1 #ifndef _FLTMGR_H 2 #define _FLTMGR_H 3 4 #include <ntifs.h> 5 #include <ndk/obfuncs.h> 6 #include <ndk/exfuncs.h> 7 #include <fltkernel.h> 8 #include <pseh/pseh2.h> 9 10 #include <section_attribs.h> 11 12 #define DRIVER_NAME L"FltMgr" 13 14 #define FLT_MAJOR_VERSION 0x0200 15 #define FLT_MINOR_VERSION 0x0000 //win2k3 16 17 #define FM_TAG_DISPATCH_TABLE 'ifMF' 18 #define FM_TAG_REGISTRY_DATA 'rtMF' 19 #define FM_TAG_DEV_OBJ_PTRS 'ldMF' 20 #define FM_TAG_UNICODE_STRING 'suMF' 21 #define FM_TAG_FILTER 'lfMF' 22 #define FM_TAG_CONTEXT_REGISTA 'rcMF' 23 #define FM_TAG_CCB 'bcMF' 24 #define FM_TAG_TEMP_REGISTRY 'rtMF' 25 26 #define MAX_DEVNAME_LENGTH 64 27 28 29 typedef struct _DRIVER_DATA 30 { 31 PDRIVER_OBJECT DriverObject; 32 PDEVICE_OBJECT DeviceObject; 33 UNICODE_STRING ServiceKey; 34 35 PDEVICE_OBJECT CommsDeviceObject; 36 37 PFAST_IO_DISPATCH FastIoDispatch; 38 39 FAST_MUTEX FilterAttachLock; 40 41 } DRIVER_DATA, *PDRIVER_DATA; 42 43 typedef struct _FLTMGR_DEVICE_EXTENSION 44 { 45 /* The file system we're attached to */ 46 PDEVICE_OBJECT AttachedToDeviceObject; 47 48 /* The storage stack(disk) associated with the file system device object we're attached to */ 49 PDEVICE_OBJECT StorageStackDeviceObject; 50 51 /* Either physical drive for volume device objects otherwise 52 * it's the name of the control device we're attached to */ 53 UNICODE_STRING DeviceName; 54 WCHAR DeviceNameBuffer[MAX_DEVNAME_LENGTH]; 55 56 } FLTMGR_DEVICE_EXTENSION, *PFLTMGR_DEVICE_EXTENSION; 57 58 59 NTSTATUS 60 FltpRegisterContexts( 61 _In_ PFLT_FILTER Filter, 62 _In_ const FLT_CONTEXT_REGISTRATION *Context 63 ); 64 65 VOID 66 FltpExInitializeRundownProtection( 67 _Out_ PEX_RUNDOWN_REF RundownRef 68 ); 69 70 BOOLEAN 71 FltpExAcquireRundownProtection( 72 _Inout_ PEX_RUNDOWN_REF RundownRef 73 ); 74 75 BOOLEAN 76 FltpExReleaseRundownProtection( 77 _Inout_ PEX_RUNDOWN_REF RundownRef 78 ); 79 80 NTSTATUS 81 NTAPI 82 FltpObjectRundownWait( 83 _Inout_ PEX_RUNDOWN_REF RundownRef 84 ); 85 86 BOOLEAN 87 FltpExRundownCompleted( 88 _Inout_ PEX_RUNDOWN_REF RundownRef 89 ); 90 91 /////////// FIXME: put these into the correct header 92 NTSTATUS 93 FltpGetBaseDeviceObjectName(_In_ PDEVICE_OBJECT DeviceObject, 94 _Inout_ PUNICODE_STRING ObjectName); 95 96 NTSTATUS 97 FltpGetObjectName(_In_ PVOID Object, 98 _Inout_ PUNICODE_STRING ObjectName); 99 100 NTSTATUS 101 FltpReallocateUnicodeString(_In_ PUNICODE_STRING String, 102 _In_ SIZE_T NewLength, 103 _In_ BOOLEAN CopyExisting); 104 105 VOID 106 FltpFreeUnicodeString(_In_ PUNICODE_STRING String); 107 108 109 110 //////////////////////////////////////////////// 111 112 113 114 115 116 117 118 119 120 121 122 123 //FM ? ? -fltmgr.sys - Unrecognized FltMgr tag(update pooltag.w) 124 //FMac - fltmgr.sys - ASCII String buffers 125 //FMas - fltmgr.sys - ASYNC_IO_COMPLETION_CONTEXT structure 126 //FMcb - fltmgr.sys - FLT_CCB structure 127 //FMcr - fltmgr.sys - Context registration structures 128 //FMct - fltmgr.sys - TRACK_COMPLETION_NODES structure 129 //FMdl - fltmgr.sys - Array of DEVICE_OBJECT pointers 130 //FMea - fltmgr.sys - EA buffer for create 131 //FMfc - fltmgr.sys - FLTMGR_FILE_OBJECT_CONTEXT structure 132 //FMfi - fltmgr.sys - Fast IO dispatch table 133 //FMfk - fltmgr.sys - Byte Range Lock structure 134 //FMfl - fltmgr.sys - FLT_FILTER structure 135 //FMfn - fltmgr.sys - NAME_CACHE_NODE structure 136 //FMfr - fltmgr.sys - FLT_FRAME structure 137 //FMfz - fltmgr.sys - FILE_LIST_CTRL structure 138 //FMib - fltmgr.sys - Irp SYSTEM buffers 139 //FMic - fltmgr.sys - IRP_CTRL structure 140 //FMin - fltmgr.sys - FLT_INSTANCE name 141 //FMil - fltmgr.sys - IRP_CTRL completion node stack 142 //FMis - fltmgr.sys - FLT_INSTANCE structure 143 //FMla - fltmgr.sys - Per - processor IRPCTRL lookaside lists 144 //FMnc - fltmgr.sys - NAME_CACHE_CREATE_CTRL structure 145 //FMng - fltmgr.sys - NAME_GENERATION_CONTEXT structure 146 //FMol - fltmgr.sys - OPLOCK_CONTEXT structure 147 //FMos - fltmgr.sys - Operation status ctrl structure 148 //FMpl - fltmgr.sys - Cache aware pushLock 149 //FMpr - fltmgr.sys - FLT_PRCB structure 150 //FMrl - fltmgr.sys - FLT_OBJECT rundown logs 151 //FMrp - fltmgr.sys - Reparse point data buffer 152 //FMrr - fltmgr.sys - Per - processor Cache - aware rundown ref structure 153 //FMsd - fltmgr.sys - Security descriptors 154 //FMsl - fltmgr.sys - STREAM_LIST_CTRL structure 155 //FMtn - fltmgr.sys - Temporary file names 156 //FMtr - fltmgr.sys - Temporary Registry information 157 //FMts - fltmgr.sys - Tree Stack 158 //FMus - fltmgr.sys - Unicode string 159 //FMvf - fltmgr.sys - FLT_VERIFIER_EXTENSION structure 160 //FMvj - fltmgr.sys - FLT_VERIFIER_OBJECT structure 161 //FMvo - fltmgr.sys - FLT_VOLUME structure 162 //FMwi - fltmgr.sys - Work item structures 163 //FMcn - fltmgr.sys - Non paged context extension structures. 164 //FMtp - fltmgr.sys - Non Paged tx vol context structures. 165 //FMlp - fltmgr.sys - Paged stream list control entry structures. 166 167 168 169 170 /* 171 FltAcquirePushLockExclusive 172 FltAcquirePushLockShared 173 FltAcquireResourceExclusive 174 FltAcquireResourceShared 175 FltAllocateCallbackData 176 FltAllocateContext 177 FltAllocateDeferredIoWorkItem 178 FltAllocateFileLock 179 FltAllocateGenericWorkItem 180 FltAllocatePoolAlignedWithTag 181 FltAttachVolume 182 FltAttachVolumeAtAltitude 183 FltBuildDefaultSecurityDescriptor 184 FltCancelFileOpen 185 FltCancelIo 186 FltCbdqDisable 187 FltCbdqEnable 188 FltCbdqInitialize 189 FltCbdqInsertIo 190 FltCbdqRemoveIo 191 FltCbdqRemoveNextIo 192 FltCheckAndGrowNameControl 193 FltCheckLockForReadAccess 194 FltCheckLockForWriteAccess 195 FltCheckOplock 196 FltClearCallbackDataDirty 197 FltClearCancelCompletion 198 FltClose 199 FltCloseClientPort 200 FltCloseCommunicationPort 201 FltCompareInstanceAltitudes 202 FltCompletePendedPostOperation 203 FltCompletePendedPreOperation 204 FltCreateCommunicationPort 205 FltCreateFile 206 FltCreateFileEx 207 FltCreateSystemVolumeInformationFolder 208 FltCurrentBatchOplock 209 FltDecodeParameters 210 FltDeleteContext 211 FltDeleteFileContext 212 FltDeleteInstanceContext 213 FltDeletePushLock 214 FltDeleteStreamContext 215 FltDeleteStreamHandleContext 216 FltDeleteVolumeContext 217 FltDetachVolume 