#include <ntifs.h>
#include <fltuserstructures.h>
#include <initguid.h>
#include "pshpack4.h"
#include "poppack.h"

Include dependency graph for fltkernel.h:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Classes
union	_FLT_PARAMETERS

struct	_FLT_IO_PARAMETER_BLOCK

struct	_FLT_CALLBACK_DATA

struct	_FLT_RELATED_OBJECTS

struct	_FLT_RELATED_CONTEXTS

struct	_FLT_CONTEXT_REGISTRATION

struct	_FLT_OPERATION_REGISTRATION

struct	_FLT_TAG_DATA_BUFFER

struct	_FLT_NAME_CONTROL

struct	_FLT_REGISTRATION

struct	_FLT_FILE_NAME_INFORMATION

struct	_FLT_VOLUME_PROPERTIES

struct	_FLT_CALLBACK_DATA_QUEUE

Macros
#define	__FLTKERNEL__

#define	FLT_MGR_BASELINE

#define	FLT_MGR_AFTER_XPSP2

#define	FLT_MGR_LONGHORN (NTDDI_VERSION >= NTDDI_VISTA)

#define	FLT_MGR_WIN7 (NTDDI_VERSION >= NTDDI_WIN7)

#define	FLT_ASSERT(_e) NT_ASSERT(_e)

#define	FLT_ASSERTMSG(_m, _e) NT_ASSERTMSG(_m, _e)

#define	Add2Ptr(P, I) ((PVOID)((PUCHAR)(P) + (I)))

#define	PtrOffset(B, O) ((ULONG)((ULONG_PTR)(O) - (ULONG_PTR)(B)))

#define	ROUND_TO_SIZE(_length, _alignment) ((((ULONG_PTR)(_length)) + ((_alignment)-1)) & ~(ULONG_PTR) ((_alignment) - 1))

#define	IS_ALIGNED(_pointer, _alignment) ((((ULONG_PTR) (_pointer)) & ((_alignment) - 1)) == 0)

#define	IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION ((UCHAR)-1)

#define	IRP_MJ_RELEASE_FOR_SECTION_SYNCHRONIZATION ((UCHAR)-2)

#define	IRP_MJ_ACQUIRE_FOR_MOD_WRITE ((UCHAR)-3)

#define	IRP_MJ_RELEASE_FOR_MOD_WRITE ((UCHAR)-4)

#define	IRP_MJ_ACQUIRE_FOR_CC_FLUSH ((UCHAR)-5)

#define	IRP_MJ_RELEASE_FOR_CC_FLUSH ((UCHAR)-6)

#define	IRP_MJ_FAST_IO_CHECK_IF_POSSIBLE ((UCHAR)-13)

#define	IRP_MJ_NETWORK_QUERY_OPEN ((UCHAR)-14)

#define	IRP_MJ_MDL_READ ((UCHAR)-15)

#define	IRP_MJ_MDL_READ_COMPLETE ((UCHAR)-16)

#define	IRP_MJ_PREPARE_MDL_WRITE ((UCHAR)-17)

#define	IRP_MJ_MDL_WRITE_COMPLETE ((UCHAR)-18)

#define	IRP_MJ_VOLUME_MOUNT ((UCHAR)-19)

#define	IRP_MJ_VOLUME_DISMOUNT ((UCHAR)-20)

#define	IRP_MJ_OPERATION_END ((UCHAR)0x80)

#define	FLT_INTERNAL_OPERATION_COUNT 22

#define	NULL_CONTEXT ((PFLT_CONTEXT)NULL)

#define	FLTFL_CALLBACK_DATA_REISSUE_MASK 0x0000FFFF

#define	FLTFL_CALLBACK_DATA_IRP_OPERATION 0x00000001

#define	FLTFL_CALLBACK_DATA_FAST_IO_OPERATION 0x00000002

#define	FLTFL_CALLBACK_DATA_FS_FILTER_OPERATION 0x00000004

#define	FLTFL_CALLBACK_DATA_SYSTEM_BUFFER 0x00000008

#define	FLTFL_CALLBACK_DATA_GENERATED_IO 0x00010000

#define	FLTFL_CALLBACK_DATA_REISSUED_IO 0x00020000

#define	FLTFL_CALLBACK_DATA_DRAINING_IO 0x00040000

#define	FLTFL_CALLBACK_DATA_POST_OPERATION 0x00080000

#define	FLTFL_CALLBACK_DATA_NEW_SYSTEM_BUFFER 0x00100000

#define	FLTFL_CALLBACK_DATA_DIRTY 0x80000000

#define	FLT_SET_CALLBACK_DATA_DIRTY(Data) FltSetCallbackDataDirty(Data)

#define	FLT_CLEAR_CALLBACK_DATA_DIRTY(Data) FltClearCallbackDataDirty(Data)

#define	FLT_IS_CALLBACK_DATA_DIRTY(Data) FltIsCallbackDataDirty(Data)

#define	FLT_IS_IRP_OPERATION(Data) (FlagOn((Data)->Flags, FLTFL_CALLBACK_DATA_IRP_OPERATION))

#define	FLT_IS_FASTIO_OPERATION(Data) (FlagOn((Data)->Flags, FLTFL_CALLBACK_DATA_FAST_IO_OPERATION))

#define	FLT_IS_FS_FILTER_OPERATION(Data) (FlagOn((Data)->Flags, FLTFL_CALLBACK_DATA_FS_FILTER_OPERATION))

#define	FLT_IS_REISSUED_IO(Data) (FlagOn((Data)->Flags, FLTFL_CALLBACK_DATA_REISSUED_IO))

#define	FLT_IS_SYSTEM_BUFFER(Data) (FlagOn((Data)->Flags, FLTFL_CALLBACK_DATA_SYSTEM_BUFFER))

#define	FLT_VOLUME_CONTEXT 0x0001

#define	FLT_INSTANCE_CONTEXT 0x0002

#define	FLT_FILE_CONTEXT 0x0004

#define	FLT_STREAM_CONTEXT 0x0008

#define	FLT_STREAMHANDLE_CONTEXT 0x0010

#define	FLT_TRANSACTION_CONTEXT 0x0020

#define	FLT_CONTEXT_END 0xffff

#define	FLT_ALL_CONTEXTS

#define	FLT_ALLOCATE_CALLBACK_DATA_PREALLOCATE_ALL_MEMORY 0x00000001

#define	FLTFL_CONTEXT_REGISTRATION_NO_EXACT_SIZE_MATCH 0x0001

#define	FLT_VARIABLE_SIZED_CONTEXTS ((SIZE_T)-1)

#define	FLTFL_INSTANCE_SETUP_AUTOMATIC_ATTACHMENT 0x00000001

#define	FLTFL_INSTANCE_SETUP_MANUAL_ATTACHMENT 0x00000002

#define	FLTFL_INSTANCE_SETUP_NEWLY_MOUNTED_VOLUME 0x00000004

#define	FLTFL_INSTANCE_SETUP_DETACHED_VOLUME 0x00000008

#define	FLT_MAX_TRANSACTION_NOTIFICATIONS

#define	FLTFL_INSTANCE_TEARDOWN_MANUAL 0x00000001

#define	FLTFL_INSTANCE_TEARDOWN_FILTER_UNLOAD 0x00000002

#define	FLTFL_INSTANCE_TEARDOWN_MANDATORY_FILTER_UNLOAD 0x00000004

#define	FLTFL_INSTANCE_TEARDOWN_VOLUME_DISMOUNT 0x00000008

#define	FLTFL_INSTANCE_TEARDOWN_INTERNAL_ERROR 0x00000010

#define	FLTFL_POST_OPERATION_DRAINING 0x00000001

#define	FLTFL_OPERATION_REGISTRATION_SKIP_PAGING_IO 0x00000001

#define	FLTFL_OPERATION_REGISTRATION_SKIP_CACHED_IO 0x00000002

#define	FLTFL_OPERATION_REGISTRATION_SKIP_NON_DASD_IO 0x00000004

#define	FLT_TAG_DATA_BUFFER_HEADER_SIZE FIELD_OFFSET(FLT_TAG_DATA_BUFFER, GenericReparseBuffer)

#define	FLTFL_FILTER_UNLOAD_MANDATORY 0x00000001

#define	FLTFL_NORMALIZE_NAME_CASE_SENSITIVE 0x01

#define	FLTFL_NORMALIZE_NAME_DESTINATION_FILE_NAME 0x02

#define	FLT_REGISTRATION_VERSION_0200 0x0200

#define	FLT_REGISTRATION_VERSION_0201 0x0201

#define	FLT_REGISTRATION_VERSION_0202 0x0202

#define	FLT_REGISTRATION_VERSION_0203 0x0203

#define	FLT_REGISTRATION_VERSION FLT_REGISTRATION_VERSION_0202

#define	FLTFL_REGISTRATION_DO_NOT_SUPPORT_SERVICE_STOP 0x00000001

#define	FLTFL_REGISTRATION_SUPPORT_NPFS_MSFS 0x00000002

#define	FLTFL_IO_OPERATION_NON_CACHED 0x00000001

#define	FLTFL_IO_OPERATION_PAGING 0x00000002

#define	FLTFL_IO_OPERATION_DO_NOT_UPDATE_BYTE_OFFSET 0x00000004

#define	FLTFL_IO_OPERATION_SYNCHRONOUS_PAGING 0x00000008

#define	FLT_VALID_FILE_NAME_FORMATS 0x000000ff

#define	FLT_FILE_NAME_NORMALIZED 0x01

#define	FLT_FILE_NAME_OPENED 0x02

#define	FLT_FILE_NAME_SHORT 0x03

#define	FltGetFileNameFormat(_NameOptions) ((_NameOptions) & FLT_VALID_FILE_NAME_FORMATS)

#define	FLT_VALID_FILE_NAME_QUERY_METHODS 0x0000ff00

#define	FLT_FILE_NAME_QUERY_DEFAULT 0x0100

#define	FLT_FILE_NAME_QUERY_CACHE_ONLY 0x0200

#define	FLT_FILE_NAME_QUERY_FILESYSTEM_ONLY 0x0300

#define	FLT_FILE_NAME_QUERY_ALWAYS_ALLOW_CACHE_LOOKUP 0x0400

#define	FltGetFileNameQueryMethod(_NameOptions) ((_NameOptions) & FLT_VALID_FILE_NAME_QUERY_METHODS)

#define	FLT_VALID_FILE_NAME_FLAGS 0xff000000

#define	FLT_FILE_NAME_REQUEST_FROM_CURRENT_PROVIDER 0x01000000

#define	FLT_FILE_NAME_DO_NOT_CACHE 0x02000000

#define	FLT_FILE_NAME_ALLOW_QUERY_ON_REPARSE 0x04000000

#define	FLTFL_FILE_NAME_PARSED_FINAL_COMPONENT 0x0001

#define	FLTFL_FILE_NAME_PARSED_EXTENSION 0x0002

#define	FLTFL_FILE_NAME_PARSED_STREAM 0x0004

#define	FLTFL_FILE_NAME_PARSED_PARENT_DIR 0x0008

#define	FLT_PORT_CONNECT 0x0001

#define	FLT_PORT_ALL_ACCESS (FLT_PORT_CONNECT \| STANDARD_RIGHTS_ALL)

Typedefs
typedef struct _FLT_FILTER *	PFLT_FILTER

typedef struct _FLT_VOLUME *	PFLT_VOLUME

typedef struct _FLT_INSTANCE *	PFLT_INSTANCE

typedef struct _FLT_PORT *	PFLT_PORT

typedef PVOID	PFLT_CONTEXT

typedef union _FLT_PARAMETERS	FLT_PARAMETERS

typedef union _FLT_PARAMETERS *	PFLT_PARAMETERS

typedef struct _FLT_IO_PARAMETER_BLOCK	FLT_IO_PARAMETER_BLOCK

typedef struct _FLT_IO_PARAMETER_BLOCK *	PFLT_IO_PARAMETER_BLOCK

typedef USHORT	FLT_CONTEXT_TYPE

typedef ULONG	FLT_CALLBACK_DATA_FLAGS

typedef ULONG	FLT_ALLOCATE_CALLBACK_DATA_FLAGS

typedef struct _FLT_CALLBACK_DATA	FLT_CALLBACK_DATA

typedef struct _FLT_CALLBACK_DATA *	PFLT_CALLBACK_DATA

typedef struct _FLT_RELATED_OBJECTS	FLT_RELATED_OBJECTS

typedef struct _FLT_RELATED_OBJECTS *	PFLT_RELATED_OBJECTS

typedef const struct _FLT_RELATED_OBJECTS *	PCFLT_RELATED_OBJECTS

typedef struct _FLT_RELATED_CONTEXTS	FLT_RELATED_CONTEXTS

typedef struct _FLT_RELATED_CONTEXTS *	PFLT_RELATED_CONTEXTS

typedef VOID(FLTAPI *	PFLT_CONTEXT_CLEANUP_CALLBACK) (_In_ PFLT_CONTEXT Context, _In_ FLT_CONTEXT_TYPE ContextType)

typedef PVOID(FLTAPI *	PFLT_CONTEXT_ALLOCATE_CALLBACK) (_In_ POOL_TYPE PoolType, _In_ SIZE_T Size, _In_ FLT_CONTEXT_TYPE ContextType)

typedef VOID(FLTAPI *	PFLT_CONTEXT_FREE_CALLBACK) (_In_ PVOID Pool, _In_ FLT_CONTEXT_TYPE ContextType)

typedef USHORT	FLT_CONTEXT_REGISTRATION_FLAGS

typedef struct _FLT_CONTEXT_REGISTRATION	FLT_CONTEXT_REGISTRATION

typedef struct _FLT_CONTEXT_REGISTRATION *	PFLT_CONTEXT_REGISTRATION

typedef const struct _FLT_CONTEXT_REGISTRATION *	PCFLT_CONTEXT_REGISTRATION

typedef ULONG	FLT_INSTANCE_SETUP_FLAGS

typedef NTSTATUS(FLTAPI *	PFLT_INSTANCE_SETUP_CALLBACK) (_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_SETUP_FLAGS Flags, _In_ DEVICE_TYPE VolumeDeviceType, _In_ FLT_FILESYSTEM_TYPE VolumeFilesystemType)

typedef ULONG	FLT_INSTANCE_QUERY_TEARDOWN_FLAGS

typedef NTSTATUS(FLTAPI *	PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK) (_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags)

typedef ULONG	FLT_INSTANCE_TEARDOWN_FLAGS

typedef VOID(FLTAPI *	PFLT_INSTANCE_TEARDOWN_CALLBACK) (_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_TEARDOWN_FLAGS Reason)

typedef enum _FLT_PREOP_CALLBACK_STATUS	FLT_PREOP_CALLBACK_STATUS

typedef enum _FLT_PREOP_CALLBACK_STATUS *	PFLT_PREOP_CALLBACK_STATUS

typedef FLT_PREOP_CALLBACK_STATUS(FLTAPI *	PFLT_PRE_OPERATION_CALLBACK) (_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Outptr_result_maybenull_ PVOID *CompletionContext)

typedef enum _FLT_POSTOP_CALLBACK_STATUS	FLT_POSTOP_CALLBACK_STATUS

typedef enum _FLT_POSTOP_CALLBACK_STATUS *	PFLT_POSTOP_CALLBACK_STATUS

typedef ULONG	FLT_POST_OPERATION_FLAGS

typedef FLT_POSTOP_CALLBACK_STATUS(FLTAPI *	PFLT_POST_OPERATION_CALLBACK) (_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_opt_ PVOID CompletionContext, _In_ FLT_POST_OPERATION_FLAGS Flags)

