1 /* 2 * fltkernel.h 3 * 4 * This file is part of the ReactOS DDK package. 5 * 6 * Contributors: 7 * Amine Khaldi (amine.khaldi@reactos.org) 8 * 9 * THIS SOFTWARE IS NOT COPYRIGHTED 10 * 11 * This source code is offered for use in the public domain. You may 12 * use, modify or distribute it freely. 13 * 14 * This code is distributed in the hope that it will be useful but 15 * WITHOUT ANY WARRANTY. ALL WARRANTIES, EXPRESS OR IMPLIED ARE HEREBY 16 * DISCLAIMED. This includes but is not limited to warranties of 17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 18 * 19 */ 20 #pragma once 21 22 #ifndef __FLTKERNEL__ 23 #define __FLTKERNEL__ 24 25 #ifdef __cplusplus 26 extern "C" { 27 #endif 28 29 #define FLT_MGR_BASELINE (((OSVER(NTDDI_VERSION) == NTDDI_WIN2K) && (SPVER(NTDDI_VERSION) >= SPVER(NTDDI_WIN2KSP4))) || \ 30 ((OSVER(NTDDI_VERSION) == NTDDI_WINXP) && (SPVER(NTDDI_VERSION) >= SPVER(NTDDI_WINXPSP2))) || \ 31 ((OSVER(NTDDI_VERSION) == NTDDI_WS03) && (SPVER(NTDDI_VERSION) >= SPVER(NTDDI_WS03SP1))) || \ 32 (NTDDI_VERSION >= NTDDI_VISTA)) 33 34 #define FLT_MGR_AFTER_XPSP2 (((OSVER(NTDDI_VERSION) == NTDDI_WIN2K) && (SPVER(NTDDI_VERSION) >= SPVER(NTDDI_WIN2KSP4))) || \ 35 ((OSVER(NTDDI_VERSION) == NTDDI_WINXP) && (SPVER(NTDDI_VERSION) > SPVER(NTDDI_WINXPSP2))) || \ 36 ((OSVER(NTDDI_VERSION) == NTDDI_WS03) && (SPVER(NTDDI_VERSION) >= SPVER(NTDDI_WS03SP1))) || \ 37 (NTDDI_VERSION >= NTDDI_VISTA)) 38 39 #define FLT_MGR_LONGHORN (NTDDI_VERSION >= NTDDI_VISTA) 40 #define FLT_MGR_WIN7 (NTDDI_VERSION >= NTDDI_WIN7) 41 42 #include <ntifs.h> 43 #include <fltuserstructures.h> 44 #include <initguid.h> 45 46 #if FLT_MGR_BASELINE 47 48 #if FLT_MGR_LONGHORN 49 #define FLT_ASSERT(_e) NT_ASSERT(_e) 50 #define FLT_ASSERTMSG(_m, _e) NT_ASSERTMSG(_m, _e) 51 #else 52 #define FLT_ASSERT(_e) ASSERT(_e) 53 #define FLT_ASSERTMSG(_m, _e) ASSERTMSG(_m, _e) 54 #endif /* FLT_MGR_LONGHORN */ 55 56 #define Add2Ptr(P,I) ((PVOID)((PUCHAR)(P) + (I))) 57 #define PtrOffset(B,O) ((ULONG)((ULONG_PTR)(O) - (ULONG_PTR)(B))) 58 59 #define ROUND_TO_SIZE(_length, _alignment) \ 60 ((((ULONG_PTR)(_length)) + ((_alignment)-1)) & ~(ULONG_PTR) ((_alignment) - 1)) 61 62 #define IS_ALIGNED(_pointer, _alignment) \ 63 ((((ULONG_PTR) (_pointer)) & ((_alignment) - 1)) == 0) 64 65 #define IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION ((UCHAR)-1) 66 #define IRP_MJ_RELEASE_FOR_SECTION_SYNCHRONIZATION ((UCHAR)-2) 67 #define IRP_MJ_ACQUIRE_FOR_MOD_WRITE ((UCHAR)-3) 68 #define IRP_MJ_RELEASE_FOR_MOD_WRITE ((UCHAR)-4) 69 #define IRP_MJ_ACQUIRE_FOR_CC_FLUSH ((UCHAR)-5) 70 #define IRP_MJ_RELEASE_FOR_CC_FLUSH ((UCHAR)-6) 71 #define IRP_MJ_FAST_IO_CHECK_IF_POSSIBLE ((UCHAR)-13) 72 #define IRP_MJ_NETWORK_QUERY_OPEN ((UCHAR)-14) 73 #define IRP_MJ_MDL_READ ((UCHAR)-15) 74 #define IRP_MJ_MDL_READ_COMPLETE ((UCHAR)-16) 75 #define IRP_MJ_PREPARE_MDL_WRITE ((UCHAR)-17) 76 #define IRP_MJ_MDL_WRITE_COMPLETE ((UCHAR)-18) 77 #define IRP_MJ_VOLUME_MOUNT ((UCHAR)-19) 78 #define IRP_MJ_VOLUME_DISMOUNT ((UCHAR)-20) 79 #define IRP_MJ_OPERATION_END ((UCHAR)0x80) 80 #define FLT_INTERNAL_OPERATION_COUNT 22 81 82 #define NULL_CONTEXT ((PFLT_CONTEXT)NULL) 83 84 typedef struct _FLT_FILTER *PFLT_FILTER; 85 typedef struct _FLT_VOLUME *PFLT_VOLUME; 86 typedef struct _FLT_INSTANCE *PFLT_INSTANCE; 87 typedef struct _FLT_PORT *PFLT_PORT; 88 89 typedef PVOID PFLT_CONTEXT; 90 91 #if !FLT_MGR_LONGHORN 92 typedef struct _KTRANSACTION *PKTRANSACTION; 93 #endif 94 95 #if !defined(_AMD64_) && !defined(_IA64_) && !defined(_ARM_) 96 #include "pshpack4.h" 97 #endif 98 99 typedef union _FLT_PARAMETERS { 100 struct { 101 PIO_SECURITY_CONTEXT SecurityContext; 102 ULONG Options; 103 USHORT POINTER_ALIGNMENT FileAttributes; 104 USHORT ShareAccess; 105 ULONG POINTER_ALIGNMENT EaLength; 106 PVOID EaBuffer; 107 LARGE_INTEGER AllocationSize; 108 } Create; 109 struct { 110 PIO_SECURITY_CONTEXT SecurityContext; 111 ULONG Options; 112 USHORT POINTER_ALIGNMENT Reserved; 113 USHORT ShareAccess; 114 PVOID Parameters; 115 } CreatePipe; 116 struct { 117 PIO_SECURITY_CONTEXT SecurityContext; 118 ULONG Options; 119 USHORT POINTER_ALIGNMENT Reserved; 120 USHORT ShareAccess; 121 PVOID Parameters; 122 } CreateMailslot; 123 struct { 124 ULONG Length; 125 ULONG POINTER_ALIGNMENT Key; 126 LARGE_INTEGER ByteOffset; 127 PVOID ReadBuffer; 128 PMDL MdlAddress; 129 } Read; 130 struct { 131 ULONG Length; 132 ULONG POINTER_ALIGNMENT Key; 133 LARGE_INTEGER ByteOffset; 134 PVOID WriteBuffer; 135 PMDL MdlAddress; 136 } Write; 137 struct { 138 ULONG Length; 139 FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass; 140 PVOID InfoBuffer; 141 } QueryFileInformation; 142 struct { 143 ULONG Length; 144 FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass; 145 PFILE_OBJECT ParentOfTarget; 146 _ANONYMOUS_UNION union { 147 _ANONYMOUS_STRUCT struct { 148 BOOLEAN ReplaceIfExists; 149 BOOLEAN AdvanceOnly; 150 } DUMMYSTRUCTNAME; 151 ULONG ClusterCount; 152 HANDLE DeleteHandle; 153 } DUMMYUNIONNAME; 154 PVOID InfoBuffer; 155 } SetFileInformation; 156 struct { 157 ULONG Length; 158 PVOID EaList; 159 ULONG EaListLength; 160 ULONG POINTER_ALIGNMENT EaIndex; 161 PVOID EaBuffer; 162 PMDL MdlAddress; 163 } QueryEa; 164 struct { 165 ULONG Length; 166 PVOID EaBuffer; 167 PMDL MdlAddress; 168 } SetEa; 169 struct { 170 ULONG Length; 171 FS_INFORMATION_CLASS POINTER_ALIGNMENT FsInformationClass; 172 PVOID VolumeBuffer; 173 } QueryVolumeInformation; 174 struct { 175 ULONG Length; 176 FS_INFORMATION_CLASS POINTER_ALIGNMENT FsInformationClass; 177 PVOID VolumeBuffer; 178 } SetVolumeInformation; 179 union { 180 struct { 181 ULONG Length; 182 PUNICODE_STRING FileName; 183 FILE_INFORMATION_CLASS FileInformationClass; 184 ULONG POINTER_ALIGNMENT FileIndex; 185 PVOID DirectoryBuffer; 186 PMDL MdlAddress; 187 } QueryDirectory; 188 struct { 189 ULONG Length; 190 ULONG POINTER_ALIGNMENT CompletionFilter; 191 ULONG POINTER_ALIGNMENT Spare1; 192 ULONG POINTER_ALIGNMENT Spare2; 193 PVOID DirectoryBuffer; 194 PMDL MdlAddress; 195 } NotifyDirectory; 196 } DirectoryControl; 197 union { 198 struct { 199 PVPB Vpb; 200 PDEVICE_OBJECT DeviceObject; 201 } VerifyVolume; 202 struct { 203 ULONG OutputBufferLength; 204 ULONG POINTER_ALIGNMENT InputBufferLength; 205 ULONG POINTER_ALIGNMENT FsControlCode; 206 } Common; 207 struct { 208 ULONG OutputBufferLength; 209 ULONG POINTER_ALIGNMENT InputBufferLength; 210 ULONG POINTER_ALIGNMENT FsControlCode; 211 PVOID InputBuffer; 212 PVOID OutputBuffer; 213 PMDL OutputMdlAddress; 214 } Neither; 215 struct { 216 ULONG OutputBufferLength; 217 ULONG POINTER_ALIGNMENT InputBufferLength; 218 ULONG POINTER_ALIGNMENT FsControlCode; 219 PVOID SystemBuffer; 220 } Buffered; 221 struct { 222 ULONG OutputBufferLength; 223 ULONG POINTER_ALIGNMENT InputBufferLength; 224 ULONG POINTER_ALIGNMENT FsControlCode; 225 PVOID InputSystemBuffer; 226 PVOID OutputBuffer; 227 PMDL OutputMdlAddress; 228 } Direct; 229 } FileSystemControl; 230 union { 231 struct { 232 ULONG OutputBufferLength; 233 ULONG POINTER_ALIGNMENT InputBufferLength; 234 ULONG POINTER_ALIGNMENT IoControlCode; 235 } Common; 236 struct { 237 ULONG OutputBufferLength; 238 ULONG POINTER_ALIGNMENT InputBufferLength; 239 ULONG POINTER_ALIGNMENT IoControlCode; 240 PVOID InputBuffer; 241 PVOID OutputBuffer; 242 PMDL OutputMdlAddress; 243 } Neither; 244 struct { 245 ULONG OutputBufferLength; 246 ULONG POINTER_ALIGNMENT InputBufferLength; 247 ULONG POINTER_ALIGNMENT IoControlCode; 248 PVOID SystemBuffer; 249 } Buffered; 250 struct { 251 ULONG OutputBufferLength; 252 ULONG POINTER_ALIGNMENT InputBufferLength; 253 ULONG POINTER_ALIGNMENT IoControlCode; 254 PVOID InputSystemBuffer; 255 PVOID OutputBuffer; 256 PMDL OutputMdlAddress; 257 } Direct; 258 struct { 259 ULONG OutputBufferLength; 260 ULONG POINTER_ALIGNMENT InputBufferLength; 261 ULONG POINTER_ALIGNMENT IoControlCode; 262 PVOID InputBuffer; 263 PVOID OutputBuffer; 264 } FastIo; 265 } DeviceIoControl; 266 struct { 267 PLARGE_INTEGER Length; 268 ULONG POINTER_ALIGNMENT Key; 269 LARGE_INTEGER ByteOffset; 270 PEPROCESS ProcessId; 271 BOOLEAN FailImmediately; 272 BOOLEAN ExclusiveLock; 273 } LockControl; 274 struct { 275 SECURITY_INFORMATION SecurityInformation; 276 ULONG POINTER_ALIGNMENT Length; 277 PVOID SecurityBuffer; 278 PMDL MdlAddress; 279 } QuerySecurity; 280 struct { 281 SECURITY_INFORMATION SecurityInformation; 282 PSECURITY_DESCRIPTOR SecurityDescriptor; 283 } SetSecurity; 284 struct { 285 ULONG_PTR ProviderId; 286 PVOID DataPath; 287 ULONG BufferSize; 288 PVOID Buffer; 289 } WMI; 290 struct { 291 ULONG Length; 292 PSID StartSid; 293 PFILE_GET_QUOTA_INFORMATION SidList; 294 ULONG SidListLength; 295 PVOID QuotaBuffer; 296 PMDL MdlAddress; 297 } QueryQuota; 298 struct { 299 ULONG Length; 300 PVOID QuotaBuffer; 301 PMDL MdlAddress; 302 } SetQuota; 303 union { 304 struct { 305 PCM_RESOURCE_LIST AllocatedResources; 306 PCM_RESOURCE_LIST AllocatedResourcesTranslated; 307 } StartDevice; 308 struct { 309 DEVICE_RELATION_TYPE Type; 310 } QueryDeviceRelations; 311 struct { 312 CONST GUID *InterfaceType; 313 USHORT Size; 314 USHORT Version; 315 PINTERFACE Interface; 316 PVOID InterfaceSpecificData; 317 } QueryInterface; 318 struct { 319 PDEVICE_CAPABILITIES Capabilities; 320 } DeviceCapabilities; 321 struct { 322 PIO_RESOURCE_REQUIREMENTS_LIST IoResourceRequirementList; 323 } FilterResourceRequirements; 324 struct { 325 ULONG WhichSpace; 326 PVOID Buffer; 327 ULONG Offset; 328 ULONG POINTER_ALIGNMENT Length; 329 } ReadWriteConfig; 330 struct { 331 BOOLEAN Lock; 332 } SetLock; 333 struct { 334 BUS_QUERY_ID_TYPE IdType; 335 } QueryId; 336 struct { 337 DEVICE_TEXT_TYPE DeviceTextType; 338 LCID POINTER_ALIGNMENT LocaleId; 339 } QueryDeviceText; 340 struct { 341 BOOLEAN InPath; 342 BOOLEAN Reserved[3]; 343 DEVICE_USAGE_NOTIFICATION_TYPE POINTER_ALIGNMENT Type; 344 } UsageNotification; 345 } Pnp; 346 struct { 347 FS_FILTER_SECTION_SYNC_TYPE SyncType; 348 ULONG PageProtection; 349 } AcquireForSectionSynchronization; 350 struct { 351 PLARGE_INTEGER EndingOffset; 352 PERESOURCE *ResourceToRelease; 353 } AcquireForModifiedPageWriter; 354 struct { 355 PERESOURCE ResourceToRelease; 356 } ReleaseForModifiedPageWriter; 357 struct { 358 LARGE_INTEGER FileOffset; 359 ULONG Length; 360 ULONG POINTER_ALIGNMENT LockKey; 361 BOOLEAN POINTER_ALIGNMENT CheckForReadOperation; 362 } FastIoCheckIfPossible; 363 struct { 364 PIRP Irp; 365 PFILE_NETWORK_OPEN_INFORMATION NetworkInformation; 366 } NetworkQueryOpen; 367 struct { 368 LARGE_INTEGER FileOffset; 369 ULONG POINTER_ALIGNMENT Length; 370 ULONG