/* * fltkernel.h * * This file is part of the ReactOS DDK package. * * Contributors: * Amine Khaldi (amine.khaldi@reactos.org) * * THIS SOFTWARE IS NOT COPYRIGHTED * * This source code is offered for use in the public domain. You may * use, modify or distribute it freely. * * This code is distributed in the hope that it will be useful but * WITHOUT ANY WARRANTY. ALL WARRANTIES, EXPRESS OR IMPLIED ARE HEREBY * DISCLAIMED. This includes but is not limited to warranties of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. * */ #pragma once #ifndef __FLTKERNEL__ #define __FLTKERNEL__ #ifdef __cplusplus extern "C" { #endif #define FLT_MGR_BASELINE (((OSVER(NTDDI_VERSION) == NTDDI_WIN2K) && (SPVER(NTDDI_VERSION) >= SPVER(NTDDI_WIN2KSP4))) || \ ((OSVER(NTDDI_VERSION) == NTDDI_WINXP) && (SPVER(NTDDI_VERSION) >= SPVER(NTDDI_WINXPSP2))) || \ ((OSVER(NTDDI_VERSION) == NTDDI_WS03) && (SPVER(NTDDI_VERSION) >= SPVER(NTDDI_WS03SP1))) || \ (NTDDI_VERSION >= NTDDI_VISTA)) #define FLT_MGR_AFTER_XPSP2 (((OSVER(NTDDI_VERSION) == NTDDI_WIN2K) && (SPVER(NTDDI_VERSION) >= SPVER(NTDDI_WIN2KSP4))) || \ ((OSVER(NTDDI_VERSION) == NTDDI_WINXP) && (SPVER(NTDDI_VERSION) > SPVER(NTDDI_WINXPSP2))) || \ ((OSVER(NTDDI_VERSION) == NTDDI_WS03) && (SPVER(NTDDI_VERSION) >= SPVER(NTDDI_WS03SP1))) || \ (NTDDI_VERSION >= NTDDI_VISTA)) #define FLT_MGR_LONGHORN (NTDDI_VERSION >= NTDDI_VISTA) #define FLT_MGR_WIN7 (NTDDI_VERSION >= NTDDI_WIN7) #include #include #include #if FLT_MGR_BASELINE #if FLT_MGR_LONGHORN #define FLT_ASSERT(_e) NT_ASSERT(_e) #define FLT_ASSERTMSG(_m, _e) NT_ASSERTMSG(_m, _e) #else #define FLT_ASSERT(_e) ASSERT(_e) #define FLT_ASSERTMSG(_m, _e) ASSERTMSG(_m, _e) #endif /* FLT_MGR_LONGHORN */ #define Add2Ptr(P,I) ((PVOID)((PUCHAR)(P) + (I))) #define PtrOffset(B,O) ((ULONG)((ULONG_PTR)(O) - (ULONG_PTR)(B))) #define ROUND_TO_SIZE(_length, _alignment) \ ((((ULONG_PTR)(_length)) + ((_alignment)-1)) & ~(ULONG_PTR) ((_alignment) - 1)) #define IS_ALIGNED(_pointer, _alignment) \ ((((ULONG_PTR) (_pointer)) & ((_alignment) - 1)) == 0) #define IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION ((UCHAR)-1) #define IRP_MJ_RELEASE_FOR_SECTION_SYNCHRONIZATION ((UCHAR)-2) #define IRP_MJ_ACQUIRE_FOR_MOD_WRITE ((UCHAR)-3) #define IRP_MJ_RELEASE_FOR_MOD_WRITE ((UCHAR)-4) #define IRP_MJ_ACQUIRE_FOR_CC_FLUSH ((UCHAR)-5) #define IRP_MJ_RELEASE_FOR_CC_FLUSH ((UCHAR)-6) #define IRP_MJ_FAST_IO_CHECK_IF_POSSIBLE ((UCHAR)-13) #define IRP_MJ_NETWORK_QUERY_OPEN ((UCHAR)-14) #define IRP_MJ_MDL_READ ((UCHAR)-15) #define IRP_MJ_MDL_READ_COMPLETE ((UCHAR)-16) #define IRP_MJ_PREPARE_MDL_WRITE ((UCHAR)-17) #define IRP_MJ_MDL_WRITE_COMPLETE ((UCHAR)-18) #define IRP_MJ_VOLUME_MOUNT ((UCHAR)-19) #define IRP_MJ_VOLUME_DISMOUNT ((UCHAR)-20) #define IRP_MJ_OPERATION_END ((UCHAR)0x80) #define FLT_INTERNAL_OPERATION_COUNT 22 #define NULL_CONTEXT ((PFLT_CONTEXT)NULL) typedef struct _FLT_FILTER *PFLT_FILTER; typedef struct _FLT_VOLUME *PFLT_VOLUME; typedef struct _FLT_INSTANCE *PFLT_INSTANCE; typedef struct _FLT_PORT *PFLT_PORT; typedef PVOID PFLT_CONTEXT; #if !FLT_MGR_LONGHORN typedef struct _KTRANSACTION *PKTRANSACTION; #endif #if !defined(_AMD64_) && !defined(_IA64_) && !defined(_ARM_) #include "pshpack4.h" #endif typedef union _FLT_PARAMETERS { struct { PIO_SECURITY_CONTEXT SecurityContext; ULONG Options; USHORT POINTER_ALIGNMENT FileAttributes; USHORT ShareAccess; ULONG POINTER_ALIGNMENT EaLength; PVOID EaBuffer; LARGE_INTEGER AllocationSize; } Create; struct { PIO_SECURITY_CONTEXT SecurityContext; ULONG Options; USHORT POINTER_ALIGNMENT Reserved; USHORT ShareAccess; PVOID Parameters; } CreatePipe; struct { PIO_SECURITY_CONTEXT SecurityContext; ULONG Options; USHORT POINTER_ALIGNMENT Reserved; USHORT ShareAccess; PVOID Parameters; } CreateMailslot; struct { ULONG Length; ULONG POINTER_ALIGNMENT Key; LARGE_INTEGER ByteOffset; PVOID ReadBuffer; PMDL MdlAddress; } Read; struct { ULONG Length; ULONG POINTER_ALIGNMENT Key; LARGE_INTEGER ByteOffset; PVOID WriteBuffer; PMDL MdlAddress; } Write; struct { ULONG Length; FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass; PVOID InfoBuffer; } QueryFileInformation; struct { ULONG Length; FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass; PFILE_OBJECT ParentOfTarget; _ANONYMOUS_UNION union { _ANONYMOUS_STRUCT struct { BOOLEAN ReplaceIfExists; BOOLEAN AdvanceOnly; } DUMMYSTRUCTNAME; ULONG ClusterCount; HANDLE DeleteHandle; } DUMMYUNIONNAME; PVOID InfoBuffer; } SetFileInformation; struct { ULONG Length; PVOID EaList; ULONG EaListLength; ULONG POINTER_ALIGNMENT EaIndex; PVOID EaBuffer; PMDL MdlAddress; } QueryEa; struct { ULONG Length; PVOID EaBuffer; PMDL MdlAddress; } SetEa; struct { ULONG Length; FS_INFORMATION_CLASS POINTER_ALIGNMENT FsInformationClass; PVOID VolumeBuffer; } QueryVolumeInformation; struct { ULONG Length; FS_INFORMATION_CLASS POINTER_ALIGNMENT FsInformationClass; PVOID VolumeBuffer; } SetVolumeInformation; union { struct { ULONG Length; PUNICODE_STRING FileName; FILE_INFORMATION_CLASS FileInformationClass; ULONG POINTER_ALIGNMENT FileIndex; PVOID DirectoryBuffer; PMDL MdlAddress; } QueryDirectory; struct { ULONG Length; ULONG POINTER_ALIGNMENT CompletionFilter; ULONG POINTER_ALIGNMENT Spare1; ULONG POINTER_ALIGNMENT Spare2; PVOID DirectoryBuffer; PMDL MdlAddress; } NotifyDirectory; } DirectoryControl; union { struct { PVPB Vpb; PDEVICE_OBJECT DeviceObject; } VerifyVolume; struct { ULONG OutputBufferLength; ULONG POINTER_ALIGNMENT InputBufferLength; ULONG POINTER_ALIGNMENT FsControlCode; } Common; struct { ULONG OutputBufferLength; ULONG POINTER_ALIGNMENT InputBufferLength; ULONG POINTER_ALIGNMENT FsControlCode; PVOID InputBuffer; PVOID OutputBuffer; PMDL OutputMdlAddress; } Neither; struct { ULONG OutputBufferLength; ULONG POINTER_ALIGNMENT InputBufferLength; ULONG POINTER_ALIGNMENT FsControlCode; PVOID SystemBuffer; } Buffered; struct { ULONG OutputBufferLength; ULONG POINTER_ALIGNMENT InputBufferLength; ULONG POINTER_ALIGNMENT FsControlCode; PVOID InputSystemBuffer; PVOID OutputBuffer; PMDL OutputMdlAddress; } Direct; } FileSystemControl; union { struct { ULONG OutputBufferLength; ULONG POINTER_ALIGNMENT InputBufferLength; ULONG POINTER_ALIGNMENT IoControlCode; } Common; struct { ULONG OutputBufferLength; ULONG POINTER_ALIGNMENT InputBufferLength; ULONG POINTER_ALIGNMENT IoControlCode; PVOID InputBuffer; PVOID OutputBuffer; PMDL OutputMdlAddress; } Neither; struct { ULONG OutputBufferLength; ULONG POINTER_ALIGNMENT InputBufferLength; ULONG POINTER_ALIGNMENT IoControlCode; PVOID SystemBuffer; } Buffered; struct { ULONG OutputBufferLength; ULONG POINTER_ALIGNMENT InputBufferLength; ULONG POINTER_ALIGNMENT IoControlCode; PVOID InputSystemBuffer; PVOID OutputBuffer; PMDL OutputMdlAddress; } Direct; struct { ULONG OutputBufferLength; ULONG POINTER_ALIGNMENT InputBufferLength; ULONG POINTER_ALIGNMENT IoControlCode; PVOID InputBuffer; PVOID OutputBuffer; } FastIo; } DeviceIoControl; struct { PLARGE_INTEGER Length; ULONG POINTER_ALIGNMENT Key; LARGE_INTEGER ByteOffset; PEPROCESS ProcessId; BOOLEAN FailImmediately; BOOLEAN ExclusiveLock; } LockControl; struct { SECURITY_INFORMATION SecurityInformation; ULONG POINTER_ALIGNMENT Length; PVOID SecurityBuffer; PMDL MdlAddress; } QuerySecurity; struct { SECURITY_INFORMATION SecurityInformation; PSECURITY_DESCRIPTOR SecurityDescriptor; } SetSecurity; struct { ULONG_PTR ProviderId; PVOID DataPath; ULONG BufferSize; PVOID Buffer; } WMI; struct { ULONG Length; PSID StartSid; PFILE_GET_QUOTA_INFORMATION SidList; ULONG SidListLength; PVOID QuotaBuffer; PMDL MdlAddress; } QueryQuota; struct { ULONG Length; PVOID QuotaBuffer; PMDL MdlAddress; } SetQuota; union { struct { PCM_RESOURCE_LIST AllocatedResources; PCM_RESOURCE_LIST AllocatedResourcesTranslated; } StartDevice; struct { DEVICE_RELATION_TYPE Type; } QueryDeviceRelations; struct { CONST GUID *InterfaceType; USHORT Size; USHORT Version; PINTERFACE Interface; PVOID InterfaceSpecificData; } QueryInterface; struct { PDEVICE_CAPABILITIES Capabilities; } DeviceCapabilities; struct { PIO_RESOURCE_REQUIREMENTS_LIST IoResourceRequirementList; } FilterResourceRequirements; struct { ULONG WhichSpace; PVOID Buffer; ULONG Offset; ULONG POINTER_ALIGNMENT Length; } ReadWriteConfig; struct { BOOLEAN Lock; } SetLock; struct { BUS_QUERY_ID_TYPE IdType; } QueryId; struct { DEVICE_TEXT_TYPE DeviceTextType; LCID POINTER_ALIGNMENT LocaleId; } QueryDeviceText; struct { BOOLEAN InPath; BOOLEAN Reserved[3]; DEVICE_USAGE_NOTIFICATION_TYPE POINTER_ALIGNMENT Type; } UsageNotification; } Pnp; struct { FS_FILTER_SECTION_SYNC_TYPE SyncType; ULONG PageProtection; } AcquireForSectionSynchronization; struct { PLARGE_INTEGER EndingOffset; PERESOURCE *ResourceToRelease; } AcquireForModifiedPageWriter; struct { PERESOURCE ResourceToRelease; } ReleaseForModifiedPageWriter; struct { LARGE_INTEGER FileOffset; ULONG Length; ULONG POINTER_ALIGNMENT LockKey; BOOLEAN POINTER_ALIGNMENT CheckForReadOperation; } FastIoCheckIfPossible; struct { PIRP Irp; PFILE_NETWORK_OPEN_INFORMATION NetworkInformation; } NetworkQueryOpen; struct { LARGE_INTEGER FileOffset; ULONG POINTER_ALIGNMENT Length; ULONG POINTER_ALIGNMENT Key; PMDL *MdlChain; } MdlRead; struct { PMDL MdlChain; } MdlReadComplete; struct { LARGE_INTEGER FileOffset; ULONG POINTER_ALIGNMENT Length; ULONG POINTER_ALIGNMENT Key; PMDL *MdlChain; } PrepareMdlWrite; struct { LARGE_INTEGER FileOffset; PMDL MdlChain; } MdlWriteComplete; struct { ULONG DeviceType; } MountVolume; struct { PVOID Argument1; PVOID Argument2; PVOID Argument3; PVOID Argument4; PVOID Argument5; LARGE_INTEGER Argument6; } Others; } FLT_PARAMETERS, *PFLT_PARAMETERS; #if !defined(_AMD64_) && !defined(_IA64_) && !defined(_ARM_) #include "poppack.h" #endif typedef struct _FLT_IO_PARAMETER_BLOCK { ULONG IrpFlags; UCHAR MajorFunction; UCHAR MinorFunction; UCHAR OperationFlags; UCHAR Reserved; PFILE_OBJECT TargetFileObject; PFLT_INSTANCE TargetInstance; FLT_PARAMETERS Parameters; } FLT_IO_PARAMETER_BLOCK, *PFLT_IO_PARAMETER_BLOCK; #define FLTFL_CALLBACK_DATA_REISSUE_MASK 0x0000FFFF #define FLTFL_CALLBACK_DATA_IRP_OPERATION 0x00000001 #define FLTFL_CALLBACK_DATA_FAST_IO_OPERATION 0x00000002 #define FLTFL_CALLBACK_DATA_FS_FILTER_OPERATION 0x00000004 #define FLTFL_CALLBACK_DATA_SYSTEM_BUFFER 0x00000008 #define FLTFL_CALLBACK_DATA_GENERATED_IO 0x00010000 #define FLTFL_CALLBACK_DATA_REISSUED_IO 0x00020000 #define FLTFL_CALLBACK_DATA_DRAINING_IO 0x00040000 #define FLTFL_CALLBACK_DATA_POST_OPERATION 0x00080000 #define FLTFL_CALLBACK_DATA_NEW_SYSTEM_BUFFER 0x00100000 #define FLTFL_CALLBACK_DATA_DIRTY 0x80000000 #define FLT_SET_CALLBACK_DATA_DIRTY(Data) FltSetCallbackDataDirty(Data) #define FLT_CLEAR_CALLBACK_DATA_DIRTY(Data) FltClearCallbackDataDirty(Data) #define FLT_IS_CALLBACK_DATA_DIRTY(Data) FltIsCallbackDataDirty(Data) #define FLT_IS_IRP_OPERATION(Data) (FlagOn((Data)->Flags, FLTFL_CALLBACK_DATA_IRP_OPERATION)) #define FLT_IS_FASTIO_OPERATION(Data) (FlagOn((Data)->Flags, FLTFL_CALLBACK_DATA_FAST_IO_OPERATION)) #define FLT_IS_FS_FILTER_OPERATION(Data) (FlagOn((Data)->Flags, FLTFL_CALLBACK_DATA_FS_FILTER_OPERATION)) #define FLT_IS_REISSUED_IO(Data) (FlagOn((Data)->Flags, FLTFL_CALLBACK_DATA_REISSUED_IO)) #define FLT_IS_SYSTEM_BUFFER(Data) (FlagOn((Data)->Flags, FLTFL_CALLBACK_DATA_SYSTEM_BUFFER)) typedef USHORT FLT_CONTEXT_TYPE; #define FLT_VOLUME_CONTEXT 0x0001 #define FLT_INSTANCE_CONTEXT 0x0002 #define FLT_FILE_CONTEXT 0x0004 #define FLT_STREAM_CONTEXT 0x0008 #define FLT_STREAMHANDLE_CONTEXT 0x0010 #define FLT_TRANSACTION_CONTEXT 0x0020 #define FLT_CONTEXT_END 0xffff #define FLT_ALL_CONTEXTS (FLT_VOLUME_CONTEXT | FLT_INSTANCE_CONTEXT | \ FLT_FILE_CONTEXT | FLT_STREAM_CONTEXT | \ FLT_STREAMHANDLE_CONTEXT | FLT_TRANSACTION_CONTEXT) typedef ULONG FLT_CALLBACK_DATA_FLAGS; #if FLT_MGR_WIN7 typedef ULONG FLT_ALLOCATE_CALLBACK_DATA_FLAGS; #define FLT_ALLOCATE_CALLBACK_DATA_PREALLOCATE_ALL_MEMORY 0x00000001 #endif /* FLT_MGR_WIN7 */ typedef struct _FLT_CALLBACK_DATA { FLT_CALLBACK_DATA_FLAGS Flags; PETHREAD CONST Thread; PFLT_IO_PARAMETER_BLOCK CONST Iopb; IO_STATUS_BLOCK IoStatus; struct _FLT_TAG_DATA_BUFFER *TagData; _ANONYMOUS_UNION union { _ANONYMOUS_STRUCT struct { LIST_ENTRY QueueLinks; PVOID QueueContext[2]; } DUMMYSTRUCTNAME; PVOID FilterContext[4]; } DUMMYUNIONNAME; KPROCESSOR_MODE RequestorMode; } FLT_CALLBACK_DATA, *PFLT_CALLBACK_DATA; typedef struct _FLT_RELATED_OBJECTS { USHORT CONST Size; USHORT CONST TransactionContext; PFLT_FILTER CONST Filter; PFLT_VOLUME CONST Volume; PFLT_INSTANCE CONST Instance; PFILE_OBJECT CONST FileObject; PKTRANSACTION CONST Transaction; } FLT_RELATED_OBJECTS, *PFLT_RELATED_OBJECTS; typedef const struct _FLT_RELATED_OBJECTS *PCFLT_RELATED_OBJECTS; typedef struct _FLT_RELATED_CONTEXTS { PFLT_CONTEXT VolumeContext; PFLT_CONTEXT InstanceContext; PFLT_CONTEXT FileContext; PFLT_CONTEXT StreamContext; PFLT_CONTEXT StreamHandleContext; PFLT_CONTEXT TransactionContext; } FLT_RELATED_CONTEXTS, *PFLT_RELATED_CONTEXTS; typedef VOID (FLTAPI *PFLT_CONTEXT_CLEANUP_CALLBACK)( _In_ PFLT_CONTEXT Context, _In_ FLT_CONTEXT_TYPE ContextType); typedef PVOID (FLTAPI *PFLT_CONTEXT_ALLOCATE_CALLBACK)( _In_ POOL_TYPE PoolType, _In_ SIZE_T Size, _In_ FLT_CONTEXT_TYPE ContextType); typedef VOID (FLTAPI *PFLT_CONTEXT_FREE_CALLBACK)( _In_ PVOID Pool, _In_ FLT_CONTEXT_TYPE ContextType); typedef USHORT FLT_CONTEXT_REGISTRATION_FLAGS; #define FLTFL_CONTEXT_REGISTRATION_NO_EXACT_SIZE_MATCH 0x0001 #define FLT_VARIABLE_SIZED_CONTEXTS ((SIZE_T)-1) typedef struct _FLT_CONTEXT_REGISTRATION { FLT_CONTEXT_TYPE ContextType; FLT_CONTEXT_REGISTRATION_FLAGS Flags; PFLT_CONTEXT_CLEANUP_CALLBACK ContextCleanupCallback; SIZE_T Size; ULONG PoolTag; PFLT_CONTEXT_ALLOCATE_CALLBACK ContextAllocateCallback; PFLT_CONTEXT_FREE_CALLBACK ContextFreeCallback; PVOID Reserved1; } FLT_CONTEXT_REGISTRATION, *PFLT_CONTEXT_REGISTRATION; typedef const struct _FLT_CONTEXT_REGISTRATION *PCFLT_CONTEXT_REGISTRATION; typedef ULONG FLT_INSTANCE_SETUP_FLAGS; #define FLTFL_INSTANCE_SETUP_AUTOMATIC_ATTACHMENT 0x00000001 #define FLTFL_INSTANCE_SETUP_MANUAL_ATTACHMENT 0x00000002 #define FLTFL_INSTANCE_SETUP_NEWLY_MOUNTED_VOLUME 0x00000004 #if FLT_MGR_LONGHORN #define FLTFL_INSTANCE_SETUP_DETACHED_VOLUME 0x00000008 #define FLT_MAX_TRANSACTION_NOTIFICATIONS (TRANSACTION_NOTIFY_PREPREPARE | \ TRANSACTION_NOTIFY_PREPARE | \ TRANSACTION_NOTIFY_COMMIT | \ TRANSACTION_NOTIFY_ROLLBACK | \ TRANSACTION_NOTIFY_COMMIT_FINALIZE) #endif /* FLT_MGR_LONGHORN */ typedef NTSTATUS (FLTAPI *PFLT_INSTANCE_SETUP_CALLBACK)( _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_SETUP_FLAGS Flags, _In_ DEVICE_TYPE VolumeDeviceType, _In_ FLT_FILESYSTEM_TYPE VolumeFilesystemType); typedef ULONG FLT_INSTANCE_QUERY_TEARDOWN_FLAGS; typedef NTSTATUS (FLTAPI *PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK)( _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags); typedef ULONG FLT_INSTANCE_TEARDOWN_FLAGS; #define FLTFL_INSTANCE_TEARDOWN_MANUAL 0x00000001 #define FLTFL_INSTANCE_TEARDOWN_FILTER_UNLOAD 0x00000002 #define FLTFL_INSTANCE_TEARDOWN_MANDATORY_FILTER_UNLOAD 0x00000004 #define FLTFL_INSTANCE_TEARDOWN_VOLUME_DISMOUNT 0x00000008 #define FLTFL_INSTANCE_TEARDOWN_INTERNAL_ERROR 0x00000010 typedef VOID (FLTAPI *PFLT_INSTANCE_TEARDOWN_CALLBACK)( _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_TEARDOWN_FLAGS Reason); typedef enum _FLT_PREOP_CALLBACK_STATUS { FLT_PREOP_SUCCESS_WITH_CALLBACK, FLT_PREOP_SUCCESS_NO_CALLBACK, FLT_PREOP_PENDING, FLT_PREOP_DISALLOW_FASTIO, FLT_PREOP_COMPLETE, FLT_PREOP_SYNCHRONIZE } FLT_PREOP_CALLBACK_STATUS, *PFLT_PREOP_CALLBACK_STATUS; typedef FLT_PREOP_CALLBACK_STATUS (FLTAPI *PFLT_PRE_OPERATION_CALLBACK)( _Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Outptr_result_maybenull_ PVOID *CompletionContext); typedef enum _FLT_POSTOP_CALLBACK_STATUS { FLT_POSTOP_FINISHED_PROCESSING, FLT_POSTOP_MORE_PROCESSING_REQUIRED } FLT_POSTOP_CALLBACK_STATUS, *PFLT_POSTOP_CALLBACK_STATUS; typedef ULONG FLT_POST_OPERATION_FLAGS; #define FLTFL_POST_OPERATION_DRAINING 0x00000001 typedef FLT_POSTOP_CALLBACK_STATUS (FLTAPI *PFLT_POST_OPERATION_CALLBACK)( _Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_opt_ PVOID CompletionContext, _In_ FLT_POST_OPERATION_FLAGS Flags); typedef ULONG FLT_OPERATION_REGISTRATION_FLAGS; #define FLTFL_OPERATION_REGISTRATION_SKIP_PAGING_IO 0x00000001 #define FLTFL_OPERATION_REGISTRATION_SKIP_CACHED_IO 0x00000002 #define FLTFL_OPERATION_REGISTRATION_SKIP_NON_DASD_IO 0x00000004 typedef struct _FLT_OPERATION_REGISTRATION { UCHAR MajorFunction; FLT_OPERATION_REGISTRATION_FLAGS Flags; PFLT_PRE_OPERATION_CALLBACK PreOperation; PFLT_POST_OPERATION_CALLBACK PostOperation; PVOID Reserved1; } FLT_OPERATION_REGISTRATION, *PFLT_OPERATION_REGISTRATION; typedef struct _FLT_TAG_DATA_BUFFER { ULONG FileTag; USHORT TagDataLength; USHORT UnparsedNameLength; _ANONYMOUS_UNION union { struct { USHORT SubstituteNameOffset; USHORT SubstituteNameLength; USHORT PrintNameOffset; USHORT PrintNameLength; ULONG Flags; WCHAR PathBuffer[1]; } SymbolicLinkReparseBuffer; struct { USHORT SubstituteNameOffset; USHORT SubstituteNameLength; USHORT PrintNameOffset; USHORT PrintNameLength; WCHAR PathBuffer[1]; } MountPointReparseBuffer; struct { UCHAR DataBuffer[1]; } GenericReparseBuffer; struct { GUID TagGuid; UCHAR DataBuffer[1]; } GenericGUIDReparseBuffer; } DUMMYUNIONNAME; } FLT_TAG_DATA_BUFFER, *PFLT_TAG_DATA_BUFFER; #define FLT_TAG_DATA_BUFFER_HEADER_SIZE