typedef ULONG	FLT_OPERATION_REGISTRATION_FLAGS

typedef struct _FLT_OPERATION_REGISTRATION	FLT_OPERATION_REGISTRATION

typedef struct _FLT_OPERATION_REGISTRATION *	PFLT_OPERATION_REGISTRATION

typedef struct _FLT_TAG_DATA_BUFFER	FLT_TAG_DATA_BUFFER

typedef struct _FLT_TAG_DATA_BUFFER *	PFLT_TAG_DATA_BUFFER

typedef ULONG	FLT_FILTER_UNLOAD_FLAGS

typedef NTSTATUS(FLTAPI *	PFLT_FILTER_UNLOAD_CALLBACK) (FLT_FILTER_UNLOAD_FLAGS Flags)

typedef struct _FLT_NAME_CONTROL	FLT_NAME_CONTROL

typedef struct _FLT_NAME_CONTROL *	PFLT_NAME_CONTROL

typedef ULONG	FLT_FILE_NAME_OPTIONS

typedef NTSTATUS(FLTAPI *	PFLT_GENERATE_FILE_NAME) (_In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _In_opt_ PFLT_CALLBACK_DATA CallbackData, _In_ FLT_FILE_NAME_OPTIONS NameOptions, _Out_ PBOOLEAN CacheFileNameInformation, _Out_ PFLT_NAME_CONTROL FileName)

typedef ULONG	FLT_NORMALIZE_NAME_FLAGS

typedef NTSTATUS(FLTAPI *	PFLT_NORMALIZE_NAME_COMPONENT) (_In_ PFLT_INSTANCE Instance, _In_ PCUNICODE_STRING ParentDirectory, _In_ USHORT VolumeNameLength, _In_ PCUNICODE_STRING Component, _Out_writes_bytes_(ExpandComponentNameLength) PFILE_NAMES_INFORMATION ExpandComponentName, _In_ ULONG ExpandComponentNameLength, _In_ FLT_NORMALIZE_NAME_FLAGS Flags, _Inout_ PVOID *NormalizationContext)

typedef NTSTATUS(FLTAPI *	PFLT_NORMALIZE_NAME_COMPONENT_EX) (_In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _In_ PCUNICODE_STRING ParentDirectory, _In_ USHORT VolumeNameLength, _In_ PCUNICODE_STRING Component, _Out_writes_bytes_(ExpandComponentNameLength) PFILE_NAMES_INFORMATION ExpandComponentName, _In_ ULONG ExpandComponentNameLength, _In_ FLT_NORMALIZE_NAME_FLAGS Flags, _Inout_ PVOID *NormalizationContext)

typedef VOID(FLTAPI *	PFLT_NORMALIZE_CONTEXT_CLEANUP) (_In_opt_ PVOID *NormalizationContext)

typedef NTSTATUS(FLTAPI *	PFLT_TRANSACTION_NOTIFICATION_CALLBACK) (_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ PFLT_CONTEXT TransactionContext, _In_ ULONG NotificationMask)

typedef ULONG	FLT_REGISTRATION_FLAGS

typedef struct _FLT_REGISTRATION	FLT_REGISTRATION

typedef struct _FLT_REGISTRATION *	PFLT_REGISTRATION

typedef VOID(FLTAPI *	PFLT_COMPLETED_ASYNC_IO_CALLBACK) (_In_ PFLT_CALLBACK_DATA CallbackData, _In_ PFLT_CONTEXT Context)

typedef ULONG	FLT_IO_OPERATION_FLAGS

typedef VOID(FLTAPI *	PFLT_GET_OPERATION_STATUS_CALLBACK) (_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ PFLT_IO_PARAMETER_BLOCK IopbSnapshot, _In_ NTSTATUS OperationStatus, _In_opt_ PVOID RequesterContext)

typedef USHORT	FLT_FILE_NAME_PARSED_FLAGS

typedef struct _FLT_FILE_NAME_INFORMATION	FLT_FILE_NAME_INFORMATION

typedef struct _FLT_FILE_NAME_INFORMATION *	PFLT_FILE_NAME_INFORMATION

typedef enum _FLT_SET_CONTEXT_OPERATION	FLT_SET_CONTEXT_OPERATION

typedef enum _FLT_SET_CONTEXT_OPERATION *	PFLT_SET_CONTEXT_OPERATION

typedef struct _FLT_VOLUME_PROPERTIES	FLT_VOLUME_PROPERTIES

typedef struct _FLT_VOLUME_PROPERTIES *	PFLT_VOLUME_PROPERTIES

typedef NTSTATUS(FLTAPI *	PFLT_MESSAGE_NOTIFY) (_In_opt_ PVOID PortCookie, _In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer, _In_ ULONG InputBufferLength, _Out_writes_bytes_to_opt_(OutputBufferLength, *ReturnOutputBufferLength) PVOID OutputBuffer, _In_ ULONG OutputBufferLength, _Out_ PULONG ReturnOutputBufferLength)

typedef NTSTATUS(FLTAPI *	PFLT_CONNECT_NOTIFY) (_In_ PFLT_PORT ClientPort, _In_opt_ PVOID ServerPortCookie, _In_reads_bytes_opt_(SizeOfContext) PVOID ConnectionContext, _In_ ULONG SizeOfContext, _Outptr_result_maybenull_ PVOID *ConnectionPortCookie)

typedef VOID(FLTAPI *	PFLT_DISCONNECT_NOTIFY) (_In_opt_ PVOID ConnectionCookie)

typedef VOID(FLTAPI *	PFLT_COMPLETE_CANCELED_CALLBACK) (_In_ PFLT_CALLBACK_DATA CallbackData)

typedef struct _FLT_DEFERRED_IO_WORKITEM *	PFLT_DEFERRED_IO_WORKITEM

typedef struct _FLT_GENERIC_WORKITEM *	PFLT_GENERIC_WORKITEM

typedef VOID(FLTAPI *	PFLT_DEFERRED_IO_WORKITEM_ROUTINE) (_In_ PFLT_DEFERRED_IO_WORKITEM FltWorkItem, _In_ PFLT_CALLBACK_DATA CallbackData, _In_opt_ PVOID Context)

typedef VOID(FLTAPI *	PFLT_GENERIC_WORKITEM_ROUTINE) (_In_ PFLT_GENERIC_WORKITEM FltWorkItem, _In_ PVOID FltObject, _In_opt_ PVOID Context)

typedef IO_CSQ_IRP_CONTEXT	FLT_CALLBACK_DATA_QUEUE_IO_CONTEXT

typedef IO_CSQ_IRP_CONTEXT *	PFLT_CALLBACK_DATA_QUEUE_IO_CONTEXT

typedef struct _FLT_CALLBACK_DATA_QUEUE	FLT_CALLBACK_DATA_QUEUE

typedef struct _FLT_CALLBACK_DATA_QUEUE *	PFLT_CALLBACK_DATA_QUEUE

typedef NTSTATUS(FLTAPI *	PFLT_CALLBACK_DATA_QUEUE_INSERT_IO) (_Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _In_ PFLT_CALLBACK_DATA Cbd, _In_opt_ PVOID InsertContext)

typedef VOID(FLTAPI *	PFLT_CALLBACK_DATA_QUEUE_REMOVE_IO) (_Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _In_ PFLT_CALLBACK_DATA Cbd)

typedef PFLT_CALLBACK_DATA(FLTAPI *	PFLT_CALLBACK_DATA_QUEUE_PEEK_NEXT_IO) (_In_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _In_opt_ PFLT_CALLBACK_DATA Cbd, _In_opt_ PVOID PeekContext)

typedef VOID(FLTAPI *	PFLT_CALLBACK_DATA_QUEUE_ACQUIRE) (_Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _Out_opt_ PKIRQL Irql)

typedef VOID(FLTAPI *	PFLT_CALLBACK_DATA_QUEUE_RELEASE) (_Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _In_opt_ KIRQL Irql)

typedef VOID(FLTAPI *	PFLT_CALLBACK_DATA_QUEUE_COMPLETE_CANCELED_IO) (_Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _Inout_ PFLT_CALLBACK_DATA Cbd)

typedef ULONG	FLT_CALLBACK_DATA_QUEUE_FLAGS

typedef NTSTATUS(*	PFLT_COMPLETE_LOCK_CALLBACK_DATA_ROUTINE) (_In_opt_ PVOID Context, _In_ PFLT_CALLBACK_DATA CallbackData)

typedef VOID(FLTAPI *	PFLTOPLOCK_WAIT_COMPLETE_ROUTINE) (_In_ PFLT_CALLBACK_DATA CallbackData, _In_opt_ PVOID Context)

typedef VOID(FLTAPI *	PFLTOPLOCK_PREPOST_CALLBACKDATA_ROUTINE) (_In_ PFLT_CALLBACK_DATA CallbackData, _In_opt_ PVOID Context)

Enumerations
enum	_FLT_PREOP_CALLBACK_STATUS { FLT_PREOP_SUCCESS_WITH_CALLBACK , FLT_PREOP_SUCCESS_NO_CALLBACK , FLT_PREOP_PENDING , FLT_PREOP_DISALLOW_FASTIO , FLT_PREOP_COMPLETE , FLT_PREOP_SYNCHRONIZE }

enum	_FLT_POSTOP_CALLBACK_STATUS { FLT_POSTOP_FINISHED_PROCESSING , FLT_POSTOP_MORE_PROCESSING_REQUIRED }

enum	_FLT_SET_CONTEXT_OPERATION { FLT_SET_CONTEXT_REPLACE_IF_EXISTS , FLT_SET_CONTEXT_KEEP_IF_EXISTS }

Functions
VOID FLTAPI	FltSetCallbackDataDirty (_Inout_ PFLT_CALLBACK_DATA Data)

VOID FLTAPI	FltClearCallbackDataDirty (_Inout_ PFLT_CALLBACK_DATA Data)

BOOLEAN FLTAPI	FltIsCallbackDataDirty (_In_ PFLT_CALLBACK_DATA Data)

_Must_inspect_result_ BOOLEAN FLTAPI	FltDoCompletionProcessingWhenSafe (_In_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_opt_ PVOID CompletionContext, _In_ FLT_POST_OPERATION_FLAGS Flags, _In_ PFLT_POST_OPERATION_CALLBACK SafePostCallback, _Out_ PFLT_POSTOP_CALLBACK_STATUS RetPostOperationStatus)

_Must_inspect_result_	_IRQL_requires_max_ (APC_LEVEL) NTSTATUS FLTAPI FltCheckAndGrowNameControl(_Inout_ PFLT_NAME_CONTROL NameCtrl

	_When_ (CallbackStatus==FLT_PREOP_COMPLETE, _IRQL_requires_max_(DISPATCH_LEVEL)) _When_(CallbackStatus!

	_IRQL_requires_max_ (DISPATCH_LEVEL) VOID FLTAPI FltCompletePendedPostOperation(_In_ PFLT_CALLBACK_DATA CallbackData)

	_When_ ((PoolType==NonPagedPoolNx), _IRQL_requires_max_(DISPATCH_LEVEL)) _When_((PoolType!

_Must_inspect_result_ _In_ PFILE_OBJECT _In_opt_ HANDLE	_In_reads_bytes_ (FileNameLength) PWSTR FileName

_Must_inspect_result_	_IRQL_requires_max_ (PASSIVE_LEVEL) NTSTATUS FLTAPI FltLoadFilter(_In_ PCUNICODE_STRING FilterName)
	Queries information details about a security descriptor.

	_When_ (FlagOn(CallbackData->Iopb->IrpFlags, IRP_PAGING_IO), _IRQL_requires_max_(APC_LEVEL)) _When_(!FlagOn(CallbackData -> Iopb->IrpFlags, IRP_PAGING_IO), _IRQL_requires_max_(PASSIVE_LEVEL)) VOID FLTAPI FltPerformSynchronousIo(_Inout_ PFLT_CALLBACK_DATA CallbackData)

_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE _In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _Out_ PIO_STATUS_BLOCK _In_opt_ PLARGE_INTEGER _In_ ULONG _In_ ULONG _In_ ULONG _In_ ULONG	_In_reads_bytes_opt_ (EaLength) PVOID EaBuffer

_Must_inspect_result_ _In_ PFILE_OBJECT _In_opt_ PLARGE_INTEGER _In_ ULONG	_Out_writes_bytes_to_ (Length, *BytesRead) PVOID Buffer

_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_opt_ GUID	_In_reads_bytes_ (DataBufferLength) PVOID DataBuffer

_Must_inspect_result_ _In_ PFILE_OBJECT _In_opt_ PLARGE_INTEGER _In_ ULONG	_In_reads_bytes_ (Length) PVOID Buffer

_Must_inspect_result_ _In_ PFILE_OBJECT _In_ SECURITY_INFORMATION	_Inout_updates_bytes_opt_ (Length) PSECURITY_DESCRIPTOR SecurityDescriptor

_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG	_In_reads_bytes_opt_ (InputBufferLength) PVOID InputBuffer

_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_ ULONG	_Out_writes_bytes_to_opt_ (OutputBufferLength, *LengthReturned) PVOID OutputBuffer

_Must_inspect_result_ _In_ FLT_CONTEXT_TYPE _In_ SIZE_T _In_ POOL_TYPE	_Outptr_result_bytebuffer_ (ContextSize) PFLT_CONTEXT *ReturnedContext)

LONG FLTAPI	FltCompareInstanceAltitudes (_In_ PFLT_INSTANCE Instance1, _In_ PFLT_INSTANCE Instance2)

_In_ FILTER_INFORMATION_CLASS	_Out_writes_bytes_to_opt_ (BufferSize, *BytesReturned) PVOID Buffer

	_Out_writes_bytes_to_opt_ (VolumePropertiesLength, *LengthReturned) PFLT_VOLUME_PROPERTIES VolumeProperties

_Must_inspect_result_ _Out_ PIO_STATUS_BLOCK	_Out_writes_bytes_ (Length) PVOID FsInformation

_Must_inspect_result_	_Out_writes_to_opt_ (VolumeListSize, NumberVolumesReturned) PFLT_VOLUME VolumeList

_Must_inspect_result_ _In_opt_ PFLT_FILTER	_Out_writes_to_opt_ (InstanceListSize, NumberInstancesReturned) PFLT_INSTANCE InstanceList

_Must_inspect_result_ _In_ PFLT_PORT	_In_reads_bytes_ (SenderBufferLength) PVOID SenderBuffer

BOOLEAN FLTAPI	FltIsIoCanceled (_In_ PFLT_CALLBACK_DATA CallbackData)

NTSTATUS FLTAPI	FltDecodeParameters (_In_ PFLT_CALLBACK_DATA CallbackData, _Outptr_opt_ PMDL MdlAddressPointer, _Outptr_opt_result_bytebuffer_(Length) PVOID *Buffer, _Outptr_opt_ PULONG Length, _Out_opt_ LOCK_OPERATION *DesiredAccess)

PMDL FASTCALL	FltGetSwappedBufferMdlAddress (_In_ PFLT_CALLBACK_DATA CallbackData)

VOID FASTCALL	FltRetainSwappedBufferMdlAddress (_In_ PFLT_CALLBACK_DATA CallbackData)

