1 $if (_NTIFS_) 2 /* FSRTL Types */ 3 4 typedef ULONG LBN; 5 typedef LBN *PLBN; 6 7 typedef ULONG VBN; 8 typedef VBN *PVBN; 9 10 #define FSRTL_COMMON_FCB_HEADER_LAYOUT \ 11 CSHORT NodeTypeCode; \ 12 CSHORT NodeByteSize; \ 13 UCHAR Flags; \ 14 UCHAR IsFastIoPossible; \ 15 UCHAR Flags2; \ 16 UCHAR Reserved:4; \ 17 UCHAR Version:4; \ 18 PERESOURCE Resource; \ 19 PERESOURCE PagingIoResource; \ 20 LARGE_INTEGER AllocationSize; \ 21 LARGE_INTEGER FileSize; \ 22 LARGE_INTEGER ValidDataLength; 23 24 typedef struct _FSRTL_COMMON_FCB_HEADER { 25 FSRTL_COMMON_FCB_HEADER_LAYOUT 26 } FSRTL_COMMON_FCB_HEADER, *PFSRTL_COMMON_FCB_HEADER; 27 28 #ifdef __cplusplus 29 typedef struct _FSRTL_ADVANCED_FCB_HEADER:FSRTL_COMMON_FCB_HEADER { 30 #else /* __cplusplus */ 31 typedef struct _FSRTL_ADVANCED_FCB_HEADER { 32 FSRTL_COMMON_FCB_HEADER_LAYOUT 33 #endif /* __cplusplus */ 34 PFAST_MUTEX FastMutex; 35 LIST_ENTRY FilterContexts; 36 #if (NTDDI_VERSION >= NTDDI_VISTA) 37 EX_PUSH_LOCK PushLock; 38 PVOID *FileContextSupportPointer; 39 #endif 40 } FSRTL_ADVANCED_FCB_HEADER, *PFSRTL_ADVANCED_FCB_HEADER; 41 42 #define FSRTL_FCB_HEADER_V0 (0x00) 43 #define FSRTL_FCB_HEADER_V1 (0x01) 44 45 #define FSRTL_FLAG_FILE_MODIFIED (0x01) 46 #define FSRTL_FLAG_FILE_LENGTH_CHANGED (0x02) 47 #define FSRTL_FLAG_LIMIT_MODIFIED_PAGES (0x04) 48 #define FSRTL_FLAG_ACQUIRE_MAIN_RSRC_EX (0x08) 49 #define FSRTL_FLAG_ACQUIRE_MAIN_RSRC_SH (0x10) 50 #define FSRTL_FLAG_USER_MAPPED_FILE (0x20) 51 #define FSRTL_FLAG_ADVANCED_HEADER (0x40) 52 #define FSRTL_FLAG_EOF_ADVANCE_ACTIVE (0x80) 53 54 #define FSRTL_FLAG2_DO_MODIFIED_WRITE (0x01) 55 #define FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS (0x02) 56 #define FSRTL_FLAG2_PURGE_WHEN_MAPPED (0x04) 57 #define FSRTL_FLAG2_IS_PAGING_FILE (0x08) 58 59 #define FSRTL_FSP_TOP_LEVEL_IRP (0x01) 60 #define FSRTL_CACHE_TOP_LEVEL_IRP (0x02) 61 #define FSRTL_MOD_WRITE_TOP_LEVEL_IRP (0x03) 62 #define FSRTL_FAST_IO_TOP_LEVEL_IRP (0x04) 63 #define FSRTL_NETWORK1_TOP_LEVEL_IRP ((LONG_PTR)0x05) 64 #define FSRTL_NETWORK2_TOP_LEVEL_IRP ((LONG_PTR)0x06) 65 #define FSRTL_MAX_TOP_LEVEL_IRP_FLAG ((LONG_PTR)0xFFFF) 66 67 typedef struct _FSRTL_AUXILIARY_BUFFER { 68 PVOID Buffer; 69 ULONG Length; 70 ULONG Flags; 71 PMDL Mdl; 72 } FSRTL_AUXILIARY_BUFFER, *PFSRTL_AUXILIARY_BUFFER; 73 74 #define FSRTL_AUXILIARY_FLAG_DEALLOCATE 0x00000001 75 76 typedef enum _FSRTL_COMPARISON_RESULT { 77 LessThan = -1, 78 EqualTo = 0, 79 GreaterThan = 1 80 } FSRTL_COMPARISON_RESULT; 81 82 #define FSRTL_FAT_LEGAL 0x01 83 #define FSRTL_HPFS_LEGAL 0x02 84 #define FSRTL_NTFS_LEGAL 0x04 85 #define FSRTL_WILD_CHARACTER 0x08 86 #define FSRTL_OLE_LEGAL 0x10 87 #define FSRTL_NTFS_STREAM_LEGAL (FSRTL_NTFS_LEGAL | FSRTL_OLE_LEGAL) 88 89 #define FSRTL_VOLUME_DISMOUNT 1 90 #define FSRTL_VOLUME_DISMOUNT_FAILED 2 91 #define FSRTL_VOLUME_LOCK 3 92 #define FSRTL_VOLUME_LOCK_FAILED 4 93 #define FSRTL_VOLUME_UNLOCK 5 94 #define FSRTL_VOLUME_MOUNT 6 95 #define FSRTL_VOLUME_NEEDS_CHKDSK 7 96 #define FSRTL_VOLUME_WORM_NEAR_FULL 8 97 #define FSRTL_VOLUME_WEARING_OUT 9 98 #define FSRTL_VOLUME_FORCED_CLOSED 10 99 #define FSRTL_VOLUME_INFO_MAKE_COMPAT 11 100 #define FSRTL_VOLUME_PREPARING_EJECT 12 101 #define FSRTL_VOLUME_CHANGE_SIZE 13 102 #define FSRTL_VOLUME_BACKGROUND_FORMAT 14 103 104 typedef VOID 105 (NTAPI *PFSRTL_STACK_OVERFLOW_ROUTINE)( 106 _In_ PVOID Context, 107 _In_ PKEVENT Event); 108 109 #if (NTDDI_VERSION >= NTDDI_VISTA) 110 111 #define FSRTL_UNC_PROVIDER_FLAGS_MAILSLOTS_SUPPORTED 0x00000001 112 #define FSRTL_UNC_PROVIDER_FLAGS_CSC_ENABLED 0x00000002 113 #define FSRTL_UNC_PROVIDER_FLAGS_DOMAIN_SVC_AWARE 0x00000004 114 115 #define FSRTL_ALLOCATE_ECPLIST_FLAG_CHARGE_QUOTA 0x00000001 116 117 #define FSRTL_ALLOCATE_ECP_FLAG_CHARGE_QUOTA 0x00000001 118 #define FSRTL_ALLOCATE_ECP_FLAG_NONPAGED_POOL 0x00000002 119 120 #define FSRTL_ECP_LOOKASIDE_FLAG_NONPAGED_POOL 0x00000002 121 122 #define FSRTL_VIRTDISK_FULLY_ALLOCATED 0x00000001 123 #define FSRTL_VIRTDISK_NO_DRIVE_LETTER 0x00000002 124 125 typedef struct _FSRTL_MUP_PROVIDER_INFO_LEVEL_1 { 126 ULONG32 ProviderId; 127 } FSRTL_MUP_PROVIDER_INFO_LEVEL_1, *PFSRTL_MUP_PROVIDER_INFO_LEVEL_1; 128 129 typedef struct _FSRTL_MUP_PROVIDER_INFO_LEVEL_2 { 130 ULONG32 ProviderId; 131 UNICODE_STRING ProviderName; 132 } FSRTL_MUP_PROVIDER_INFO_LEVEL_2, *PFSRTL_MUP_PROVIDER_INFO_LEVEL_2; 133 134 typedef VOID 135 (*PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK) ( 136 _Inout_ PVOID EcpContext, 137 _In_ LPCGUID EcpType); 