POINTER_ALIGNMENT Key; 371 PMDL *MdlChain; 372 } MdlRead; 373 struct { 374 PMDL MdlChain; 375 } MdlReadComplete; 376 struct { 377 LARGE_INTEGER FileOffset; 378 ULONG POINTER_ALIGNMENT Length; 379 ULONG POINTER_ALIGNMENT Key; 380 PMDL *MdlChain; 381 } PrepareMdlWrite; 382 struct { 383 LARGE_INTEGER FileOffset; 384 PMDL MdlChain; 385 } MdlWriteComplete; 386 struct { 387 ULONG DeviceType; 388 } MountVolume; 389 struct { 390 PVOID Argument1; 391 PVOID Argument2; 392 PVOID Argument3; 393 PVOID Argument4; 394 PVOID Argument5; 395 LARGE_INTEGER Argument6; 396 } Others; 397 } FLT_PARAMETERS, *PFLT_PARAMETERS; 398 399 #if !defined(_AMD64_) && !defined(_IA64_) && !defined(_ARM_) 400 #include "poppack.h" 401 #endif 402 403 typedef struct _FLT_IO_PARAMETER_BLOCK { 404 ULONG IrpFlags; 405 UCHAR MajorFunction; 406 UCHAR MinorFunction; 407 UCHAR OperationFlags; 408 UCHAR Reserved; 409 PFILE_OBJECT TargetFileObject; 410 PFLT_INSTANCE TargetInstance; 411 FLT_PARAMETERS Parameters; 412 } FLT_IO_PARAMETER_BLOCK, *PFLT_IO_PARAMETER_BLOCK; 413 414 #define FLTFL_CALLBACK_DATA_REISSUE_MASK 0x0000FFFF 415 #define FLTFL_CALLBACK_DATA_IRP_OPERATION 0x00000001 416 #define FLTFL_CALLBACK_DATA_FAST_IO_OPERATION 0x00000002 417 #define FLTFL_CALLBACK_DATA_FS_FILTER_OPERATION 0x00000004 418 #define FLTFL_CALLBACK_DATA_SYSTEM_BUFFER 0x00000008 419 #define FLTFL_CALLBACK_DATA_GENERATED_IO 0x00010000 420 #define FLTFL_CALLBACK_DATA_REISSUED_IO 0x00020000 421 #define FLTFL_CALLBACK_DATA_DRAINING_IO 0x00040000 422 #define FLTFL_CALLBACK_DATA_POST_OPERATION 0x00080000 423 #define FLTFL_CALLBACK_DATA_NEW_SYSTEM_BUFFER 0x00100000 424 #define FLTFL_CALLBACK_DATA_DIRTY 0x80000000 425 426 #define FLT_SET_CALLBACK_DATA_DIRTY(Data) FltSetCallbackDataDirty(Data) 427 #define FLT_CLEAR_CALLBACK_DATA_DIRTY(Data) FltClearCallbackDataDirty(Data) 428 #define FLT_IS_CALLBACK_DATA_DIRTY(Data) FltIsCallbackDataDirty(Data) 429 430 #define FLT_IS_IRP_OPERATION(Data) (FlagOn((Data)->Flags, FLTFL_CALLBACK_DATA_IRP_OPERATION)) 431 #define FLT_IS_FASTIO_OPERATION(Data) (FlagOn((Data)->Flags, FLTFL_CALLBACK_DATA_FAST_IO_OPERATION)) 432 #define FLT_IS_FS_FILTER_OPERATION(Data) (FlagOn((Data)->Flags, FLTFL_CALLBACK_DATA_FS_FILTER_OPERATION)) 433 #define FLT_IS_REISSUED_IO(Data) (FlagOn((Data)->Flags, FLTFL_CALLBACK_DATA_REISSUED_IO)) 434 #define FLT_IS_SYSTEM_BUFFER(Data) (FlagOn((Data)->Flags, FLTFL_CALLBACK_DATA_SYSTEM_BUFFER)) 435 436 typedef USHORT FLT_CONTEXT_TYPE; 437 438 #define FLT_VOLUME_CONTEXT 0x0001 439 #define FLT_INSTANCE_CONTEXT 0x0002 440 #define FLT_FILE_CONTEXT 0x0004 441 #define FLT_STREAM_CONTEXT 0x0008 442 #define FLT_STREAMHANDLE_CONTEXT 0x0010 443 #define FLT_TRANSACTION_CONTEXT 0x0020 444 #define FLT_CONTEXT_END 0xffff 445 446 #define FLT_ALL_CONTEXTS (FLT_VOLUME_CONTEXT | FLT_INSTANCE_CONTEXT | \ 447 FLT_FILE_CONTEXT | FLT_STREAM_CONTEXT | \ 448 FLT_STREAMHANDLE_CONTEXT | FLT_TRANSACTION_CONTEXT) 449 450 typedef ULONG FLT_CALLBACK_DATA_FLAGS; 451 452 #if FLT_MGR_WIN7 453 typedef ULONG FLT_ALLOCATE_CALLBACK_DATA_FLAGS; 454 #define FLT_ALLOCATE_CALLBACK_DATA_PREALLOCATE_ALL_MEMORY 0x00000001 455 #endif /* FLT_MGR_WIN7 */ 456 457 typedef struct _FLT_CALLBACK_DATA { 458 FLT_CALLBACK_DATA_FLAGS Flags; 459 PETHREAD CONST Thread; 460 PFLT_IO_PARAMETER_BLOCK CONST Iopb; 461 IO_STATUS_BLOCK IoStatus; 462 struct _FLT_TAG_DATA_BUFFER *TagData; 463 _ANONYMOUS_UNION union { 464 _ANONYMOUS_STRUCT struct { 465 LIST_ENTRY QueueLinks; 466 PVOID QueueContext[2]; 467 } DUMMYSTRUCTNAME; 468 PVOID FilterContext[4]; 469 } DUMMYUNIONNAME; 470 KPROCESSOR_MODE RequestorMode; 471 } FLT_CALLBACK_DATA, *PFLT_CALLBACK_DATA; 472 473 typedef struct _FLT_RELATED_OBJECTS { 474 USHORT CONST Size; 475 USHORT CONST TransactionContext; 476 PFLT_FILTER CONST Filter; 477 PFLT_VOLUME CONST Volume; 478 PFLT_INSTANCE CONST Instance; 479 PFILE_OBJECT CONST FileObject; 480 PKTRANSACTION CONST Transaction; 481 } FLT_RELATED_OBJECTS, *PFLT_RELATED_OBJECTS; 482 typedef const struct _FLT_RELATED_OBJECTS *PCFLT_RELATED_OBJECTS; 483 484 typedef struct _FLT_RELATED_CONTEXTS { 485 PFLT_CONTEXT VolumeContext; 486 PFLT_CONTEXT InstanceContext; 487 PFLT_CONTEXT FileContext; 488 PFLT_CONTEXT StreamContext; 489 PFLT_CONTEXT StreamHandleContext; 490 PFLT_CONTEXT TransactionContext; 491 } FLT_RELATED_CONTEXTS, *PFLT_RELATED_CONTEXTS; 492 493 typedef VOID 494 (FLTAPI *PFLT_CONTEXT_CLEANUP_CALLBACK)( 495 _In_ PFLT_CONTEXT Context, 496 _In_ FLT_CONTEXT_TYPE ContextType); 497 498 typedef PVOID 499 (FLTAPI *PFLT_CONTEXT_ALLOCATE_CALLBACK)( 500 _In_ POOL_TYPE PoolType, 501 _In_ SIZE_T Size, 502 _In_ FLT_CONTEXT_TYPE ContextType); 503 504 typedef VOID 505 (FLTAPI *PFLT_CONTEXT_FREE_CALLBACK)( 506 _In_ PVOID Pool, 507 _In_ FLT_CONTEXT_TYPE ContextType); 508 509 typedef USHORT FLT_CONTEXT_REGISTRATION_FLAGS; 510 511 #define FLTFL_CONTEXT_REGISTRATION_NO_EXACT_SIZE_MATCH 0x0001 512 513 #define FLT_VARIABLE_SIZED_CONTEXTS ((SIZE_T)-1) 514 515 typedef struct _FLT_CONTEXT_REGISTRATION { 516 FLT_CONTEXT_TYPE ContextType; 517 FLT_CONTEXT_REGISTRATION_FLAGS Flags; 518 PFLT_CONTEXT_CLEANUP_CALLBACK ContextCleanupCallback; 519 SIZE_T Size; 520 ULONG PoolTag; 521 PFLT_CONTEXT_ALLOCATE_CALLBACK ContextAllocateCallback; 522 PFLT_CONTEXT_FREE_CALLBACK ContextFreeCallback; 523 PVOID Reserved1; 524 } FLT_CONTEXT_REGISTRATION, *PFLT_CONTEXT_REGISTRATION; 525 typedef const struct _FLT_CONTEXT_REGISTRATION *PCFLT_CONTEXT_REGISTRATION; 526 527 typedef ULONG FLT_INSTANCE_SETUP_FLAGS; 528 529 #define FLTFL_INSTANCE_SETUP_AUTOMATIC_ATTACHMENT 0x00000001 530 #define FLTFL_INSTANCE_SETUP_MANUAL_ATTACHMENT 0x00000002 531 #define FLTFL_INSTANCE_SETUP_NEWLY_MOUNTED_VOLUME 0x00000004 532 533 #if FLT_MGR_LONGHORN 534 535 #define FLTFL_INSTANCE_SETUP_DETACHED_VOLUME 0x00000008 536 537 #define FLT_MAX_TRANSACTION_NOTIFICATIONS (TRANSACTION_NOTIFY_PREPREPARE | \ 538 TRANSACTION_NOTIFY_PREPARE | \ 539 TRANSACTION_NOTIFY_COMMIT | \ 540 TRANSACTION_NOTIFY_ROLLBACK | \ 541 TRANSACTION_NOTIFY_COMMIT_FINALIZE) 542 543 #endif /* FLT_MGR_LONGHORN */ 544 545 typedef NTSTATUS 546 (FLTAPI *PFLT_INSTANCE_SETUP_CALLBACK)( 547 _In_ PCFLT_RELATED_OBJECTS FltObjects, 548 _In_ FLT_INSTANCE_SETUP_FLAGS Flags, 549 _In_ DEVICE_TYPE VolumeDeviceType, 550 _In_ FLT_FILESYSTEM_TYPE VolumeFilesystemType); 551 552 typedef ULONG FLT_INSTANCE_QUERY_TEARDOWN_FLAGS; 553 554 typedef NTSTATUS 555 (FLTAPI *PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK)( 556 _In_ PCFLT_RELATED_OBJECTS FltObjects, 557 _In_ FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags); 558 559 typedef ULONG FLT_INSTANCE_TEARDOWN_FLAGS; 560 561 #define FLTFL_INSTANCE_TEARDOWN_MANUAL 0x00000001 562 #define FLTFL_INSTANCE_TEARDOWN_FILTER_UNLOAD 0x00000002 563 #define FLTFL_INSTANCE_TEARDOWN_MANDATORY_FILTER_UNLOAD 0x00000004 564 #define FLTFL_INSTANCE_TEARDOWN_VOLUME_DISMOUNT 0x00000008 565 #define FLTFL_INSTANCE_TEARDOWN_INTERNAL_ERROR 0x00000010 566 567 typedef VOID 568 (FLTAPI *PFLT_INSTANCE_TEARDOWN_CALLBACK)( 569 _In_ PCFLT_RELATED_OBJECTS FltObjects, 570 _In_ FLT_INSTANCE_TEARDOWN_FLAGS Reason); 571 572 typedef enum _FLT_PREOP_CALLBACK_STATUS { 573 FLT_PREOP_SUCCESS_WITH_CALLBACK, 574 FLT_PREOP_SUCCESS_NO_CALLBACK, 575 FLT_PREOP_PENDING, 576 FLT_PREOP_DISALLOW_FASTIO, 577 FLT_PREOP_COMPLETE, 578 FLT_PREOP_SYNCHRONIZE 579 } FLT_PREOP_CALLBACK_STATUS, *PFLT_PREOP_CALLBACK_STATUS; 580 581 typedef FLT_PREOP_CALLBACK_STATUS 582 (FLTAPI *PFLT_PRE_OPERATION_CALLBACK)( 583 _Inout_ PFLT_CALLBACK_DATA Data, 584 _In_ PCFLT_RELATED_OBJECTS FltObjects, 585 _Outptr_result_maybenull_ PVOID *CompletionContext); 586 587 typedef enum _FLT_POSTOP_CALLBACK_STATUS { 588 FLT_POSTOP_FINISHED_PROCESSING, 589 FLT_POSTOP_MORE_PROCESSING_REQUIRED 590 } FLT_POSTOP_CALLBACK_STATUS, *PFLT_POSTOP_CALLBACK_STATUS; 591 592 typedef ULONG FLT_POST_OPERATION_FLAGS; 593 594 #define FLTFL_POST_OPERATION_DRAINING 0x00000001 595 596 typedef FLT_POSTOP_CALLBACK_STATUS 597 (FLTAPI *PFLT_POST_OPERATION_CALLBACK)( 598 _Inout_ PFLT_CALLBACK_DATA Data, 599 _In_ PCFLT_RELATED_OBJECTS FltObjects, 600 _In_opt_ PVOID CompletionContext, 601 _In_ FLT_POST_OPERATION_FLAGS Flags); 602 603 typedef ULONG FLT_OPERATION_REGISTRATION_FLAGS; 604 605 #define FLTFL_OPERATION_REGISTRATION_SKIP_PAGING_IO 0x00000001 606 #define FLTFL_OPERATION_REGISTRATION_SKIP_CACHED_IO 0x00000002 607 #define FLTFL_OPERATION_REGISTRATION_SKIP_NON_DASD_IO 0x00000004 608 609 typedef struct _FLT_OPERATION_REGISTRATION { 610 UCHAR MajorFunction; 611 FLT_OPERATION_REGISTRATION_FLAGS Flags; 612 PFLT_PRE_OPERATION_CALLBACK PreOperation; 613 PFLT_POST_OPERATION_CALLBACK PostOperation; 614 PVOID Reserved1; 615 } FLT_OPERATION_REGISTRATION, *PFLT_OPERATION_REGISTRATION; 616 617 typedef struct _FLT_TAG_DATA_BUFFER { 618 ULONG FileTag; 619 USHORT TagDataLength; 620 USHORT UnparsedNameLength; 621 _ANONYMOUS_UNION union { 622 struct { 623 USHORT SubstituteNameOffset; 624 USHORT SubstituteNameLength; 625 USHORT PrintNameOffset; 626 USHORT PrintNameLength; 627 ULONG Flags; 628 WCHAR PathBuffer[1]; 629 } SymbolicLinkReparseBuffer; 630 struct { 631 USHORT SubstituteNameOffset; 632 USHORT SubstituteNameLength; 633 USHORT PrintNameOffset; 634 USHORT PrintNameLength; 635 WCHAR PathBuffer[1]; 636 } MountPointReparseBuffer; 637 struct { 638 UCHAR DataBuffer[1]; 639 } GenericReparseBuffer; 640 struct { 641 GUID TagGuid; 642 UCHAR DataBuffer[1]; 643 } GenericGUIDReparseBuffer; 644 } DUMMYUNIONNAME; 645 } FLT_TAG_DATA_BUFFER, *PFLT_TAG_DATA_BUFFER; 646 647 #define FLT_TAG_DATA_BUFFER_HEADER_SIZE FIELD_OFFSET(FLT_TAG_DATA_BUFFER, GenericReparseBuffer) 648 649 typedef ULONG FLT_FILTER_UNLOAD_FLAGS; 650 651 #define FLTFL_FILTER_UNLOAD_MANDATORY 0x00000001 652 653 typedef NTSTATUS 654 (FLTAPI *PFLT_FILTER_UNLOAD_CALLBACK)( 655 FLT_FILTER_UNLOAD_FLAGS Flags); 656 657 typedef struct _FLT_NAME_CONTROL { 658 UNICODE_STRING Name; 659 } FLT_NAME_CONTROL, *PFLT_NAME_CONTROL; 660 661 typedef ULONG FLT_FILE_NAME_OPTIONS; 662 663 typedef NTSTATUS 664 (FLTAPI *PFLT_GENERATE_FILE_NAME)( 665 _In_ PFLT_INSTANCE Instance, 666 _In_ PFILE_OBJECT FileObject, 667 _In_opt_ PFLT_CALLBACK_DATA CallbackData, 668 _In_ FLT_FILE_NAME_OPTIONS NameOptions, 669 _Out_ PBOOLEAN CacheFileNameInformation, 670 _Out_ PFLT_NAME_CONTROL FileName); 671 672 typedef ULONG FLT_NORMALIZE_NAME_FLAGS; 673 674 #define FLTFL_NORMALIZE_NAME_CASE_SENSITIVE 0x01 675 #define FLTFL_NORMALIZE_NAME_DESTINATION_FILE_NAME 0x02 676 677 typedef NTSTATUS 678 (FLTAPI *PFLT_NORMALIZE_NAME_COMPONENT)( 679 _In_ PFLT_INSTANCE Instance, 680 _In_ PCUNICODE_STRING ParentDirectory, 681 _In_ USHORT VolumeNameLength, 682 _In_ PCUNICODE_STRING Component, 683 _Out_writes_bytes_(ExpandComponentNameLength) PFILE_NAMES_INFORMATION ExpandComponentName, 684 _In_ ULONG ExpandComponentNameLength, 685 _In_ FLT_NORMALIZE_NAME_FLAGS Flags, 686 _Inout_ PVOID *NormalizationContext); 687 688 typedef NTSTATUS 689 (FLTAPI *PFLT_NORMALIZE_NAME_COMPONENT_EX)( 690 _In_ PFLT_INSTANCE Instance, 691 _In_ PFILE_OBJECT FileObject, 692 _In_ PCUNICODE_STRING ParentDirectory, 693 _In_ USHORT VolumeNameLength, 694 _In_ PCUNICODE_STRING Component, 695 _Out_writes_bytes_(ExpandComponentNameLength) PFILE_NAMES_INFORMATION ExpandComponentName, 696 _In_ ULONG ExpandComponentNameLength, 697 _In_ FLT_NORMALIZE_NAME_FLAGS Flags, 698 _Inout_ PVOID *NormalizationContext); 699 700 typedef VOID 701 (FLTAPI *PFLT_NORMALIZE_CONTEXT_CLEANUP)( 702 _In_opt_ PVOID *NormalizationContext); 703 704 #if FLT_MGR_LONGHORN 705 typedef NTSTATUS 706 (FLTAPI *PFLT_TRANSACTION_NOTIFICATION_CALLBACK)( 707 _In_ PCFLT_RELATED_OBJECTS FltObjects, 708 _In_ PFLT_CONTEXT TransactionContext, 709 _In_ ULONG NotificationMask); 710 #endif /* FLT_MGR_LONGHORN */ 711 712 #define FLT_REGISTRATION_VERSION_0200 0x0200 713 #define FLT_REGISTRATION_VERSION_0201 0x0201 714 #define FLT_REGISTRATION_VERSION_0202 0x0202 715 #define FLT_REGISTRATION_VERSION_0203 0x0203 716 717 #if FLT_MGR_LONGHORN 718 #define FLT_REGISTRATION_VERSION FLT_REGISTRATION_VERSION_0202 719 #else 720 #define FLT_REGISTRATION_VERSION FLT_REGISTRATION_VERSION_0200 721 #endif 722 723 typedef ULONG FLT_REGISTRATION_FLAGS; 724 725 #define FLTFL_REGISTRATION_DO_NOT_SUPPORT_SERVICE_STOP 0x00000001 726 #define FLTFL_REGISTRATION_SUPPORT_NPFS_MSFS 0x00000002 727 728 typedef struct _FLT_REGISTRATION { 729 USHORT Size; 730 USHORT Version; 731 FLT_REGISTRATION_FLAGS Flags; 732 CONST FLT_CONTEXT_REGISTRATION *ContextRegistration; 733 CONST FLT_OPERATION_REGISTRATION *OperationRegistration; 734 PFLT_FILTER_UNLOAD_CALLBACK FilterUnloadCallback; 735 PFLT_INSTANCE_SETUP_CALLBACK InstanceSetupCallback; 736 PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK InstanceQueryTeardownCallback; 737 PFLT_INSTANCE_TEARDOWN_CALLBACK InstanceTeardownStartCallback; 738 PFLT_INSTANCE_TEARDOWN_CALLBACK InstanceTeardownCompleteCallback; 739 PFLT_GENERATE_FILE_NAME GenerateFileNameCallback; 740 PFLT_NORMALIZE_NAME_COMPONENT NormalizeNameComponentCallback; 741 PFLT_NORMALIZE_CONTEXT_CLEANUP NormalizeContextCleanupCallback; 742 #if FLT_MGR_LONGHORN 743 PFLT_TRANSACTION_NOTIFICATION_CALLBACK TransactionNotificationCallback; 744 PFLT_NORMALIZE_NAME_COMPONENT_EX NormalizeNameComponentExCallback; 745 #endif /* FLT_MGR_LONGHORN */ 746 } FLT_REGISTRATION, *PFLT_REGISTRATION; 747 748 typedef VOID 749 (FLTAPI *PFLT_COMPLETED_ASYNC_IO_CALLBACK)( 750 _In_ PFLT_CALLBACK_DATA CallbackData, 751 _In_ PFLT_CONTEXT Context); 752 753 typedef ULONG FLT_IO_OPERATION_FLAGS; 754 755 #define FLTFL_IO_OPERATION_NON_CACHED 0x00000001 756 #define FLTFL_IO_OPERATION_PAGING 0x00000002 757 #define FLTFL_IO_OPERATION_DO_NOT_UPDATE_BYTE_OFFSET 0x00000004 758 759 #if FLT_MGR_LONGHORN 760 #define FLTFL_IO_OPERATION_SYNCHRONOUS_PAGING 0x00000008 761 #endif 762 763 typedef VOID 764 (FLTAPI *PFLT_GET_OPERATION_STATUS_CALLBACK)( 765 _In_ PCFLT_RELATED_OBJECTS FltObjects, 766 _In_ PFLT_IO_PARAMETER_BLOCK IopbSnapshot, 767 _In_ NTSTATUS OperationStatus, 768 _In_opt_ PVOID RequesterContext); 769 770 typedef ULONG FLT_FILE_NAME_OPTIONS; 771 772 #define FLT_VALID_FILE_NAME_FORMATS 0x000000ff 773 774 #define FLT_FILE_NAME_NORMALIZED 0x01 775 #define FLT_FILE_NAME_OPENED 0x02 776 #define FLT_FILE_NAME_SHORT 0x03 777 778 #define FltGetFileNameFormat( _NameOptions ) ((_NameOptions) & FLT_VALID_FILE_NAME_FORMATS) 779 780 #define FLT_VALID_FILE_NAME_QUERY_METHODS 0x0000ff00 781 782 #define FLT_FILE_NAME_QUERY_DEFAULT 0x0100 783 #define FLT_FILE_NAME_QUERY_CACHE_ONLY 0x0200 784 #define FLT_FILE_NAME_QUERY_FILESYSTEM_ONLY 0x0300 785 #define FLT_FILE_NAME_QUERY_ALWAYS_ALLOW_CACHE_LOOKUP 0x0400 786 787 #define FltGetFileNameQueryMethod( _NameOptions ) ((_NameOptions) & FLT_VALID_FILE_NAME_QUERY_METHODS) 788 789 #define FLT_VALID_FILE_NAME_FLAGS 0xff000000 790 791 #define FLT_FILE_NAME_REQUEST_FROM_CURRENT_PROVIDER 0x01000000 792 #define FLT_FILE_NAME_DO_NOT_CACHE 0x02000000 793 794 #if FLT_MGR_AFTER_XPSP2 795 #define FLT_FILE_NAME_ALLOW_QUERY_ON_REPARSE 0x04000000 796 #endif 797 798 typedef USHORT FLT_FILE_NAME_PARSED_FLAGS; 799 800 #define FLTFL_FILE_NAME_PARSED_FINAL_COMPONENT 0x0001 801 #define FLTFL_FILE_NAME_PARSED_EXTENSION 0x0002 802 #define FLTFL_FILE_NAME_PARSED_STREAM 0x0004 803 #define FLTFL_FILE_NAME_PARSED_PARENT_DIR 0x0008 804 805 typedef struct _FLT_FILE_NAME_INFORMATION { 806 USHORT Size; 807 FLT_FILE_NAME_PARSED_FLAGS NamesParsed; 808 FLT_FILE_NAME_OPTIONS Format; 809 UNICODE_STRING Name; 810 UNICODE_STRING Volume; 811 UNICODE_STRING Share; 812 UNICODE_STRING Extension; 813 UNICODE_STRING Stream; 814 UNICODE_STRING FinalComponent; 815 UNICODE_STRING ParentDir; 816 } FLT_FILE_NAME_INFORMATION, *PFLT_FILE_NAME_INFORMATION; 817 818 typedef enum _FLT_SET_CONTEXT_OPERATION { 819 FLT_SET_CONTEXT_REPLACE_IF_EXISTS, 820 FLT_SET_CONTEXT_KEEP_IF_EXISTS 821 } FLT_SET_CONTEXT_OPERATION, *PFLT_SET_CONTEXT_OPERATION; 822 823 typedef struct _FLT_VOLUME_PROPERTIES { 824 DEVICE_TYPE DeviceType; 825 ULONG DeviceCharacteristics; 826 ULONG DeviceObjectFlags; 827 ULONG AlignmentRequirement; 828 USHORT SectorSize; 829 USHORT Reserved0; 830 UNICODE_STRING FileSystemDriverName; 831 UNICODE_STRING FileSystemDeviceName; 832 UNICODE_STRING RealDeviceName; 833 } FLT_VOLUME_PROPERTIES, *PFLT_VOLUME_PROPERTIES; 834 835 #define FLT_PORT_CONNECT 0x0001 836 #define FLT_PORT_ALL_ACCESS (FLT_PORT_CONNECT | STANDARD_RIGHTS_ALL) 837 838 typedef NTSTATUS 839 (FLTAPI *PFLT_MESSAGE_NOTIFY)( 840 _In_opt_ PVOID PortCookie, 841 _In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer, 842 _In_ ULONG InputBufferLength, 843 _Out_writes_bytes_to_opt_(OutputBufferLength,*ReturnOutputBufferLength) PVOID OutputBuffer, 844 _In_ ULONG OutputBufferLength, 845 _Out_ PULONG ReturnOutputBufferLength); 846 847 typedef NTSTATUS 848 (FLTAPI *PFLT_CONNECT_NOTIFY)( 849 _In_ PFLT_PORT ClientPort, 850 _In_opt_ PVOID ServerPortCookie, 851 _In_reads_bytes_opt_(SizeOfContext) PVOID ConnectionContext, 852 _In_ ULONG SizeOfContext, 853 _Outptr_result_maybenull_ PVOID *ConnectionPortCookie); 854 855 typedef VOID 856 (FLTAPI *PFLT_DISCONNECT_NOTIFY)( 857 _In_opt_ PVOID ConnectionCookie); 858 859 typedef VOID 860 (FLTAPI *PFLT_COMPLETE_CANCELED_CALLBACK)( 861 _In_ PFLT_CALLBACK_DATA CallbackData); 862 863 typedef struct _FLT_DEFERRED_IO_WORKITEM *PFLT_DEFERRED_IO_WORKITEM; 864 typedef struct _FLT_GENERIC_WORKITEM *PFLT_GENERIC_WORKITEM; 865 866 typedef VOID 867 (FLTAPI *PFLT_DEFERRED_IO_WORKITEM_ROUTINE)( 868 _In_ PFLT_DEFERRED_IO_WORKITEM FltWorkItem, 869 _In_ PFLT_CALLBACK_DATA CallbackData, 870 _In_opt_ PVOID Context); 871 872 typedef VOID 873 (FLTAPI *PFLT_GENERIC_WORKITEM_ROUTINE)( 874 _In_ PFLT_GENERIC_WORKITEM FltWorkItem, 875 _In_ PVOID FltObject, 876 _In_opt_ PVOID Context); 877 878 typedef IO_CSQ_IRP_CONTEXT FLT_CALLBACK_DATA_QUEUE_IO_CONTEXT, *PFLT_CALLBACK_DATA_QUEUE_IO_CONTEXT; 879 880 typedef struct _FLT_CALLBACK_DATA_QUEUE FLT_CALLBACK_DATA_QUEUE, *PFLT_CALLBACK_DATA_QUEUE; 881 882 typedef NTSTATUS 883 (FLTAPI *PFLT_CALLBACK_DATA_QUEUE_INSERT_IO)( 884 _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, 885 _In_ PFLT_CALLBACK_DATA Cbd, 886 _In_opt_ PVOID InsertContext); 887 888 typedef VOID 889 (FLTAPI *PFLT_CALLBACK_DATA_QUEUE_REMOVE_IO)( 890 _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, 891 _In_ PFLT_CALLBACK_DATA Cbd); 892 893 typedef PFLT_CALLBACK_DATA 894 (FLTAPI *PFLT_CALLBACK_DATA_QUEUE_PEEK_NEXT_IO)( 895 _In_ PFLT_CALLBACK_DATA_QUEUE Cbdq, 896 _In_opt_ PFLT_CALLBACK_DATA Cbd, 897 _In_opt_ PVOID PeekContext); 898 899 typedef VOID 900 (FLTAPI *PFLT_CALLBACK_DATA_QUEUE_ACQUIRE)( 901 _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, 902 _Out_opt_ PKIRQL Irql); 903 904 typedef VOID 905 (FLTAPI *PFLT_CALLBACK_DATA_QUEUE_RELEASE)( 906 _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, 907 _In_opt_ KIRQL Irql); 908 909 typedef VOID 910 (FLTAPI *PFLT_CALLBACK_DATA_QUEUE_COMPLETE_CANCELED_IO)( 911 _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, 912 _Inout_ PFLT_CALLBACK_DATA Cbd); 913 914 typedef ULONG FLT_CALLBACK_DATA_QUEUE_FLAGS; 915 916 typedef struct _FLT_CALLBACK_DATA_QUEUE { 917 IO_CSQ Csq; 918 FLT_CALLBACK_DATA_QUEUE_FLAGS Flags; 919 PFLT_INSTANCE Instance; 920 PFLT_CALLBACK_DATA_QUEUE_INSERT_IO InsertIo; 921 PFLT_CALLBACK_DATA_QUEUE_REMOVE_IO RemoveIo; 922 PFLT_CALLBACK_DATA_QUEUE_PEEK_NEXT_IO PeekNextIo; 923 PFLT_CALLBACK_DATA_QUEUE_ACQUIRE Acquire; 924 PFLT_CALLBACK_DATA_QUEUE_RELEASE Release; 925 PFLT_CALLBACK_DATA_QUEUE_COMPLETE_CANCELED_IO CompleteCanceledIo; 926 } FLT_CALLBACK_DATA_QUEUE, *PFLT_CALLBACK_DATA_QUEUE; 927 928 typedef NTSTATUS 929 (*PFLT_COMPLETE_LOCK_CALLBACK_DATA_ROUTINE)( 930 _In_opt_ PVOID Context, 931 _In_ PFLT_CALLBACK_DATA CallbackData); 932 933 typedef VOID 934 (FLTAPI *PFLTOPLOCK_WAIT_COMPLETE_ROUTINE)( 935 _In_ PFLT_CALLBACK_DATA CallbackData, 936 _In_opt_ PVOID Context); 937 938 typedef VOID 939 (FLTAPI *PFLTOPLOCK_PREPOST_CALLBACKDATA_ROUTINE)( 940 _In_ PFLT_CALLBACK_DATA CallbackData, 941 _In_opt_ PVOID Context); 942 943 VOID 944 FLTAPI 945 FltSetCallbackDataDirty( 946 _Inout_ PFLT_CALLBACK_DATA Data); 947 948 VOID 949 FLTAPI 950 FltClearCallbackDataDirty( 951 _Inout_ PFLT_CALLBACK_DATA Data); 952 953 BOOLEAN 954 FLTAPI 955 FltIsCallbackDataDirty( 956 _In_ PFLT_CALLBACK_DATA Data); 957 958 _Must_inspect_result_ 959 BOOLEAN 960 FLTAPI 961 FltDoCompletionProcessingWhenSafe( 962 _In_ PFLT_CALLBACK_DATA Data, 963 _In_ PCFLT_RELATED_OBJECTS FltObjects, 964 _In_opt_ PVOID CompletionContext, 965 _In_ FLT_POST_OPERATION_FLAGS Flags, 966 _In_ PFLT_POST_OPERATION_CALLBACK SafePostCallback, 967 _Out_ PFLT_POSTOP_CALLBACK_STATUS RetPostOperationStatus); 968 969 _Must_inspect_result_ 970 _IRQL_requires_max_(APC_LEVEL) 971 NTSTATUS 972 FLTAPI 973 FltCheckAndGrowNameControl( 974 _Inout_ PFLT_NAME_CONTROL NameCtrl, 975 _In_ USHORT NewSize); 976 977 _Must_inspect_result_ 978 _IRQL_requires_max_(APC_LEVEL) 979 NTSTATUS 980 FLTAPI 981 FltPurgeFileNameInformationCache( 982 _In_ PFLT_INSTANCE Instance, 983 _In_opt_ PFILE_OBJECT FileObject); 984 985 _Must_inspect_result_ 986 _IRQL_requires_max_(APC_LEVEL) 987 NTSTATUS 988 FLTAPI 989 FltRegisterFilter( 990 _In_ PDRIVER_OBJECT Driver, 991 _In_ CONST FLT_REGISTRATION *Registration, 992 _Outptr_ PFLT_FILTER *RetFilter); 993 994 _IRQL_requires_max_(APC_LEVEL) 995 VOID 996 FLTAPI 997 FltUnregisterFilter( 998 _In_ PFLT_FILTER Filter); 999 1000 _Must_inspect_result_ 1001 _IRQL_requires_max_(APC_LEVEL) 1002 NTSTATUS 1003 FLTAPI 1004 FltStartFiltering( 1005 _In_ PFLT_FILTER Filter); 1006 1007 _Must_inspect_result_ 1008 _IRQL_requires_max_(APC_LEVEL) 1009 PVOID 1010 FLTAPI 1011 FltGetRoutineAddress( 1012 _In_ PCSTR FltMgrRoutineName); 1013 1014 _When_(CallbackStatus==FLT_PREOP_COMPLETE, _IRQL_requires_max_(DISPATCH_LEVEL)) 1015 _When_(CallbackStatus!