAPI *PFLT_TRANSACTION_NOTIFICATION_CALLBACK)(PCFLT_RELATED_OBJECTS, PFLT_CONTEXT, ULONG);
|
|
|
|
typedef struct _FLT_CONTEXT_REGISTRATION
|
|
{
|
|
FLT_CONTEXT_TYPE ContextType;
|
|
FLT_CONTEXT_REGISTRATION_FLAGS Flags;
|
|
PFLT_CONTEXT_CLEANUP_CALLBACK ContextCleanupCallback;
|
|
SIZE_T Size;
|
|
ULONG PoolTag;
|
|
PFLT_CONTEXT_ALLOCATE_CALLBACK ContextAllocateCallback;
|
|
PFLT_CONTEXT_FREE_CALLBACK ContextFreeCallback;
|
|
void *Reserved1;
|
|
} FLT_CONTEXT_REGISTRATION, *PFLT_CONTEXT_REGISTRATION;
|
|
|
|
typedef const FLT_CONTEXT_REGISTRATION *PCFLT_CONTEXT_REGISTRATION;
|
|
|
|
typedef struct _FLT_OPERATION_REGISTRATION
|
|
{
|
|
UCHAR MajorFunction;
|
|
FLT_OPERATION_REGISTRATION_FLAGS Flags;
|
|
PFLT_PRE_OPERATION_CALLBACK PreOperation;
|
|
PFLT_POST_OPERATION_CALLBACK PostOperation;
|
|
void *Reserved1;
|
|
} FLT_OPERATION_REGISTRATION, *PFLT_OPERATION_REGISTRATION;
|
|
|
|
typedef struct _FLT_REGISTRATION
|
|
{
|
|
USHORT Size;
|
|
USHORT Version;
|
|
FLT_REGISTRATION_FLAGS Flags;
|
|
const FLT_CONTEXT_REGISTRATION *ContextRegistration;
|
|
const FLT_OPERATION_REGISTRATION *OperationRegistration;
|
|
PFLT_FILTER_UNLOAD_CALLBACK FilterUnloadCallback;
|
|
PFLT_INSTANCE_SETUP_CALLBACK InstanceSetupCallback;
|
|
PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK InstanceQueryTeardownCallback;
|
|
PFLT_INSTANCE_TEARDOWN_CALLBACK InstanceTeardownStartCallback;
|
|
PFLT_INSTANCE_TEARDOWN_CALLBACK InstanceTeardownCompleteCallback;
|
|
PFLT_GENERATE_FILE_NAME GenerateFileNameCallback;
|
|
PFLT_NORMALIZE_NAME_COMPONENT NormalizeNameComponentCallback;
|
|
PFLT_NORMALIZE_CONTEXT_CLEANUP NormalizeContextCleanupCallback;
|
|
PFLT_TRANSACTION_NOTIFICATION_CALLBACK TransactionNotificationCallback;
|
|
PFLT_NORMALIZE_NAME_COMPONENT_EX NormalizeNameComponentExCallback;
|
|
PFLT_SECTION_CONFLICT_NOTIFICATION_CALLBACK SectionNotificationCallback;
|
|
} FLT_REGISTRATION, *PFLT_REGISTRATION;
|
|
|
|
|
|
NTSTATUS WINAPI FltRegisterFilter(PDRIVER_OBJECT, const FLT_REGISTRATION *, PFLT_FILTER *);
|
|
NTSTATUS WINAPI FltStartFiltering(PFLT_FILTER);
|
|
void WINAPI FltUnregisterFilter(PFLT_FILTER);
|
|
|
|
#ifdef __cplusplus
|
|
}
|
|
#endif
|
|
|
|
#endif
|