218 FltDeviceIoControlFile 219 FltDoCompletionProcessingWhenSafe 220 FltEnumerateFilterInformation 221 FltEnumerateFilters 222 FltEnumerateInstanceInformationByFilter 223 FltEnumerateInstanceInformationByVolume 224 FltEnumerateInstances 225 FltEnumerateVolumeInformation 226 FltEnumerateVolumes 227 FltFlushBuffers 228 FltFreeCallbackData 229 FltFreeDeferredIoWorkItem 230 FltFreeFileLock 231 FltFreeGenericWorkItem 232 FltFreePoolAlignedWithTag 233 FltFreeSecurityDescriptor 234 FltFsControlFile 235 FltGetBottomInstance 236 FltGetContexts 237 FltGetDestinationFileNameInformation 238 FltGetDeviceObject 239 FltGetDiskDeviceObject 240 FltGetFileContext 241 FltGetFileNameInformation 242 FltGetFileNameInformationUnsafe 243 FltGetFilterFromInstance 244 FltGetFilterFromName 245 FltGetFilterInformation 246 FltGetInstanceContext 247 FltGetInstanceInformation 248 FltGetIrpName 249 FltGetLowerInstance 250 FltGetRequestorProcess 251 FltGetRequestorProcessId 252 FltGetRoutineAddress 253 FltGetStreamContext 254 FltGetStreamHandleContext 255 FltGetSwappedBufferMdlAddress 256 FltGetTopInstance 257 FltGetTunneledName 258 FltGetUpperInstance 259 FltGetVolumeContext 260 FltGetVolumeFromDeviceObject 261 FltGetVolumeFromFileObject 262 FltLoadFilter 263 FltGetVolumeFromName 264 FltGetVolumeGuidName 265 FltGetVolumeInstanceFromName 266 FltGetVolumeName 267 FltGetVolumeProperties 268 FltInitializeFileLock 269 FltInitializeOplock 270 FltInitializePushLock 271 FltIs32bitProcess 272 FltIsCallbackDataDirty 273 FltIsDirectory 274 FltIsIoCanceled 275 FltIsOperationSynchronous 276 FltIsVolumeWritable 277 FltLoadFilter 278 FltLockUserBuffer 279 FltNotifyFilterChangeDirectory 280 FltObjectDereference 281 FltObjectReference 282 FltOpenVolume 283 FltOplockFsctrl 284 FltOplockIsFastIoPossible 285 FltParseFileName 286 FltParseFileNameInformation 287 FltPerformAsynchronousIo 288 FltPerformSynchronousIo 289 FltProcessFileLock 290 FltPurgeFileNameInformationCache 291 FltQueryEaFile 292 FltQueryInformationFile 293 FltQuerySecurityObject 294 FltQueryVolumeInformation 295 FltQueryVolumeInformationFile 296 FltQueueDeferredIoWorkItem 297 FltQueueGenericWorkItem 298 FltReadFile 299 FltReferenceContext 300 FltReferenceFileNameInformation 301 FltRegisterFilter 302 FltReissueSynchronousIo 303 FltReleaseContext 304 FltReleaseContexts 305 FltReleaseFileNameInformation 306 FltReleasePushLock 307 FltReleaseResource 308 FltRequestOperationStatusCallback 309 FltRetainSwappedBufferMdlAddress 310 FltReuseCallbackData 311 FltSendMessage 312 FltSetCallbackDataDirty 313 FltSetCancelCompletion 314 FltSetEaFile 315 FltSetFileContext 316 FltSetInformationFile 317 FltSetInstanceContext 318 FltSetSecurityObject 319 FltSetStreamContext 320 FltSetStreamHandleContext 321 FltSetVolumeContext 322 FltSetVolumeInformation 323 FltStartFiltering 324 FltSupportsFileContexts 325 FltSupportsStreamContexts 326 FltSupportsStreamHandleContexts 327 FltTagFile 328 FltUninitializeFileLock 329 FltUninitializeOplock 330 FltUnloadFilter 331 FltUnregisterFilter 332 FltUntagFile 333 FltWriteFile 334 */ 335 336 337 338 339 #endif /* _FLTMGR_H */ 340