138 139 typedef struct _ECP_LIST ECP_LIST, *PECP_LIST; 140 141 typedef ULONG FSRTL_ALLOCATE_ECPLIST_FLAGS; 142 typedef ULONG FSRTL_ALLOCATE_ECP_FLAGS; 143 typedef ULONG FSRTL_ECP_LOOKASIDE_FLAGS; 144 145 typedef enum _FSRTL_CHANGE_BACKING_TYPE { 146 ChangeDataControlArea, 147 ChangeImageControlArea, 148 ChangeSharedCacheMap 149 } FSRTL_CHANGE_BACKING_TYPE, *PFSRTL_CHANGE_BACKING_TYPE; 150 151 #endif /* (NTDDI_VERSION >= NTDDI_VISTA) */ 152 153 typedef struct _FSRTL_PER_FILE_CONTEXT { 154 LIST_ENTRY Links; 155 PVOID OwnerId; 156 PVOID InstanceId; 157 PFREE_FUNCTION FreeCallback; 158 } FSRTL_PER_FILE_CONTEXT, *PFSRTL_PER_FILE_CONTEXT; 159 160 typedef struct _FSRTL_PER_STREAM_CONTEXT { 161 LIST_ENTRY Links; 162 PVOID OwnerId; 163 PVOID InstanceId; 164 PFREE_FUNCTION FreeCallback; 165 } FSRTL_PER_STREAM_CONTEXT, *PFSRTL_PER_STREAM_CONTEXT; 166 167 #if (NTDDI_VERSION >= NTDDI_WIN2K) 168 typedef VOID 169 (*PFN_FSRTLTEARDOWNPERSTREAMCONTEXTS) ( 170 _In_ PFSRTL_ADVANCED_FCB_HEADER AdvancedHeader); 171 #endif 172 173 typedef struct _FSRTL_PER_FILEOBJECT_CONTEXT { 174 LIST_ENTRY Links; 175 PVOID OwnerId; 176 PVOID InstanceId; 177 } FSRTL_PER_FILEOBJECT_CONTEXT, *PFSRTL_PER_FILEOBJECT_CONTEXT; 178 179 #define FSRTL_CC_FLUSH_ERROR_FLAG_NO_HARD_ERROR 0x1 180 #define FSRTL_CC_FLUSH_ERROR_FLAG_NO_LOG_ENTRY 0x2 181 182 typedef NTSTATUS 183 (NTAPI *PCOMPLETE_LOCK_IRP_ROUTINE) ( 184 _In_ PVOID Context, 185 _In_ PIRP Irp); 186 187 typedef struct _FILE_LOCK_INFO { 188 LARGE_INTEGER StartingByte; 189 LARGE_INTEGER Length; 190 BOOLEAN ExclusiveLock; 191 ULONG Key; 192 PFILE_OBJECT FileObject; 193 PVOID ProcessId; 194 LARGE_INTEGER EndingByte; 195 } FILE_LOCK_INFO, *PFILE_LOCK_INFO; 196 197 typedef VOID 198 (NTAPI *PUNLOCK_ROUTINE) ( 199 _In_ PVOID Context, 200 _In_ PFILE_LOCK_INFO FileLockInfo); 201 202 typedef struct _FILE_LOCK { 203 PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine; 204 PUNLOCK_ROUTINE UnlockRoutine; 205 BOOLEAN FastIoIsQuestionable; 206 BOOLEAN SpareC[3]; 207 PVOID LockInformation; 208 FILE_LOCK_INFO LastReturnedLockInfo; 209 PVOID LastReturnedLock; 210 LONG volatile LockRequestsInProgress; 211 } FILE_LOCK, *PFILE_LOCK; 212 213 typedef struct _TUNNEL { 214 FAST_MUTEX Mutex; 215 PRTL_SPLAY_LINKS