=FLT_PREOP_COMPLETE, _IRQL_requires_max_(APC_LEVEL)) 1016 VOID 1017 FLTAPI 1018 FltCompletePendedPreOperation( 1019 _In_ PFLT_CALLBACK_DATA CallbackData, 1020 _In_ FLT_PREOP_CALLBACK_STATUS CallbackStatus, 1021 _In_opt_ PVOID Context); 1022 1023 _IRQL_requires_max_(DISPATCH_LEVEL) 1024 VOID 1025 FLTAPI 1026 FltCompletePendedPostOperation( 1027 _In_ PFLT_CALLBACK_DATA CallbackData); 1028 1029 _Must_inspect_result_ 1030 _IRQL_requires_max_(DISPATCH_LEVEL) 1031 NTSTATUS 1032 FLTAPI 1033 FltRequestOperationStatusCallback( 1034 _In_ PFLT_CALLBACK_DATA Data, 1035 _In_ PFLT_GET_OPERATION_STATUS_CALLBACK CallbackRoutine, 1036 _In_opt_ PVOID RequesterContext); 1037 1038 _When_((PoolType==NonPagedPoolNx), _IRQL_requires_max_(DISPATCH_LEVEL)) 1039 _When_((PoolType!=NonPagedPoolNx), _IRQL_requires_max_(APC_LEVEL)) 1040 PVOID 1041 FLTAPI 1042 FltAllocatePoolAlignedWithTag( 1043 _In_ PFLT_INSTANCE Instance, 1044 _In_ POOL_TYPE PoolType, 1045 _In_ SIZE_T NumberOfBytes, 1046 _In_ ULONG Tag); 1047 1048 _IRQL_requires_max_(DISPATCH_LEVEL) 1049 VOID 1050 FLTAPI 1051 FltFreePoolAlignedWithTag( 1052 _In_ PFLT_INSTANCE Instance, 1053 _In_ PVOID Buffer, 1054 _In_ ULONG Tag); 1055 1056 _Must_inspect_result_ 1057 _IRQL_requires_max_(APC_LEVEL) 1058 NTSTATUS 1059 FLTAPI 1060 FltGetFileNameInformation( 1061 _In_ PFLT_CALLBACK_DATA CallbackData, 1062 _In_ FLT_FILE_NAME_OPTIONS NameOptions, 1063 _Outptr_ PFLT_FILE_NAME_INFORMATION *FileNameInformation); 1064 1065 _Must_inspect_result_ 1066 _IRQL_requires_max_(APC_LEVEL) 1067 NTSTATUS 1068 FLTAPI 1069 FltGetFileNameInformationUnsafe( 1070 _In_ PFILE_OBJECT FileObject, 1071 _In_opt_ PFLT_INSTANCE Instance, 1072 _In_ FLT_FILE_NAME_OPTIONS NameOptions, 1073 _Outptr_ PFLT_FILE_NAME_INFORMATION *FileNameInformation); 1074 1075 _IRQL_requires_max_(APC_LEVEL) 1076 VOID 1077 FLTAPI 1078 FltReleaseFileNameInformation( 1079 _In_ PFLT_FILE_NAME_INFORMATION FileNameInformation); 1080 1081 _IRQL_requires_max_(APC_LEVEL) 1082 VOID 1083 FLTAPI 1084 FltReferenceFileNameInformation( 1085 _In_ PFLT_FILE_NAME_INFORMATION FileNameInformation); 1086 1087 _IRQL_requires_max_(APC_LEVEL) 1088 NTSTATUS 1089 FLTAPI 1090 FltParseFileName( 1091 _In_ PCUNICODE_STRING FileName, 1092 _Inout_opt_ PUNICODE_STRING Extension, 1093 _Inout_opt_ PUNICODE_STRING Stream, 1094 _Inout_opt_ PUNICODE_STRING FinalComponent); 1095 1096 _IRQL_requires_max_(APC_LEVEL) 1097 NTSTATUS 1098 FLTAPI 1099 FltParseFileNameInformation( 1100 _Inout_ PFLT_FILE_NAME_INFORMATION FileNameInformation); 1101 1102 _Must_inspect_result_ 1103 _IRQL_requires_max_(APC_LEVEL) 1104 NTSTATUS 1105 FLTAPI 1106 FltGetTunneledName( 1107 _In_ PFLT_CALLBACK_DATA CallbackData, 1108 _In_ PFLT_FILE_NAME_INFORMATION FileNameInformation, 1109 _Outptr_result_maybenull_ PFLT_FILE_NAME_INFORMATION *RetTunneledFileNameInformation); 1110 1111 _Must_inspect_result_ 1112 _IRQL_requires_max_(APC_LEVEL) 1113 NTSTATUS 1114 FLTAPI 1115 FltGetVolumeName( 1116 _In_ PFLT_VOLUME Volume, 1117 _Inout_opt_ PUNICODE_STRING VolumeName, 1118 _Out_opt_ PULONG BufferSizeNeeded); 1119 1120 _Must_inspect_result_ 1121 _IRQL_requires_max_(APC_LEVEL) 1122 NTSTATUS 1123 FLTAPI 1124 FltGetDestinationFileNameInformation( 1125 _In_ PFLT_INSTANCE Instance, 1126 _In_ PFILE_OBJECT FileObject, 1127 _In_opt_ HANDLE RootDirectory, 1128 _In_reads_bytes_(FileNameLength) PWSTR FileName, 1129 _In_ ULONG FileNameLength, 1130 _In_ FLT_FILE_NAME_OPTIONS NameOptions, 1131 _Outptr_ PFLT_FILE_NAME_INFORMATION *RetFileNameInformation); 1132 1133 _Must_inspect_result_ 1134 _IRQL_requires_max_(APC_LEVEL) 1135 NTSTATUS 1136 FLTAPI 1137 FltIsDirectory( 1138 _In_ PFILE_OBJECT FileObject, 1139 _In_ PFLT_INSTANCE Instance, 1140 _Out_ PBOOLEAN IsDirectory); 1141 1142 _Must_inspect_result_ 1143 _IRQL_requires_max_(PASSIVE_LEVEL) 1144 NTSTATUS 1145 FLTAPI 1146 FltLoadFilter( 1147 _In_ PCUNICODE_STRING FilterName); 1148 1149 _Must_inspect_result_ 1150 _IRQL_requires_max_(PASSIVE_LEVEL) 1151 NTSTATUS 1152 FLTAPI 1153 FltUnloadFilter( 1154 _In_ PCUNICODE_STRING FilterName); 1155 1156 _Must_inspect_result_ 1157 _IRQL_requires_max_(APC_LEVEL) 1158 NTSTATUS 1159 FLTAPI 1160 FltAttachVolume( 1161 _Inout_ PFLT_FILTER Filter, 1162 _Inout_ PFLT_VOLUME Volume, 1163 _In_opt_ PCUNICODE_STRING InstanceName, 1164 _Outptr_opt_result_maybenull_ PFLT_INSTANCE *RetInstance); 1165 1166 _Must_inspect_result_ 1167 _IRQL_requires_max_(APC_LEVEL) 1168 NTSTATUS 1169 FLTAPI 1170 FltAttachVolumeAtAltitude( 1171 _Inout_ PFLT_FILTER Filter, 1172 _Inout_ PFLT_VOLUME Volume, 1173 _In_ PCUNICODE_STRING Altitude, 1174 _In_opt_ PCUNICODE_STRING InstanceName, 1175 _Outptr_opt_result_maybenull_ PFLT_INSTANCE *RetInstance); 1176 1177 _Must_inspect_result_ 1178 _IRQL_requires_max_(APC_LEVEL) 1179 NTSTATUS 1180 FLTAPI 1181 FltDetachVolume( 1182 _Inout_ PFLT_FILTER Filter, 1183 _Inout_ PFLT_VOLUME Volume, 1184 _In_opt_ PCUNICODE_STRING InstanceName); 1185 1186 _Must_inspect_result_ 1187 _IRQL_requires_max_(APC_LEVEL) 1188 NTSTATUS 1189 FLTAPI 1190 FltAllocateCallbackData( 1191 _In_ PFLT_INSTANCE Instance, 1192 _In_opt_ PFILE_OBJECT FileObject, 1193 _Outptr_ PFLT_CALLBACK_DATA *RetNewCallbackData); 1194 1195 _IRQL_requires_max_(DISPATCH_LEVEL) 1196 VOID 1197 FLTAPI 1198 FltFreeCallbackData( 1199 _In_ PFLT_CALLBACK_DATA CallbackData); 1200 1201 _IRQL_requires_max_(APC_LEVEL) 1202 VOID 1203 FLTAPI 1204 FltReuseCallbackData( 1205 _Inout_ PFLT_CALLBACK_DATA CallbackData); 1206 1207 _When_(FlagOn(CallbackData->Iopb->IrpFlags, IRP_PAGING_IO), _IRQL_requires_max_(APC_LEVEL)) 1208 _When_(!FlagOn(CallbackData->Iopb->IrpFlags, IRP_PAGING_IO), _IRQL_requires_max_(PASSIVE_LEVEL)) 1209 VOID 1210 FLTAPI 1211 FltPerformSynchronousIo( 1212 _Inout_ PFLT_CALLBACK_DATA CallbackData); 1213 1214 _Must_inspect_result_ 1215 _When_( FlagOn(CallbackData->Iopb->IrpFlags, IRP_PAGING_IO), _IRQL_requires_max_(APC_LEVEL)) 1216 _When_( !FlagOn(CallbackData->Iopb->IrpFlags, IRP_PAGING_IO), _IRQL_requires_max_(PASSIVE_LEVEL)) 1217 NTSTATUS 1218 FLTAPI 1219 FltPerformAsynchronousIo( 1220 _Inout_ PFLT_CALLBACK_DATA CallbackData, 1221 _In_ PFLT_COMPLETED_ASYNC_IO_CALLBACK CallbackRoutine, 1222 _In_ PVOID CallbackContext); 1223 1224 _Must_inspect_result_ 1225 _IRQL_requires_max_(PASSIVE_LEVEL) 1226 NTSTATUS 1227 FLTAPI 1228 FltCreateFile( 1229 _In_ PFLT_FILTER Filter, 1230 _In_opt_ PFLT_INSTANCE Instance, 1231 _Out_ PHANDLE FileHandle, 1232 _In_ ACCESS_MASK DesiredAccess, 1233 _In_ POBJECT_ATTRIBUTES ObjectAttributes, 1234 _Out_ PIO_STATUS_BLOCK IoStatusBlock, 1235 _In_opt_ PLARGE_INTEGER AllocationSize, 1236 _In_ ULONG FileAttributes, 1237 _In_ ULONG ShareAccess, 1238 _In_ ULONG CreateDisposition, 1239 _In_ ULONG CreateOptions, 1240 _In_reads_bytes_opt_(EaLength)PVOID EaBuffer, 1241 _In_ ULONG EaLength, 1242 _In_ ULONG Flags); 1243 1244 _Must_inspect_result_ 1245 _IRQL_requires_max_(PASSIVE_LEVEL) 1246 _When_((Flags|FLTFL_IO_OPERATION_PAGING|FLTFL_IO_OPERATION_SYNCHRONOUS_PAGING),_IRQL_requires_max_(APC_LEVEL)) 1247 NTSTATUS 1248 FLTAPI 1249 FltReadFile( 1250 _In_ PFLT_INSTANCE InitiatingInstance, 1251 _In_ PFILE_OBJECT FileObject, 1252 _In_opt_ PLARGE_INTEGER ByteOffset, 1253 _In_ ULONG Length, 1254 _Out_writes_bytes_to_(Length,*BytesRead) PVOID Buffer, 1255 _In_ FLT_IO_OPERATION_FLAGS Flags, 1256 _Out_opt_ PULONG BytesRead, 1257 _In_opt_ PFLT_COMPLETED_ASYNC_IO_CALLBACK CallbackRoutine, 1258 _In_opt_ PVOID CallbackContext); 1259 1260 _Must_inspect_result_ 1261 _IRQL_requires_max_(PASSIVE_LEVEL) 1262 NTSTATUS 1263 FLTAPI 1264 FltTagFile( 1265 _In_ PFLT_INSTANCE InitiatingInstance, 1266 _In_ PFILE_OBJECT FileObject, 1267 _In_ ULONG FileTag, 1268 _In_opt_ GUID *Guid, 1269 _In_reads_bytes_(DataBufferLength) PVOID DataBuffer, 1270 _In_ USHORT DataBufferLength); 1271 1272 _Must_inspect_result_ 1273 _IRQL_requires_max_(PASSIVE_LEVEL) 1274 NTSTATUS 1275 FLTAPI 1276 FltUntagFile( 1277 _In_ PFLT_INSTANCE InitiatingInstance, 1278 _In_ PFILE_OBJECT FileObject, 1279 _In_ ULONG FileTag, 1280 _In_opt_ GUID *Guid); 1281 1282 _Must_inspect_result_ 1283 _IRQL_requires_max_(PASSIVE_LEVEL) 1284 _When_((Flags|FLTFL_IO_OPERATION_PAGING|FLTFL_IO_OPERATION_SYNCHRONOUS_PAGING),_IRQL_requires_max_(APC_LEVEL)) 1285 NTSTATUS 1286 FLTAPI 1287 FltWriteFile( 1288 _In_ PFLT_INSTANCE InitiatingInstance, 1289 _In_ PFILE_OBJECT FileObject, 1290 _In_opt_ PLARGE_INTEGER ByteOffset, 1291 _In_ ULONG Length, 1292 _In_reads_bytes_(Length) PVOID Buffer, 1293 _In_ FLT_IO_OPERATION_FLAGS Flags, 1294 _Out_opt_ PULONG BytesWritten, 1295 _In_opt_ PFLT_COMPLETED_ASYNC_IO_CALLBACK CallbackRoutine, 1296 _In_opt_ PVOID CallbackContext); 1297 1298 _Must_inspect_result_ 1299 _IRQL_requires_max_(PASSIVE_LEVEL) 1300 NTSTATUS 1301 FLTAPI 1302 FltQueryInformationFile( 1303 _In_ PFLT_INSTANCE Instance, 1304 _In_ PFILE_OBJECT FileObject, 1305 _Out_writes_bytes_to_(Length,*LengthReturned) PVOID FileInformation, 1306 _In_ ULONG Length, 1307 _In_ FILE_INFORMATION_CLASS FileInformationClass, 1308 _Out_opt_ PULONG LengthReturned); 1309 1310 _Must_inspect_result_ 1311 _IRQL_requires_max_(PASSIVE_LEVEL) 1312 NTSTATUS 1313 FLTAPI 1314 FltSetInformationFile( 1315 _In_ PFLT_INSTANCE Instance, 1316 _In_ PFILE_OBJECT FileObject, 1317 _In_reads_bytes_(Length) PVOID FileInformation, 1318 _In_ ULONG Length, 1319 _In_ FILE_INFORMATION_CLASS FileInformationClass); 1320 1321 _Must_inspect_result_ 1322 _IRQL_requires_max_(PASSIVE_LEVEL) 1323 NTSTATUS 1324 FLTAPI 1325 FltQueryVolumeInformationFile( 1326 _In_ PFLT_INSTANCE Instance, 1327 _In_ PFILE_OBJECT FileObject, 1328 _Out_writes_bytes_to_(Length,*LengthReturned) PVOID FsInformation, 1329 _In_ ULONG Length, 1330 _In_ FS_INFORMATION_CLASS FsInformationClass, 1331 _Out_opt_ PULONG LengthReturned); 1332 1333 _Must_inspect_result_ 1334 _IRQL_requires_max_(PASSIVE_LEVEL) 1335 NTSTATUS 1336 FLTAPI 1337 FltQuerySecurityObject( 1338 _In_ PFLT_INSTANCE Instance, 1339 _In_ PFILE_OBJECT FileObject, 1340 _In_ SECURITY_INFORMATION SecurityInformation, 1341 _Inout_updates_bytes_opt_(Length) PSECURITY_DESCRIPTOR SecurityDescriptor, 1342 _In_ ULONG Length, 1343 _Out_opt_ PULONG LengthNeeded); 1344 1345 _Must_inspect_result_ 1346 _IRQL_requires_max_(PASSIVE_LEVEL) 1347 NTSTATUS 1348 FLTAPI 1349 FltSetSecurityObject( 1350 _In_ PFLT_INSTANCE Instance, 1351 _In_ PFILE_OBJECT FileObject, 1352 _In_ SECURITY_INFORMATION SecurityInformation, 1353 _In_ PSECURITY_DESCRIPTOR SecurityDescriptor); 1354 1355 _Must_inspect_result_ 1356 _IRQL_requires_max_(PASSIVE_LEVEL) 1357 NTSTATUS 1358 FLTAPI 1359 FltFlushBuffers( 1360 _In_ PFLT_INSTANCE Instance, 1361 _In_ PFILE_OBJECT FileObject); 1362 1363 _Must_inspect_result_ 1364 _IRQL_requires_max_(PASSIVE_LEVEL) 1365 NTSTATUS 1366 FLTAPI 1367 FltFsControlFile( 1368 _In_ PFLT_INSTANCE Instance, 1369 _In_ PFILE_OBJECT FileObject, 1370 _In_ ULONG FsControlCode, 1371 _In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer, 1372 _In_ ULONG InputBufferLength, 1373 _Out_writes_bytes_to_opt_(OutputBufferLength,*LengthReturned) PVOID OutputBuffer, 1374 _In_ ULONG OutputBufferLength, 1375 _Out_opt_ PULONG LengthReturned); 1376 1377 _Must_inspect_result_ 1378 _IRQL_requires_max_(PASSIVE_LEVEL) 1379 NTSTATUS 1380 FLTAPI 1381 FltDeviceIoControlFile( 1382 _In_ PFLT_INSTANCE Instance, 1383 _In_ PFILE_OBJECT FileObject, 1384 _In_ ULONG IoControlCode, 1385 _In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer, 1386 _In_ ULONG InputBufferLength, 1387 _Out_writes_bytes_to_opt_(OutputBufferLength,*LengthReturned) PVOID OutputBuffer, 1388 _In_ ULONG OutputBufferLength, 1389 _Out_opt_ PULONG LengthReturned); 1390 1391 _When_(FlagOn(CallbackData->Iopb->IrpFlags, IRP_PAGING_IO), _IRQL_requires_max_(APC_LEVEL)) 1392 _When_(!FlagOn(CallbackData->Iopb->IrpFlags, IRP_PAGING_IO), _IRQL_requires_max_(PASSIVE_LEVEL)) 1393 VOID 1394 FLTAPI 1395 FltReissueSynchronousIo( 1396 _In_ PFLT_INSTANCE InitiatingInstance, 1397 _In_ PFLT_CALLBACK_DATA CallbackData); 1398 1399 _IRQL_requires_max_(PASSIVE_LEVEL) 1400 NTSTATUS 1401 FLTAPI 1402 FltClose( 1403 _In_ HANDLE FileHandle); 1404 1405 _IRQL_requires_max_(PASSIVE_LEVEL) 1406 VOID 1407 FLTAPI 1408 FltCancelFileOpen( 1409 _In_ PFLT_INSTANCE Instance, 1410 _In_ PFILE_OBJECT FileObject); 1411 1412 _Must_inspect_result_ 1413 _IRQL_requires_max_(PASSIVE_LEVEL) 1414 NTSTATUS 1415 FLTAPI 1416 FltCreateSystemVolumeInformationFolder( 1417 _In_ PFLT_INSTANCE Instance); 1418 1419 _IRQL_requires_max_(APC_LEVEL) 1420 BOOLEAN 1421 FLTAPI 1422 FltSupportsFileContexts( 1423 _In_ PFILE_OBJECT FileObject); 1424 1425 _IRQL_requires_max_(APC_LEVEL) 1426 BOOLEAN 1427 FLTAPI 1428 FltSupportsStreamContexts( 1429 _In_ PFILE_OBJECT FileObject); 1430 1431 _IRQL_requires_max_(APC_LEVEL) 1432 BOOLEAN 1433 FLTAPI 1434 FltSupportsStreamHandleContexts( 1435 _In_ PFILE_OBJECT FileObject); 1436 1437 _Must_inspect_result_ 1438 _IRQL_requires_max_(APC_LEVEL) 1439 NTSTATUS 1440 FLTAPI 1441 FltAllocateContext( 1442 _In_ PFLT_FILTER Filter, 1443 _In_ FLT_CONTEXT_TYPE ContextType, 1444 _In_ SIZE_T ContextSize, 1445 _In_ POOL_TYPE PoolType, 1446 _Outptr_result_bytebuffer_(ContextSize) PFLT_CONTEXT *ReturnedContext); 1447 1448 _IRQL_requires_max_(APC_LEVEL) 1449 VOID 1450 FLTAPI 1451 FltGetContexts( 1452 _In_ PCFLT_RELATED_OBJECTS FltObjects, 1453 _In_ FLT_CONTEXT_TYPE DesiredContexts, 1454 _Out_ PFLT_RELATED_CONTEXTS Contexts); 1455 1456 _IRQL_requires_max_(APC_LEVEL) 1457 VOID 1458 FLTAPI 1459 FltReleaseContexts( 1460 _In_ PFLT_RELATED_CONTEXTS Contexts); 1461 1462 _IRQL_requires_max_(APC_LEVEL) 1463 NTSTATUS 1464 FLTAPI 1465 FltSetVolumeContext( 1466 _In_ PFLT_VOLUME Volume, 1467 _In_ FLT_SET_CONTEXT_OPERATION Operation, 1468 _In_ PFLT_CONTEXT NewContext, 1469 _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext); 1470 1471 _IRQL_requires_max_(APC_LEVEL) 1472 NTSTATUS 1473 FLTAPI 1474 FltSetInstanceContext( 1475 _In_ PFLT_INSTANCE Instance, 1476 _In_ FLT_SET_CONTEXT_OPERATION Operation, 1477 _In_ PFLT_CONTEXT NewContext, 1478 _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext); 1479 1480 _IRQL_requires_max_(APC_LEVEL) 1481 NTSTATUS 1482 FLTAPI 1483 FltSetFileContext( 1484 _In_ PFLT_INSTANCE Instance, 1485 _In_ PFILE_OBJECT FileObject, 1486 _In_ FLT_SET_CONTEXT_OPERATION Operation, 1487 _In_ PFLT_CONTEXT NewContext, 1488 _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext); 1489 1490 _IRQL_requires_max_(APC_LEVEL) 1491 NTSTATUS 1492 FLTAPI 1493 FltSetStreamContext( 1494 _In_ PFLT_INSTANCE Instance, 1495 _In_ PFILE_OBJECT FileObject, 1496 _In_ FLT_SET_CONTEXT_OPERATION Operation, 1497 _In_ PFLT_CONTEXT NewContext, 1498 _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext); 1499 1500 _IRQL_requires_max_(APC_LEVEL) 1501 NTSTATUS 1502 FLTAPI 1503 FltSetStreamHandleContext( 1504 _In_ PFLT_INSTANCE Instance, 1505 _In_ PFILE_OBJECT FileObject, 1506 _In_ FLT_SET_CONTEXT_OPERATION Operation, 1507 _In_ PFLT_CONTEXT NewContext, 1508 _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext); 1509 1510 _IRQL_requires_max_(APC_LEVEL) 1511 VOID 1512 FLTAPI 1513 FltDeleteContext( 1514 _In_ PFLT_CONTEXT Context); 1515 1516 _IRQL_requires_max_(APC_LEVEL) 1517 NTSTATUS 1518 FLTAPI 1519 FltDeleteVolumeContext( 1520 _In_ PFLT_FILTER Filter, 1521 _In_ PFLT_VOLUME Volume, 1522 _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext); 1523 1524 _IRQL_requires_max_(APC_LEVEL) 1525 NTSTATUS 1526 FLTAPI 1527 FltDeleteInstanceContext( 1528 _In_ PFLT_INSTANCE Instance, 1529 _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext); 1530 1531 _IRQL_requires_max_(APC_LEVEL) 1532 NTSTATUS 1533 FLTAPI 1534 FltDeleteFileContext( 1535 _In_ PFLT_INSTANCE Instance, 1536 _In_ PFILE_OBJECT FileObject, 1537 _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext); 1538 1539 _IRQL_requires_max_(APC_LEVEL) 1540 NTSTATUS 1541 FLTAPI 1542 FltDeleteStreamContext( 1543 _In_ PFLT_INSTANCE Instance, 1544 _In_ PFILE_OBJECT FileObject, 1545 _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext); 1546 1547 _IRQL_requires_max_(APC_LEVEL) 1548 NTSTATUS 1549 FLTAPI 1550 FltDeleteStreamHandleContext( 1551 _In_ PFLT_INSTANCE Instance, 1552 _In_ PFILE_OBJECT FileObject, 1553 _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext); 1554 1555 _IRQL_requires_max_(APC_LEVEL) 1556 NTSTATUS 1557 FLTAPI 1558 FltGetVolumeContext( 1559 _In_ PFLT_FILTER Filter, 1560 _In_ PFLT_VOLUME Volume, 1561 _Outptr_ PFLT_CONTEXT *Context); 1562 1563 _IRQL_requires_max_(APC_LEVEL) 1564 NTSTATUS 1565 FLTAPI 1566 FltGetInstanceContext( 1567 _In_ PFLT_INSTANCE Instance, 1568 _Outptr_ PFLT_CONTEXT *Context); 1569 1570 _IRQL_requires_max_(APC_LEVEL) 1571 NTSTATUS 1572 FLTAPI 1573 FltGetFileContext( 1574 _In_ PFLT_INSTANCE Instance, 1575 _In_ PFILE_OBJECT FileObject, 1576 _Outptr_ PFLT_CONTEXT *Context); 1577 1578 _IRQL_requires_max_(APC_LEVEL) 1579 NTSTATUS 1580 FLTAPI 1581 FltGetStreamContext( 1582 _In_ PFLT_INSTANCE Instance, 1583 _In_ PFILE_OBJECT FileObject, 1584 _Outptr_ PFLT_CONTEXT *Context); 1585 1586 _IRQL_requires_max_(APC_LEVEL) 1587 NTSTATUS 1588 FLTAPI 1589 FltGetStreamHandleContext( 1590 _In_ PFLT_INSTANCE Instance, 1591 _In_ PFILE_OBJECT FileObject, 1592 _Outptr_ PFLT_CONTEXT *Context); 1593 1594 _IRQL_requires_max_(DISPATCH_LEVEL) 1595 VOID 1596 FLTAPI 1597 FltReferenceContext( 1598 _In_ PFLT_CONTEXT Context); 1599 1600 _IRQL_requires_max_(DISPATCH_LEVEL) 1601 VOID 1602 FLTAPI 1603 FltReleaseContext( 1604 _In_ PFLT_CONTEXT Context); 1605 1606 _IRQL_requires_max_(APC_LEVEL) 1607 NTSTATUS 1608 FLTAPI 1609 FltGetFilterFromName( 1610 _In_ PCUNICODE_STRING FilterName, 1611 _Outptr_ PFLT_FILTER *RetFilter); 1612 1613 _IRQL_requires_max_(PASSIVE_LEVEL) 1614 NTSTATUS 1615 FLTAPI 1616 FltGetVolumeFromName( 1617 _In_ PFLT_FILTER Filter, 1618 _In_ PCUNICODE_STRING VolumeName, 1619 _Outptr_ PFLT_VOLUME *RetVolume); 1620 1621 _IRQL_requires_max_(APC_LEVEL) 1622 NTSTATUS 1623 FLTAPI 1624 FltGetVolumeInstanceFromName( 1625 _In_opt_ PFLT_FILTER Filter, 1626 _In_ PFLT_VOLUME Volume, 1627 _In_opt_ PCUNICODE_STRING InstanceName, 1628 _Outptr_ PFLT_INSTANCE *RetInstance); 1629 1630 _IRQL_requires_max_(APC_LEVEL) 1631 NTSTATUS 1632 FLTAPI 1633 FltGetVolumeFromInstance( 1634 _In_ PFLT_INSTANCE Instance, 1635 _Outptr_ PFLT_VOLUME *RetVolume); 1636 1637 _IRQL_requires_max_(APC_LEVEL) 1638 NTSTATUS 1639 FLTAPI 1640 FltGetFilterFromInstance( 1641 _In_ PFLT_INSTANCE Instance, 1642 _Outptr_ PFLT_FILTER *RetFilter); 1643 1644 _IRQL_requires_max_(APC_LEVEL) 1645 NTSTATUS 1646 FLTAPI 1647 FltGetVolumeFromFileObject( 1648 _In_ PFLT_FILTER Filter, 1649 _In_ PFILE_OBJECT FileObject, 1650 _Outptr_ PFLT_VOLUME *RetVolume); 1651 1652 _IRQL_requires_max_(APC_LEVEL) 1653 NTSTATUS 1654 FLTAPI 1655 FltGetVolumeFromDeviceObject( 1656 _In_ PFLT_FILTER Filter, 1657 _In_ PDEVICE_OBJECT DeviceObject, 1658 _Outptr_ PFLT_VOLUME *RetVolume); 1659 1660 _IRQL_requires_max_(DISPATCH_LEVEL) 1661 NTSTATUS 1662 FLTAPI 1663 FltGetDeviceObject( 1664 _In_ PFLT_VOLUME Volume, 1665 _Outptr_ PDEVICE_OBJECT *DeviceObject); 1666 1667 _IRQL_requires_max_(DISPATCH_LEVEL) 1668 NTSTATUS 1669 FLTAPI 1670 FltGetDiskDeviceObject( 1671 _In_ PFLT_VOLUME Volume, 1672 _Outptr_ PDEVICE_OBJECT *DiskDeviceObject); 1673 1674 _IRQL_requires_max_(APC_LEVEL) 1675 NTSTATUS 1676 FLTAPI 1677 FltGetLowerInstance( 1678 _In_ PFLT_INSTANCE CurrentInstance, 1679 _Outptr_ PFLT_INSTANCE *LowerInstance); 1680 1681 _IRQL_requires_max_(APC_LEVEL) 1682 NTSTATUS 1683 FLTAPI 1684 FltGetUpperInstance( 1685 _In_ PFLT_INSTANCE CurrentInstance, 1686 _Outptr_ PFLT_INSTANCE *UpperInstance); 1687 1688 _IRQL_requires_max_(APC_LEVEL) 1689 NTSTATUS 1690 FLTAPI 1691 FltGetTopInstance( 1692 _In_ PFLT_VOLUME Volume, 1693 _Outptr_ PFLT_INSTANCE *Instance); 1694 1695 _IRQL_requires_max_(APC_LEVEL) 1696 NTSTATUS 1697 FLTAPI 1698 FltGetBottomInstance( 1699 _In_ PFLT_VOLUME Volume, 1700 _Outptr_ PFLT_INSTANCE *Instance); 1701 1702 LONG 1703 FLTAPI 1704 FltCompareInstanceAltitudes( 1705 _In_ PFLT_INSTANCE Instance1, 1706 _In_ PFLT_INSTANCE Instance2); 1707 1708 _IRQL_requires_max_(APC_LEVEL) 1709 NTSTATUS 1710 FLTAPI 1711 FltGetFilterInformation( 1712 _In_ PFLT_FILTER Filter, 1713 _In_ FILTER_INFORMATION_CLASS InformationClass, 1714 _Out_writes_bytes_to_opt_(BufferSize, *BytesReturned) PVOID Buffer, 1715 _In_ ULONG BufferSize, 1716 _Out_ PULONG BytesReturned); 1717 1718 _IRQL_requires_max_(APC_LEVEL) 1719 NTSTATUS 1720 FLTAPI 1721 FltGetInstanceInformation( 1722 _In_ PFLT_INSTANCE Instance, 1723 _In_ INSTANCE_INFORMATION_CLASS InformationClass, 1724 _Out_writes_bytes_to_opt_(BufferSize,*BytesReturned) PVOID Buffer, 1725 _In_ ULONG BufferSize, 1726 _Out_ PULONG BytesReturned); 1727 1728 _IRQL_requires_max_(APC_LEVEL) 1729 NTSTATUS 1730 FLTAPI 1731 FltGetVolumeProperties( 1732 _In_ PFLT_VOLUME Volume, 1733 _Out_writes_bytes_to_opt_(VolumePropertiesLength,*LengthReturned) PFLT_VOLUME_PROPERTIES VolumeProperties, 1734 _In_ ULONG VolumePropertiesLength, 1735 _Out_ PULONG LengthReturned); 1736 1737 _Must_inspect_result_ 1738 _IRQL_requires_max_(PASSIVE_LEVEL) 1739 NTSTATUS 1740 FLTAPI 1741 FltIsVolumeWritable( 1742 _In_ PVOID FltObject, 1743 _Out_ PBOOLEAN IsWritable); 1744 1745 _Must_inspect_result_ 1746 _IRQL_requires_max_(PASSIVE_LEVEL) 1747 NTSTATUS 1748 FLTAPI 1749 FltGetVolumeGuidName( 1750 _In_ PFLT_VOLUME Volume, 1751 _Out_ PUNICODE_STRING VolumeGuidName, 1752 _Out_opt_ PULONG BufferSizeNeeded); 1753 1754 _Must_inspect_result_ 1755 _IRQL_requires_max_(PASSIVE_LEVEL) 1756 NTSTATUS 1757 FLTAPI 1758 FltQueryVolumeInformation( 1759 _In_ PFLT_INSTANCE Instance, 1760 _Out_ PIO_STATUS_BLOCK Iosb, 1761 _Out_writes_bytes_(Length) PVOID FsInformation, 1762 _In_ ULONG Length, 1763 _In_ FS_INFORMATION_CLASS FsInformationClass); 1764 1765 _Must_inspect_result_ 1766 _IRQL_requires_max_(PASSIVE_LEVEL) 1767 NTSTATUS 1768 FLTAPI 1769 FltSetVolumeInformation( 1770 _In_ PFLT_INSTANCE Instance, 1771 _Out_ PIO_STATUS_BLOCK Iosb, 1772 _Out_writes_bytes_(Length) PVOID FsInformation, 1773 _In_ ULONG Length, 1774 _In_ FS_INFORMATION_CLASS FsInformationClass); 1775 1776 _Must_inspect_result_ 1777 _IRQL_requires_max_(APC_LEVEL) 1778 NTSTATUS 1779 FLTAPI 1780 FltEnumerateFilters( 1781 _Out_writes_to_opt_(FilterListSize,*NumberFiltersReturned) PFLT_FILTER *FilterList, 1782 _In_ ULONG FilterListSize, 1783 _Out_ PULONG NumberFiltersReturned); 1784 1785 _Must_inspect_result_ 1786 _IRQL_requires_max_(APC_LEVEL) 1787 NTSTATUS 1788 FLTAPI 1789 FltEnumerateVolumes( 1790 _In_ PFLT_FILTER Filter, 1791 _Out_writes_to_opt_(VolumeListSize,*NumberVolumesReturned) PFLT_VOLUME *VolumeList, 1792 _In_ ULONG VolumeListSize, 1793 _Out_ PULONG NumberVolumesReturned); 1794 1795 _Must_inspect_result_ 1796 _IRQL_requires_max_(APC_LEVEL) 1797 NTSTATUS 1798 FLTAPI 1799 FltEnumerateInstances( 1800 _In_opt_ PFLT_VOLUME Volume, 1801 _In_opt_ PFLT_FILTER Filter, 1802 _Out_writes_to_opt_(InstanceListSize,*NumberInstancesReturned) PFLT_INSTANCE *InstanceList, 1803 _In_ ULONG InstanceListSize, 1804 _Out_ PULONG NumberInstancesReturned); 1805 1806 _Must_inspect_result_ 1807 _IRQL_requires_max_(APC_LEVEL) 1808 NTSTATUS 1809 FLTAPI 1810 FltEnumerateFilterInformation( 1811 _In_ ULONG Index, 1812 _In_ FILTER_INFORMATION_CLASS InformationClass, 1813 _Out_writes_bytes_to_opt_(BufferSize,*BytesReturned) PVOID Buffer, 1814 _In_ ULONG BufferSize, 1815 _Out_ PULONG BytesReturned); 1816 1817 _Must_inspect_result_ 1818 _IRQL_requires_max_(APC_LEVEL) 1819 NTSTATUS 1820 FLTAPI 1821 FltEnumerateInstanceInformationByFilter( 1822 _In_ PFLT_FILTER Filter, 1823 _In_ ULONG Index, 1824 _In_ INSTANCE_INFORMATION_CLASS InformationClass, 1825 _Out_writes_bytes_to_opt_(BufferSize,*BytesReturned) PVOID Buffer, 1826 _In_ ULONG BufferSize, 1827 _Out_ PULONG BytesReturned); 1828 1829 _Must_inspect_result_ 1830 _IRQL_requires_max_(APC_LEVEL) 1831 NTSTATUS 1832 FLTAPI 1833 FltEnumerateInstanceInformationByVolume( 1834 _In_ PFLT_VOLUME Volume, 1835 _In_ ULONG Index, 1836 _In_ INSTANCE_INFORMATION_CLASS InformationClass, 1837 _Out_writes_bytes_to_opt_(BufferSize,*BytesReturned) PVOID Buffer, 1838 _In_ ULONG BufferSize, 1839 _Out_ PULONG BytesReturned); 1840 1841 _Must_inspect_result_ 1842 _IRQL_requires_max_(APC_LEVEL) 1843 NTSTATUS 1844 FLTAPI 1845 FltEnumerateVolumeInformation( 1846 _In_ PFLT_FILTER Filter, 1847 _In_ ULONG Index, 1848 _In_ FILTER_VOLUME_INFORMATION_CLASS InformationClass, 1849 _Out_writes_bytes_to_opt_(BufferSize,*BytesReturned) PVOID Buffer, 1850 _In_ ULONG BufferSize, 1851 _Out_ PULONG BytesReturned); 1852 1853 _Must_inspect_result_ 1854 _IRQL_requires_max_(DISPATCH_LEVEL) 1855 NTSTATUS 1856 FLTAPI 1857 FltObjectReference( 1858 _Inout_ PVOID FltObject); 1859 1860 _IRQL_requires_max_(DISPATCH_LEVEL) 1861 VOID 1862 FLTAPI 1863 FltObjectDereference( 1864 _Inout_ PVOID FltObject); 1865 1866 _Must_inspect_result_ 1867 _IRQL_requires_max_(PASSIVE_LEVEL) 1868 NTSTATUS 1869 FLTAPI 1870 FltCreateCommunicationPort( 1871 _In_ PFLT_FILTER Filter, 1872 _Outptr_ PFLT_PORT *ServerPort, 1873 _In_ POBJECT_ATTRIBUTES ObjectAttributes, 1874 _In_opt_ PVOID ServerPortCookie, 1875 _In_ PFLT_CONNECT_NOTIFY ConnectNotifyCallback, 1876 _In_ PFLT_DISCONNECT_NOTIFY DisconnectNotifyCallback, 1877 _In_opt_ PFLT_MESSAGE_NOTIFY MessageNotifyCallback, 1878 _In_ LONG MaxConnections); 1879 1880 _IRQL_requires_max_(PASSIVE_LEVEL) 1881 VOID 1882 FLTAPI 1883 FltCloseCommunicationPort( 1884 _In_ PFLT_PORT ServerPort); 1885 1886 _IRQL_requires_max_(PASSIVE_LEVEL) 1887 VOID 1888 FLTAPI 1889 FltCloseClientPort( 1890 _In_ PFLT_FILTER Filter, 1891 _Outptr_ PFLT_PORT *ClientPort); 1892 1893 _Must_inspect_result_ 1894 _IRQL_requires_max_(APC_LEVEL) 1895 NTSTATUS 1896 FLTAPI 1897 FltSendMessage( 1898 _In_ PFLT_FILTER Filter, 1899 _In_ PFLT_PORT *ClientPort, 1900 _In_reads_bytes_(SenderBufferLength) PVOID SenderBuffer, 1901 _In_ ULONG SenderBufferLength, 1902 _Out_writes_bytes_opt_(*ReplyLength) PVOID ReplyBuffer, 1903 _Inout_opt_ PULONG ReplyLength, 1904 _In_opt_ PLARGE_INTEGER Timeout); 1905 1906 _Must_inspect_result_ 1907 _IRQL_requires_max_(APC_LEVEL) 1908 NTSTATUS 1909 FLTAPI 1910 FltBuildDefaultSecurityDescriptor( 1911 _Outptr_ PSECURITY_DESCRIPTOR *SecurityDescriptor, 1912 _In_ ACCESS_MASK DesiredAccess); 1913 1914 _IRQL_requires_max_(APC_LEVEL) 1915 VOID 1916 FLTAPI 1917 FltFreeSecurityDescriptor( 1918 _In_ PSECURITY_DESCRIPTOR SecurityDescriptor); 1919 1920 _Must_inspect_result_ 1921 _IRQL_requires_max_(DISPATCH_LEVEL) 1922 BOOLEAN 1923 FLTAPI 1924 FltCancelIo( 1925 _In_ PFLT_CALLBACK_DATA CallbackData); 1926 1927 _IRQL_requires_max_(DISPATCH_LEVEL) 1928 NTSTATUS 1929 FLTAPI 1930 FltSetCancelCompletion( 1931 _In_ PFLT_CALLBACK_DATA CallbackData, 1932 _In_ PFLT_COMPLETE_CANCELED_CALLBACK CanceledCallback); 1933 1934 _Must_inspect_result_ 1935 _IRQL_requires_max_(DISPATCH_LEVEL) 1936 NTSTATUS 1937 FLTAPI 1938 FltClearCancelCompletion( 1939 _In_ PFLT_CALLBACK_DATA CallbackData); 1940 1941 BOOLEAN 1942 FLTAPI 1943 FltIsIoCanceled( 1944 _In_ PFLT_CALLBACK_DATA CallbackData); 1945 1946 _Must_inspect_result_ 1947 _IRQL_requires_max_(DISPATCH_LEVEL) 1948 PFLT_DEFERRED_IO_WORKITEM 1949 FLTAPI 1950 FltAllocateDeferredIoWorkItem(VOID); 1951 1952 _IRQL_requires_max_(DISPATCH_LEVEL) 1953 VOID 1954 FLTAPI 1955 FltFreeDeferredIoWorkItem( 1956 _In_ PFLT_DEFERRED_IO_WORKITEM FltWorkItem); 1957 1958 _Must_inspect_result_ 1959 _IRQL_requires_max_(DISPATCH_LEVEL) 1960 PFLT_GENERIC_WORKITEM 1961 FLTAPI 1962 FltAllocateGenericWorkItem(VOID); 1963 1964 _IRQL_requires_max_(DISPATCH_LEVEL) 1965 VOID 1966 FLTAPI 1967 FltFreeGenericWorkItem( 1968 _In_ PFLT_GENERIC_WORKITEM FltWorkItem); 1969 1970 _Must_inspect_result_ 1971 _IRQL_requires_max_(DISPATCH_LEVEL) 1972 NTSTATUS 1973 FLTAPI 1974 FltQueueDeferredIoWorkItem( 1975 _In_ PFLT_DEFERRED_IO_WORKITEM FltWorkItem, 1976 _In_ PFLT_CALLBACK_DATA Data, 1977 _In_ PFLT_DEFERRED_IO_WORKITEM_ROUTINE WorkerRoutine, 1978 _In_ WORK_QUEUE_TYPE QueueType, 1979 _In_ PVOID Context); 1980 1981 _Must_inspect_result_ 1982 _IRQL_requires_max_(DISPATCH_LEVEL) 1983 NTSTATUS 1984 FLTAPI 1985 FltQueueGenericWorkItem( 1986 _In_ PFLT_GENERIC_WORKITEM FltWorkItem, 1987 _In_ PVOID FltObject, 1988 _In_ PFLT_GENERIC_WORKITEM_ROUTINE WorkerRoutine, 1989 _In_ WORK_QUEUE_TYPE QueueType, 1990 _In_opt_ PVOID Context); 1991 1992 _Must_inspect_result_ 1993 _IRQL_requires_max_(APC_LEVEL) 1994 NTSTATUS 1995 FLTAPI 1996 FltLockUserBuffer( 1997 _In_ PFLT_CALLBACK_DATA CallbackData); 1998 1999 NTSTATUS 2000 FLTAPI 2001 FltDecodeParameters( 2002 _In_ PFLT_CALLBACK_DATA CallbackData, 2003 _Outptr_opt_ PMDL **MdlAddressPointer, 2004 _Outptr_opt_result_bytebuffer_(**Length) PVOID **Buffer, 2005 _Outptr_opt_ PULONG *Length, 2006 _Out_opt_ LOCK_OPERATION *DesiredAccess); 2007 2008 PMDL 2009 FASTCALL 2010 FltGetSwappedBufferMdlAddress( 2011 _In_ PFLT_CALLBACK_DATA CallbackData); 2012 2013 VOID 2014 FASTCALL 2015 FltRetainSwappedBufferMdlAddress( 2016 _In_ PFLT_CALLBACK_DATA CallbackData); 2017 2018 NTSTATUS 2019 FLTAPI 2020 FltCbdqInitialize( 2021 _In_ PFLT_INSTANCE Instance, 2022 _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, 2023 _In_ PFLT_CALLBACK_DATA_QUEUE_INSERT_IO CbdqInsertIo, 2024 _In_ PFLT_CALLBACK_DATA_QUEUE_REMOVE_IO CbdqRemoveIo, 2025 _In_ PFLT_CALLBACK_DATA_QUEUE_PEEK_NEXT_IO CbdqPeekNextIo, 2026 _In_ PFLT_CALLBACK_DATA_QUEUE_ACQUIRE CbdqAcquire, 2027 _In_ PFLT_CALLBACK_DATA_QUEUE_RELEASE CbdqRelease, 2028 _In_ PFLT_CALLBACK_DATA_QUEUE_COMPLETE_CANCELED_IO CbdqCompleteCanceledIo); 2029 2030 VOID 2031 FLTAPI 2032 FltCbdqEnable( 2033 _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq); 2034 2035 VOID 2036 FLTAPI 2037 FltCbdqDisable( 2038 _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq); 2039 2040 _Must_inspect_result_ 2041 NTSTATUS 2042 FLTAPI 2043 FltCbdqInsertIo( 2044 _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, 2045 _In_ PFLT_CALLBACK_DATA Cbd, 2046 _In_opt_ PFLT_CALLBACK_DATA_QUEUE_IO_CONTEXT Context, 2047 _In_opt_ PVOID InsertContext); 2048 2049 _Must_inspect_result_ 2050 PFLT_CALLBACK_DATA 2051 FLTAPI 2052 FltCbdqRemoveIo( 2053 _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, 2054 _In_ PFLT_CALLBACK_DATA_QUEUE_IO_CONTEXT Context); 2055 2056 _Must_inspect_result_ 2057 PFLT_CALLBACK_DATA 2058 FLTAPI 2059 FltCbdqRemoveNextIo( 2060 _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, 2061 _In_opt_ PVOID PeekContext); 2062 2063 _IRQL_requires_max_(APC_LEVEL) 2064 VOID 2065 FLTAPI 2066 FltInitializeOplock( 2067 _Out_ POPLOCK Oplock); 2068 2069 _IRQL_requires_max_(APC_LEVEL) 2070 VOID 2071 FLTAPI 2072 FltUninitializeOplock( 2073 _In_ POPLOCK Oplock); 2074 2075 _Must_inspect_result_ 2076 _IRQL_requires_max_(APC_LEVEL) 2077 FLT_PREOP_CALLBACK_STATUS 2078 FLTAPI 2079 FltOplockFsctrl( 2080 _In_ POPLOCK Oplock, 2081 _In_ PFLT_CALLBACK_DATA CallbackData, 2082 _In_ ULONG OpenCount); 2083 2084 _Must_inspect_result_ 2085 _IRQL_requires_max_(APC_LEVEL) 2086 FLT_PREOP_CALLBACK_STATUS 2087 FLTAPI 2088 FltCheckOplock( 2089 _In_ POPLOCK Oplock, 2090 _In_ PFLT_CALLBACK_DATA CallbackData, 2091 _In_opt_ PVOID Context, 2092 _In_opt_ PFLTOPLOCK_WAIT_COMPLETE_ROUTINE WaitCompletionRoutine, 2093 _In_opt_ PFLTOPLOCK_PREPOST_CALLBACKDATA_ROUTINE PrePostCallbackDataRoutine); 2094 2095 _IRQL_requires_max_(APC_LEVEL) 2096 BOOLEAN 2097 FLTAPI 2098 FltOplockIsFastIoPossible( 2099 _In_ POPLOCK Oplock); 2100 2101 _IRQL_requires_max_(APC_LEVEL) 2102 BOOLEAN 2103 FLTAPI 2104 FltCurrentBatchOplock( 2105 _In_ POPLOCK Oplock); 2106 2107 VOID 2108 FLTAPI 2109 FltInitializeFileLock( 2110 _Out_ PFILE_LOCK FileLock); 2111 2112 VOID 2113 FLTAPI 2114 FltUninitializeFileLock( 2115 _In_ PFILE_LOCK FileLock); 2116 2117 _Must_inspect_result_ 2118 _IRQL_requires_max_(APC_LEVEL) 2119 PFILE_LOCK 2120 FLTAPI 2121 FltAllocateFileLock( 2122 _In_opt_ PFLT_COMPLETE_LOCK_CALLBACK_DATA_ROUTINE CompleteLockCallbackDataRoutine, 2123 _In_opt_ PUNLOCK_ROUTINE UnlockRoutine); 2124 2125 _IRQL_requires_max_(APC_LEVEL) 2126 VOID 2127 FLTAPI 2128 FltFreeFileLock( 2129 _In_ PFILE_LOCK FileLock); 2130 2131 _Must_inspect_result_ 2132 _IRQL_requires_max_(APC_LEVEL) 2133 FLT_PREOP_CALLBACK_STATUS 2134 FLTAPI 2135 FltProcessFileLock( 2136 _In_ PFILE_LOCK FileLock, 2137 _In_ PFLT_CALLBACK_DATA CallbackData, 2138 _In_opt_ PVOID Context); 2139 2140 _Must_inspect_result_ 2141 _IRQL_requires_max_(APC_LEVEL) 2142 BOOLEAN 2143 FLTAPI 2144 FltCheckLockForReadAccess( 2145 _In_ PFILE_LOCK FileLock, 2146 _In_ PFLT_CALLBACK_DATA CallbackData); 2147 2148 _Must_inspect_result_ 2149 _IRQL_requires_max_(APC_LEVEL) 2150 BOOLEAN 2151 FLTAPI 2152 FltCheckLockForWriteAccess( 2153 _In_ PFILE_LOCK FileLock, 2154 _In_ PFLT_CALLBACK_DATA CallbackData); 2155 2156 _Acquires_lock_(_Global_critical_region_) 2157 _IRQL_requires_max_(APC_LEVEL) 2158 VOID 2159 FLTAPI 2160 FltAcquireResourceExclusive( 2161 _Inout_ _Requires_lock_not_held_(*_Curr_) _Acquires_lock_(*_Curr_) PERESOURCE Resource); 2162 2163 _Acquires_lock_(_Global_critical_region_) 2164 _IRQL_requires_max_(APC_LEVEL) 2165 VOID 2166 FLTAPI 2167 FltAcquireResourceShared( 2168 _Inout_ _Requires_lock_not_held_(*_Curr_) _Acquires_lock_(*_Curr_) PERESOURCE Resource); 2169 2170 _Releases_lock_(_Global_critical_region_) 2171 _IRQL_requires_max_(DISPATCH_LEVEL) 2172 VOID 2173 FLTAPI 2174 FltReleaseResource( 2175 _Inout_ _Requires_lock_held_(*_Curr_) _Releases_lock_(*_Curr_) PERESOURCE Resource); 2176 2177 _IRQL_requires_max_(APC_LEVEL) 2178 VOID 2179 FLTAPI 2180 FltInitializePushLock( 2181 _Out_ PEX_PUSH_LOCK PushLock); 2182 2183 _IRQL_requires_max_(APC_LEVEL) 2184 VOID 2185 FLTAPI 2186 FltDeletePushLock( 2187 _In_ PEX_PUSH_LOCK PushLock); 2188 2189 _Acquires_lock_(_Global_critical_region_) 2190 _IRQL_requires_max_(APC_LEVEL) 2191 VOID 2192 FLTAPI 2193 FltAcquirePushLockExclusive( 2194 _Inout_ _Requires_lock_not_held_(*_Curr_) _Acquires_lock_(*_Curr_) PEX_PUSH_LOCK PushLock); 2195 2196 _Acquires_lock_(_Global_critical_region_) 2197 _IRQL_requires_max_(APC_LEVEL) 2198 VOID 2199 FLTAPI 2200 FltAcquirePushLockShared( 2201 _Inout_ _Requires_lock_not_held_(*_Curr_) _Acquires_lock_(*_Curr_) PEX_PUSH_LOCK PushLock); 2202 2203 _Releases_lock_(_Global_critical_region_) 2204 _IRQL_requires_max_(APC_LEVEL) 2205 VOID 2206 FLTAPI 2207 FltReleasePushLock( 2208 _Inout_ _Requires_lock_held_(*_Curr_) _Releases_lock_(*_Curr_) PEX_PUSH_LOCK PushLock); 2209 2210 BOOLEAN 2211 FLTAPI 2212 FltIsOperationSynchronous( 2213 _In_ PFLT_CALLBACK_DATA CallbackData); 2214 2215 _IRQL_requires_max_(DISPATCH_LEVEL) 2216 BOOLEAN 2217 FLTAPI 2218 FltIs32bitProcess( 2219 _In_opt_ PFLT_CALLBACK_DATA CallbackData); 2220 2221 _IRQL_requires_max_(DISPATCH_LEVEL) 2222 PEPROCESS 2223 FLTAPI 2224 FltGetRequestorProcess( 2225 _In_ PFLT_CALLBACK_DATA CallbackData); 2226 2227 _IRQL_requires_max_(DISPATCH_LEVEL) 2228 ULONG 2229 FLTAPI 2230 FltGetRequestorProcessId( 2231 _In_ PFLT_CALLBACK_DATA CallbackData); 2232 2233 _IRQL_requires_max_(APC_LEVEL) 2234 VOID 2235 FLTAPI 2236 FltNotifyFilterChangeDirectory( 2237 _Inout_ PNOTIFY_SYNC NotifySync, 2238 _Inout_ PLIST_ENTRY NotifyList, 2239 _In_ PVOID FsContext, 2240 _In_ PSTRING FullDirectoryName, 2241 _In_ BOOLEAN WatchTree, 2242 _In_ BOOLEAN IgnoreBuffer, 2243 _In_ ULONG CompletionFilter, 2244 _In_ PFLT_CALLBACK_DATA NotifyCallbackData, 2245 _In_opt_ PCHECK_FOR_TRAVERSE_ACCESS TraverseCallback, 2246 _In_opt_ PSECURITY_SUBJECT_CONTEXT SubjectContext, 2247 _In_opt_ PFILTER_REPORT_CHANGE FilterCallback); 2248 2249 PCHAR 2250 FLTAPI 2251 FltGetIrpName( 2252 _In_ UCHAR IrpMajorCode); 2253 2254 #if FLT_MGR_AFTER_XPSP2 2255 2256 _Must_inspect_result_ 2257 _IRQL_requires_max_(PASSIVE_LEVEL) 2258 NTSTATUS 2259 FLTAPI 2260 FltCreateFileEx( 2261 _In_ PFLT_FILTER Filter, 2262 _In_opt_ PFLT_INSTANCE Instance, 2263 _Out_ PHANDLE FileHandle, 2264 _Outptr_opt_ PFILE_OBJECT *FileObject, 2265 _In_ ACCESS_MASK DesiredAccess, 2266 _In_ POBJECT_ATTRIBUTES ObjectAttributes, 2267 _Out_ PIO_STATUS_BLOCK IoStatusBlock, 2268 _In_opt_ PLARGE_INTEGER AllocationSize, 2269 _In_ ULONG FileAttributes, 2270 _In_ ULONG ShareAccess, 2271 _In_ ULONG CreateDisposition, 2272 _In_ ULONG CreateOptions, 2273 _In_reads_bytes_opt_(EaLength) PVOID EaBuffer, 2274 _In_ ULONG EaLength, 2275 _In_ ULONG Flags); 2276 2277 _Must_inspect_result_ 2278 _IRQL_requires_max_(PASSIVE_LEVEL) 2279 NTSTATUS 2280 FLTAPI 2281 FltOpenVolume( 2282 _In_ PFLT_INSTANCE Instance, 2283 _Out_ PHANDLE VolumeHandle, 2284 _Outptr_opt_ PFILE_OBJECT *VolumeFileObject); 2285 2286 _Must_inspect_result_ 2287 _IRQL_requires_max_(PASSIVE_LEVEL) 2288 NTSTATUS 2289 FLTAPI 2290 FltQueryEaFile( 2291 _In_ PFLT_INSTANCE Instance, 2292 _In_ PFILE_OBJECT FileObject, 2293 _Out_writes_bytes_to_(Length,*LengthReturned) PVOID ReturnedEaData, 2294 _In_ ULONG Length, 2295 _In_ BOOLEAN ReturnSingleEntry, 2296 _In_reads_bytes_opt_(EaListLength) PVOID EaList, 2297 _In_ ULONG EaListLength, 2298 _In_opt_ PULONG EaIndex, 2299 _In_ BOOLEAN RestartScan, 2300 _Out_opt_ PULONG LengthReturned); 2301 2302 _Must_inspect_result_ 2303 _IRQL_requires_max_(PASSIVE_LEVEL) 2304 NTSTATUS 2305 FLTAPI 2306 FltSetEaFile( 2307 _In_ PFLT_INSTANCE Instance, 2308 _In_ PFILE_OBJECT FileObject, 2309 _In_reads_bytes_(Length) PVOID EaBuffer, 2310 _In_ ULONG Length); 2311 2312 #endif /* FLT_MGR_AFTER_XPSP2 */ 2313 2314 #if FLT_MGR_LONGHORN 2315 2316 _Must_inspect_result_ 2317 _IRQL_requires_max_(PASSIVE_LEVEL) 2318 NTSTATUS 2319 FLTAPI 2320 FltCreateFileEx2( 2321 _In_ PFLT_FILTER Filter, 2322 _In_opt_ PFLT_INSTANCE Instance, 2323 _Out_ PHANDLE FileHandle, 2324 _Outptr_opt_ PFILE_OBJECT *FileObject, 2325 _In_ ACCESS_MASK DesiredAccess, 2326 _In_ POBJECT_ATTRIBUTES ObjectAttributes, 2327 _Out_ PIO_STATUS_BLOCK IoStatusBlock, 2328 _In_opt_ PLARGE_INTEGER AllocationSize, 2329 _In_ ULONG FileAttributes, 2330 _In_ ULONG ShareAccess, 2331 _In_ ULONG CreateDisposition, 2332 _In_ ULONG CreateOptions, 2333 _In_reads_bytes_opt_(EaLength) PVOID EaBuffer, 2334 _In_ ULONG EaLength, 2335 _In_ ULONG Flags, 2336 _In_opt_ PIO_DRIVER_CREATE_CONTEXT DriverContext); 2337 2338 _Must_inspect_result_ 2339 _IRQL_requires_max_(PASSIVE_LEVEL) 2340 NTSTATUS 2341 FLTAPI 2342 FltQueryDirectoryFile( 2343 _In_ PFLT_INSTANCE Instance, 2344 _In_ PFILE_OBJECT FileObject, 2345 _Out_writes_bytes_(Length) PVOID FileInformation, 2346 _In_ ULONG Length, 2347 _In_ FILE_INFORMATION_CLASS FileInformationClass, 2348 _In_ BOOLEAN ReturnSingleEntry, 2349 _In_opt_ PUNICODE_STRING FileName, 2350 _In_ BOOLEAN RestartScan, 2351 _Out_opt_ PULONG LengthReturned); 2352 2353 _IRQL_requires_max_(APC_LEVEL) 2354 BOOLEAN 2355 FLTAPI 2356 FltSupportsFileContextsEx( 2357 _In_ PFILE_OBJECT FileObject, 2358 _In_opt_ PFLT_INSTANCE Instance); 2359 2360 _IRQL_requires_max_(APC_LEVEL) 2361 NTSTATUS 2362 FLTAPI 2363 FltSetTransactionContext( 2364 _In_ PFLT_INSTANCE Instance, 2365 _In_ PKTRANSACTION Transaction, 2366 _In_ FLT_SET_CONTEXT_OPERATION Operation, 2367 _In_ PFLT_CONTEXT NewContext, 2368 _Outptr_opt_ PFLT_CONTEXT *OldContext); 2369 2370 _IRQL_requires_max_(APC_LEVEL) 2371 NTSTATUS 2372 FLTAPI 2373 FltDeleteTransactionContext( 2374 _In_ PFLT_INSTANCE Instance, 2375 _In_ PKTRANSACTION Transaction, 2376 _Outptr_opt_ PFLT_CONTEXT *OldContext); 2377 2378 _IRQL_requires_max_(APC_LEVEL) 2379 NTSTATUS 2380 FLTAPI 2381 FltGetTransactionContext( 2382 _In_ PFLT_INSTANCE Instance, 2383 _In_ PKTRANSACTION Transaction, 2384 _Outptr_ PFLT_CONTEXT *Context); 2385 2386 _IRQL_requires_max_(APC_LEVEL) 2387 BOOLEAN 2388 FLTAPI 2389 FltIsFltMgrVolumeDeviceObject( 2390 _In_ PDEVICE_OBJECT DeviceObject); 2391 2392 _IRQL_requires_max_(APC_LEVEL) 2393 NTSTATUS 2394 FLTAPI 2395 FltGetVolumeInformation( 2396 _In_ PFLT_VOLUME Volume, 2397 _In_ FILTER_VOLUME_INFORMATION_CLASS InformationClass, 2398 _Out_writes_bytes_to_opt_(BufferSize,*BytesReturned) PVOID Buffer, 2399 _In_ ULONG BufferSize, 2400 _Out_ PULONG BytesReturned); 2401 2402 _IRQL_requires_max_(APC_LEVEL) 2403 NTSTATUS 2404 FLTAPI 2405 FltGetFileSystemType( 2406 _In_ PVOID FltObject, 2407 _Out_ PFLT_FILESYSTEM_TYPE FileSystemType); 2408 2409 _Must_inspect_result_ 2410 _IRQL_requires_max_(PASSIVE_LEVEL) 2411 NTSTATUS 2412 FLTAPI 2413 FltIsVolumeSnapshot( 2414 _In_ PVOID FltObject, 2415 _Out_ PBOOLEAN IsSnapshotVolume); 2416 2417 _Must_inspect_result_ 2418 _When_(((CallbackData!=NULL) && FLT_IS_IRP_OPERATION(CallbackData)), _IRQL_requires_max_(PASSIVE_LEVEL)) 2419 _When_((!((CallbackData!=NULL) && FLT_IS_IRP_OPERATION(CallbackData))), _IRQL_requires_max_(APC_LEVEL)) 2420 NTSTATUS 2421 FLTAPI 2422 FltCancellableWaitForSingleObject( 2423 _In_ PVOID Object, 2424 _In_opt_ PLARGE_INTEGER Timeout, 2425 _In_opt_ PFLT_CALLBACK_DATA CallbackData); 2426 2427 _Must_inspect_result_ 2428 _When_(((CallbackData!=NULL) && FLT_IS_IRP_OPERATION(CallbackData)), _IRQL_requires_max_(PASSIVE_LEVEL)) 2429 _When_((!((CallbackData!