NTSTATUS FLTAPI	FltCbdqInitialize (_In_ PFLT_INSTANCE Instance, _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _In_ PFLT_CALLBACK_DATA_QUEUE_INSERT_IO CbdqInsertIo, _In_ PFLT_CALLBACK_DATA_QUEUE_REMOVE_IO CbdqRemoveIo, _In_ PFLT_CALLBACK_DATA_QUEUE_PEEK_NEXT_IO CbdqPeekNextIo, _In_ PFLT_CALLBACK_DATA_QUEUE_ACQUIRE CbdqAcquire, _In_ PFLT_CALLBACK_DATA_QUEUE_RELEASE CbdqRelease, _In_ PFLT_CALLBACK_DATA_QUEUE_COMPLETE_CANCELED_IO CbdqCompleteCanceledIo)

VOID FLTAPI	FltCbdqEnable (_Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq)

VOID FLTAPI	FltCbdqDisable (_Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq)

_Must_inspect_result_ NTSTATUS FLTAPI	FltCbdqInsertIo (_Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _In_ PFLT_CALLBACK_DATA Cbd, _In_opt_ PFLT_CALLBACK_DATA_QUEUE_IO_CONTEXT Context, _In_opt_ PVOID InsertContext)

_Must_inspect_result_ PFLT_CALLBACK_DATA FLTAPI	FltCbdqRemoveIo (_Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _In_ PFLT_CALLBACK_DATA_QUEUE_IO_CONTEXT Context)

_Must_inspect_result_ PFLT_CALLBACK_DATA FLTAPI	FltCbdqRemoveNextIo (_Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _In_opt_ PVOID PeekContext)

VOID FLTAPI	FltInitializeFileLock (_Out_ PFILE_LOCK FileLock)

VOID FLTAPI	FltUninitializeFileLock (_In_ PFILE_LOCK FileLock)

	_Acquires_lock_ (_Global_critical_region_) _IRQL_requires_max_(APC_LEVEL) VOID FLTAPI FltAcquireResourceExclusive(_Inout_ _Requires_lock_not_held_(_Curr_) _Acquires_lock_(_Curr_) PERESOURCE Resource)

	_Releases_lock_ (_Global_critical_region_) _IRQL_requires_max_(DISPATCH_LEVEL) VOID FLTAPI FltReleaseResource(_Inout_ _Requires_lock_held_(_Curr_) _Releases_lock_(_Curr_) PERESOURCE Resource)

BOOLEAN FLTAPI	FltIsOperationSynchronous (_In_ PFLT_CALLBACK_DATA CallbackData)

PCHAR FLTAPI	FltGetIrpName (_In_ UCHAR IrpMajorCode)

_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_ BOOLEAN	_In_reads_bytes_opt_ (EaListLength) PVOID EaList

_Must_inspect_result_	_When_ (((CallbackData!=NULL) &&FLT_IS_IRP_OPERATION(CallbackData)), _IRQL_requires_max_(PASSIVE_LEVEL)) _When_((!((CallbackData!

_Must_inspect_result_	_IRQL_requires_max_ (DPC_LEVEL) PVOID FLTAPI FltGetNewSystemBufferAddress(_In_ PFLT_CALLBACK_DATA CallbackData)

BOOLEAN FLTAPI	FltOplockKeysEqual (_In_opt_ PFILE_OBJECT Fo1, _In_opt_ PFILE_OBJECT Fo2)

Variables
_Must_inspect_result_ _In_ USHORT	NewSize

_Must_inspect_result_ _In_opt_ PFILE_OBJECT	FileObject

_Must_inspect_result_ _In_ CONST FLT_REGISTRATION *	Registration

_Must_inspect_result_ _In_ CONST FLT_REGISTRATION _Outptr_ PFLT_FILTER *	RetFilter

_In_ FLT_PREOP_CALLBACK_STATUS	CallbackStatus

_In_ FLT_PREOP_CALLBACK_STATUS _In_opt_ PVOID	Context

_Must_inspect_result_ _In_ PFLT_GET_OPERATION_STATUS_CALLBACK	CallbackRoutine

_Must_inspect_result_ _In_ PFLT_GET_OPERATION_STATUS_CALLBACK _In_opt_ PVOID	RequesterContext

_In_ PVOID	Buffer

_In_ PVOID _In_ ULONG	Tag

_Must_inspect_result_ _In_ FLT_FILE_NAME_OPTIONS	NameOptions

_Must_inspect_result_ _In_ FLT_FILE_NAME_OPTIONS _Outptr_ PFLT_FILE_NAME_INFORMATION *	FileNameInformation

_Must_inspect_result_ _In_opt_ PFLT_INSTANCE	Instance

_Inout_opt_ PUNICODE_STRING	Extension

_Inout_opt_ PUNICODE_STRING _Inout_opt_ PUNICODE_STRING	Stream

_Inout_opt_ PUNICODE_STRING _Inout_opt_ PUNICODE_STRING _Inout_opt_ PUNICODE_STRING	FinalComponent

_Must_inspect_result_ _In_ PFLT_FILE_NAME_INFORMATION _Outptr_result_maybenull_ PFLT_FILE_NAME_INFORMATION *	RetTunneledFileNameInformation

_Must_inspect_result_ _Inout_opt_ PUNICODE_STRING	VolumeName

_Must_inspect_result_ _Inout_opt_ PUNICODE_STRING _Out_opt_ PULONG	BufferSizeNeeded

_Must_inspect_result_ _In_ PFILE_OBJECT _In_opt_ HANDLE	RootDirectory

_Must_inspect_result_ _In_ PFILE_OBJECT _In_opt_ HANDLE _In_ ULONG	FileNameLength

_Must_inspect_result_ _In_ PFILE_OBJECT _In_opt_ HANDLE _In_ ULONG _In_ FLT_FILE_NAME_OPTIONS _Outptr_ PFLT_FILE_NAME_INFORMATION *	RetFileNameInformation

_Must_inspect_result_ _In_ PFLT_INSTANCE _Out_ PBOOLEAN	IsDirectory

_Must_inspect_result_ _Inout_ PFLT_VOLUME	Volume

_Must_inspect_result_ _Inout_ PFLT_VOLUME _In_opt_ PCUNICODE_STRING	InstanceName

_Must_inspect_result_ _Inout_ PFLT_VOLUME _In_opt_ PCUNICODE_STRING _Outptr_opt_result_maybenull_ PFLT_INSTANCE *	RetInstance

_Must_inspect_result_ _Inout_ PFLT_VOLUME _In_ PCUNICODE_STRING	Altitude

_Must_inspect_result_ _In_opt_ PFILE_OBJECT _Outptr_ PFLT_CALLBACK_DATA *	RetNewCallbackData

_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE	FileHandle

_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE _In_ ACCESS_MASK	DesiredAccess

_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE _In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES	ObjectAttributes

_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE _In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _Out_ PIO_STATUS_BLOCK	IoStatusBlock

_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE _In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _Out_ PIO_STATUS_BLOCK _In_opt_ PLARGE_INTEGER	AllocationSize

_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE _In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _Out_ PIO_STATUS_BLOCK _In_opt_ PLARGE_INTEGER _In_ ULONG	FileAttributes

_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE _In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _Out_ PIO_STATUS_BLOCK _In_opt_ PLARGE_INTEGER _In_ ULONG _In_ ULONG	ShareAccess

_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE _In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _Out_ PIO_STATUS_BLOCK _In_opt_ PLARGE_INTEGER _In_ ULONG _In_ ULONG _In_ ULONG	CreateDisposition

_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE _In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _Out_ PIO_STATUS_BLOCK _In_opt_ PLARGE_INTEGER _In_ ULONG _In_ ULONG _In_ ULONG _In_ ULONG	CreateOptions

_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE _In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _Out_ PIO_STATUS_BLOCK _In_opt_ PLARGE_INTEGER _In_ ULONG _In_ ULONG _In_ ULONG _In_ ULONG _In_ ULONG	EaLength

_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE _In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _Out_ PIO_STATUS_BLOCK _In_opt_ PLARGE_INTEGER _In_ ULONG _In_ ULONG _In_ ULONG _In_ ULONG _In_ ULONG _In_ ULONG	Flags

_Must_inspect_result_ _In_ PFILE_OBJECT _In_opt_ PLARGE_INTEGER	ByteOffset

_Must_inspect_result_ _In_ PFILE_OBJECT _In_opt_ PLARGE_INTEGER _In_ ULONG	Length

_Must_inspect_result_ _In_ PFILE_OBJECT _In_opt_ PLARGE_INTEGER _In_ ULONG _In_ FLT_IO_OPERATION_FLAGS _Out_opt_ PULONG	BytesRead

_Must_inspect_result_ _In_ PFILE_OBJECT _In_opt_ PLARGE_INTEGER _In_ ULONG _In_ FLT_IO_OPERATION_FLAGS _Out_opt_ PULONG _In_opt_ PFLT_COMPLETED_ASYNC_IO_CALLBACK _In_opt_ PVOID	CallbackContext

_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG	FileTag

_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_opt_ GUID *	Guid

_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_opt_ GUID _In_ USHORT	DataBufferLength

_Must_inspect_result_ _In_ PFILE_OBJECT _In_opt_ PLARGE_INTEGER _In_ ULONG _In_ FLT_IO_OPERATION_FLAGS _Out_opt_ PULONG	BytesWritten

_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_ FILE_INFORMATION_CLASS	FileInformationClass

_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_ FILE_INFORMATION_CLASS _Out_opt_ PULONG	LengthReturned

_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_ FS_INFORMATION_CLASS	FsInformationClass

_Must_inspect_result_ _In_ PFILE_OBJECT _In_ SECURITY_INFORMATION	SecurityInformation

_Must_inspect_result_ _In_ PFILE_OBJECT _In_ SECURITY_INFORMATION _In_ ULONG _Out_opt_ PULONG	LengthNeeded

_Must_inspect_result_ _In_ PFILE_OBJECT _In_ SECURITY_INFORMATION _In_ PSECURITY_DESCRIPTOR	SecurityDescriptor

_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG	FsControlCode

_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_ ULONG	InputBufferLength

_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_ ULONG _In_ ULONG	OutputBufferLength

_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG	IoControlCode

_Must_inspect_result_ _In_ FLT_CONTEXT_TYPE	ContextType

_Must_inspect_result_ _In_ FLT_CONTEXT_TYPE _In_ SIZE_T	ContextSize

_Must_inspect_result_ _In_ FLT_CONTEXT_TYPE _In_ SIZE_T _In_ POOL_TYPE	PoolType

_In_ FLT_CONTEXT_TYPE	DesiredContexts

_In_ FLT_CONTEXT_TYPE _Out_ PFLT_RELATED_CONTEXTS	Contexts

_In_ FLT_SET_CONTEXT_OPERATION	Operation

_In_ FLT_SET_CONTEXT_OPERATION _In_ PFLT_CONTEXT	NewContext

_In_ FLT_SET_CONTEXT_OPERATION _In_ PFLT_CONTEXT _Outptr_opt_result_maybenull_ PFLT_CONTEXT *	OldContext

_In_ PCUNICODE_STRING _Outptr_ PFLT_VOLUME *	RetVolume

_In_ PDEVICE_OBJECT	DeviceObject

_Outptr_ PDEVICE_OBJECT *	DiskDeviceObject

_Outptr_ PFLT_INSTANCE *	LowerInstance

_Outptr_ PFLT_INSTANCE *	UpperInstance

_In_ FILTER_INFORMATION_CLASS	InformationClass

_In_ FILTER_INFORMATION_CLASS _In_ ULONG	BufferSize

_In_ FILTER_INFORMATION_CLASS _In_ ULONG _Out_ PULONG	BytesReturned

_In_ ULONG	VolumePropertiesLength

_Must_inspect_result_ _Out_ PBOOLEAN	IsWritable

_Must_inspect_result_ _Out_ PUNICODE_STRING	VolumeGuidName

_Must_inspect_result_ _Out_ PIO_STATUS_BLOCK	Iosb

_Must_inspect_result_ NumberFiltersReturned PFLT_FILTER	FilterList

_Must_inspect_result_ *NumberFiltersReturned PFLT_FILTER _In_ ULONG	FilterListSize

_Must_inspect_result_ *NumberFiltersReturned PFLT_FILTER _In_ ULONG _Out_ PULONG	NumberFiltersReturned

_Must_inspect_result_ _In_ ULONG	VolumeListSize

_Must_inspect_result_ _In_ ULONG _Out_ PULONG	NumberVolumesReturned

_Must_inspect_result_ _In_opt_ PFLT_FILTER	Filter

_Must_inspect_result_ _In_opt_ PFLT_FILTER _In_ ULONG	InstanceListSize

_Must_inspect_result_ _In_opt_ PFLT_FILTER _In_ ULONG _Out_ PULONG	NumberInstancesReturned

_Must_inspect_result_ _In_ ULONG	Index

_Must_inspect_result_ _Outptr_ PFLT_PORT *	ServerPort

_Must_inspect_result_ _Outptr_ PFLT_PORT _In_ POBJECT_ATTRIBUTES _In_opt_ PVOID	ServerPortCookie

_Must_inspect_result_ _Outptr_ PFLT_PORT _In_ POBJECT_ATTRIBUTES _In_opt_ PVOID _In_ PFLT_CONNECT_NOTIFY	ConnectNotifyCallback

_Must_inspect_result_ _Outptr_ PFLT_PORT _In_ POBJECT_ATTRIBUTES _In_opt_ PVOID _In_ PFLT_CONNECT_NOTIFY _In_ PFLT_DISCONNECT_NOTIFY	DisconnectNotifyCallback

_Must_inspect_result_ _Outptr_ PFLT_PORT _In_ POBJECT_ATTRIBUTES _In_opt_ PVOID _In_ PFLT_CONNECT_NOTIFY _In_ PFLT_DISCONNECT_NOTIFY _In_opt_ PFLT_MESSAGE_NOTIFY	MessageNotifyCallback

_Must_inspect_result_ _Outptr_ PFLT_PORT _In_ POBJECT_ATTRIBUTES _In_opt_ PVOID _In_ PFLT_CONNECT_NOTIFY _In_ PFLT_DISCONNECT_NOTIFY _In_opt_ PFLT_MESSAGE_NOTIFY _In_ LONG	MaxConnections

_Outptr_ PFLT_PORT *	ClientPort

_Must_inspect_result_ _In_ PFLT_PORT _In_ ULONG	SenderBufferLength

_Must_inspect_result_ _In_ PFLT_PORT _In_ ULONG _Out_writes_bytes_opt_ ReplyLength PVOID	ReplyBuffer

_Must_inspect_result_ _In_ PFLT_PORT _In_ ULONG _Out_writes_bytes_opt_ ReplyLength PVOID _Inout_opt_ PULONG	ReplyLength

_Must_inspect_result_ _In_ PFLT_PORT _In_ ULONG _Out_writes_bytes_opt_ ReplyLength PVOID _Inout_opt_ PULONG _In_opt_ PLARGE_INTEGER	Timeout

_In_ PFLT_COMPLETE_CANCELED_CALLBACK	CanceledCallback

_Must_inspect_result_ _In_ PFLT_CALLBACK_DATA	Data

_Must_inspect_result_ _In_ PFLT_CALLBACK_DATA _In_ PFLT_DEFERRED_IO_WORKITEM_ROUTINE	WorkerRoutine

_Must_inspect_result_ _In_ PFLT_CALLBACK_DATA _In_ PFLT_DEFERRED_IO_WORKITEM_ROUTINE _In_ WORK_QUEUE_TYPE	QueueType