FIELD_OFFSET(FLT_TAG_DATA_BUFFER, GenericReparseBuffer) typedef ULONG FLT_FILTER_UNLOAD_FLAGS; #define FLTFL_FILTER_UNLOAD_MANDATORY 0x00000001 typedef NTSTATUS (FLTAPI *PFLT_FILTER_UNLOAD_CALLBACK)( FLT_FILTER_UNLOAD_FLAGS Flags); typedef struct _FLT_NAME_CONTROL { UNICODE_STRING Name; } FLT_NAME_CONTROL, *PFLT_NAME_CONTROL; typedef ULONG FLT_FILE_NAME_OPTIONS; typedef NTSTATUS (FLTAPI *PFLT_GENERATE_FILE_NAME)( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _In_opt_ PFLT_CALLBACK_DATA CallbackData, _In_ FLT_FILE_NAME_OPTIONS NameOptions, _Out_ PBOOLEAN CacheFileNameInformation, _Out_ PFLT_NAME_CONTROL FileName); typedef ULONG FLT_NORMALIZE_NAME_FLAGS; #define FLTFL_NORMALIZE_NAME_CASE_SENSITIVE 0x01 #define FLTFL_NORMALIZE_NAME_DESTINATION_FILE_NAME 0x02 typedef NTSTATUS (FLTAPI *PFLT_NORMALIZE_NAME_COMPONENT)( _In_ PFLT_INSTANCE Instance, _In_ PCUNICODE_STRING ParentDirectory, _In_ USHORT VolumeNameLength, _In_ PCUNICODE_STRING Component, _Out_writes_bytes_(ExpandComponentNameLength) PFILE_NAMES_INFORMATION ExpandComponentName, _In_ ULONG ExpandComponentNameLength, _In_ FLT_NORMALIZE_NAME_FLAGS Flags, _Inout_ PVOID *NormalizationContext); typedef NTSTATUS (FLTAPI *PFLT_NORMALIZE_NAME_COMPONENT_EX)( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _In_ PCUNICODE_STRING ParentDirectory, _In_ USHORT VolumeNameLength, _In_ PCUNICODE_STRING Component, _Out_writes_bytes_(ExpandComponentNameLength) PFILE_NAMES_INFORMATION ExpandComponentName, _In_ ULONG ExpandComponentNameLength, _In_ FLT_NORMALIZE_NAME_FLAGS Flags, _Inout_ PVOID *NormalizationContext); typedef VOID (FLTAPI *PFLT_NORMALIZE_CONTEXT_CLEANUP)( _In_opt_ PVOID *NormalizationContext); #if FLT_MGR_LONGHORN typedef NTSTATUS (FLTAPI *PFLT_TRANSACTION_NOTIFICATION_CALLBACK)( _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ PFLT_CONTEXT TransactionContext, _In_ ULONG NotificationMask); #endif /* FLT_MGR_LONGHORN */ #define FLT_REGISTRATION_VERSION_0200 0x0200 #define FLT_REGISTRATION_VERSION_0201 0x0201 #define FLT_REGISTRATION_VERSION_0202 0x0202 #define FLT_REGISTRATION_VERSION_0203 0x0203 #if FLT_MGR_LONGHORN #define FLT_REGISTRATION_VERSION FLT_REGISTRATION_VERSION_0202 #else #define FLT_REGISTRATION_VERSION FLT_REGISTRATION_VERSION_0200 #endif typedef ULONG FLT_REGISTRATION_FLAGS; #define FLTFL_REGISTRATION_DO_NOT_SUPPORT_SERVICE_STOP 0x00000001 #define FLTFL_REGISTRATION_SUPPORT_NPFS_MSFS 0x00000002 typedef struct _FLT_REGISTRATION { USHORT Size; USHORT Version; FLT_REGISTRATION_FLAGS Flags; CONST FLT_CONTEXT_REGISTRATION *ContextRegistration; CONST FLT_OPERATION_REGISTRATION *OperationRegistration; PFLT_FILTER_UNLOAD_CALLBACK FilterUnloadCallback; PFLT_INSTANCE_SETUP_CALLBACK InstanceSetupCallback; PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK InstanceQueryTeardownCallback; PFLT_INSTANCE_TEARDOWN_CALLBACK InstanceTeardownStartCallback; PFLT_INSTANCE_TEARDOWN_CALLBACK InstanceTeardownCompleteCallback; PFLT_GENERATE_FILE_NAME GenerateFileNameCallback; PFLT_NORMALIZE_NAME_COMPONENT NormalizeNameComponentCallback; PFLT_NORMALIZE_CONTEXT_CLEANUP NormalizeContextCleanupCallback; #if FLT_MGR_LONGHORN PFLT_TRANSACTION_NOTIFICATION_CALLBACK TransactionNotificationCallback; PFLT_NORMALIZE_NAME_COMPONENT_EX NormalizeNameComponentExCallback; #endif /* FLT_MGR_LONGHORN */ } FLT_REGISTRATION, *PFLT_REGISTRATION; typedef VOID (FLTAPI *PFLT_COMPLETED_ASYNC_IO_CALLBACK)( _In_ PFLT_CALLBACK_DATA CallbackData, _In_ PFLT_CONTEXT Context); typedef ULONG FLT_IO_OPERATION_FLAGS; #define FLTFL_IO_OPERATION_NON_CACHED 0x00000001 #define FLTFL_IO_OPERATION_PAGING 0x00000002 #define FLTFL_IO_OPERATION_DO_NOT_UPDATE_BYTE_OFFSET 0x00000004 #if FLT_MGR_LONGHORN #define FLTFL_IO_OPERATION_SYNCHRONOUS_PAGING 0x00000008 #endif typedef VOID (FLTAPI *PFLT_GET_OPERATION_STATUS_CALLBACK)( _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ PFLT_IO_PARAMETER_BLOCK IopbSnapshot, _In_ NTSTATUS OperationStatus, _In_opt_ PVOID RequesterContext); typedef ULONG FLT_FILE_NAME_OPTIONS; #define FLT_VALID_FILE_NAME_FORMATS 0x000000ff #define FLT_FILE_NAME_NORMALIZED 0x01 #define FLT_FILE_NAME_OPENED 0x02 #define FLT_FILE_NAME_SHORT 0x03 #define FltGetFileNameFormat( _NameOptions ) ((_NameOptions) & FLT_VALID_FILE_NAME_FORMATS) #define FLT_VALID_FILE_NAME_QUERY_METHODS 0x0000ff00 #define FLT_FILE_NAME_QUERY_DEFAULT 0x0100 #define FLT_FILE_NAME_QUERY_CACHE_ONLY 0x0200 #define FLT_FILE_NAME_QUERY_FILESYSTEM_ONLY 0x0300 #define FLT_FILE_NAME_QUERY_ALWAYS_ALLOW_CACHE_LOOKUP 0x0400 #define FltGetFileNameQueryMethod( _NameOptions ) ((_NameOptions) & FLT_VALID_FILE_NAME_QUERY_METHODS) #define FLT_VALID_FILE_NAME_FLAGS 0xff000000 #define FLT_FILE_NAME_REQUEST_FROM_CURRENT_PROVIDER 0x01000000 #define FLT_FILE_NAME_DO_NOT_CACHE 0x02000000 #if FLT_MGR_AFTER_XPSP2 #define FLT_FILE_NAME_ALLOW_QUERY_ON_REPARSE 0x04000000 #endif typedef USHORT FLT_FILE_NAME_PARSED_FLAGS; #define FLTFL_FILE_NAME_PARSED_FINAL_COMPONENT 0x0001 #define FLTFL_FILE_NAME_PARSED_EXTENSION 0x0002 #define FLTFL_FILE_NAME_PARSED_STREAM 0x0004 #define FLTFL_FILE_NAME_PARSED_PARENT_DIR 0x0008 typedef struct _FLT_FILE_NAME_INFORMATION { USHORT Size; FLT_FILE_NAME_PARSED_FLAGS NamesParsed; FLT_FILE_NAME_OPTIONS Format; UNICODE_STRING Name; UNICODE_STRING Volume; UNICODE_STRING Share; UNICODE_STRING Extension; UNICODE_STRING Stream; UNICODE_STRING FinalComponent; UNICODE_STRING ParentDir; } FLT_FILE_NAME_INFORMATION, *PFLT_FILE_NAME_INFORMATION; typedef enum _FLT_SET_CONTEXT_OPERATION { FLT_SET_CONTEXT_REPLACE_IF_EXISTS, FLT_SET_CONTEXT_KEEP_IF_EXISTS } FLT_SET_CONTEXT_OPERATION, *PFLT_SET_CONTEXT_OPERATION; typedef struct _FLT_VOLUME_PROPERTIES { DEVICE_TYPE DeviceType; ULONG DeviceCharacteristics; ULONG DeviceObjectFlags; ULONG AlignmentRequirement; USHORT SectorSize; USHORT Reserved0; UNICODE_STRING FileSystemDriverName; UNICODE_STRING FileSystemDeviceName; UNICODE_STRING RealDeviceName; } FLT_VOLUME_PROPERTIES, *PFLT_VOLUME_PROPERTIES; #define FLT_PORT_CONNECT 0x0001 #define FLT_PORT_ALL_ACCESS (FLT_PORT_CONNECT | STANDARD_RIGHTS_ALL) typedef NTSTATUS (FLTAPI *PFLT_MESSAGE_NOTIFY)( _In_opt_ PVOID PortCookie, _In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer, _In_ ULONG InputBufferLength, _Out_writes_bytes_to_opt_(OutputBufferLength,*ReturnOutputBufferLength) PVOID OutputBuffer, _In_ ULONG OutputBufferLength, _Out_ PULONG ReturnOutputBufferLength); typedef NTSTATUS (FLTAPI *PFLT_CONNECT_NOTIFY)( _In_ PFLT_PORT ClientPort, _In_opt_ PVOID ServerPortCookie, _In_reads_bytes_opt_(SizeOfContext) PVOID ConnectionContext, _In_ ULONG SizeOfContext, _Outptr_result_maybenull_ PVOID *ConnectionPortCookie); typedef VOID (FLTAPI *PFLT_DISCONNECT_NOTIFY)( _In_opt_ PVOID ConnectionCookie); typedef VOID (FLTAPI *PFLT_COMPLETE_CANCELED_CALLBACK)( _In_ PFLT_CALLBACK_DATA CallbackData); typedef struct _FLT_DEFERRED_IO_WORKITEM *PFLT_DEFERRED_IO_WORKITEM; typedef struct _FLT_GENERIC_WORKITEM *PFLT_GENERIC_WORKITEM; typedef VOID (FLTAPI *PFLT_DEFERRED_IO_WORKITEM_ROUTINE)( _In_ PFLT_DEFERRED_IO_WORKITEM FltWorkItem, _In_ PFLT_CALLBACK_DATA CallbackData, _In_opt_ PVOID Context); typedef VOID (FLTAPI *PFLT_GENERIC_WORKITEM_ROUTINE)( _In_ PFLT_GENERIC_WORKITEM FltWorkItem, _In_ PVOID FltObject, _In_opt_ PVOID Context); typedef IO_CSQ_IRP_CONTEXT FLT_CALLBACK_DATA_QUEUE_IO_CONTEXT, *PFLT_CALLBACK_DATA_QUEUE_IO_CONTEXT; typedef struct _FLT_CALLBACK_DATA_QUEUE FLT_CALLBACK_DATA_QUEUE, *PFLT_CALLBACK_DATA_QUEUE; typedef NTSTATUS (FLTAPI *PFLT_CALLBACK_DATA_QUEUE_INSERT_IO)( _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _In_ PFLT_CALLBACK_DATA Cbd, _In_opt_ PVOID InsertContext); typedef VOID (FLTAPI *PFLT_CALLBACK_DATA_QUEUE_REMOVE_IO)( _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _In_ PFLT_CALLBACK_DATA Cbd); typedef PFLT_CALLBACK_DATA (FLTAPI *PFLT_CALLBACK_DATA_QUEUE_PEEK_NEXT_IO)( _In_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _In_opt_ PFLT_CALLBACK_DATA Cbd, _In_opt_ PVOID PeekContext); typedef VOID (FLTAPI *PFLT_CALLBACK_DATA_QUEUE_ACQUIRE)( _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _Out_opt_ PKIRQL Irql); typedef VOID (FLTAPI *PFLT_CALLBACK_DATA_QUEUE_RELEASE)( _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _In_opt_ KIRQL Irql); typedef VOID (FLTAPI *PFLT_CALLBACK_DATA_QUEUE_COMPLETE_CANCELED_IO)( _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _Inout_ PFLT_CALLBACK_DATA Cbd); typedef ULONG FLT_CALLBACK_DATA_QUEUE_FLAGS; typedef struct _FLT_CALLBACK_DATA_QUEUE { IO_CSQ Csq; FLT_CALLBACK_DATA_QUEUE_FLAGS Flags; PFLT_INSTANCE Instance; PFLT_CALLBACK_DATA_QUEUE_INSERT_IO InsertIo; PFLT_CALLBACK_DATA_QUEUE_REMOVE_IO RemoveIo; PFLT_CALLBACK_DATA_QUEUE_PEEK_NEXT_IO PeekNextIo; PFLT_CALLBACK_DATA_QUEUE_ACQUIRE Acquire; PFLT_CALLBACK_DATA_QUEUE_RELEASE