Cache; 216 LIST_ENTRY TimerQueue; 217 USHORT NumEntries; 218 } TUNNEL, *PTUNNEL; 219 220 typedef struct _BASE_MCB { 221 ULONG MaximumPairCount; 222 ULONG PairCount; 223 USHORT PoolType; 224 USHORT Flags; 225 PVOID Mapping; 226 } BASE_MCB, *PBASE_MCB; 227 228 typedef struct _LARGE_MCB { 229 PKGUARDED_MUTEX GuardedMutex; 230 BASE_MCB BaseMcb; 231 } LARGE_MCB, *PLARGE_MCB; 232 233 #define MCB_FLAG_RAISE_ON_ALLOCATION_FAILURE 1 234 235 typedef struct _MCB { 236 LARGE_MCB DummyFieldThatSizesThisStructureCorrectly; 237 } MCB, *PMCB; 238 239 typedef enum _FAST_IO_POSSIBLE { 240 FastIoIsNotPossible = 0, 241 FastIoIsPossible, 242 FastIoIsQuestionable 243 } FAST_IO_POSSIBLE; 244 245 typedef struct _EOF_WAIT_BLOCK { 246 LIST_ENTRY EofWaitLinks; 247 KEVENT Event; 248 } EOF_WAIT_BLOCK, *PEOF_WAIT_BLOCK; 249 250 typedef PVOID OPLOCK, *POPLOCK; 251 252 typedef VOID 253 (NTAPI *POPLOCK_WAIT_COMPLETE_ROUTINE) ( 254 _In_ PVOID Context, 255 _In_ PIRP Irp); 256 257 typedef VOID 258 (NTAPI *POPLOCK_FS_PREPOST_IRP) ( 259 _In_ PVOID Context, 260 _In_ PIRP Irp); 261 262 #if (NTDDI_VERSION >= NTDDI_VISTASP1) 263 #define OPLOCK_FLAG_COMPLETE_IF_OPLOCKED 0x00000001 264 #endif 265 266 #if (NTDDI_VERSION >= NTDDI_WIN7) 267 #define OPLOCK_FLAG_OPLOCK_KEY_CHECK_ONLY 0x00000002 268 #define OPLOCK_FLAG_BACK_OUT_ATOMIC_OPLOCK 0x00000004 269 #define OPLOCK_FLAG_IGNORE_OPLOCK_KEYS 0x00000008 270 #define OPLOCK_FSCTRL_FLAG_ALL_KEYS_MATCH 0x00000001 271 #endif 272 273 #if (NTDDI_VERSION >= NTDDI_WIN7) 274 275 typedef struct _OPLOCK_KEY_ECP_CONTEXT { 276 GUID OplockKey; 277 ULONG Reserved; 278 } OPLOCK_KEY_ECP_CONTEXT, *POPLOCK_KEY_ECP_CONTEXT; 279 280 DEFINE_GUID(GUID_ECP_OPLOCK_KEY, 0x48850596, 0x3050, 0x4be7, 0x98, 0x63, 0xfe, 0xc3, 0x50, 0xce, 0x8d, 0x7f); 281 282 #endif 283 284 typedef PVOID PNOTIFY_SYNC; 285 286 #if (NTDDI_VERSION >= NTDDI_WIN7) 287 typedef struct _ECP_HEADER ECP_HEADER, *PECP_HEADER; 288 #endif 289 290 typedef BOOLEAN 291 (NTAPI *PCHECK_FOR_TRAVERSE_ACCESS) ( 292 _In_ PVOID NotifyContext, 293 _In_opt_ PVOID TargetContext, 294 _In_ PSECURITY_SUBJECT_CONTEXT SubjectContext); 295 296 typedef BOOLEAN 297 (NTAPI *PFILTER_REPORT_CHANGE) ( 298 _In_ PVOID NotifyContext, 299 _In_ PVOID FilterContext); 300 $endif (_NTIFS_) 301