_Must_inspect_result_ _In_ PVOID	FltObject

_Must_inspect_result_ _In_ PFLT_CALLBACK_DATA	CallbackData

_Must_inspect_result_ _In_ PFLT_CALLBACK_DATA _In_ ULONG	OpenCount

_Must_inspect_result_ _In_ PFLT_CALLBACK_DATA _In_opt_ PVOID _In_opt_ PFLTOPLOCK_WAIT_COMPLETE_ROUTINE	WaitCompletionRoutine

_Must_inspect_result_ _In_ PFLT_CALLBACK_DATA _In_opt_ PVOID _In_opt_ PFLTOPLOCK_WAIT_COMPLETE_ROUTINE _In_opt_ PFLTOPLOCK_PREPOST_CALLBACKDATA_ROUTINE	PrePostCallbackDataRoutine

_Must_inspect_result_ _In_opt_ PUNLOCK_ROUTINE	UnlockRoutine

_Inout_ PLIST_ENTRY	NotifyList

_Inout_ PLIST_ENTRY _In_ PVOID	FsContext

_Inout_ PLIST_ENTRY _In_ PVOID _In_ PSTRING	FullDirectoryName

_Inout_ PLIST_ENTRY _In_ PVOID _In_ PSTRING _In_ BOOLEAN	WatchTree

_Inout_ PLIST_ENTRY _In_ PVOID _In_ PSTRING _In_ BOOLEAN _In_ BOOLEAN	IgnoreBuffer

_Inout_ PLIST_ENTRY _In_ PVOID _In_ PSTRING _In_ BOOLEAN _In_ BOOLEAN _In_ ULONG	CompletionFilter

_Inout_ PLIST_ENTRY _In_ PVOID _In_ PSTRING _In_ BOOLEAN _In_ BOOLEAN _In_ ULONG _In_ PFLT_CALLBACK_DATA	NotifyCallbackData

_Inout_ PLIST_ENTRY _In_ PVOID _In_ PSTRING _In_ BOOLEAN _In_ BOOLEAN _In_ ULONG _In_ PFLT_CALLBACK_DATA _In_opt_ PCHECK_FOR_TRAVERSE_ACCESS	TraverseCallback

_Inout_ PLIST_ENTRY _In_ PVOID _In_ PSTRING _In_ BOOLEAN _In_ BOOLEAN _In_ ULONG _In_ PFLT_CALLBACK_DATA _In_opt_ PCHECK_FOR_TRAVERSE_ACCESS _In_opt_ PSECURITY_SUBJECT_CONTEXT	SubjectContext

_Inout_ PLIST_ENTRY _In_ PVOID _In_ PSTRING _In_ BOOLEAN _In_ BOOLEAN _In_ ULONG _In_ PFLT_CALLBACK_DATA _In_opt_ PCHECK_FOR_TRAVERSE_ACCESS _In_opt_ PSECURITY_SUBJECT_CONTEXT _In_opt_ PFILTER_REPORT_CHANGE	FilterCallback

_Must_inspect_result_ _Out_ PHANDLE	VolumeHandle

_Must_inspect_result_ _Out_ PHANDLE _Outptr_opt_ PFILE_OBJECT *	VolumeFileObject

_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_ BOOLEAN	ReturnSingleEntry

_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_ BOOLEAN _In_ ULONG	EaListLength

_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_ BOOLEAN _In_ ULONG _In_opt_ PULONG	EaIndex

_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_ BOOLEAN _In_ ULONG _In_opt_ PULONG _In_ BOOLEAN	RestartScan

_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE _Outptr_opt_ PFILE_OBJECT _In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _Out_ PIO_STATUS_BLOCK _In_opt_ PLARGE_INTEGER _In_ ULONG _In_ ULONG _In_ ULONG _In_ ULONG _In_ ULONG _In_ ULONG _In_opt_ PIO_DRIVER_CREATE_CONTEXT	DriverContext

_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_ FILE_INFORMATION_CLASS _In_ BOOLEAN _In_opt_ PUNICODE_STRING	FileName

_In_ PKTRANSACTION	Transaction

_Out_ PFLT_FILESYSTEM_TYPE	FileSystemType

_Must_inspect_result_ _Out_ PBOOLEAN	IsSnapshotVolume

_Must_inspect_result_ _In_ PKTRANSACTION _In_ PFLT_CONTEXT	TransactionContext

_Must_inspect_result_ _In_ PKTRANSACTION _In_ PFLT_CONTEXT _In_ NOTIFICATION_MASK	NotificationMask

_Must_inspect_result_ _In_ FSRTL_ALLOCATE_ECPLIST_FLAGS _Outptr_ PECP_LIST *	EcpList

_Must_inspect_result_ _In_ LPCGUID	EcpType

_Must_inspect_result_ _In_ LPCGUID ULONG	SizeOfContext

_Must_inspect_result_ _In_ LPCGUID ULONG _In_ FSRTL_ALLOCATE_ECP_FLAGS _In_opt_ PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK	CleanupCallback

_Must_inspect_result_ _In_ LPCGUID ULONG _In_ FSRTL_ALLOCATE_ECP_FLAGS _In_opt_ PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK _In_ ULONG	PoolTag

_Must_inspect_result_ _In_ LPCGUID ULONG _In_ FSRTL_ALLOCATE_ECP_FLAGS _In_opt_ PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK _In_ ULONG _Outptr_ PVOID *	EcpContext

_Inout_ PVOID	Lookaside

_Inout_ PVOID _In_ FSRTL_ECP_LOOKASIDE_FLAGS _In_ SIZE_T	Size

_Must_inspect_result_ _In_ LPCGUID _In_ ULONG _In_ FSRTL_ALLOCATE_ECP_FLAGS _In_opt_ PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK _Inout_ PVOID	LookasideList

_In_ PECP_LIST _In_ LPCGUID _Outptr_opt_ PVOID _Out_opt_ ULONG *	EcpContextSize

_In_ PECP_LIST _In_opt_ PVOID	CurrentEcpContext

_In_ PECP_LIST _In_opt_ PVOID _Out_opt_ LPGUID	NextEcpType

_In_ PECP_LIST _In_opt_ PVOID _Out_opt_ LPGUID _Outptr_opt_ PVOID *	NextEcpContext

_In_ PECP_LIST _In_opt_ PVOID _Out_opt_ LPGUID _Outptr_opt_ PVOID _Out_opt_ ULONG *	NextEcpContextSize

_In_opt_ PFILE_OBJECT _In_opt_ PETHREAD	Thread

_In_opt_ PFILE_OBJECT _In_opt_ PETHREAD _Inout_ PIO_PRIORITY_INFO	PriorityInfo

_Out_opt_ PIO_PRIORITY_INFO	OutputPriorityInfo

_In_ IO_PRIORITY_HINT	PriorityHint

_Must_inspect_result_ _Out_ PULONG	SessionId

_In_ PFLT_INSTANCE	TargetInstance

_In_ PFLT_INSTANCE _Out_opt_ PBOOLEAN	SourceDeviceStackSizeModified

_In_ PFLT_INSTANCE _Out_ PBOOLEAN	RedirectionAllowed

_In_ PFLT_INSTANCE _Out_ PBOOLEAN	RedirectionAllowedThisIo

_In_ PFLT_INSTANCE _Out_ PBOOLEAN _Out_opt_ PBOOLEAN	RedirectionAllowedAllIo

Macro Definition Documentation

◆ FLTKERNEL

#define __FLTKERNEL__

Definition at line 23 of file fltkernel.h.

◆ Add2Ptr

#define Add2Ptr	(	P,
		I
	)	((PVOID)((PUCHAR)(P) + (I)))

Definition at line 56 of file fltkernel.h.

◆ FLT_ALL_CONTEXTS

#define FLT_ALL_CONTEXTS

Value:

                          (FLT_VOLUME_CONTEXT | FLT_INSTANCE_CONTEXT | \
                          FLT_FILE_CONTEXT | FLT_STREAM_CONTEXT |     \
                          FLT_STREAMHANDLE_CONTEXT | FLT_TRANSACTION_CONTEXT)

Definition at line 446 of file fltkernel.h.

◆ FLT_ALLOCATE_CALLBACK_DATA_PREALLOCATE_ALL_MEMORY

#define FLT_ALLOCATE_CALLBACK_DATA_PREALLOCATE_ALL_MEMORY 0x00000001

Definition at line 454 of file fltkernel.h.

◆ FLT_ASSERT

#define FLT_ASSERT ( _e ) NT_ASSERT(_e)

Definition at line 49 of file fltkernel.h.

◆ FLT_ASSERTMSG

#define FLT_ASSERTMSG	(	_m,
		_e
	)	NT_ASSERTMSG(_m, _e)

Definition at line 50 of file fltkernel.h.

◆ FLT_CLEAR_CALLBACK_DATA_DIRTY

#define FLT_CLEAR_CALLBACK_DATA_DIRTY ( Data ) FltClearCallbackDataDirty(Data)

Definition at line 427 of file fltkernel.h.

◆ FLT_CONTEXT_END

#define FLT_CONTEXT_END 0xffff

Definition at line 444 of file fltkernel.h.

◆ FLT_FILE_CONTEXT

#define FLT_FILE_CONTEXT 0x0004

Definition at line 440 of file fltkernel.h.

◆ FLT_FILE_NAME_ALLOW_QUERY_ON_REPARSE

#define FLT_FILE_NAME_ALLOW_QUERY_ON_REPARSE 0x04000000

Definition at line 795 of file fltkernel.h.

◆ FLT_FILE_NAME_DO_NOT_CACHE

#define FLT_FILE_NAME_DO_NOT_CACHE 0x02000000

Definition at line 792 of file fltkernel.h.

◆ FLT_FILE_NAME_NORMALIZED

#define FLT_FILE_NAME_NORMALIZED 0x01

Definition at line 774 of file fltkernel.h.

◆ FLT_FILE_NAME_OPENED

#define FLT_FILE_NAME_OPENED 0x02

Definition at line 775 of file fltkernel.h.

◆ FLT_FILE_NAME_QUERY_ALWAYS_ALLOW_CACHE_LOOKUP

#define FLT_FILE_NAME_QUERY_ALWAYS_ALLOW_CACHE_LOOKUP 0x0400

Definition at line 785 of file fltkernel.h.

◆ FLT_FILE_NAME_QUERY_CACHE_ONLY

#define FLT_FILE_NAME_QUERY_CACHE_ONLY 0x0200

Definition at line 783 of file fltkernel.h.

◆ FLT_FILE_NAME_QUERY_DEFAULT

#define FLT_FILE_NAME_QUERY_DEFAULT 0x0100

Definition at line 782 of file fltkernel.h.

◆ FLT_FILE_NAME_QUERY_FILESYSTEM_ONLY

#define FLT_FILE_NAME_QUERY_FILESYSTEM_ONLY 0x0300

Definition at line 784 of file fltkernel.h.

◆ FLT_FILE_NAME_REQUEST_FROM_CURRENT_PROVIDER

#define FLT_FILE_NAME_REQUEST_FROM_CURRENT_PROVIDER 0x01000000

Definition at line 791 of file fltkernel.h.

◆ FLT_FILE_NAME_SHORT

#define FLT_FILE_NAME_SHORT 0x03

Definition at line 776 of file fltkernel.h.

◆ FLT_INSTANCE_CONTEXT

#define FLT_INSTANCE_CONTEXT 0x0002

Definition at line 439 of file fltkernel.h.

◆ FLT_INTERNAL_OPERATION_COUNT

#define FLT_INTERNAL_OPERATION_COUNT 22

Definition at line 80 of file fltkernel.h.

◆ FLT_IS_CALLBACK_DATA_DIRTY

#define FLT_IS_CALLBACK_DATA_DIRTY ( Data ) FltIsCallbackDataDirty(Data)

Definition at line 428 of file fltkernel.h.

◆ FLT_IS_FASTIO_OPERATION

#define FLT_IS_FASTIO_OPERATION ( Data ) (FlagOn((Data)->Flags, FLTFL_CALLBACK_DATA_FAST_IO_OPERATION))

Definition at line 431 of file fltkernel.h.

◆ FLT_IS_FS_FILTER_OPERATION

#define FLT_IS_FS_FILTER_OPERATION ( Data ) (FlagOn((Data)->Flags, FLTFL_CALLBACK_DATA_FS_FILTER_OPERATION))

Definition at line 432 of file fltkernel.h.

◆ FLT_IS_IRP_OPERATION

#define FLT_IS_IRP_OPERATION ( Data ) (FlagOn((Data)->Flags, FLTFL_CALLBACK_DATA_IRP_OPERATION))

Definition at line 430 of file fltkernel.h.

◆ FLT_IS_REISSUED_IO

#define FLT_IS_REISSUED_IO ( Data ) (FlagOn((Data)->Flags, FLTFL_CALLBACK_DATA_REISSUED_IO))

Definition at line 433 of file fltkernel.h.

◆ FLT_IS_SYSTEM_BUFFER

#define FLT_IS_SYSTEM_BUFFER ( Data ) (FlagOn((Data)->Flags, FLTFL_CALLBACK_DATA_SYSTEM_BUFFER))

Definition at line 434 of file fltkernel.h.

◆ FLT_MAX_TRANSACTION_NOTIFICATIONS

#define FLT_MAX_TRANSACTION_NOTIFICATIONS

Value:

                                           (TRANSACTION_NOTIFY_PREPREPARE | \
                                           TRANSACTION_NOTIFY_PREPARE |    \
                                           TRANSACTION_NOTIFY_COMMIT |     \
                                           TRANSACTION_NOTIFY_ROLLBACK |   \
                                           TRANSACTION_NOTIFY_COMMIT_FINALIZE)

Definition at line 537 of file fltkernel.h.

◆ FLT_MGR_AFTER_XPSP2

#define FLT_MGR_AFTER_XPSP2

Value:

                             (((OSVER(NTDDI_VERSION) == NTDDI_WIN2K) && (SPVER(NTDDI_VERSION) >= SPVER(NTDDI_WIN2KSP4))) || \
                             ((OSVER(NTDDI_VERSION) == NTDDI_WINXP) && (SPVER(NTDDI_VERSION) >  SPVER(NTDDI_WINXPSP2))) || \
                             ((OSVER(NTDDI_VERSION) == NTDDI_WS03)  && (SPVER(NTDDI_VERSION) >= SPVER(NTDDI_WS03SP1)))  || \
                             (NTDDI_VERSION >= NTDDI_VISTA))

Definition at line 34 of file fltkernel.h.

◆ FLT_MGR_BASELINE

#define FLT_MGR_BASELINE

Value:

                          (((OSVER(NTDDI_VERSION) == NTDDI_WIN2K) && (SPVER(NTDDI_VERSION) >= SPVER(NTDDI_WIN2KSP4))) || \
                          ((OSVER(NTDDI_VERSION) == NTDDI_WINXP) && (SPVER(NTDDI_VERSION) >= SPVER(NTDDI_WINXPSP2))) || \
                          ((OSVER(NTDDI_VERSION) == NTDDI_WS03)  && (SPVER(NTDDI_VERSION) >= SPVER(NTDDI_WS03SP1)))  || \
                          (NTDDI_VERSION >= NTDDI_VISTA))

Definition at line 29 of file fltkernel.h.

◆ FLT_MGR_LONGHORN

#define FLT_MGR_LONGHORN (NTDDI_VERSION >= NTDDI_VISTA)

Definition at line 39 of file fltkernel.h.

◆ FLT_MGR_WIN7

#define FLT_MGR_WIN7 (NTDDI_VERSION >= NTDDI_WIN7)

Definition at line 40 of file fltkernel.h.