Release; PFLT_CALLBACK_DATA_QUEUE_COMPLETE_CANCELED_IO CompleteCanceledIo; } FLT_CALLBACK_DATA_QUEUE, *PFLT_CALLBACK_DATA_QUEUE; typedef NTSTATUS (*PFLT_COMPLETE_LOCK_CALLBACK_DATA_ROUTINE)( _In_opt_ PVOID Context, _In_ PFLT_CALLBACK_DATA CallbackData); typedef VOID (FLTAPI *PFLTOPLOCK_WAIT_COMPLETE_ROUTINE)( _In_ PFLT_CALLBACK_DATA CallbackData, _In_opt_ PVOID Context); typedef VOID (FLTAPI *PFLTOPLOCK_PREPOST_CALLBACKDATA_ROUTINE)( _In_ PFLT_CALLBACK_DATA CallbackData, _In_opt_ PVOID Context); VOID FLTAPI FltSetCallbackDataDirty( _Inout_ PFLT_CALLBACK_DATA Data); VOID FLTAPI FltClearCallbackDataDirty( _Inout_ PFLT_CALLBACK_DATA Data); BOOLEAN FLTAPI FltIsCallbackDataDirty( _In_ PFLT_CALLBACK_DATA Data); _Must_inspect_result_ BOOLEAN FLTAPI FltDoCompletionProcessingWhenSafe( _In_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_opt_ PVOID CompletionContext, _In_ FLT_POST_OPERATION_FLAGS Flags, _In_ PFLT_POST_OPERATION_CALLBACK SafePostCallback, _Out_ PFLT_POSTOP_CALLBACK_STATUS RetPostOperationStatus); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltCheckAndGrowNameControl( _Inout_ PFLT_NAME_CONTROL NameCtrl, _In_ USHORT NewSize); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltPurgeFileNameInformationCache( _In_ PFLT_INSTANCE Instance, _In_opt_ PFILE_OBJECT FileObject); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltRegisterFilter( _In_ PDRIVER_OBJECT Driver, _In_ CONST FLT_REGISTRATION *Registration, _Outptr_ PFLT_FILTER *RetFilter); _IRQL_requires_max_(APC_LEVEL) VOID FLTAPI FltUnregisterFilter( _In_ PFLT_FILTER Filter); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltStartFiltering( _In_ PFLT_FILTER Filter); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) PVOID FLTAPI FltGetRoutineAddress( _In_ PCSTR FltMgrRoutineName); _When_(CallbackStatus==FLT_PREOP_COMPLETE, _IRQL_requires_max_(DISPATCH_LEVEL)) _When_(CallbackStatus!=FLT_PREOP_COMPLETE, _IRQL_requires_max_(APC_LEVEL)) VOID FLTAPI FltCompletePendedPreOperation( _In_ PFLT_CALLBACK_DATA CallbackData, _In_ FLT_PREOP_CALLBACK_STATUS CallbackStatus, _In_opt_ PVOID Context); _IRQL_requires_max_(DISPATCH_LEVEL) VOID FLTAPI FltCompletePendedPostOperation( _In_ PFLT_CALLBACK_DATA CallbackData); _Must_inspect_result_ _IRQL_requires_max_(DISPATCH_LEVEL) NTSTATUS FLTAPI FltRequestOperationStatusCallback( _In_ PFLT_CALLBACK_DATA Data, _In_ PFLT_GET_OPERATION_STATUS_CALLBACK CallbackRoutine, _In_opt_ PVOID RequesterContext); _When_((PoolType==NonPagedPoolNx), _IRQL_requires_max_(DISPATCH_LEVEL)) _When_((PoolType!=NonPagedPoolNx), _IRQL_requires_max_(APC_LEVEL)) PVOID FLTAPI FltAllocatePoolAlignedWithTag( _In_ PFLT_INSTANCE Instance, _In_ POOL_TYPE PoolType, _In_ SIZE_T NumberOfBytes, _In_ ULONG Tag); _IRQL_requires_max_(DISPATCH_LEVEL) VOID FLTAPI FltFreePoolAlignedWithTag( _In_ PFLT_INSTANCE Instance, _In_ PVOID Buffer, _In_ ULONG Tag); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltGetFileNameInformation( _In_ PFLT_CALLBACK_DATA CallbackData, _In_ FLT_FILE_NAME_OPTIONS NameOptions, _Outptr_ PFLT_FILE_NAME_INFORMATION *FileNameInformation); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltGetFileNameInformationUnsafe( _In_ PFILE_OBJECT FileObject, _In_opt_ PFLT_INSTANCE Instance, _In_ FLT_FILE_NAME_OPTIONS NameOptions, _Outptr_ PFLT_FILE_NAME_INFORMATION *FileNameInformation); _IRQL_requires_max_(APC_LEVEL) VOID FLTAPI FltReleaseFileNameInformation( _In_ PFLT_FILE_NAME_INFORMATION FileNameInformation); _IRQL_requires_max_(APC_LEVEL) VOID FLTAPI FltReferenceFileNameInformation( _In_ PFLT_FILE_NAME_INFORMATION FileNameInformation); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltParseFileName( _In_ PCUNICODE_STRING FileName, _Inout_opt_ PUNICODE_STRING Extension, _Inout_opt_ PUNICODE_STRING Stream, _Inout_opt_ PUNICODE_STRING FinalComponent); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltParseFileNameInformation( _Inout_ PFLT_FILE_NAME_INFORMATION FileNameInformation); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltGetTunneledName( _In_ PFLT_CALLBACK_DATA CallbackData, _In_ PFLT_FILE_NAME_INFORMATION FileNameInformation, _Outptr_result_maybenull_ PFLT_FILE_NAME_INFORMATION *RetTunneledFileNameInformation); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltGetVolumeName( _In_ PFLT_VOLUME Volume, _Inout_opt_ PUNICODE_STRING VolumeName, _Out_opt_ PULONG BufferSizeNeeded); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltGetDestinationFileNameInformation( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _In_opt_ HANDLE RootDirectory, _In_reads_bytes_(FileNameLength) PWSTR FileName, _In_ ULONG FileNameLength, _In_ FLT_FILE_NAME_OPTIONS NameOptions, _Outptr_ PFLT_FILE_NAME_INFORMATION *RetFileNameInformation); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltIsDirectory( _In_ PFILE_OBJECT FileObject, _In_ PFLT_INSTANCE Instance, _Out_ PBOOLEAN IsDirectory); _Must_inspect_result_ _IRQL_requires_max_(PASSIVE_LEVEL) NTSTATUS FLTAPI FltLoadFilter( _In_ PCUNICODE_STRING FilterName); _Must_inspect_result_ _IRQL_requires_max_(PASSIVE_LEVEL) NTSTATUS FLTAPI FltUnloadFilter( _In_ PCUNICODE_STRING FilterName); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltAttachVolume( _Inout_ PFLT_FILTER Filter, _Inout_ PFLT_VOLUME Volume, _In_opt_ PCUNICODE_STRING InstanceName, _Outptr_opt_result_maybenull_ PFLT_INSTANCE *RetInstance); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltAttachVolumeAtAltitude( _Inout_ PFLT_FILTER Filter, _Inout_ PFLT_VOLUME Volume, _In_ PCUNICODE_STRING Altitude, _In_opt_ PCUNICODE_STRING InstanceName, _Outptr_opt_result_maybenull_ PFLT_INSTANCE *RetInstance); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltDetachVolume( _Inout_ PFLT_FILTER Filter, _Inout_ PFLT_VOLUME Volume, _In_opt_ PCUNICODE_STRING InstanceName); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltAllocateCallbackData( _In_ PFLT_INSTANCE Instance, _In_opt_ PFILE_OBJECT FileObject, _Outptr_ PFLT_CALLBACK_DATA *RetNewCallbackData); _IRQL_requires_max_(DISPATCH_LEVEL) VOID FLTAPI FltFreeCallbackData( _In_ PFLT_CALLBACK_DATA CallbackData); _IRQL_requires_max_(APC_LEVEL) VOID FLTAPI FltReuseCallbackData( _Inout_ PFLT_CALLBACK_DATA CallbackData); _When_(FlagOn(CallbackData->Iopb->IrpFlags, IRP_PAGING_IO), _IRQL_requires_max_(APC_LEVEL)) _When_(!FlagOn(CallbackData->Iopb->IrpFlags, IRP_PAGING_IO), _IRQL_requires_max_(PASSIVE_LEVEL)) VOID FLTAPI FltPerformSynchronousIo( _Inout_ PFLT_CALLBACK_DATA CallbackData); _Must_inspect_result_ _When_( FlagOn(CallbackData->Iopb->IrpFlags, IRP_PAGING_IO), _IRQL_requires_max_(APC_LEVEL)) _When_( !FlagOn(CallbackData->Iopb->IrpFlags, IRP_PAGING_IO), _IRQL_requires_max_(PASSIVE_LEVEL)) NTSTATUS FLTAPI FltPerformAsynchronousIo( _Inout_ PFLT_CALLBACK_DATA CallbackData, _In_ PFLT_COMPLETED_ASYNC_IO_CALLBACK CallbackRoutine, _In_ PVOID CallbackContext); _Must_inspect_result_ _IRQL_requires_max_(PASSIVE_LEVEL) NTSTATUS FLTAPI FltCreateFile( _In_ PFLT_FILTER Filter, _In_opt_ PFLT_INSTANCE Instance, _Out_ PHANDLE FileHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _Out_ PIO_STATUS_BLOCK IoStatusBlock, _In_opt_ PLARGE_INTEGER AllocationSize, _In_ ULONG FileAttributes, _In_ ULONG ShareAccess, _In_ ULONG CreateDisposition, _In_ ULONG CreateOptions, _In_reads_bytes_opt_(EaLength)PVOID EaBuffer, _In_ ULONG EaLength, _In_ ULONG Flags); _Must_inspect_result_ _IRQL_requires_max_(PASSIVE_LEVEL) _When_((Flags|FLTFL_IO_OPERATION_PAGING|FLTFL_IO_OPERATION_SYNCHRONOUS_PAGING),_IRQL_requires_max_(APC_LEVEL)) NTSTATUS FLTAPI FltReadFile( _In_ PFLT_INSTANCE InitiatingInstance, _In_ PFILE_OBJECT FileObject, _In_opt_ PLARGE_INTEGER ByteOffset, _In_ ULONG Length, _Out_writes_bytes_to_(Length,*BytesRead) PVOID Buffer, _In_ FLT_IO_OPERATION_FLAGS Flags, _Out_opt_ PULONG BytesRead, _In_opt_ PFLT_COMPLETED_ASYNC_IO_CALLBACK CallbackRoutine, _In_opt_ PVOID CallbackContext); _Must_inspect_result_ _IRQL_requires_max_(PASSIVE_LEVEL) NTSTATUS FLTAPI FltTagFile( _In_ PFLT_INSTANCE InitiatingInstance, _In_ PFILE_OBJECT FileObject, _In_ ULONG FileTag, _In_opt_ GUID *Guid, _In_reads_bytes_(DataBufferLength) PVOID DataBuffer, _In_ USHORT DataBufferLength); _Must_inspect_result_ _IRQL_requires_max_(PASSIVE_LEVEL) NTSTATUS FLTAPI FltUntagFile( _In_ PFLT_INSTANCE InitiatingInstance, _In_ PFILE_OBJECT FileObject, _In_ ULONG FileTag, _In_opt_ GUID *Guid); _Must_inspect_result_ _IRQL_requires_max_(PASSIVE_LEVEL) _When_((Flags|FLTFL_IO_OPERATION_PAGING|FLTFL_IO_OPERATION_SYNCHRONOUS_PAGING),_IRQL_requires_max_(APC_LEVEL)) NTSTATUS FLTAPI FltWriteFile( _In_ PFLT_INSTANCE InitiatingInstance, _In_ PFILE_OBJECT FileObject, _In_opt_ PLARGE_INTEGER ByteOffset, _In_ ULONG Length, _In_reads_bytes_(Length) PVOID Buffer, _In_ FLT_IO_OPERATION_FLAGS Flags, _Out_opt_ PULONG