=NULL) && FLT_IS_IRP_OPERATION(CallbackData))), _IRQL_requires_max_(APC_LEVEL)) 2430 NTSTATUS 2431 FLTAPI 2432 FltCancellableWaitForMultipleObjects( 2433 _In_ ULONG Count, 2434 _In_reads_(Count) PVOID ObjectArray[], 2435 _In_ WAIT_TYPE WaitType, 2436 _In_opt_ PLARGE_INTEGER Timeout, 2437 _In_opt_ PKWAIT_BLOCK WaitBlockArray, 2438 _In_ PFLT_CALLBACK_DATA CallbackData); 2439 2440 _IRQL_requires_max_(DISPATCH_LEVEL) 2441 HANDLE 2442 FLTAPI 2443 FltGetRequestorProcessIdEx( 2444 _In_ PFLT_CALLBACK_DATA CallbackData); 2445 2446 _Must_inspect_result_ 2447 _IRQL_requires_max_(APC_LEVEL) 2448 NTSTATUS 2449 FLTAPI 2450 FltEnlistInTransaction( 2451 _In_ PFLT_INSTANCE Instance, 2452 _In_ PKTRANSACTION Transaction, 2453 _In_ PFLT_CONTEXT TransactionContext, 2454 _In_ NOTIFICATION_MASK NotificationMask); 2455 2456 _IRQL_requires_max_(APC_LEVEL) 2457 NTSTATUS 2458 FLTAPI 2459 FltRollbackEnlistment( 2460 _In_ PFLT_INSTANCE Instance, 2461 _In_ PKTRANSACTION Transaction, 2462 _In_opt_ PFLT_CONTEXT TransactionContext); 2463 2464 _IRQL_requires_max_(APC_LEVEL) 2465 NTSTATUS 2466 FLTAPI 2467 FltPrePrepareComplete( 2468 _In_ PFLT_INSTANCE Instance, 2469 _In_ PKTRANSACTION Transaction, 2470 _In_opt_ PFLT_CONTEXT TransactionContext); 2471 2472 _IRQL_requires_max_(APC_LEVEL) 2473 NTSTATUS 2474 FLTAPI 2475 FltPrepareComplete( 2476 _In_ PFLT_INSTANCE Instance, 2477 _In_ PKTRANSACTION Transaction, 2478 _In_opt_ PFLT_CONTEXT TransactionContext); 2479 2480 _IRQL_requires_max_(PASSIVE_LEVEL) 2481 NTSTATUS 2482 FLTAPI 2483 FltCommitComplete( 2484 _In_ PFLT_INSTANCE Instance, 2485 _In_ PKTRANSACTION Transaction, 2486 _In_opt_ PFLT_CONTEXT TransactionContext); 2487 2488 _IRQL_requires_max_(APC_LEVEL) 2489 NTSTATUS 2490 FLTAPI 2491 FltCommitFinalizeComplete( 2492 _In_ PFLT_INSTANCE Instance, 2493 _In_ PKTRANSACTION Transaction, 2494 _In_opt_ PFLT_CONTEXT TransactionContext); 2495 2496 _IRQL_requires_max_(PASSIVE_LEVEL) 2497 NTSTATUS 2498 FLTAPI 2499 FltRollbackComplete( 2500 _In_ PFLT_INSTANCE Instance, 2501 _In_ PKTRANSACTION Transaction, 2502 _In_opt_ PFLT_CONTEXT TransactionContext); 2503 2504 _Must_inspect_result_ 2505 _IRQL_requires_max_(APC_LEVEL) 2506 NTSTATUS 2507 FLTAPI 2508 FltAllocateExtraCreateParameterList( 2509 _In_ PFLT_FILTER Filter, 2510 _In_ FSRTL_ALLOCATE_ECPLIST_FLAGS Flags, 2511 _Outptr_ PECP_LIST *EcpList); 2512 2513 _Must_inspect_result_ 2514 _IRQL_requires_max_(APC_LEVEL) 2515 NTSTATUS 2516 FLTAPI 2517 FltAllocateExtraCreateParameter( 2518 _In_ PFLT_FILTER Filter, 2519 _In_ LPCGUID EcpType, 2520 ULONG SizeOfContext, 2521 _In_ FSRTL_ALLOCATE_ECP_FLAGS Flags, 2522 _In_opt_ PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK CleanupCallback, 2523 _In_ ULONG PoolTag, 2524 _Outptr_ PVOID *EcpContext); 2525 2526 _IRQL_requires_max_(APC_LEVEL) 2527 VOID 2528 FLTAPI 2529 FltInitExtraCreateParameterLookasideList( 2530 _In_ PFLT_FILTER Filter, 2531 _Inout_ PVOID Lookaside, 2532 _In_ FSRTL_ECP_LOOKASIDE_FLAGS Flags, 2533 _In_ SIZE_T Size, 2534 _In_ ULONG Tag); 2535 2536 _IRQL_requires_max_(APC_LEVEL) 2537 VOID 2538 FLTAPI 2539 FltDeleteExtraCreateParameterLookasideList( 2540 _In_ PFLT_FILTER Filter, 2541 _Inout_ PVOID Lookaside, 2542 _In_ FSRTL_ECP_LOOKASIDE_FLAGS Flags); 2543 2544 _Must_inspect_result_ 2545 _IRQL_requires_max_(APC_LEVEL) 2546 NTSTATUS 2547 FLTAPI 2548 FltAllocateExtraCreateParameterFromLookasideList( 2549 _In_ PFLT_FILTER Filter, 2550 _In_ LPCGUID EcpType, 2551 _In_ ULONG SizeOfContext, 2552 _In_ FSRTL_ALLOCATE_ECP_FLAGS Flags, 2553 _In_opt_ PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK CleanupCallback, 2554 _Inout_ PVOID LookasideList, 2555 _Outptr_ PVOID *EcpContext); 2556 2557 _IRQL_requires_max_(APC_LEVEL) 2558 NTSTATUS 2559 FLTAPI 2560 FltInsertExtraCreateParameter( 2561 _In_ PFLT_FILTER Filter, 2562 _Inout_ PECP_LIST EcpList, 2563 _Inout_ PVOID EcpContext); 2564 2565 _IRQL_requires_max_(APC_LEVEL) 2566 NTSTATUS 2567 FLTAPI 2568 FltFindExtraCreateParameter( 2569 _In_ PFLT_FILTER Filter, 2570 _In_ PECP_LIST EcpList, 2571 _In_ LPCGUID EcpType, 2572 _Outptr_opt_ PVOID *EcpContext, 2573 _Out_opt_ ULONG *EcpContextSize); 2574 2575 _IRQL_requires_max_(APC_LEVEL) 2576 NTSTATUS 2577 FLTAPI 2578 FltRemoveExtraCreateParameter( 2579 _In_ PFLT_FILTER Filter, 2580 _Inout_ PECP_LIST EcpList, 2581 _In_ LPCGUID EcpType, 2582 _Outptr_ PVOID *EcpContext, 2583 _Out_opt_ ULONG *EcpContextSize); 2584 2585 _IRQL_requires_max_(APC_LEVEL) 2586 VOID 2587 FLTAPI 2588 FltFreeExtraCreateParameterList( 2589 _In_ PFLT_FILTER Filter, 2590 _In_ PECP_LIST EcpList); 2591 2592 _IRQL_requires_max_(APC_LEVEL) 2593 VOID 2594 FLTAPI 2595 FltFreeExtraCreateParameter( 2596 _In_ PFLT_FILTER Filter, 2597 _In_ PVOID EcpContext); 2598 2599 _IRQL_requires_max_(APC_LEVEL) 2600 NTSTATUS 2601 FLTAPI 2602 FltGetEcpListFromCallbackData( 2603 _In_ PFLT_FILTER Filter, 2604 _In_ PFLT_CALLBACK_DATA CallbackData, 2605 _Outptr_result_maybenull_ PECP_LIST *EcpList); 2606 2607 _IRQL_requires_max_(APC_LEVEL) 2608 NTSTATUS 2609 FLTAPI 2610 FltSetEcpListIntoCallbackData( 2611 _In_ PFLT_FILTER Filter, 2612 _In_ PFLT_CALLBACK_DATA CallbackData, 2613 _In_ PECP_LIST EcpList); 2614 2615 _IRQL_requires_max_(APC_LEVEL) 2616 NTSTATUS 2617 FLTAPI 2618 FltGetNextExtraCreateParameter( 2619 _In_ PFLT_FILTER Filter, 2620 _In_ PECP_LIST EcpList, 2621 _In_opt_ PVOID CurrentEcpContext, 2622 _Out_opt_ LPGUID NextEcpType, 2623 _Outptr_opt_ PVOID *NextEcpContext, 2624 _Out_opt_ ULONG *NextEcpContextSize); 2625 2626 _IRQL_requires_max_(APC_LEVEL) 2627 VOID 2628 FLTAPI 2629 FltAcknowledgeEcp( 2630 _In_ PFLT_FILTER Filter, 2631 _In_ PVOID EcpContext); 2632 2633 _IRQL_requires_max_(APC_LEVEL) 2634 BOOLEAN 2635 FLTAPI 2636 FltIsEcpAcknowledged( 2637 _In_ PFLT_FILTER Filter, 2638 _In_ PVOID EcpContext); 2639 2640 _IRQL_requires_max_(APC_LEVEL) 2641 BOOLEAN 2642 FLTAPI 2643 FltIsEcpFromUserMode( 2644 _In_ PFLT_FILTER Filter, 2645 _In_ PVOID EcpContext); 2646 2647 _IRQL_requires_max_(DISPATCH_LEVEL) 2648 NTSTATUS 2649 FLTAPI 2650 FltRetrieveIoPriorityInfo( 2651 _In_opt_ PFLT_CALLBACK_DATA Data, 2652 _In_opt_ PFILE_OBJECT FileObject, 2653 _In_opt_ PETHREAD Thread, 2654 _Inout_ PIO_PRIORITY_INFO PriorityInfo); 2655 2656 _IRQL_requires_max_(DISPATCH_LEVEL) 2657 NTSTATUS 2658 FLTAPI 2659 FltApplyPriorityInfoThread( 2660 _In_ PIO_PRIORITY_INFO InputPriorityInfo, 2661 _Out_opt_ PIO_PRIORITY_INFO OutputPriorityInfo, 2662 _In_ PETHREAD Thread); 2663 2664 _IRQL_requires_max_(DISPATCH_LEVEL) 2665 IO_PRIORITY_HINT 2666 FLTAPI 2667 FltGetIoPriorityHint( 2668 _In_ PFLT_CALLBACK_DATA Data); 2669 2670 _IRQL_requires_max_(DISPATCH_LEVEL) 2671 IO_PRIORITY_HINT 2672 FLTAPI 2673 FltGetIoPriorityHintFromCallbackData( 2674 _In_ PFLT_CALLBACK_DATA Data); 2675 2676 _IRQL_requires_max_(DISPATCH_LEVEL) 2677 NTSTATUS 2678 FLTAPI 2679 FltSetIoPriorityHintIntoCallbackData( 2680 _In_ PFLT_CALLBACK_DATA Data, 2681 _In_ IO_PRIORITY_HINT PriorityHint); 2682 2683 _IRQL_requires_max_(DISPATCH_LEVEL) 2684 IO_PRIORITY_HINT 2685 FLTAPI 2686 FltGetIoPriorityHintFromFileObject( 2687 _In_ PFILE_OBJECT FileObject); 2688 2689 _Must_inspect_result_ 2690 _IRQL_requires_max_(DISPATCH_LEVEL) 2691 NTSTATUS 2692 FLTAPI 2693 FltSetIoPriorityHintIntoFileObject( 2694 _In_ PFILE_OBJECT FileObject, 2695 _In_ IO_PRIORITY_HINT PriorityHint); 2696 2697 _IRQL_requires_max_(DISPATCH_LEVEL) 2698 IO_PRIORITY_HINT 2699 FLTAPI 2700 FltGetIoPriorityHintFromThread( 2701 _In_ PETHREAD Thread); 2702 2703 _IRQL_requires_max_(DISPATCH_LEVEL) 2704 NTSTATUS 2705 FLTAPI 2706 FltSetIoPriorityHintIntoThread( 2707 _In_ PETHREAD Thread, 2708 _In_ IO_PRIORITY_HINT PriorityHint); 2709 2710 #endif /* FLT_MGR_LONGHORN */ 2711 2712 #if FLT_MGR_WIN7 2713 2714 _Must_inspect_result_ 2715 _IRQL_requires_max_(APC_LEVEL) 2716 NTSTATUS 2717 FLTAPI 2718 FltAllocateCallbackDataEx( 2719 _In_ PFLT_INSTANCE Instance, 2720 _In_opt_ PFILE_OBJECT FileObject, 2721 _In_ FLT_ALLOCATE_CALLBACK_DATA_FLAGS Flags, 2722 _Outptr_ PFLT_CALLBACK_DATA *RetNewCallbackData); 2723 2724 _Must_inspect_result_ 2725 _IRQL_requires_max_(DPC_LEVEL) 2726 PVOID 2727 FLTAPI 2728 FltGetNewSystemBufferAddress( 2729 _In_ PFLT_CALLBACK_DATA CallbackData); 2730 2731 _Must_inspect_result_ 2732 _IRQL_requires_max_(APC_LEVEL) 2733 FLT_PREOP_CALLBACK_STATUS 2734 FLTAPI 2735 FltCheckOplockEx( 2736 _In_ POPLOCK Oplock, 2737 _In_ PFLT_CALLBACK_DATA CallbackData, 2738 _In_ ULONG Flags, 2739 _In_opt_ PVOID Context, 2740 _In_opt_ PFLTOPLOCK_WAIT_COMPLETE_ROUTINE WaitCompletionRoutine, 2741 _In_opt_ PFLTOPLOCK_PREPOST_CALLBACKDATA_ROUTINE PrePostCallbackDataRoutine); 2742 2743 _IRQL_requires_max_(APC_LEVEL) 2744 BOOLEAN 2745 FLTAPI 2746 FltCurrentOplock( 2747 _In_ POPLOCK Oplock); 2748 2749 _IRQL_requires_max_(APC_LEVEL) 2750 BOOLEAN 2751 FLTAPI 2752 FltCurrentOplockH( 2753 _In_ POPLOCK Oplock); 2754 2755 _IRQL_requires_max_(APC_LEVEL) 2756 FLT_PREOP_CALLBACK_STATUS 2757 FLTAPI 2758 FltOplockBreakH( 2759 _In_ POPLOCK Oplock, 2760 _In_ PFLT_CALLBACK_DATA CallbackData, 2761 _In_ ULONG Flags, 2762 _In_opt_ PVOID Context, 2763 _In_opt_ PFLTOPLOCK_WAIT_COMPLETE_ROUTINE WaitCompletionRoutine, 2764 _In_opt_ PFLTOPLOCK_PREPOST_CALLBACKDATA_ROUTINE PrePostCallbackDataRoutine); 2765 2766 _IRQL_requires_max_(APC_LEVEL) 2767 FLT_PREOP_CALLBACK_STATUS 2768 FLTAPI 2769 FltOplockBreakToNone( 2770 _In_ POPLOCK Oplock, 2771 _In_ PFLT_CALLBACK_DATA CallbackData, 2772 _In_opt_ PVOID Context, 2773 _In_opt_ PFLTOPLOCK_WAIT_COMPLETE_ROUTINE WaitCompletionRoutine, 2774 _In_opt_ PFLTOPLOCK_PREPOST_CALLBACKDATA_ROUTINE PrePostCallbackDataRoutine); 2775 2776 _IRQL_requires_max_(APC_LEVEL) 2777 FLT_PREOP_CALLBACK_STATUS 2778 FLTAPI 2779 FltOplockBreakToNoneEx( 2780 _In_ POPLOCK Oplock, 2781 _In_ PFLT_CALLBACK_DATA CallbackData, 2782 _In_ ULONG Flags, 2783 _In_opt_ PVOID Context, 2784 _In_opt_ PFLTOPLOCK_WAIT_COMPLETE_ROUTINE WaitCompletionRoutine, 2785 _In_opt_ PFLTOPLOCK_PREPOST_CALLBACKDATA_ROUTINE PrePostCallbackDataRoutine); 2786 2787 _IRQL_requires_max_(APC_LEVEL) 2788 BOOLEAN 2789 FLTAPI 2790 FltOplockIsSharedRequest( 2791 _In_ PFLT_CALLBACK_DATA CallbackData); 2792 2793 _Must_inspect_result_ 2794 _IRQL_requires_max_(APC_LEVEL) 2795 FLT_PREOP_CALLBACK_STATUS 2796 FLTAPI 2797 FltOplockFsctrlEx( 2798 _In_ POPLOCK Oplock, 2799 _In_ PFLT_CALLBACK_DATA CallbackData, 2800 _In_ ULONG OpenCount, 2801 _In_ ULONG Flags); 2802 2803 BOOLEAN 2804 FLTAPI 2805 FltOplockKeysEqual( 2806 _In_opt_ PFILE_OBJECT Fo1, 2807 _In_opt_ PFILE_OBJECT Fo2); 2808 2809 _Must_inspect_result_ 2810 _IRQL_requires_max_(APC_LEVEL) 2811 NTSTATUS 2812 FLTAPI 2813 FltGetRequestorSessionId( 2814 _In_ PFLT_CALLBACK_DATA CallbackData, 2815 _Out_ PULONG SessionId); 2816 2817 _IRQL_requires_max_(DISPATCH_LEVEL) 2818 NTSTATUS 2819 FLTAPI 2820 FltAdjustDeviceStackSizeForIoRedirection( 2821 _In_ PFLT_INSTANCE SourceInstance, 2822 _In_ PFLT_INSTANCE TargetInstance, 2823 _Out_opt_ PBOOLEAN SourceDeviceStackSizeModified); 2824 2825 _IRQL_requires_max_(DISPATCH_LEVEL) 2826 NTSTATUS 2827 FLTAPI 2828 FltIsIoRedirectionAllowed( 2829 _In_ PFLT_INSTANCE SourceInstance, 2830 _In_ PFLT_INSTANCE TargetInstance, 2831 _Out_ PBOOLEAN RedirectionAllowed); 2832 2833 _IRQL_requires_max_(DISPATCH_LEVEL) 2834 NTSTATUS 2835 FLTAPI 2836 FltIsIoRedirectionAllowedForOperation( 2837 _In_ PFLT_CALLBACK_DATA Data, 2838 _In_ PFLT_INSTANCE TargetInstance, 2839 _Out_ PBOOLEAN RedirectionAllowedThisIo, 2840 _Out_opt_ PBOOLEAN RedirectionAllowedAllIo); 2841 2842 #endif /* FLT_MGR_WIN7 */ 2843 2844 #endif /* FLT_MGR_BASELINE */ 2845 2846 #ifdef __cplusplus 2847 } /* extern "C" */ 2848 #endif 2849 2850 #endif /* __FLTKERNEL__ */ 2851