◆ FLT_PORT_ALL_ACCESS

#define FLT_PORT_ALL_ACCESS (FLT_PORT_CONNECT | STANDARD_RIGHTS_ALL)

Definition at line 836 of file fltkernel.h.

◆ FLT_PORT_CONNECT

#define FLT_PORT_CONNECT 0x0001

Definition at line 835 of file fltkernel.h.

◆ FLT_REGISTRATION_VERSION

#define FLT_REGISTRATION_VERSION FLT_REGISTRATION_VERSION_0202

Definition at line 718 of file fltkernel.h.

◆ FLT_REGISTRATION_VERSION_0200

#define FLT_REGISTRATION_VERSION_0200 0x0200

Definition at line 712 of file fltkernel.h.

◆ FLT_REGISTRATION_VERSION_0201

#define FLT_REGISTRATION_VERSION_0201 0x0201

Definition at line 713 of file fltkernel.h.

◆ FLT_REGISTRATION_VERSION_0202

#define FLT_REGISTRATION_VERSION_0202 0x0202

Definition at line 714 of file fltkernel.h.

◆ FLT_REGISTRATION_VERSION_0203

#define FLT_REGISTRATION_VERSION_0203 0x0203

Definition at line 715 of file fltkernel.h.

◆ FLT_SET_CALLBACK_DATA_DIRTY

#define FLT_SET_CALLBACK_DATA_DIRTY ( Data ) FltSetCallbackDataDirty(Data)

Definition at line 426 of file fltkernel.h.

◆ FLT_STREAM_CONTEXT

#define FLT_STREAM_CONTEXT 0x0008

Definition at line 441 of file fltkernel.h.

◆ FLT_STREAMHANDLE_CONTEXT

#define FLT_STREAMHANDLE_CONTEXT 0x0010

Definition at line 442 of file fltkernel.h.

◆ FLT_TAG_DATA_BUFFER_HEADER_SIZE

#define FLT_TAG_DATA_BUFFER_HEADER_SIZE FIELD_OFFSET(FLT_TAG_DATA_BUFFER, GenericReparseBuffer)

Definition at line 647 of file fltkernel.h.

◆ FLT_TRANSACTION_CONTEXT

#define FLT_TRANSACTION_CONTEXT 0x0020

Definition at line 443 of file fltkernel.h.

◆ FLT_VALID_FILE_NAME_FLAGS

#define FLT_VALID_FILE_NAME_FLAGS 0xff000000

Definition at line 789 of file fltkernel.h.

◆ FLT_VALID_FILE_NAME_FORMATS

#define FLT_VALID_FILE_NAME_FORMATS 0x000000ff

Definition at line 772 of file fltkernel.h.

◆ FLT_VALID_FILE_NAME_QUERY_METHODS

#define FLT_VALID_FILE_NAME_QUERY_METHODS 0x0000ff00

Definition at line 780 of file fltkernel.h.

◆ FLT_VARIABLE_SIZED_CONTEXTS

#define FLT_VARIABLE_SIZED_CONTEXTS ((SIZE_T)-1)

Definition at line 513 of file fltkernel.h.

◆ FLT_VOLUME_CONTEXT

#define FLT_VOLUME_CONTEXT 0x0001

Definition at line 438 of file fltkernel.h.

◆ FLTFL_CALLBACK_DATA_DIRTY

#define FLTFL_CALLBACK_DATA_DIRTY 0x80000000

Definition at line 424 of file fltkernel.h.

◆ FLTFL_CALLBACK_DATA_DRAINING_IO

#define FLTFL_CALLBACK_DATA_DRAINING_IO 0x00040000

Definition at line 421 of file fltkernel.h.

◆ FLTFL_CALLBACK_DATA_FAST_IO_OPERATION

#define FLTFL_CALLBACK_DATA_FAST_IO_OPERATION 0x00000002

Definition at line 416 of file fltkernel.h.

◆ FLTFL_CALLBACK_DATA_FS_FILTER_OPERATION

#define FLTFL_CALLBACK_DATA_FS_FILTER_OPERATION 0x00000004

Definition at line 417 of file fltkernel.h.

◆ FLTFL_CALLBACK_DATA_GENERATED_IO

#define FLTFL_CALLBACK_DATA_GENERATED_IO 0x00010000

Definition at line 419 of file fltkernel.h.

◆ FLTFL_CALLBACK_DATA_IRP_OPERATION

#define FLTFL_CALLBACK_DATA_IRP_OPERATION 0x00000001

Definition at line 415 of file fltkernel.h.

◆ FLTFL_CALLBACK_DATA_NEW_SYSTEM_BUFFER

#define FLTFL_CALLBACK_DATA_NEW_SYSTEM_BUFFER 0x00100000

Definition at line 423 of file fltkernel.h.

◆ FLTFL_CALLBACK_DATA_POST_OPERATION

#define FLTFL_CALLBACK_DATA_POST_OPERATION 0x00080000

Definition at line 422 of file fltkernel.h.

◆ FLTFL_CALLBACK_DATA_REISSUE_MASK

#define FLTFL_CALLBACK_DATA_REISSUE_MASK 0x0000FFFF

Definition at line 414 of file fltkernel.h.

◆ FLTFL_CALLBACK_DATA_REISSUED_IO

#define FLTFL_CALLBACK_DATA_REISSUED_IO 0x00020000

Definition at line 420 of file fltkernel.h.

◆ FLTFL_CALLBACK_DATA_SYSTEM_BUFFER

#define FLTFL_CALLBACK_DATA_SYSTEM_BUFFER 0x00000008

Definition at line 418 of file fltkernel.h.

◆ FLTFL_CONTEXT_REGISTRATION_NO_EXACT_SIZE_MATCH

#define FLTFL_CONTEXT_REGISTRATION_NO_EXACT_SIZE_MATCH 0x0001

Definition at line 511 of file fltkernel.h.

◆ FLTFL_FILE_NAME_PARSED_EXTENSION

#define FLTFL_FILE_NAME_PARSED_EXTENSION 0x0002

Definition at line 801 of file fltkernel.h.

◆ FLTFL_FILE_NAME_PARSED_FINAL_COMPONENT

#define FLTFL_FILE_NAME_PARSED_FINAL_COMPONENT 0x0001

Definition at line 800 of file fltkernel.h.

◆ FLTFL_FILE_NAME_PARSED_PARENT_DIR

#define FLTFL_FILE_NAME_PARSED_PARENT_DIR 0x0008

Definition at line 803 of file fltkernel.h.

◆ FLTFL_FILE_NAME_PARSED_STREAM

#define FLTFL_FILE_NAME_PARSED_STREAM 0x0004

Definition at line 802 of file fltkernel.h.

◆ FLTFL_FILTER_UNLOAD_MANDATORY

#define FLTFL_FILTER_UNLOAD_MANDATORY 0x00000001

Definition at line 651 of file fltkernel.h.

◆ FLTFL_INSTANCE_SETUP_AUTOMATIC_ATTACHMENT

#define FLTFL_INSTANCE_SETUP_AUTOMATIC_ATTACHMENT 0x00000001

Definition at line 529 of file fltkernel.h.

◆ FLTFL_INSTANCE_SETUP_DETACHED_VOLUME

#define FLTFL_INSTANCE_SETUP_DETACHED_VOLUME 0x00000008

Definition at line 535 of file fltkernel.h.

◆ FLTFL_INSTANCE_SETUP_MANUAL_ATTACHMENT

#define FLTFL_INSTANCE_SETUP_MANUAL_ATTACHMENT 0x00000002

Definition at line 530 of file fltkernel.h.

◆ FLTFL_INSTANCE_SETUP_NEWLY_MOUNTED_VOLUME

#define FLTFL_INSTANCE_SETUP_NEWLY_MOUNTED_VOLUME 0x00000004

Definition at line 531 of file fltkernel.h.

◆ FLTFL_INSTANCE_TEARDOWN_FILTER_UNLOAD

#define FLTFL_INSTANCE_TEARDOWN_FILTER_UNLOAD 0x00000002

Definition at line 562 of file fltkernel.h.

◆ FLTFL_INSTANCE_TEARDOWN_INTERNAL_ERROR

#define FLTFL_INSTANCE_TEARDOWN_INTERNAL_ERROR 0x00000010

Definition at line 565 of file fltkernel.h.

◆ FLTFL_INSTANCE_TEARDOWN_MANDATORY_FILTER_UNLOAD

#define FLTFL_INSTANCE_TEARDOWN_MANDATORY_FILTER_UNLOAD 0x00000004

Definition at line 563 of file fltkernel.h.

◆ FLTFL_INSTANCE_TEARDOWN_MANUAL

#define FLTFL_INSTANCE_TEARDOWN_MANUAL 0x00000001

Definition at line 561 of file fltkernel.h.

◆ FLTFL_INSTANCE_TEARDOWN_VOLUME_DISMOUNT

#define FLTFL_INSTANCE_TEARDOWN_VOLUME_DISMOUNT 0x00000008

Definition at line 564 of file fltkernel.h.

◆ FLTFL_IO_OPERATION_DO_NOT_UPDATE_BYTE_OFFSET

#define FLTFL_IO_OPERATION_DO_NOT_UPDATE_BYTE_OFFSET 0x00000004

Definition at line 757 of file fltkernel.h.

◆ FLTFL_IO_OPERATION_NON_CACHED

#define FLTFL_IO_OPERATION_NON_CACHED 0x00000001

Definition at line 755 of file fltkernel.h.

◆ FLTFL_IO_OPERATION_PAGING

#define FLTFL_IO_OPERATION_PAGING 0x00000002

Definition at line 756 of file fltkernel.h.

◆ FLTFL_IO_OPERATION_SYNCHRONOUS_PAGING

#define FLTFL_IO_OPERATION_SYNCHRONOUS_PAGING 0x00000008

Definition at line 760 of file fltkernel.h.

◆ FLTFL_NORMALIZE_NAME_CASE_SENSITIVE

#define FLTFL_NORMALIZE_NAME_CASE_SENSITIVE 0x01

Definition at line 674 of file fltkernel.h.

◆ FLTFL_NORMALIZE_NAME_DESTINATION_FILE_NAME

#define FLTFL_NORMALIZE_NAME_DESTINATION_FILE_NAME 0x02

Definition at line 675 of file fltkernel.h.

◆ FLTFL_OPERATION_REGISTRATION_SKIP_CACHED_IO

#define FLTFL_OPERATION_REGISTRATION_SKIP_CACHED_IO 0x00000002

Definition at line 606 of file fltkernel.h.

◆ FLTFL_OPERATION_REGISTRATION_SKIP_NON_DASD_IO

#define FLTFL_OPERATION_REGISTRATION_SKIP_NON_DASD_IO 0x00000004

Definition at line 607 of file fltkernel.h.

◆ FLTFL_OPERATION_REGISTRATION_SKIP_PAGING_IO

#define FLTFL_OPERATION_REGISTRATION_SKIP_PAGING_IO 0x00000001

Definition at line 605 of file fltkernel.h.

◆ FLTFL_POST_OPERATION_DRAINING

#define FLTFL_POST_OPERATION_DRAINING 0x00000001

Definition at line 594 of file fltkernel.h.

◆ FLTFL_REGISTRATION_DO_NOT_SUPPORT_SERVICE_STOP

#define FLTFL_REGISTRATION_DO_NOT_SUPPORT_SERVICE_STOP 0x00000001

Definition at line 725 of file fltkernel.h.

◆ FLTFL_REGISTRATION_SUPPORT_NPFS_MSFS

#define FLTFL_REGISTRATION_SUPPORT_NPFS_MSFS 0x00000002

Definition at line 726 of file fltkernel.h.

◆ FltGetFileNameFormat

#define FltGetFileNameFormat ( _NameOptions ) ((_NameOptions) & FLT_VALID_FILE_NAME_FORMATS)

Definition at line 778 of file fltkernel.h.

◆ FltGetFileNameQueryMethod

#define FltGetFileNameQueryMethod ( _NameOptions ) ((_NameOptions) & FLT_VALID_FILE_NAME_QUERY_METHODS)

Definition at line 787 of file fltkernel.h.

◆ IRP_MJ_ACQUIRE_FOR_CC_FLUSH

#define IRP_MJ_ACQUIRE_FOR_CC_FLUSH ((UCHAR)-5)

Definition at line 69 of file fltkernel.h.

◆ IRP_MJ_ACQUIRE_FOR_MOD_WRITE

#define IRP_MJ_ACQUIRE_FOR_MOD_WRITE ((UCHAR)-3)

Definition at line 67 of file fltkernel.h.

◆ IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION

#define IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION ((UCHAR)-1)

Definition at line 65 of file fltkernel.h.

◆ IRP_MJ_FAST_IO_CHECK_IF_POSSIBLE

#define IRP_MJ_FAST_IO_CHECK_IF_POSSIBLE ((UCHAR)-13)

Definition at line 71 of file fltkernel.h.

◆ IRP_MJ_MDL_READ

#define IRP_MJ_MDL_READ ((UCHAR)-15)

Definition at line 73 of file fltkernel.h.

◆ IRP_MJ_MDL_READ_COMPLETE

#define IRP_MJ_MDL_READ_COMPLETE ((UCHAR)-16)

Definition at line 74 of file fltkernel.h.

◆ IRP_MJ_MDL_WRITE_COMPLETE

#define IRP_MJ_MDL_WRITE_COMPLETE ((UCHAR)-18)

Definition at line 76 of file fltkernel.h.

◆ IRP_MJ_NETWORK_QUERY_OPEN

#define IRP_MJ_NETWORK_QUERY_OPEN ((UCHAR)-14)

Definition at line 72 of file fltkernel.h.

◆ IRP_MJ_OPERATION_END

#define IRP_MJ_OPERATION_END ((UCHAR)0x80)

Definition at line 79 of file fltkernel.h.

◆ IRP_MJ_PREPARE_MDL_WRITE

#define IRP_MJ_PREPARE_MDL_WRITE ((UCHAR)-17)

Definition at line 75 of file fltkernel.h.

◆ IRP_MJ_RELEASE_FOR_CC_FLUSH

#define IRP_MJ_RELEASE_FOR_CC_FLUSH ((UCHAR)-6)

Definition at line 70 of file fltkernel.h.

◆ IRP_MJ_RELEASE_FOR_MOD_WRITE

#define IRP_MJ_RELEASE_FOR_MOD_WRITE ((UCHAR)-4)

Definition at line 68 of file fltkernel.h.

◆ IRP_MJ_RELEASE_FOR_SECTION_SYNCHRONIZATION

#define IRP_MJ_RELEASE_FOR_SECTION_SYNCHRONIZATION ((UCHAR)-2)

Definition at line 66 of file fltkernel.h.

◆ IRP_MJ_VOLUME_DISMOUNT

#define IRP_MJ_VOLUME_DISMOUNT ((UCHAR)-20)

Definition at line 78 of file fltkernel.h.

◆ IRP_MJ_VOLUME_MOUNT

#define IRP_MJ_VOLUME_MOUNT ((UCHAR)-19)

Definition at line 77 of file fltkernel.h.

◆ IS_ALIGNED

#define IS_ALIGNED	(	_pointer,
		_alignment
	)	((((ULONG_PTR) (_pointer)) & ((_alignment) - 1)) == 0)

Definition at line 62 of file fltkernel.h.

◆ NULL_CONTEXT

#define NULL_CONTEXT ((PFLT_CONTEXT)NULL)

Definition at line 82 of file fltkernel.h.