BytesWritten, _In_opt_ PFLT_COMPLETED_ASYNC_IO_CALLBACK CallbackRoutine, _In_opt_ PVOID CallbackContext); _Must_inspect_result_ _IRQL_requires_max_(PASSIVE_LEVEL) NTSTATUS FLTAPI FltQueryInformationFile( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _Out_writes_bytes_to_(Length,*LengthReturned) PVOID FileInformation, _In_ ULONG Length, _In_ FILE_INFORMATION_CLASS FileInformationClass, _Out_opt_ PULONG LengthReturned); _Must_inspect_result_ _IRQL_requires_max_(PASSIVE_LEVEL) NTSTATUS FLTAPI FltSetInformationFile( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _In_reads_bytes_(Length) PVOID FileInformation, _In_ ULONG Length, _In_ FILE_INFORMATION_CLASS FileInformationClass); _Must_inspect_result_ _IRQL_requires_max_(PASSIVE_LEVEL) NTSTATUS FLTAPI FltQueryVolumeInformationFile( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _Out_writes_bytes_to_(Length,*LengthReturned) PVOID FsInformation, _In_ ULONG Length, _In_ FS_INFORMATION_CLASS FsInformationClass, _Out_opt_ PULONG LengthReturned); _Must_inspect_result_ _IRQL_requires_max_(PASSIVE_LEVEL) NTSTATUS FLTAPI FltQuerySecurityObject( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _In_ SECURITY_INFORMATION SecurityInformation, _Inout_updates_bytes_opt_(Length) PSECURITY_DESCRIPTOR SecurityDescriptor, _In_ ULONG Length, _Out_opt_ PULONG LengthNeeded); _Must_inspect_result_ _IRQL_requires_max_(PASSIVE_LEVEL) NTSTATUS FLTAPI FltSetSecurityObject( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _In_ SECURITY_INFORMATION SecurityInformation, _In_ PSECURITY_DESCRIPTOR SecurityDescriptor); _Must_inspect_result_ _IRQL_requires_max_(PASSIVE_LEVEL) NTSTATUS FLTAPI FltFlushBuffers( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject); _Must_inspect_result_ _IRQL_requires_max_(PASSIVE_LEVEL) NTSTATUS FLTAPI FltFsControlFile( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _In_ ULONG FsControlCode, _In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer, _In_ ULONG InputBufferLength, _Out_writes_bytes_to_opt_(OutputBufferLength,*LengthReturned) PVOID OutputBuffer, _In_ ULONG OutputBufferLength, _Out_opt_ PULONG LengthReturned); _Must_inspect_result_ _IRQL_requires_max_(PASSIVE_LEVEL) NTSTATUS FLTAPI FltDeviceIoControlFile( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _In_ ULONG IoControlCode, _In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer, _In_ ULONG InputBufferLength, _Out_writes_bytes_to_opt_(OutputBufferLength,*LengthReturned) PVOID OutputBuffer, _In_ ULONG OutputBufferLength, _Out_opt_ PULONG LengthReturned); _When_(FlagOn(CallbackData->Iopb->IrpFlags, IRP_PAGING_IO), _IRQL_requires_max_(APC_LEVEL)) _When_(!FlagOn(CallbackData->Iopb->IrpFlags, IRP_PAGING_IO), _IRQL_requires_max_(PASSIVE_LEVEL)) VOID FLTAPI FltReissueSynchronousIo( _In_ PFLT_INSTANCE InitiatingInstance, _In_ PFLT_CALLBACK_DATA CallbackData); _IRQL_requires_max_(PASSIVE_LEVEL) NTSTATUS FLTAPI FltClose( _In_ HANDLE FileHandle); _IRQL_requires_max_(PASSIVE_LEVEL) VOID FLTAPI FltCancelFileOpen( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject); _Must_inspect_result_ _IRQL_requires_max_(PASSIVE_LEVEL) NTSTATUS FLTAPI FltCreateSystemVolumeInformationFolder( _In_ PFLT_INSTANCE Instance); _IRQL_requires_max_(APC_LEVEL) BOOLEAN FLTAPI FltSupportsFileContexts( _In_ PFILE_OBJECT FileObject); _IRQL_requires_max_(APC_LEVEL) BOOLEAN FLTAPI FltSupportsStreamContexts( _In_ PFILE_OBJECT FileObject); _IRQL_requires_max_(APC_LEVEL) BOOLEAN FLTAPI FltSupportsStreamHandleContexts( _In_ PFILE_OBJECT FileObject); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltAllocateContext( _In_ PFLT_FILTER Filter, _In_ FLT_CONTEXT_TYPE ContextType, _In_ SIZE_T ContextSize, _In_ POOL_TYPE PoolType, _Outptr_result_bytebuffer_(ContextSize) PFLT_CONTEXT *ReturnedContext); _IRQL_requires_max_(APC_LEVEL) VOID FLTAPI FltGetContexts( _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_CONTEXT_TYPE DesiredContexts, _Out_ PFLT_RELATED_CONTEXTS Contexts); _IRQL_requires_max_(APC_LEVEL) VOID FLTAPI FltReleaseContexts( _In_ PFLT_RELATED_CONTEXTS Contexts); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltSetVolumeContext( _In_ PFLT_VOLUME Volume, _In_ FLT_SET_CONTEXT_OPERATION Operation, _In_ PFLT_CONTEXT NewContext, _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltSetInstanceContext( _In_ PFLT_INSTANCE Instance, _In_ FLT_SET_CONTEXT_OPERATION Operation, _In_ PFLT_CONTEXT NewContext, _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltSetFileContext( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _In_ FLT_SET_CONTEXT_OPERATION Operation, _In_ PFLT_CONTEXT NewContext, _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltSetStreamContext( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _In_ FLT_SET_CONTEXT_OPERATION Operation, _In_ PFLT_CONTEXT NewContext, _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltSetStreamHandleContext( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _In_ FLT_SET_CONTEXT_OPERATION Operation, _In_ PFLT_CONTEXT NewContext, _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext); _IRQL_requires_max_(APC_LEVEL) VOID FLTAPI FltDeleteContext( _In_ PFLT_CONTEXT Context); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltDeleteVolumeContext( _In_ PFLT_FILTER Filter, _In_ PFLT_VOLUME Volume, _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltDeleteInstanceContext( _In_ PFLT_INSTANCE Instance, _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltDeleteFileContext( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltDeleteStreamContext( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltDeleteStreamHandleContext( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltGetVolumeContext( _In_ PFLT_FILTER Filter, _In_ PFLT_VOLUME Volume, _Outptr_ PFLT_CONTEXT *Context); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltGetInstanceContext( _In_ PFLT_INSTANCE Instance, _Outptr_ PFLT_CONTEXT *Context); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltGetFileContext( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _Outptr_ PFLT_CONTEXT *Context); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltGetStreamContext( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _Outptr_ PFLT_CONTEXT *Context); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltGetStreamHandleContext( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _Outptr_ PFLT_CONTEXT *Context); _IRQL_requires_max_(DISPATCH_LEVEL) VOID FLTAPI FltReferenceContext( _In_ PFLT_CONTEXT Context); _IRQL_requires_max_(DISPATCH_LEVEL) VOID FLTAPI FltReleaseContext( _In_ PFLT_CONTEXT Context); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltGetFilterFromName( _In_ PCUNICODE_STRING FilterName, _Outptr_ PFLT_FILTER *RetFilter); _IRQL_requires_max_(PASSIVE_LEVEL) NTSTATUS FLTAPI FltGetVolumeFromName( _In_ PFLT_FILTER Filter, _In_ PCUNICODE_STRING VolumeName, _Outptr_ PFLT_VOLUME *RetVolume); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltGetVolumeInstanceFromName( _In_opt_ PFLT_FILTER Filter, _In_ PFLT_VOLUME Volume, _In_opt_ PCUNICODE_STRING InstanceName, _Outptr_ PFLT_INSTANCE *RetInstance); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltGetVolumeFromInstance( _In_ PFLT_INSTANCE Instance, _Outptr_ PFLT_VOLUME *RetVolume); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltGetFilterFromInstance( _In_ PFLT_INSTANCE Instance, _Outptr_ PFLT_FILTER *RetFilter); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltGetVolumeFromFileObject( _In_ PFLT_FILTER Filter, _In_ PFILE_OBJECT FileObject, _Outptr_ PFLT_VOLUME *RetVolume); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltGetVolumeFromDeviceObject( _In_ PFLT_FILTER Filter, _In_ PDEVICE_OBJECT DeviceObject, _Outptr_ PFLT_VOLUME *RetVolume); _IRQL_requires_max_(DISPATCH_LEVEL) NTSTATUS FLTAPI FltGetDeviceObject( _In_ PFLT_VOLUME Volume, _Outptr_ PDEVICE_OBJECT *DeviceObject); _IRQL_requires_max_(DISPATCH_LEVEL) NTSTATUS FLTAPI FltGetDiskDeviceObject( _In_ PFLT_VOLUME Volume, _Outptr_ PDEVICE_OBJECT *DiskDeviceObject); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltGetLowerInstance( _In_ PFLT_INSTANCE CurrentInstance, _Outptr_ PFLT_INSTANCE *LowerInstance); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltGetUpperInstance( _In_ PFLT_INSTANCE CurrentInstance, _Outptr_ PFLT_INSTANCE *UpperInstance); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltGetTopInstance( _In_ PFLT_VOLUME Volume, _Outptr_ PFLT_INSTANCE *Instance); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltGetBottomInstance( _In_ PFLT_VOLUME Volume, _Outptr_ PFLT_INSTANCE *Instance); LONG FLTAPI FltCompareInstanceAltitudes( _In_ PFLT_INSTANCE Instance1, _In_ PFLT_INSTANCE Instance2); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltGetFilterInformation( _In_ PFLT_FILTER Filter, _In_ FILTER_INFORMATION_CLASS InformationClass, _Out_writes_bytes_to_opt_(BufferSize, *BytesReturned) PVOID Buffer, _In_ ULONG BufferSize, _Out_ PULONG BytesReturned); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltGetInstanceInformation( _In_ PFLT_INSTANCE Instance, _In_ INSTANCE_INFORMATION_CLASS InformationClass, _Out_writes_bytes_to_opt_(BufferSize,*BytesReturned) PVOID Buffer, _In_ ULONG BufferSize, _Out_ PULONG BytesReturned); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltGetVolumeProperties( _In_ PFLT_VOLUME Volume, _Out_writes_bytes_to_opt_(VolumePropertiesLength,*LengthReturned) PFLT_VOLUME_PROPERTIES VolumeProperties, _In_ ULONG VolumePropertiesLength, _Out_ PULONG LengthReturned); _Must_inspect_result_ _IRQL_requires_max_(PASSIVE_LEVEL) NTSTATUS FLTAPI FltIsVolumeWritable( _In_ PVOID FltObject, _Out_ PBOOLEAN IsWritable); _Must_inspect_result_ _IRQL_requires_max_(PASSIVE_LEVEL) NTSTATUS FLTAPI FltGetVolumeGuidName( _In_ PFLT_VOLUME Volume, _Out_ PUNICODE_STRING VolumeGuidName, _Out_opt_ PULONG BufferSizeNeeded); _Must_inspect_result_ _IRQL_requires_max_(PASSIVE_LEVEL) NTSTATUS FLTAPI FltQueryVolumeInformation( _In_ PFLT_INSTANCE Instance, _Out_ PIO_STATUS_BLOCK Iosb, _Out_writes_bytes_(Length) PVOID FsInformation, _In_ ULONG Length, _In_ FS_INFORMATION_CLASS FsInformationClass); _Must_inspect_result_ _IRQL_requires_max_(PASSIVE_LEVEL) NTSTATUS FLTAPI FltSetVolumeInformation( _In_ PFLT_INSTANCE Instance, _Out_ PIO_STATUS_BLOCK Iosb, _Out_writes_bytes_(Length) PVOID FsInformation, _In_ ULONG Length, _In_ FS_INFORMATION_CLASS FsInformationClass); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltEnumerateFilters( _Out_writes_to_opt_(FilterListSize,*NumberFiltersReturned) PFLT_FILTER *FilterList, _In_ ULONG FilterListSize, _Out_ PULONG NumberFiltersReturned); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltEnumerateVolumes( _In_ PFLT_FILTER Filter, _Out_writes_to_opt_(VolumeListSize,*NumberVolumesReturned) PFLT_VOLUME *VolumeList, _In_ ULONG VolumeListSize, _Out_ PULONG NumberVolumesReturned); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltEnumerateInstances( _In_opt_ PFLT_VOLUME Volume, _In_opt_ PFLT_FILTER Filter, _Out_writes_to_opt_(InstanceListSize,*NumberInstancesReturned) PFLT_INSTANCE *InstanceList, _In_ ULONG InstanceListSize, _Out_ PULONG NumberInstancesReturned); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltEnumerateFilterInformation( _In_ ULONG Index, _In_ FILTER_INFORMATION_CLASS InformationClass, _Out_writes_bytes_to_opt_(BufferSize,*BytesReturned) PVOID Buffer, _In_ ULONG BufferSize, _Out_ PULONG BytesReturned); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltEnumerateInstanceInformationByFilter( _In_ PFLT_FILTER Filter, _In_ ULONG Index, _In_ INSTANCE_INFORMATION_CLASS InformationClass, _Out_writes_bytes_to_opt_(BufferSize,*BytesReturned) PVOID Buffer, _In_ ULONG BufferSize, _Out_ PULONG BytesReturned); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltEnumerateInstanceInformationByVolume( _In_ PFLT_VOLUME Volume, _In_ ULONG Index, _In_ INSTANCE_INFORMATION_CLASS InformationClass, _Out_writes_bytes_to_opt_(BufferSize,*BytesReturned) PVOID Buffer, _In_ ULONG BufferSize, _Out_ PULONG BytesReturned); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltEnumerateVolumeInformation( _In_ PFLT_FILTER Filter, _In_ ULONG Index, _In_ FILTER_VOLUME_INFORMATION_CLASS InformationClass, _Out_writes_bytes_to_opt_(BufferSize,*BytesReturned) PVOID Buffer, _In_ ULONG BufferSize, _Out_ PULONG BytesReturned); _Must_inspect_result_ _IRQL_requires_max_(DISPATCH_LEVEL) NTSTATUS FLTAPI FltObjectReference( _Inout_ PVOID FltObject); _IRQL_requires_max_(DISPATCH_LEVEL) VOID FLTAPI FltObjectDereference( _Inout_ PVOID FltObject); _Must_inspect_result_ _IRQL_requires_max_(PASSIVE_LEVEL) NTSTATUS FLTAPI FltCreateCommunicationPort( _In_ PFLT_FILTER Filter, _Outptr_ PFLT_PORT *ServerPort, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _In_opt_ PVOID ServerPortCookie, _In_ PFLT_CONNECT_NOTIFY ConnectNotifyCallback, _In_ PFLT_DISCONNECT_NOTIFY DisconnectNotifyCallback, _In_opt_ PFLT_MESSAGE_NOTIFY MessageNotifyCallback, _In_ LONG MaxConnections); _IRQL_requires_max_(PASSIVE_LEVEL) VOID FLTAPI FltCloseCommunicationPort( _In_ PFLT_PORT ServerPort); _IRQL_requires_max_(PASSIVE_LEVEL) VOID FLTAPI FltCloseClientPort( _In_ PFLT_FILTER Filter, _Outptr_ PFLT_PORT *ClientPort); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltSendMessage( _In_ PFLT_FILTER Filter, _In_ PFLT_PORT *ClientPort, _In_reads_bytes_(SenderBufferLength) PVOID SenderBuffer, _In_ ULONG SenderBufferLength, _Out_writes_bytes_opt_(*ReplyLength) PVOID ReplyBuffer, _Inout_opt_ PULONG ReplyLength, _In_opt_ PLARGE_INTEGER Timeout); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltBuildDefaultSecurityDescriptor( _Outptr_ PSECURITY_DESCRIPTOR *SecurityDescriptor, _In_ ACCESS_MASK DesiredAccess); _IRQL_requires_max_(APC_LEVEL) VOID FLTAPI FltFreeSecurityDescriptor( _In_ PSECURITY_DESCRIPTOR SecurityDescriptor); _Must_inspect_result_ _IRQL_requires_max_(DISPATCH_LEVEL) BOOLEAN FLTAPI FltCancelIo( _In_ PFLT_CALLBACK_DATA CallbackData); _IRQL_requires_max_(DISPATCH_LEVEL) NTSTATUS FLTAPI FltSetCancelCompletion( _In_ PFLT_CALLBACK_DATA CallbackData, _In_ PFLT_COMPLETE_CANCELED_CALLBACK CanceledCallback); _Must_inspect_result_ _IRQL_requires_max_(DISPATCH_LEVEL) NTSTATUS FLTAPI FltClearCancelCompletion( _In_ PFLT_CALLBACK_DATA CallbackData); BOOLEAN FLTAPI FltIsIoCanceled( _In_ PFLT_CALLBACK_DATA CallbackData); _Must_inspect_result_ _IRQL_requires_max_(DISPATCH_LEVEL) PFLT_DEFERRED_IO_WORKITEM FLTAPI FltAllocateDeferredIoWorkItem(VOID); _IRQL_requires_max_(DISPATCH_LEVEL) VOID FLTAPI FltFreeDeferredIoWorkItem( _In_ PFLT_DEFERRED_IO_WORKITEM FltWorkItem); _Must_inspect_result_ _IRQL_requires_max_(DISPATCH_LEVEL) PFLT_GENERIC_WORKITEM FLTAPI FltAllocateGenericWorkItem(VOID); _IRQL_requires_max_(DISPATCH_LEVEL) VOID FLTAPI FltFreeGenericWorkItem( _In_ PFLT_GENERIC_WORKITEM FltWorkItem); _Must_inspect_result_ _IRQL_requires_max_(DISPATCH_LEVEL) NTSTATUS FLTAPI FltQueueDeferredIoWorkItem( _In_ PFLT_DEFERRED_IO_WORKITEM FltWorkItem, _In_ PFLT_CALLBACK_DATA Data, _In_ PFLT_DEFERRED_IO_WORKITEM_ROUTINE WorkerRoutine, _In_ WORK_QUEUE_TYPE QueueType, _In_ PVOID Context); _Must_inspect_result_ _IRQL_requires_max_(DISPATCH_LEVEL) NTSTATUS FLTAPI FltQueueGenericWorkItem( _In_ PFLT_GENERIC_WORKITEM FltWorkItem, _In_ PVOID FltObject, _In_ PFLT_GENERIC_WORKITEM_ROUTINE WorkerRoutine, _In_ WORK_QUEUE_TYPE QueueType, _In_opt_ PVOID Context); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltLockUserBuffer( _In_ PFLT_CALLBACK_DATA CallbackData); NTSTATUS FLTAPI FltDecodeParameters( _In_ PFLT_CALLBACK_DATA CallbackData, _Outptr_opt_ PMDL **MdlAddressPointer, _Outptr_opt_result_bytebuffer_(**Length) PVOID **Buffer, _Outptr_opt_ PULONG *Length, _Out_opt_ LOCK_OPERATION *DesiredAccess); PMDL FASTCALL FltGetSwappedBufferMdlAddress( _In_ PFLT_CALLBACK_DATA CallbackData); VOID FASTCALL FltRetainSwappedBufferMdlAddress( _In_ PFLT_CALLBACK_DATA CallbackData); NTSTATUS FLTAPI FltCbdqInitialize( _In_ PFLT_INSTANCE Instance, _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _In_ PFLT_CALLBACK_DATA_QUEUE_INSERT_IO CbdqInsertIo, _In_ PFLT_CALLBACK_DATA_QUEUE_REMOVE_IO CbdqRemoveIo, _In_ PFLT_CALLBACK_DATA_QUEUE_PEEK_NEXT_IO CbdqPeekNextIo, _In_ PFLT_CALLBACK_DATA_QUEUE_ACQUIRE CbdqAcquire, _In_ PFLT_CALLBACK_DATA_QUEUE_RELEASE CbdqRelease, _In_ PFLT_CALLBACK_DATA_QUEUE_COMPLETE_CANCELED_IO CbdqCompleteCanceledIo); VOID FLTAPI FltCbdqEnable( _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq); VOID FLTAPI FltCbdqDisable( _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq); _Must_inspect_result_ NTSTATUS FLTAPI FltCbdqInsertIo( _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _In_ PFLT_CALLBACK_DATA Cbd, _In_opt_ PFLT_CALLBACK_DATA_QUEUE_IO_CONTEXT Context, _In_opt_ PVOID InsertContext); _Must_inspect_result_ PFLT_CALLBACK_DATA FLTAPI FltCbdqRemoveIo( _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _In_ PFLT_CALLBACK_DATA_QUEUE_IO_CONTEXT Context); _Must_inspect_result_ PFLT_CALLBACK_DATA FLTAPI FltCbdqRemoveNextIo( _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _In_opt_ PVOID PeekContext); _IRQL_requires_max_(APC_LEVEL) VOID FLTAPI FltInitializeOplock( _Out_ POPLOCK Oplock); _IRQL_requires_max_(APC_LEVEL) VOID FLTAPI FltUninitializeOplock( _In_ POPLOCK Oplock); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) FLT_PREOP_CALLBACK_STATUS FLTAPI FltOplockFsctrl( _In_ POPLOCK Oplock, _In_ PFLT_CALLBACK_DATA CallbackData, _In_ ULONG OpenCount); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) FLT_PREOP_CALLBACK_STATUS