◆ PtrOffset

#define PtrOffset	(	B,
		O
	)	((ULONG)((ULONG_PTR)(O) - (ULONG_PTR)(B)))

Definition at line 57 of file fltkernel.h.

◆ ROUND_TO_SIZE

#define ROUND_TO_SIZE	(	_length,
		_alignment
	)	((((ULONG_PTR)(_length)) + ((_alignment)-1)) & ~(ULONG_PTR) ((_alignment) - 1))

Definition at line 59 of file fltkernel.h.

Typedef Documentation

◆ FLT_ALLOCATE_CALLBACK_DATA_FLAGS

typedef ULONG FLT_ALLOCATE_CALLBACK_DATA_FLAGS

Definition at line 453 of file fltkernel.h.

◆ FLT_CALLBACK_DATA

typedef struct _FLT_CALLBACK_DATA FLT_CALLBACK_DATA

◆ FLT_CALLBACK_DATA_FLAGS

typedef ULONG FLT_CALLBACK_DATA_FLAGS

Definition at line 450 of file fltkernel.h.

◆ FLT_CALLBACK_DATA_QUEUE

typedef struct _FLT_CALLBACK_DATA_QUEUE FLT_CALLBACK_DATA_QUEUE

Definition at line 880 of file fltkernel.h.

◆ FLT_CALLBACK_DATA_QUEUE_FLAGS

typedef ULONG FLT_CALLBACK_DATA_QUEUE_FLAGS

Definition at line 914 of file fltkernel.h.

◆ FLT_CALLBACK_DATA_QUEUE_IO_CONTEXT

typedef IO_CSQ_IRP_CONTEXT FLT_CALLBACK_DATA_QUEUE_IO_CONTEXT

Definition at line 878 of file fltkernel.h.

◆ FLT_CONTEXT_REGISTRATION

typedef struct _FLT_CONTEXT_REGISTRATION FLT_CONTEXT_REGISTRATION

◆ FLT_CONTEXT_REGISTRATION_FLAGS

typedef USHORT FLT_CONTEXT_REGISTRATION_FLAGS

Definition at line 509 of file fltkernel.h.

◆ FLT_CONTEXT_TYPE

typedef USHORT FLT_CONTEXT_TYPE

Definition at line 436 of file fltkernel.h.

◆ FLT_FILE_NAME_INFORMATION

typedef struct _FLT_FILE_NAME_INFORMATION FLT_FILE_NAME_INFORMATION

◆ FLT_FILE_NAME_OPTIONS

typedef ULONG FLT_FILE_NAME_OPTIONS

Definition at line 661 of file fltkernel.h.

◆ FLT_FILE_NAME_PARSED_FLAGS

typedef USHORT FLT_FILE_NAME_PARSED_FLAGS

Definition at line 798 of file fltkernel.h.

◆ FLT_FILTER_UNLOAD_FLAGS

typedef ULONG FLT_FILTER_UNLOAD_FLAGS

Definition at line 649 of file fltkernel.h.

◆ FLT_INSTANCE_QUERY_TEARDOWN_FLAGS

typedef ULONG FLT_INSTANCE_QUERY_TEARDOWN_FLAGS

Definition at line 552 of file fltkernel.h.

◆ FLT_INSTANCE_SETUP_FLAGS

typedef ULONG FLT_INSTANCE_SETUP_FLAGS

Definition at line 527 of file fltkernel.h.

◆ FLT_INSTANCE_TEARDOWN_FLAGS

typedef ULONG FLT_INSTANCE_TEARDOWN_FLAGS

Definition at line 559 of file fltkernel.h.

◆ FLT_IO_OPERATION_FLAGS

typedef ULONG FLT_IO_OPERATION_FLAGS

Definition at line 753 of file fltkernel.h.

◆ FLT_IO_PARAMETER_BLOCK

typedef struct _FLT_IO_PARAMETER_BLOCK FLT_IO_PARAMETER_BLOCK

◆ FLT_NAME_CONTROL

typedef struct _FLT_NAME_CONTROL FLT_NAME_CONTROL

◆ FLT_NORMALIZE_NAME_FLAGS

typedef ULONG FLT_NORMALIZE_NAME_FLAGS

Definition at line 672 of file fltkernel.h.

◆ FLT_OPERATION_REGISTRATION

typedef struct _FLT_OPERATION_REGISTRATION FLT_OPERATION_REGISTRATION

◆ FLT_OPERATION_REGISTRATION_FLAGS

typedef ULONG FLT_OPERATION_REGISTRATION_FLAGS

Definition at line 603 of file fltkernel.h.

◆ FLT_PARAMETERS

typedef union _FLT_PARAMETERS FLT_PARAMETERS

◆ FLT_POST_OPERATION_FLAGS

typedef ULONG FLT_POST_OPERATION_FLAGS

Definition at line 592 of file fltkernel.h.

◆ FLT_POSTOP_CALLBACK_STATUS

typedef enum _FLT_POSTOP_CALLBACK_STATUS FLT_POSTOP_CALLBACK_STATUS

◆ FLT_PREOP_CALLBACK_STATUS

typedef enum _FLT_PREOP_CALLBACK_STATUS FLT_PREOP_CALLBACK_STATUS

◆ FLT_REGISTRATION

typedef struct _FLT_REGISTRATION FLT_REGISTRATION

◆ FLT_REGISTRATION_FLAGS

typedef ULONG FLT_REGISTRATION_FLAGS

Definition at line 723 of file fltkernel.h.

◆ FLT_RELATED_CONTEXTS

typedef struct _FLT_RELATED_CONTEXTS FLT_RELATED_CONTEXTS

◆ FLT_RELATED_OBJECTS

typedef struct _FLT_RELATED_OBJECTS FLT_RELATED_OBJECTS

◆ FLT_SET_CONTEXT_OPERATION

typedef enum _FLT_SET_CONTEXT_OPERATION FLT_SET_CONTEXT_OPERATION

◆ FLT_TAG_DATA_BUFFER

typedef struct _FLT_TAG_DATA_BUFFER FLT_TAG_DATA_BUFFER

◆ FLT_VOLUME_PROPERTIES

typedef struct _FLT_VOLUME_PROPERTIES FLT_VOLUME_PROPERTIES

◆ PCFLT_CONTEXT_REGISTRATION

typedef const struct _FLT_CONTEXT_REGISTRATION* PCFLT_CONTEXT_REGISTRATION

Definition at line 525 of file fltkernel.h.

◆ PCFLT_RELATED_OBJECTS

typedef const struct _FLT_RELATED_OBJECTS* PCFLT_RELATED_OBJECTS

Definition at line 482 of file fltkernel.h.

◆ PFLT_CALLBACK_DATA

typedef struct _FLT_CALLBACK_DATA * PFLT_CALLBACK_DATA

◆ PFLT_CALLBACK_DATA_QUEUE

typedef struct _FLT_CALLBACK_DATA_QUEUE * PFLT_CALLBACK_DATA_QUEUE

Definition at line 880 of file fltkernel.h.

◆ PFLT_CALLBACK_DATA_QUEUE_ACQUIRE

typedef VOID(FLTAPI * PFLT_CALLBACK_DATA_QUEUE_ACQUIRE) (_Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _Out_opt_ PKIRQL Irql)

Definition at line 899 of file fltkernel.h.

◆ PFLT_CALLBACK_DATA_QUEUE_COMPLETE_CANCELED_IO

typedef VOID(FLTAPI * PFLT_CALLBACK_DATA_QUEUE_COMPLETE_CANCELED_IO) (_Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _Inout_ PFLT_CALLBACK_DATA Cbd)

Definition at line 909 of file fltkernel.h.

◆ PFLT_CALLBACK_DATA_QUEUE_INSERT_IO

typedef NTSTATUS(FLTAPI * PFLT_CALLBACK_DATA_QUEUE_INSERT_IO) (_Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _In_ PFLT_CALLBACK_DATA Cbd, _In_opt_ PVOID InsertContext)

Definition at line 882 of file fltkernel.h.

◆ PFLT_CALLBACK_DATA_QUEUE_IO_CONTEXT

typedef IO_CSQ_IRP_CONTEXT * PFLT_CALLBACK_DATA_QUEUE_IO_CONTEXT

Definition at line 878 of file fltkernel.h.

◆ PFLT_CALLBACK_DATA_QUEUE_PEEK_NEXT_IO

typedef PFLT_CALLBACK_DATA(FLTAPI * PFLT_CALLBACK_DATA_QUEUE_PEEK_NEXT_IO) (_In_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _In_opt_ PFLT_CALLBACK_DATA Cbd, _In_opt_ PVOID PeekContext)

Definition at line 893 of file fltkernel.h.

◆ PFLT_CALLBACK_DATA_QUEUE_RELEASE

typedef VOID(FLTAPI * PFLT_CALLBACK_DATA_QUEUE_RELEASE) (_Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _In_opt_ KIRQL Irql)

Definition at line 904 of file fltkernel.h.

◆ PFLT_CALLBACK_DATA_QUEUE_REMOVE_IO

typedef VOID(FLTAPI * PFLT_CALLBACK_DATA_QUEUE_REMOVE_IO) (_Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _In_ PFLT_CALLBACK_DATA Cbd)

Definition at line 888 of file fltkernel.h.

◆ PFLT_COMPLETE_CANCELED_CALLBACK

typedef VOID(FLTAPI * PFLT_COMPLETE_CANCELED_CALLBACK) (_In_ PFLT_CALLBACK_DATA CallbackData)

Definition at line 859 of file fltkernel.h.

◆ PFLT_COMPLETE_LOCK_CALLBACK_DATA_ROUTINE

typedef NTSTATUS(* PFLT_COMPLETE_LOCK_CALLBACK_DATA_ROUTINE) (_In_opt_ PVOID Context, _In_ PFLT_CALLBACK_DATA CallbackData)

Definition at line 928 of file fltkernel.h.

◆ PFLT_COMPLETED_ASYNC_IO_CALLBACK

typedef VOID(FLTAPI * PFLT_COMPLETED_ASYNC_IO_CALLBACK) (_In_ PFLT_CALLBACK_DATA CallbackData, _In_ PFLT_CONTEXT Context)

Definition at line 748 of file fltkernel.h.

◆ PFLT_CONNECT_NOTIFY

typedef NTSTATUS(FLTAPI * PFLT_CONNECT_NOTIFY) (_In_ PFLT_PORT ClientPort, _In_opt_ PVOID ServerPortCookie, _In_reads_bytes_opt_(SizeOfContext) PVOID ConnectionContext, _In_ ULONG SizeOfContext, _Outptr_result_maybenull_ PVOID *ConnectionPortCookie)

Definition at line 847 of file fltkernel.h.

◆ PFLT_CONTEXT

typedef PVOID PFLT_CONTEXT

Definition at line 89 of file fltkernel.h.

◆ PFLT_CONTEXT_ALLOCATE_CALLBACK

typedef PVOID(FLTAPI * PFLT_CONTEXT_ALLOCATE_CALLBACK) (_In_ POOL_TYPE PoolType, _In_ SIZE_T Size, _In_ FLT_CONTEXT_TYPE ContextType)

Definition at line 498 of file fltkernel.h.

◆ PFLT_CONTEXT_CLEANUP_CALLBACK

typedef VOID(FLTAPI * PFLT_CONTEXT_CLEANUP_CALLBACK) (_In_ PFLT_CONTEXT Context, _In_ FLT_CONTEXT_TYPE ContextType)

Definition at line 493 of file fltkernel.h.

◆ PFLT_CONTEXT_FREE_CALLBACK

typedef VOID(FLTAPI * PFLT_CONTEXT_FREE_CALLBACK) (_In_ PVOID Pool, _In_ FLT_CONTEXT_TYPE ContextType)

Definition at line 504 of file fltkernel.h.

◆ PFLT_CONTEXT_REGISTRATION

typedef struct _FLT_CONTEXT_REGISTRATION * PFLT_CONTEXT_REGISTRATION

◆ PFLT_DEFERRED_IO_WORKITEM

typedef struct _FLT_DEFERRED_IO_WORKITEM* PFLT_DEFERRED_IO_WORKITEM

Definition at line 863 of file fltkernel.h.

◆ PFLT_DEFERRED_IO_WORKITEM_ROUTINE

typedef VOID(FLTAPI * PFLT_DEFERRED_IO_WORKITEM_ROUTINE) (_In_ PFLT_DEFERRED_IO_WORKITEM FltWorkItem, _In_ PFLT_CALLBACK_DATA CallbackData, _In_opt_ PVOID Context)

Definition at line 866 of file fltkernel.h.

◆ PFLT_DISCONNECT_NOTIFY

typedef VOID(FLTAPI * PFLT_DISCONNECT_NOTIFY) (_In_opt_ PVOID ConnectionCookie)

Definition at line 855 of file fltkernel.h.

◆ PFLT_FILE_NAME_INFORMATION

typedef struct _FLT_FILE_NAME_INFORMATION * PFLT_FILE_NAME_INFORMATION

◆ PFLT_FILTER

typedef struct _FLT_FILTER* PFLT_FILTER

Definition at line 84 of file fltkernel.h.

◆ PFLT_FILTER_UNLOAD_CALLBACK

typedef NTSTATUS(FLTAPI * PFLT_FILTER_UNLOAD_CALLBACK) (FLT_FILTER_UNLOAD_FLAGS Flags)

Definition at line 653 of file fltkernel.h.

◆ PFLT_GENERATE_FILE_NAME

typedef NTSTATUS(FLTAPI * PFLT_GENERATE_FILE_NAME) (_In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _In_opt_ PFLT_CALLBACK_DATA CallbackData, _In_ FLT_FILE_NAME_OPTIONS NameOptions, _Out_ PBOOLEAN CacheFileNameInformation, _Out_ PFLT_NAME_CONTROL FileName)

Definition at line 663 of file fltkernel.h.

◆ PFLT_GENERIC_WORKITEM

typedef struct _FLT_GENERIC_WORKITEM* PFLT_GENERIC_WORKITEM

Definition at line 864 of file fltkernel.h.

◆ PFLT_GENERIC_WORKITEM_ROUTINE

typedef VOID(FLTAPI * PFLT_GENERIC_WORKITEM_ROUTINE) (_In_ PFLT_GENERIC_WORKITEM FltWorkItem, _In_ PVOID FltObject, _In_opt_ PVOID Context)

Definition at line 872 of file fltkernel.h.

◆ PFLT_GET_OPERATION_STATUS_CALLBACK

typedef VOID(FLTAPI * PFLT_GET_OPERATION_STATUS_CALLBACK) (_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ PFLT_IO_PARAMETER_BLOCK IopbSnapshot, _In_ NTSTATUS OperationStatus, _In_opt_ PVOID RequesterContext)

Definition at line 763 of file fltkernel.h.

◆ PFLT_INSTANCE

typedef struct _FLT_INSTANCE* PFLT_INSTANCE

Definition at line 86 of file fltkernel.h.

◆ PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK

typedef NTSTATUS(FLTAPI * PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK) (_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags)

Definition at line 554 of file fltkernel.h.

◆ PFLT_INSTANCE_SETUP_CALLBACK

typedef NTSTATUS(FLTAPI * PFLT_INSTANCE_SETUP_CALLBACK) (_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_SETUP_FLAGS Flags, _In_ DEVICE_TYPE VolumeDeviceType, _In_ FLT_FILESYSTEM_TYPE VolumeFilesystemType)

Definition at line 545 of file fltkernel.h.

◆ PFLT_INSTANCE_TEARDOWN_CALLBACK

typedef VOID(FLTAPI * PFLT_INSTANCE_TEARDOWN_CALLBACK) (_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_TEARDOWN_FLAGS Reason)

Definition at line 567 of file fltkernel.h.

◆ PFLT_IO_PARAMETER_BLOCK

typedef struct _FLT_IO_PARAMETER_BLOCK * PFLT_IO_PARAMETER_BLOCK

◆ PFLT_MESSAGE_NOTIFY

typedef NTSTATUS(FLTAPI * PFLT_MESSAGE_NOTIFY) (_In_opt_ PVOID PortCookie, _In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer, _In_ ULONG InputBufferLength, _Out_writes_bytes_to_opt_(OutputBufferLength, *ReturnOutputBufferLength) PVOID OutputBuffer, _In_ ULONG OutputBufferLength, _Out_ PULONG ReturnOutputBufferLength)

Definition at line 838 of file fltkernel.h.

◆ PFLT_NAME_CONTROL

typedef struct _FLT_NAME_CONTROL * PFLT_NAME_CONTROL

◆ PFLT_NORMALIZE_CONTEXT_CLEANUP

typedef VOID(FLTAPI * PFLT_NORMALIZE_CONTEXT_CLEANUP) (_In_opt_ PVOID *NormalizationContext)

Definition at line 700 of file fltkernel.h.

◆ PFLT_NORMALIZE_NAME_COMPONENT

typedef NTSTATUS(FLTAPI * PFLT_NORMALIZE_NAME_COMPONENT) (_In_ PFLT_INSTANCE Instance, _In_ PCUNICODE_STRING ParentDirectory, _In_ USHORT VolumeNameLength, _In_ PCUNICODE_STRING Component, _Out_writes_bytes_(ExpandComponentNameLength) PFILE_NAMES_INFORMATION ExpandComponentName, _In_ ULONG ExpandComponentNameLength, _In_ FLT_NORMALIZE_NAME_FLAGS Flags, _Inout_ PVOID *NormalizationContext)

Definition at line 677 of file fltkernel.h.

◆ PFLT_NORMALIZE_NAME_COMPONENT_EX

typedef NTSTATUS(FLTAPI * PFLT_NORMALIZE_NAME_COMPONENT_EX) (_In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _In_ PCUNICODE_STRING ParentDirectory, _In_ USHORT VolumeNameLength, _In_ PCUNICODE_STRING Component, _Out_writes_bytes_(ExpandComponentNameLength) PFILE_NAMES_INFORMATION ExpandComponentName, _In_ ULONG ExpandComponentNameLength, _In_ FLT_NORMALIZE_NAME_FLAGS Flags, _Inout_ PVOID *NormalizationContext)

Definition at line 688 of file fltkernel.h.

◆ PFLT_OPERATION_REGISTRATION

typedef struct _FLT_OPERATION_REGISTRATION * PFLT_OPERATION_REGISTRATION

◆ PFLT_PARAMETERS

typedef union _FLT_PARAMETERS * PFLT_PARAMETERS

◆ PFLT_PORT

typedef struct _FLT_PORT* PFLT_PORT

Definition at line 87 of file fltkernel.h.

◆ PFLT_POST_OPERATION_CALLBACK

typedef FLT_POSTOP_CALLBACK_STATUS(FLTAPI * PFLT_POST_OPERATION_CALLBACK) (_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_opt_ PVOID CompletionContext, _In_ FLT_POST_OPERATION_FLAGS Flags)

Definition at line 596 of file fltkernel.h.

◆ PFLT_POSTOP_CALLBACK_STATUS

typedef enum _FLT_POSTOP_CALLBACK_STATUS * PFLT_POSTOP_CALLBACK_STATUS

◆ PFLT_PRE_OPERATION_CALLBACK

typedef FLT_PREOP_CALLBACK_STATUS(FLTAPI * PFLT_PRE_OPERATION_CALLBACK) (_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Outptr_result_maybenull_ PVOID *CompletionContext)

Definition at line 581 of file fltkernel.h.

◆ PFLT_PREOP_CALLBACK_STATUS

typedef enum _FLT_PREOP_CALLBACK_STATUS * PFLT_PREOP_CALLBACK_STATUS

◆ PFLT_REGISTRATION

typedef struct _FLT_REGISTRATION * PFLT_REGISTRATION

◆ PFLT_RELATED_CONTEXTS

typedef struct _FLT_RELATED_CONTEXTS * PFLT_RELATED_CONTEXTS

◆ PFLT_RELATED_OBJECTS

typedef struct _FLT_RELATED_OBJECTS * PFLT_RELATED_OBJECTS

◆ PFLT_SET_CONTEXT_OPERATION

typedef enum _FLT_SET_CONTEXT_OPERATION * PFLT_SET_CONTEXT_OPERATION

◆ PFLT_TAG_DATA_BUFFER

typedef struct _FLT_TAG_DATA_BUFFER * PFLT_TAG_DATA_BUFFER

◆ PFLT_TRANSACTION_NOTIFICATION_CALLBACK

typedef NTSTATUS(FLTAPI * PFLT_TRANSACTION_NOTIFICATION_CALLBACK) (_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ PFLT_CONTEXT TransactionContext, _In_ ULONG NotificationMask)

Definition at line 705 of file fltkernel.h.

◆ PFLT_VOLUME

typedef struct _FLT_VOLUME* PFLT_VOLUME

Definition at line 85 of file fltkernel.h.

◆ PFLT_VOLUME_PROPERTIES

typedef struct _FLT_VOLUME_PROPERTIES * PFLT_VOLUME_PROPERTIES

◆ PFLTOPLOCK_PREPOST_CALLBACKDATA_ROUTINE

typedef VOID(FLTAPI * PFLTOPLOCK_PREPOST_CALLBACKDATA_ROUTINE) (_In_ PFLT_CALLBACK_DATA CallbackData, _In_opt_ PVOID Context)

Definition at line 938 of file fltkernel.h.

◆ PFLTOPLOCK_WAIT_COMPLETE_ROUTINE

typedef VOID(FLTAPI * PFLTOPLOCK_WAIT_COMPLETE_ROUTINE) (_In_ PFLT_CALLBACK_DATA CallbackData, _In_opt_ PVOID Context)

Definition at line 933 of file fltkernel.h.

Enumeration Type Documentation

◆ _FLT_POSTOP_CALLBACK_STATUS

enum _FLT_POSTOP_CALLBACK_STATUS

Enumerator
FLT_POSTOP_FINISHED_PROCESSING
FLT_POSTOP_MORE_PROCESSING_REQUIRED

Definition at line 587 of file fltkernel.h.

                                         {
  FLT_POSTOP_FINISHED_PROCESSING,
  FLT_POSTOP_MORE_PROCESSING_REQUIRED
} FLT_POSTOP_CALLBACK_STATUS, *PFLT_POSTOP_CALLBACK_STATUS;

◆ _FLT_PREOP_CALLBACK_STATUS

enum _FLT_PREOP_CALLBACK_STATUS

Enumerator
FLT_PREOP_SUCCESS_WITH_CALLBACK
FLT_PREOP_SUCCESS_NO_CALLBACK
FLT_PREOP_PENDING
FLT_PREOP_DISALLOW_FASTIO
FLT_PREOP_COMPLETE
FLT_PREOP_SYNCHRONIZE

Definition at line 572 of file fltkernel.h.

                                        {
  FLT_PREOP_SUCCESS_WITH_CALLBACK,
  FLT_PREOP_SUCCESS_NO_CALLBACK,
  FLT_PREOP_PENDING,
  FLT_PREOP_DISALLOW_FASTIO,
  FLT_PREOP_COMPLETE,
  FLT_PREOP_SYNCHRONIZE
} FLT_PREOP_CALLBACK_STATUS, *PFLT_PREOP_CALLBACK_STATUS;

◆ _FLT_SET_CONTEXT_OPERATION

enum _FLT_SET_CONTEXT_OPERATION

Enumerator
FLT_SET_CONTEXT_REPLACE_IF_EXISTS
FLT_SET_CONTEXT_KEEP_IF_EXISTS

Definition at line 818 of file fltkernel.h.

                                        {
  FLT_SET_CONTEXT_REPLACE_IF_EXISTS,
  FLT_SET_CONTEXT_KEEP_IF_EXISTS
} FLT_SET_CONTEXT_OPERATION, *PFLT_SET_CONTEXT_OPERATION;

Function Documentation

◆ _Acquires_lock_()

_Acquires_lock_ ( _Global_critical_region_ )

Definition at line 59 of file Object.c.

{
    KeEnterCriticalRegion();
 
    /* Try acquiring the lock */
    if (InterlockedBitTestAndSet((PLONG)PushLock, EX_PUSH_LOCK_LOCK_V))
    {
        /* Someone changed it, use the slow path */
        ExfAcquirePushLockExclusive(PushLock);
    }
 
    /* Sanity check */
    FLT_ASSERT(PushLock->Locked);
}

◆ _In_reads_bytes_() [1/4]

_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_opt_ GUID _In_reads_bytes_ ( DataBufferLength )

◆ _In_reads_bytes_() [2/4]

_Must_inspect_result_ _In_ PFILE_OBJECT _In_opt_ HANDLE _In_reads_bytes_ ( FileNameLength )

◆ _In_reads_bytes_() [3/4]

_Must_inspect_result_ _In_ PFILE_OBJECT _In_opt_ PLARGE_INTEGER _In_ ULONG _In_reads_bytes_ ( Length )

◆ _In_reads_bytes_() [4/4]

_Must_inspect_result_ _In_ PFLT_PORT _In_reads_bytes_ ( SenderBufferLength )

◆ _In_reads_bytes_opt_() [1/3]

_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE _In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _Out_ PIO_STATUS_BLOCK _In_opt_ PLARGE_INTEGER _In_ ULONG _In_ ULONG _In_ ULONG _In_ ULONG _In_reads_bytes_opt_ ( EaLength )

◆ _In_reads_bytes_opt_() [2/3]

_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_ BOOLEAN _In_reads_bytes_opt_ ( EaListLength )

◆ _In_reads_bytes_opt_() [3/3]

_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_reads_bytes_opt_ ( InputBufferLength )

◆ _Inout_updates_bytes_opt_()

_Must_inspect_result_ _In_ PFILE_OBJECT _In_ SECURITY_INFORMATION _Inout_updates_bytes_opt_ ( Length )

◆ _IRQL_requires_max_() [1/4]

_Must_inspect_result_ _IRQL_requires_max_ ( APC_LEVEL )

Definition at line 37 of file cddata.c.

{
    THREAD_CONTEXT ThreadContext = {0};
    PIRP_CONTEXT IrpContext = NULL;
    BOOLEAN Wait;
 
#ifdef CD_SANITY
    PVOID PreviousTopLevel;
#endif
 
    NTSTATUS Status;
 
#if DBG
 
    KIRQL SaveIrql = KeGetCurrentIrql();
 
#endif
 
    ASSERT_OPTIONAL_IRP( Irp );
 
    UNREFERENCED_PARAMETER( DeviceObject );
 
    FsRtlEnterFileSystem();
 
#ifdef CD_SANITY
    PreviousTopLevel = IoGetTopLevelIrp();
#endif
 
    //
    //  Loop until this request has been completed or posted.
    //
 
    do {
 
        //
        //  Use a try-except to handle the exception cases.
        //
 
        _SEH2_TRY {
 
            //
            //  If the IrpContext is NULL then this is the first pass through
            //  this loop.
            //
 
            if (IrpContext == NULL) {
 
                //
                //  Decide if this request is waitable an allocate the IrpContext.
                //  If the file object in the stack location is NULL then this
                //  is a mount which is always waitable.  Otherwise we look at
                //  the file object flags.
                //
 
                if (IoGetCurrentIrpStackLocation( Irp )->FileObject == NULL) {
 
                    Wait = TRUE;
 
                } else {
 
                    Wait = CanFsdWait( Irp );
                }
 
                IrpContext = CdCreateIrpContext( Irp, Wait );
 
                //
                //  Update the thread context information.
                //
 
                CdSetThreadContext( IrpContext, &ThreadContext );
 
#ifdef CD_SANITY
                NT_ASSERT( !CdTestTopLevel ||
                        SafeNodeType( IrpContext->TopLevel ) == CDFS_NTC_IRP_CONTEXT );
#endif
 
            //
            //  Otherwise cleanup the IrpContext for the retry.
            //
 
            } else {
 
                //
                //  Set the MORE_PROCESSING flag to make sure the IrpContext
                //  isn't inadvertently deleted here.  Then cleanup the
                //  IrpContext to perform the retry.
                //
 
                SetFlag( IrpContext->Flags, IRP_CONTEXT_FLAG_MORE_PROCESSING );
                CdCleanupIrpContext( IrpContext, FALSE );
            }
 
            //
            //  Case on the major irp code.
            //
 
            switch (IrpContext->MajorFunction) {
 
            case IRP_MJ_CREATE :
 
                Status = CdCommonCreate( IrpContext, Irp );
                break;
 
            case IRP_MJ_CLOSE :
 
                Status = CdCommonClose( IrpContext, Irp );
                break;
 
            case IRP_MJ_READ :
 
                //
                //  If this is an Mdl complete request, don't go through
                //  common read.
                //
 
                if (FlagOn( IrpContext->MinorFunction, IRP_MN_COMPLETE )) {
 
                    Status = CdCompleteMdl( IrpContext, Irp );
 
                } else {
 
                    Status = CdCommonRead( IrpContext, Irp );
                }
 
                break;
 
            case IRP_MJ_WRITE :
 
                Status = CdCommonWrite( IrpContext, Irp );
                break;
 
            case IRP_MJ_QUERY_INFORMATION :
 
                Status = CdCommonQueryInfo( IrpContext, Irp );
                break;
 
            case IRP_MJ_SET_INFORMATION :
 
                Status = CdCommonSetInfo( IrpContext, Irp );
                break;
 
            case IRP_MJ_QUERY_VOLUME_INFORMATION :
 
                Status = CdCommonQueryVolInfo( IrpContext, Irp );
                break;
 
            case IRP_MJ_DIRECTORY_CONTROL :
 
                Status = CdCommonDirControl( IrpContext, Irp );
                break;
 
            case IRP_MJ_FILE_SYSTEM_CONTROL :
 
                Status = CdCommonFsControl( IrpContext, Irp );
                break;
 
            case IRP_MJ_DEVICE_CONTROL :
 
                Status = CdCommonDevControl( IrpContext, Irp );
                break;
 
            case IRP_MJ_LOCK_CONTROL :
 
                Status = CdCommonLockControl( IrpContext, Irp );
                break;
 
            case IRP_MJ_CLEANUP :
 
                Status = CdCommonCleanup( IrpContext, Irp );
                break;
 
            case IRP_MJ_PNP :
 
                Status = CdCommonPnp( IrpContext, Irp );
                break;
 
            case IRP_MJ_SHUTDOWN :
 
                Status = CdCommonShutdown( IrpContext, Irp );
                break;
 
            default :
 
                Status = STATUS_INVALID_DEVICE_REQUEST;
                CdCompleteRequest( IrpContext, Irp, Status );
            }
 
        } _SEH2_EXCEPT( CdExceptionFilter( IrpContext, _SEH2_GetExceptionInformation() )) {
 
            Status = CdProcessException( IrpContext, Irp, _SEH2_GetExceptionCode() );
        } _SEH2_END;
 
    } while (Status == STATUS_CANT_WAIT);
 
#ifdef CD_SANITY
    NT_ASSERT( !CdTestTopLevel ||
            (PreviousTopLevel == IoGetTopLevelIrp()) );
#endif
 
    FsRtlExitFileSystem();
 
    NT_ASSERT( SaveIrql == KeGetCurrentIrql( ));
 
    return Status;
}

◆ _IRQL_requires_max_() [2/4]

_IRQL_requires_max_ ( DISPATCH_LEVEL )

Definition at line 347 of file hardware.c.