FLTAPI FltCheckOplock( _In_ POPLOCK Oplock, _In_ PFLT_CALLBACK_DATA CallbackData, _In_opt_ PVOID Context, _In_opt_ PFLTOPLOCK_WAIT_COMPLETE_ROUTINE WaitCompletionRoutine, _In_opt_ PFLTOPLOCK_PREPOST_CALLBACKDATA_ROUTINE PrePostCallbackDataRoutine); _IRQL_requires_max_(APC_LEVEL) BOOLEAN FLTAPI FltOplockIsFastIoPossible( _In_ POPLOCK Oplock); _IRQL_requires_max_(APC_LEVEL) BOOLEAN FLTAPI FltCurrentBatchOplock( _In_ POPLOCK Oplock); VOID FLTAPI FltInitializeFileLock( _Out_ PFILE_LOCK FileLock); VOID FLTAPI FltUninitializeFileLock( _In_ PFILE_LOCK FileLock); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) PFILE_LOCK FLTAPI FltAllocateFileLock( _In_opt_ PFLT_COMPLETE_LOCK_CALLBACK_DATA_ROUTINE CompleteLockCallbackDataRoutine, _In_opt_ PUNLOCK_ROUTINE UnlockRoutine); _IRQL_requires_max_(APC_LEVEL) VOID FLTAPI FltFreeFileLock( _In_ PFILE_LOCK FileLock); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) FLT_PREOP_CALLBACK_STATUS FLTAPI FltProcessFileLock( _In_ PFILE_LOCK FileLock, _In_ PFLT_CALLBACK_DATA CallbackData, _In_opt_ PVOID Context); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) BOOLEAN FLTAPI FltCheckLockForReadAccess( _In_ PFILE_LOCK FileLock, _In_ PFLT_CALLBACK_DATA CallbackData); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) BOOLEAN FLTAPI FltCheckLockForWriteAccess( _In_ PFILE_LOCK FileLock, _In_ PFLT_CALLBACK_DATA CallbackData); _Acquires_lock_(_Global_critical_region_) _IRQL_requires_max_(APC_LEVEL) VOID FLTAPI FltAcquireResourceExclusive( _Inout_ _Requires_lock_not_held_(*_Curr_) _Acquires_lock_(*_Curr_) PERESOURCE Resource); _Acquires_lock_(_Global_critical_region_) _IRQL_requires_max_(APC_LEVEL) VOID FLTAPI FltAcquireResourceShared( _Inout_ _Requires_lock_not_held_(*_Curr_) _Acquires_lock_(*_Curr_) PERESOURCE Resource); _Releases_lock_(_Global_critical_region_) _IRQL_requires_max_(DISPATCH_LEVEL) VOID FLTAPI FltReleaseResource( _Inout_ _Requires_lock_held_(*_Curr_) _Releases_lock_(*_Curr_) PERESOURCE Resource); _IRQL_requires_max_(APC_LEVEL) VOID FLTAPI FltInitializePushLock( _Out_ PEX_PUSH_LOCK PushLock); _IRQL_requires_max_(APC_LEVEL) VOID FLTAPI FltDeletePushLock( _In_ PEX_PUSH_LOCK PushLock); _Acquires_lock_(_Global_critical_region_) _IRQL_requires_max_(APC_LEVEL) VOID FLTAPI FltAcquirePushLockExclusive( _Inout_ _Requires_lock_not_held_(*_Curr_) _Acquires_lock_(*_Curr_) PEX_PUSH_LOCK PushLock); _Acquires_lock_(_Global_critical_region_) _IRQL_requires_max_(APC_LEVEL) VOID FLTAPI FltAcquirePushLockShared( _Inout_ _Requires_lock_not_held_(*_Curr_) _Acquires_lock_(*_Curr_) PEX_PUSH_LOCK PushLock); _Releases_lock_(_Global_critical_region_) _IRQL_requires_max_(APC_LEVEL) VOID FLTAPI FltReleasePushLock( _Inout_ _Requires_lock_held_(*_Curr_) _Releases_lock_(*_Curr_) PEX_PUSH_LOCK PushLock); BOOLEAN FLTAPI FltIsOperationSynchronous( _In_ PFLT_CALLBACK_DATA CallbackData); _IRQL_requires_max_(DISPATCH_LEVEL) BOOLEAN FLTAPI FltIs32bitProcess( _In_opt_ PFLT_CALLBACK_DATA CallbackData); _IRQL_requires_max_(DISPATCH_LEVEL) PEPROCESS FLTAPI FltGetRequestorProcess( _In_ PFLT_CALLBACK_DATA CallbackData); _IRQL_requires_max_(DISPATCH_LEVEL) ULONG FLTAPI FltGetRequestorProcessId( _In_ PFLT_CALLBACK_DATA CallbackData); _IRQL_requires_max_(APC_LEVEL) VOID FLTAPI FltNotifyFilterChangeDirectory( _Inout_ PNOTIFY_SYNC NotifySync, _Inout_ PLIST_ENTRY NotifyList, _In_ PVOID FsContext, _In_ PSTRING FullDirectoryName, _In_ BOOLEAN WatchTree, _In_ BOOLEAN IgnoreBuffer, _In_ ULONG CompletionFilter, _In_ PFLT_CALLBACK_DATA NotifyCallbackData, _In_opt_ PCHECK_FOR_TRAVERSE_ACCESS TraverseCallback, _In_opt_ PSECURITY_SUBJECT_CONTEXT SubjectContext, _In_opt_ PFILTER_REPORT_CHANGE FilterCallback); PCHAR FLTAPI FltGetIrpName( _In_ UCHAR IrpMajorCode); #if FLT_MGR_AFTER_XPSP2 _Must_inspect_result_ _IRQL_requires_max_(PASSIVE_LEVEL) NTSTATUS FLTAPI FltCreateFileEx( _In_ PFLT_FILTER Filter, _In_opt_ PFLT_INSTANCE Instance, _Out_ PHANDLE FileHandle, _Outptr_opt_ PFILE_OBJECT *FileObject, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _Out_ PIO_STATUS_BLOCK IoStatusBlock, _In_opt_ PLARGE_INTEGER AllocationSize, _In_ ULONG FileAttributes, _In_ ULONG ShareAccess, _In_ ULONG CreateDisposition, _In_ ULONG CreateOptions, _In_reads_bytes_opt_(EaLength) PVOID EaBuffer, _In_ ULONG EaLength, _In_ ULONG Flags); _Must_inspect_result_ _IRQL_requires_max_(PASSIVE_LEVEL) NTSTATUS FLTAPI FltOpenVolume( _In_ PFLT_INSTANCE Instance, _Out_ PHANDLE VolumeHandle, _Outptr_opt_ PFILE_OBJECT *VolumeFileObject); _Must_inspect_result_ _IRQL_requires_max_(PASSIVE_LEVEL) NTSTATUS FLTAPI FltQueryEaFile( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _Out_writes_bytes_to_(Length,*LengthReturned) PVOID ReturnedEaData, _In_ ULONG Length, _In_ BOOLEAN ReturnSingleEntry, _In_reads_bytes_opt_(EaListLength) PVOID EaList, _In_ ULONG EaListLength, _In_opt_ PULONG EaIndex, _In_ BOOLEAN RestartScan, _Out_opt_ PULONG LengthReturned); _Must_inspect_result_ _IRQL_requires_max_(PASSIVE_LEVEL) NTSTATUS FLTAPI FltSetEaFile( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _In_reads_bytes_(Length) PVOID EaBuffer, _In_ ULONG Length); #endif /* FLT_MGR_AFTER_XPSP2 */ #if FLT_MGR_LONGHORN _Must_inspect_result_ _IRQL_requires_max_(PASSIVE_LEVEL) NTSTATUS FLTAPI FltCreateFileEx2( _In_ PFLT_FILTER Filter, _In_opt_ PFLT_INSTANCE Instance, _Out_ PHANDLE FileHandle, _Outptr_opt_ PFILE_OBJECT *FileObject, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _Out_ PIO_STATUS_BLOCK IoStatusBlock, _In_opt_ PLARGE_INTEGER AllocationSize, _In_ ULONG FileAttributes, _In_ ULONG ShareAccess, _In_ ULONG CreateDisposition, _In_ ULONG CreateOptions, _In_reads_bytes_opt_(EaLength) PVOID EaBuffer, _In_ ULONG EaLength, _In_ ULONG Flags, _In_opt_ PIO_DRIVER_CREATE_CONTEXT DriverContext); _Must_inspect_result_ _IRQL_requires_max_(PASSIVE_LEVEL) NTSTATUS FLTAPI FltQueryDirectoryFile( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _Out_writes_bytes_(Length) PVOID FileInformation, _In_ ULONG Length, _In_ FILE_INFORMATION_CLASS FileInformationClass, _In_ BOOLEAN ReturnSingleEntry, _In_opt_ PUNICODE_STRING FileName, _In_ BOOLEAN RestartScan, _Out_opt_ PULONG LengthReturned); _IRQL_requires_max_(APC_LEVEL) BOOLEAN FLTAPI FltSupportsFileContextsEx( _In_ PFILE_OBJECT FileObject, _In_opt_ PFLT_INSTANCE Instance); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltSetTransactionContext( _In_ PFLT_INSTANCE Instance, _In_ PKTRANSACTION Transaction, _In_ FLT_SET_CONTEXT_OPERATION Operation, _In_ PFLT_CONTEXT NewContext, _Outptr_opt_ PFLT_CONTEXT *OldContext); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltDeleteTransactionContext( _In_ PFLT_INSTANCE Instance, _In_ PKTRANSACTION Transaction, _Outptr_opt_ PFLT_CONTEXT *OldContext); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltGetTransactionContext( _In_ PFLT_INSTANCE Instance, _In_ PKTRANSACTION Transaction, _Outptr_ PFLT_CONTEXT *Context); _IRQL_requires_max_(APC_LEVEL) BOOLEAN FLTAPI FltIsFltMgrVolumeDeviceObject( _In_ PDEVICE_OBJECT DeviceObject); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltGetVolumeInformation( _In_ PFLT_VOLUME Volume, _In_ FILTER_VOLUME_INFORMATION_CLASS InformationClass, _Out_writes_bytes_to_opt_(BufferSize,*BytesReturned) PVOID Buffer, _In_ ULONG BufferSize, _Out_ PULONG BytesReturned); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltGetFileSystemType( _In_ PVOID FltObject, _Out_ PFLT_FILESYSTEM_TYPE FileSystemType); _Must_inspect_result_ _IRQL_requires_max_(PASSIVE_LEVEL) NTSTATUS FLTAPI FltIsVolumeSnapshot( _In_ PVOID FltObject, _Out_ PBOOLEAN IsSnapshotVolume); _Must_inspect_result_ _When_(((CallbackData!=NULL) && FLT_IS_IRP_OPERATION(CallbackData)), _IRQL_requires_max_(PASSIVE_LEVEL)) _When_((!((CallbackData!=NULL) && FLT_IS_IRP_OPERATION(CallbackData))), _IRQL_requires_max_(APC_LEVEL)) NTSTATUS FLTAPI FltCancellableWaitForSingleObject( _In_ PVOID Object, _In_opt_ PLARGE_INTEGER Timeout, _In_opt_ PFLT_CALLBACK_DATA CallbackData); _Must_inspect_result_ _When_(((CallbackData!=NULL) && FLT_IS_IRP_OPERATION(CallbackData)), _IRQL_requires_max_(PASSIVE_LEVEL)) _When_((!((CallbackData!=NULL) && FLT_IS_IRP_OPERATION(CallbackData))), _IRQL_requires_max_(APC_LEVEL)) NTSTATUS FLTAPI FltCancellableWaitForMultipleObjects( _In_ ULONG Count, _In_reads_(Count) PVOID ObjectArray[], _In_ WAIT_TYPE WaitType, _In_opt_ PLARGE_INTEGER Timeout, _In_opt_ PKWAIT_BLOCK WaitBlockArray, _In_ PFLT_CALLBACK_DATA CallbackData); _IRQL_requires_max_(DISPATCH_LEVEL) HANDLE FLTAPI FltGetRequestorProcessIdEx( _In_ PFLT_CALLBACK_DATA CallbackData); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltEnlistInTransaction( _In_ PFLT_INSTANCE Instance, _In_ PKTRANSACTION Transaction, _In_ PFLT_CONTEXT TransactionContext, _In_ NOTIFICATION_MASK NotificationMask); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltRollbackEnlistment( _In_ PFLT_INSTANCE Instance, _In_ PKTRANSACTION Transaction, _In_opt_ PFLT_CONTEXT TransactionContext); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltPrePrepareComplete( _In_ PFLT_INSTANCE Instance, _In_ PKTRANSACTION Transaction, _In_opt_ PFLT_CONTEXT TransactionContext); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltPrepareComplete( _In_ PFLT_INSTANCE Instance, _In_ PKTRANSACTION Transaction, _In_opt_ PFLT_CONTEXT TransactionContext); _IRQL_requires_max_(PASSIVE_LEVEL) NTSTATUS FLTAPI FltCommitComplete( _In_ PFLT_INSTANCE Instance, _In_ PKTRANSACTION Transaction, _In_opt_ PFLT_CONTEXT TransactionContext); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltCommitFinalizeComplete( _In_ PFLT_INSTANCE Instance, _In_ PKTRANSACTION Transaction, _In_opt_ PFLT_CONTEXT TransactionContext); _IRQL_requires_max_(PASSIVE_LEVEL) NTSTATUS FLTAPI FltRollbackComplete( _In_ PFLT_INSTANCE Instance, _In_ PKTRANSACTION Transaction, _In_opt_ PFLT_CONTEXT TransactionContext); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltAllocateExtraCreateParameterList( _In_ PFLT_FILTER Filter, _In_ FSRTL_ALLOCATE_ECPLIST_FLAGS Flags, _Outptr_ PECP_LIST *EcpList); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltAllocateExtraCreateParameter( _In_ PFLT_FILTER Filter, _In_ LPCGUID EcpType, ULONG SizeOfContext, _In_ FSRTL_ALLOCATE_ECP_FLAGS Flags, _In_opt_ PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK CleanupCallback, _In_ ULONG PoolTag, _Outptr_ PVOID *EcpContext); _IRQL_requires_max_(APC_LEVEL) VOID FLTAPI FltInitExtraCreateParameterLookasideList( _In_ PFLT_FILTER Filter, _Inout_ PVOID Lookaside, _In_ FSRTL_ECP_LOOKASIDE_FLAGS Flags, _In_ SIZE_T Size, _In_ ULONG Tag); _IRQL_requires_max_(APC_LEVEL) VOID FLTAPI FltDeleteExtraCreateParameterLookasideList( _In_ PFLT_FILTER Filter, _Inout_ PVOID Lookaside, _In_ FSRTL_ECP_LOOKASIDE_FLAGS Flags); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltAllocateExtraCreateParameterFromLookasideList( _In_ PFLT_FILTER Filter, _In_ LPCGUID EcpType, _In_ ULONG SizeOfContext, _In_ FSRTL_ALLOCATE_ECP_FLAGS Flags, _In_opt_ PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK CleanupCallback, _Inout_ PVOID LookasideList, _Outptr_ PVOID *EcpContext); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltInsertExtraCreateParameter( _In_ PFLT_FILTER Filter, _Inout_ PECP_LIST EcpList, _Inout_ PVOID EcpContext); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltFindExtraCreateParameter( _In_ PFLT_FILTER Filter, _In_ PECP_LIST EcpList, _In_ LPCGUID EcpType, _Outptr_opt_ PVOID *EcpContext, _Out_opt_ ULONG *EcpContextSize); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltRemoveExtraCreateParameter( _In_ PFLT_FILTER Filter, _Inout_ PECP_LIST EcpList, _In_ LPCGUID EcpType, _Outptr_ PVOID *EcpContext, _Out_opt_ ULONG *EcpContextSize); _IRQL_requires_max_(APC_LEVEL) VOID FLTAPI FltFreeExtraCreateParameterList( _In_ PFLT_FILTER Filter, _In_ PECP_LIST EcpList); _IRQL_requires_max_(APC_LEVEL) VOID FLTAPI FltFreeExtraCreateParameter( _In_ PFLT_FILTER Filter, _In_ PVOID EcpContext); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltGetEcpListFromCallbackData( _In_ PFLT_FILTER Filter, _In_ PFLT_CALLBACK_DATA CallbackData, _Outptr_result_maybenull_ PECP_LIST *EcpList); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltSetEcpListIntoCallbackData( _In_ PFLT_FILTER Filter, _In_ PFLT_CALLBACK_DATA CallbackData, _In_ PECP_LIST EcpList); _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltGetNextExtraCreateParameter( _In_ PFLT_FILTER Filter, _In_ PECP_LIST EcpList, _In_opt_ PVOID CurrentEcpContext, _Out_opt_ LPGUID NextEcpType, _Outptr_opt_ PVOID *NextEcpContext, _Out_opt_ ULONG *NextEcpContextSize); _IRQL_requires_max_(APC_LEVEL) VOID FLTAPI FltAcknowledgeEcp( _In_ PFLT_FILTER Filter, _In_ PVOID EcpContext); _IRQL_requires_max_(APC_LEVEL) BOOLEAN FLTAPI FltIsEcpAcknowledged( _In_ PFLT_FILTER Filter, _In_ PVOID EcpContext); _IRQL_requires_max_(APC_LEVEL) BOOLEAN FLTAPI FltIsEcpFromUserMode( _In_ PFLT_FILTER Filter, _In_ PVOID EcpContext); _IRQL_requires_max_(DISPATCH_LEVEL) NTSTATUS FLTAPI FltRetrieveIoPriorityInfo( _In_opt_ PFLT_CALLBACK_DATA Data, _In_opt_ PFILE_OBJECT FileObject, _In_opt_ PETHREAD Thread, _Inout_ PIO_PRIORITY_INFO PriorityInfo); _IRQL_requires_max_(DISPATCH_LEVEL) NTSTATUS FLTAPI FltApplyPriorityInfoThread( _In_ PIO_PRIORITY_INFO InputPriorityInfo, _Out_opt_ PIO_PRIORITY_INFO OutputPriorityInfo, _In_ PETHREAD Thread); _IRQL_requires_max_(DISPATCH_LEVEL) IO_PRIORITY_HINT FLTAPI FltGetIoPriorityHint( _In_ PFLT_CALLBACK_DATA Data); _IRQL_requires_max_(DISPATCH_LEVEL) IO_PRIORITY_HINT FLTAPI FltGetIoPriorityHintFromCallbackData( _In_ PFLT_CALLBACK_DATA Data); _IRQL_requires_max_(DISPATCH_LEVEL) NTSTATUS FLTAPI FltSetIoPriorityHintIntoCallbackData( _In_ PFLT_CALLBACK_DATA Data, _In_ IO_PRIORITY_HINT PriorityHint); _IRQL_requires_max_(DISPATCH_LEVEL) IO_PRIORITY_HINT FLTAPI FltGetIoPriorityHintFromFileObject( _In_ PFILE_OBJECT FileObject); _Must_inspect_result_ _IRQL_requires_max_(DISPATCH_LEVEL) NTSTATUS FLTAPI FltSetIoPriorityHintIntoFileObject( _In_ PFILE_OBJECT FileObject, _In_ IO_PRIORITY_HINT PriorityHint); _IRQL_requires_max_(DISPATCH_LEVEL) IO_PRIORITY_HINT FLTAPI FltGetIoPriorityHintFromThread( _In_ PETHREAD Thread); _IRQL_requires_max_(DISPATCH_LEVEL) NTSTATUS FLTAPI FltSetIoPriorityHintIntoThread( _In_ PETHREAD Thread, _In_ IO_PRIORITY_HINT PriorityHint); #endif /* FLT_MGR_LONGHORN */ #if FLT_MGR_WIN7 _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltAllocateCallbackDataEx( _In_ PFLT_INSTANCE Instance, _In_opt_ PFILE_OBJECT FileObject, _In_ FLT_ALLOCATE_CALLBACK_DATA_FLAGS Flags, _Outptr_ PFLT_CALLBACK_DATA *RetNewCallbackData); _Must_inspect_result_ _IRQL_requires_max_(DPC_LEVEL) PVOID FLTAPI FltGetNewSystemBufferAddress( _In_ PFLT_CALLBACK_DATA CallbackData); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) FLT_PREOP_CALLBACK_STATUS FLTAPI FltCheckOplockEx( _In_ POPLOCK Oplock, _In_ PFLT_CALLBACK_DATA CallbackData, _In_ ULONG Flags, _In_opt_ PVOID Context, _In_opt_ PFLTOPLOCK_WAIT_COMPLETE_ROUTINE WaitCompletionRoutine, _In_opt_ PFLTOPLOCK_PREPOST_CALLBACKDATA_ROUTINE PrePostCallbackDataRoutine); _IRQL_requires_max_(APC_LEVEL) BOOLEAN FLTAPI FltCurrentOplock( _In_ POPLOCK Oplock); _IRQL_requires_max_(APC_LEVEL) BOOLEAN FLTAPI FltCurrentOplockH( _In_ POPLOCK Oplock); _IRQL_requires_max_(APC_LEVEL) FLT_PREOP_CALLBACK_STATUS FLTAPI FltOplockBreakH( _In_ POPLOCK Oplock, _In_ PFLT_CALLBACK_DATA CallbackData, _In_ ULONG Flags, _In_opt_ PVOID Context, _In_opt_ PFLTOPLOCK_WAIT_COMPLETE_ROUTINE WaitCompletionRoutine, _In_opt_ PFLTOPLOCK_PREPOST_CALLBACKDATA_ROUTINE PrePostCallbackDataRoutine); _IRQL_requires_max_(APC_LEVEL) FLT_PREOP_CALLBACK_STATUS FLTAPI FltOplockBreakToNone( _In_ POPLOCK Oplock, _In_ PFLT_CALLBACK_DATA CallbackData, _In_opt_ PVOID Context, _In_opt_ PFLTOPLOCK_WAIT_COMPLETE_ROUTINE WaitCompletionRoutine, _In_opt_ PFLTOPLOCK_PREPOST_CALLBACKDATA_ROUTINE PrePostCallbackDataRoutine); _IRQL_requires_max_(APC_LEVEL) FLT_PREOP_CALLBACK_STATUS FLTAPI FltOplockBreakToNoneEx( _In_ POPLOCK Oplock, _In_ PFLT_CALLBACK_DATA CallbackData, _In_ ULONG Flags, _In_opt_ PVOID Context, _In_opt_ PFLTOPLOCK_WAIT_COMPLETE_ROUTINE WaitCompletionRoutine, _In_opt_ PFLTOPLOCK_PREPOST_CALLBACKDATA_ROUTINE PrePostCallbackDataRoutine); _IRQL_requires_max_(APC_LEVEL) BOOLEAN FLTAPI FltOplockIsSharedRequest( _In_ PFLT_CALLBACK_DATA CallbackData); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) FLT_PREOP_CALLBACK_STATUS FLTAPI FltOplockFsctrlEx( _In_ POPLOCK Oplock, _In_ PFLT_CALLBACK_DATA CallbackData, _In_ ULONG OpenCount, _In_ ULONG Flags); BOOLEAN FLTAPI FltOplockKeysEqual( _In_opt_ PFILE_OBJECT Fo1, _In_opt_ PFILE_OBJECT Fo2); _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltGetRequestorSessionId( _In_ PFLT_CALLBACK_DATA CallbackData, _Out_ PULONG SessionId); _IRQL_requires_max_(DISPATCH_LEVEL) NTSTATUS FLTAPI FltAdjustDeviceStackSizeForIoRedirection( _In_ PFLT_INSTANCE SourceInstance, _In_ PFLT_INSTANCE TargetInstance, _Out_opt_ PBOOLEAN SourceDeviceStackSizeModified); _IRQL_requires_max_(DISPATCH_LEVEL) NTSTATUS FLTAPI FltIsIoRedirectionAllowed( _In_ PFLT_INSTANCE SourceInstance, _In_ PFLT_INSTANCE TargetInstance, _Out_ PBOOLEAN RedirectionAllowed); _IRQL_requires_max_(DISPATCH_LEVEL) NTSTATUS FLTAPI FltIsIoRedirectionAllowedForOperation( _In_ PFLT_CALLBACK_DATA Data, _In_ PFLT_INSTANCE TargetInstance, _Out_ PBOOLEAN RedirectionAllowedThisIo, _Out_opt_ PBOOLEAN RedirectionAllowedAllIo); #endif /* FLT_MGR_WIN7 */ #endif /* FLT_MGR_BASELINE */ #ifdef __cplusplus } /* extern "C" */ #endif #endif /* __FLTKERNEL__ */