{
    SendKey();
    Wake(LogicalDevice->CSN);
}

◆ _IRQL_requires_max_() [3/4]

_Must_inspect_result_ _IRQL_requires_max_ ( DPC_LEVEL )

◆ _IRQL_requires_max_() [4/4]

_Must_inspect_result_ _IRQL_requires_max_ ( PASSIVE_LEVEL )

Queries information details about a security descriptor.

Computes the quota size of a security descriptor.

Assigns a security descriptor for a new object.

An extended function that assigns a security descriptor for a new object.

Frees a security descriptor.

An extended function that sets new information data to a security descriptor.

Modifies some information data about a security descriptor.

Parameters

[in]	SecurityInformation	Security information details to be queried from a security descriptor.
[out]	SecurityDescriptor	The returned security descriptor with security information data.
[in,out]	Length	The returned length of a security descriptor.
[in,out]	ObjectsSecurityDescriptor	The returned object security descriptor.

Returns: Returns STATUS_SUCCESS if the operations have been completed successfully and that the specific information about the security descriptor has been queried. STATUS_BUFFER_TOO_SMALL is returned if the buffer size is too small to contain the queried info about the security descriptor.

Parameters

[in]	Object	If specified, the function will use this arbitrary object that points to an object security descriptor.
[in]	SecurityInformation	Security information details to be set.
[in]	SecurityDescriptor	A security descriptor where its info is to be changed.
[in,out]	ObjectsSecurityDescriptor	The returned pointer to security descriptor objects.
[in]	PoolType	Pool type for the new security descriptor to allocate.
[in]	GenericMapping	The generic mapping of access rights masks.

Returns: See SeSetSecurityDescriptorInfoEx.

Parameters

[in]	Object	If specified, the function will use this arbitrary object that points to an object security descriptor.
[in]	SecurityInformation	Security information details to be set.
[in]	SecurityDescriptor	A security descriptor where its info is to be changed.
[in,out]	ObjectsSecurityDescriptor	The returned pointer to security descriptor objects.
[in]	AutoInheritFlags	Flags bitmask inheritation, influencing how the security descriptor can be inherited and if it can be in the first place.
[in]	PoolType	Pool type for the new security descriptor to allocate.
[in]	GenericMapping	The generic mapping of access rights masks.

Returns: Returns STATUS_SUCCESS if the operations have been completed without problems and that new info has been set to the security descriptor. STATUS_NO_SECURITY_ON_OBJECT is returned if the object does not have a security descriptor. STATUS_INSUFFICIENT_RESOURCES is returned if memory pool allocation for the new security descriptor with new info set has failed.

Parameters

[in] SecurityDescriptor A security descriptor to be freed from memory.

Returns: Returns STATUS_SUCCESS.

Parameters

[in]	_ParentDescriptor	A security descriptor of the parent object that is being created.
[in]	_ExplicitDescriptor	An explicit security descriptor that is applied to a new object.
[out]	NewDescriptor	The new allocated security descriptor.
[in]	ObjectType	The type of the new object.
[in]	IsDirectoryObject	Set this to TRUE if the newly created object is a directory object, otherwise set this to FALSE.
[in]	AutoInheritFlags	Automatic inheritance flags that influence how access control entries within ACLs from security descriptors are inherited.
[in]	SubjectContext	Security subject context of the new object.
[in]	GenericMapping	Generic mapping of access mask rights.
[in]	PoolType	This parameter is unused.

Returns: Returns STATUS_SUCCESS if the operations have been completed successfully and that the security descriptor has been assigned to the new object. STATUS_NO_TOKEN is returned if the caller hasn't supplied a valid argument to a security subject context. STATUS_INVALID_OWNER is returned if the caller hasn't supplied a parent descriptor that belongs to the main user (owner). STATUS_INVALID_PRIMARY_GROUP is returned by the same reason as with the previous NTSTATUS code. The two NTSTATUS codes are returned if the calling thread stated that the owner and/or group is defaulted to the parent descriptor (SEF_DEFAULT_OWNER_FROM_PARENT and/or SEF_DEFAULT_GROUP_FROM_PARENT respectively). STATUS_INSUFFICIENT_RESOURCES is returned if memory pool allocation for the descriptor buffer has failed. A failure NTSTATUS is returned otherwise.

Parameters

[in]	ParentDescriptor	A security descriptor of the parent object that is being created.
[in]	ExplicitDescriptor	An explicit security descriptor that is applied to a new object.
[out]	NewDescriptor	The new allocated security descriptor.
[in]	IsDirectoryObject	Set this to TRUE if the newly created object is a directory object, otherwise set this to FALSE.
[in]	SubjectContext	Security subject context of the new object.
[in]	GenericMapping	Generic mapping of access mask rights.
[in]	PoolType	This parameter is unused.

Returns: See SeAssignSecurityEx.

Parameters

[in]	SecurityDescriptor	A security descriptor.
[out]	QuotaInfoSize	The returned quota size of the given security descriptor to the caller. The function may return 0 to this parameter if the descriptor doesn't have a group or a discretionary access control list (DACL) even.

Returns: Returns STATUS_SUCCESS if the quota size of a security descriptor has been computed successfully. STATUS_UNKNOWN_REVISION is returned if the security descriptor has an invalid revision.

Definition at line 923 of file Messaging.c.

{
    PFLT_SERVER_PORT_OBJECT PortObject;
    NTSTATUS Status;
 
    /* The caller must allow at least one connection */
    if (MaxConnections == 0)
    {
        return STATUS_INVALID_PARAMETER;
    }
 
    /* The request must be for a kernel handle */
    if (!(ObjectAttributes->Attributes & OBJ_KERNEL_HANDLE))
    {
        return STATUS_INVALID_PARAMETER;
    }
 
    /*
     * Get rundown protection on the target to stop the owner
     * from unloading whilst this port object is open. It gets
     * removed in the FltpServerPortClose callback
     */
    Status = FltObjectReference(Filter);
    if (!NT_SUCCESS(Status))
    {
        return Status;
    }
 
    /* Create the server port object for this filter */
    Status = ObCreateObject(KernelMode,
                            ServerPortObjectType,
                            ObjectAttributes,
                            KernelMode,
                            NULL,
                            sizeof(FLT_SERVER_PORT_OBJECT),
                            0,
                            0,
                            (PVOID *)&PortObject);
    if (NT_SUCCESS(Status))
    {
        /* Zero out the struct */
        RtlZeroMemory(PortObject, sizeof(FLT_SERVER_PORT_OBJECT));
 
        /* Increment the ref count on the target filter */
        FltpObjectPointerReference((PFLT_OBJECT)Filter);
 
        /* Setup the filter port object */
        PortObject->Filter = Filter;
        PortObject->ConnectNotify = ConnectNotifyCallback;
        PortObject->DisconnectNotify = DisconnectNotifyCallback;
        PortObject->MessageNotify = MessageNotifyCallback;
        PortObject->Cookie = ServerPortCookie;
        PortObject->MaxConnections = MaxConnections;
 
        /* Insert the object */
        Status = ObInsertObject(PortObject,
                                NULL,
                                STANDARD_RIGHTS_ALL | FILE_READ_DATA,
                                0,
                                NULL,
                                (PHANDLE)ServerPort);
        if (NT_SUCCESS(Status))
        {
            /* Lock the connection list */
            ExAcquireFastMutex(&Filter->ConnectionList.mLock);
 
            /* Add the new port object to the connection list and increment the count */
            InsertTailList(&Filter->ConnectionList.mList, &PortObject->FilterLink);
            Filter->ConnectionList.mCount++;
 
            /* Unlock the connection list*/
            ExReleaseFastMutex(&Filter->ConnectionList.mLock);
        }
    }
 
    if (!NT_SUCCESS(Status))
    {
        /* Allow the filter to be cleaned up */
        FltObjectDereference(Filter);
    }
 
    return Status;
}

◆ _Out_writes_bytes_()

_Must_inspect_result_ _Out_ PIO_STATUS_BLOCK _Out_writes_bytes_ ( Length )

◆ _Out_writes_bytes_to_()

_Must_inspect_result_ _In_ PFILE_OBJECT _In_opt_ PLARGE_INTEGER _In_ ULONG _Out_writes_bytes_to_	(	Length	,
		*	BytesRead
	)

◆ _Out_writes_bytes_to_opt_() [1/3]

_In_ FILTER_INFORMATION_CLASS _Out_writes_bytes_to_opt_	(	BufferSize	,
		*	BytesReturned
	)

◆ _Out_writes_bytes_to_opt_() [2/3]

_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_ ULONG _Out_writes_bytes_to_opt_	(	OutputBufferLength	,
		*	LengthReturned
	)

◆ _Out_writes_bytes_to_opt_() [3/3]

_Out_writes_bytes_to_opt_	(	VolumePropertiesLength	,
		*	LengthReturned
	)

◆ _Out_writes_to_opt_() [1/2]

_Must_inspect_result_ _In_opt_ PFLT_FILTER _Out_writes_to_opt_	(	InstanceListSize	,
		*	NumberInstancesReturned
	)

◆ _Out_writes_to_opt_() [2/2]

_Must_inspect_result_ _Out_writes_to_opt_	(	VolumeListSize	,
		*	NumberVolumesReturned
	)

◆ _Outptr_result_bytebuffer_()

_Must_inspect_result_ _In_ FLT_CONTEXT_TYPE _In_ SIZE_T _In_ POOL_TYPE _Outptr_result_bytebuffer_ ( ContextSize )

◆ _Releases_lock_()

_Releases_lock_ ( _Global_critical_region_ )

Definition at line 101 of file Object.c.

{
    EX_PUSH_LOCK OldValue = *PushLock;
    EX_PUSH_LOCK NewValue;
 
    /* Sanity checks */
    FLT_ASSERT(OldValue.Locked);
 
    /* Check if the pushlock is shared */
    if (OldValue.Shared > 1)
    {
        /* Decrease the share count */
        NewValue.Value = OldValue.Value - EX_PUSH_LOCK_SHARE_INC;
    }
    else
    {
        /* Clear the pushlock entirely */
        NewValue.Value = 0;
    }
 
    /* Check if nobody is waiting on us and try clearing the lock here */
    if ((OldValue.Waiting) ||
        (ExpChangePushlock(PushLock, NewValue.Ptr, OldValue.Ptr) !=
         OldValue.Ptr))
    {
        /* We have waiters, use the long path */
        ExfReleasePushLock(PushLock);
    }
 
    KeLeaveCriticalRegion();
}

◆ _When_() [1/4]

_Must_inspect_result_ _When_	(	((CallbackData!=NULL) &&FLT_IS_IRP_OPERATION(CallbackData))	,
		_IRQL_requires_max_(PASSIVE_LEVEL)
	)

◆ _When_() [2/4]

_When_	(	(PoolType==NonPagedPoolNx)	,
		_IRQL_requires_max_(DISPATCH_LEVEL)
	)

◆ _When_() [3/4]

_When_	(	CallbackStatus	= `=FLT_PREOP_COMPLETE`,
		_IRQL_requires_max_(DISPATCH_LEVEL)
	)

◆ _When_() [4/4]

_When_	(	FlagOn(CallbackData->Iopb->IrpFlags, IRP_PAGING_IO)	,
		_IRQL_requires_max_(APC_LEVEL)
	)		-> Iopb->IrpFlags, IRP_PAGING_IO), _IRQL_requires_max_(PASSIVE_LEVEL)) VOID FLTAPI FltPerformSynchronousIo(_Inout_ PFLT_CALLBACK_DATA CallbackData)

◆ FltCbdqDisable()

VOID FLTAPI FltCbdqDisable ( _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq )

◆ FltCbdqEnable()

VOID FLTAPI FltCbdqEnable ( _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq )

◆ FltCbdqInitialize()

NTSTATUS FLTAPI FltCbdqInitialize	(	_In_ PFLT_INSTANCE	Instance,
		_Inout_ PFLT_CALLBACK_DATA_QUEUE	Cbdq,
		_In_ PFLT_CALLBACK_DATA_QUEUE_INSERT_IO	CbdqInsertIo,
		_In_ PFLT_CALLBACK_DATA_QUEUE_REMOVE_IO	CbdqRemoveIo,
		_In_ PFLT_CALLBACK_DATA_QUEUE_PEEK_NEXT_IO	CbdqPeekNextIo,
		_In_ PFLT_CALLBACK_DATA_QUEUE_ACQUIRE	CbdqAcquire,
		_In_ PFLT_CALLBACK_DATA_QUEUE_RELEASE	CbdqRelease,
		_In_ PFLT_CALLBACK_DATA_QUEUE_COMPLETE_CANCELED_IO	CbdqCompleteCanceledIo
	)

◆ FltCbdqInsertIo()

_Must_inspect_result_ NTSTATUS FLTAPI FltCbdqInsertIo	(	_Inout_ PFLT_CALLBACK_DATA_QUEUE	Cbdq,
		_In_ PFLT_CALLBACK_DATA	Cbd,
		_In_opt_ PFLT_CALLBACK_DATA_QUEUE_IO_CONTEXT	Context,
		_In_opt_ PVOID	InsertContext
	)

◆ FltCbdqRemoveIo()

_Must_inspect_result_ PFLT_CALLBACK_DATA FLTAPI FltCbdqRemoveIo	(	_Inout_ PFLT_CALLBACK_DATA_QUEUE	Cbdq,
		_In_ PFLT_CALLBACK_DATA_QUEUE_IO_CONTEXT	Context
	)

◆ FltCbdqRemoveNextIo()

_Must_inspect_result_ PFLT_CALLBACK_DATA FLTAPI FltCbdqRemoveNextIo	(	_Inout_ PFLT_CALLBACK_DATA_QUEUE	Cbdq,
		_In_opt_ PVOID	PeekContext
	)

◆ FltClearCallbackDataDirty()

VOID FLTAPI FltClearCallbackDataDirty ( _Inout_ PFLT_CALLBACK_DATA Data )

◆ FltCompareInstanceAltitudes()

LONG FLTAPI FltCompareInstanceAltitudes	(	_In_ PFLT_INSTANCE	Instance1,
		_In_ PFLT_INSTANCE	Instance2
	)

◆ FltDecodeParameters()

NTSTATUS FLTAPI FltDecodeParameters	(	_In_ PFLT_CALLBACK_DATA	CallbackData,
		_Outptr_opt_ PMDL **	MdlAddressPointer,
		_Outptr_opt_result_bytebuffer_ Length PVOID	Buffer,
		_Outptr_opt_ PULONG *	Length,
		_Out_opt_ LOCK_OPERATION *	DesiredAccess
	)

◆ FltDoCompletionProcessingWhenSafe()

_Must_inspect_result_ BOOLEAN FLTAPI FltDoCompletionProcessingWhenSafe	(	_In_ PFLT_CALLBACK_DATA	Data,
		_In_ PCFLT_RELATED_OBJECTS	FltObjects,
		_In_opt_ PVOID	CompletionContext,
		_In_ FLT_POST_OPERATION_FLAGS	Flags,
		_In_ PFLT_POST_OPERATION_CALLBACK	SafePostCallback,
		_Out_ PFLT_POSTOP_CALLBACK_STATUS	RetPostOperationStatus
	)