fltmgr.h File Reference

#include <ntifs.h>
#include <ndk/obfuncs.h>
#include <ndk/exfuncs.h>
#include <fltkernel.h>
#include <pseh/pseh2.h>
#include <section_attribs.h>

Include dependency graph for fltmgr.h:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Classes
struct	_DRIVER_DATA
struct	_FLTMGR_DEVICE_EXTENSION

Macros
#define	DRIVER_NAME   L"FltMgr"
#define	FLT_MAJOR_VERSION   0x0200
#define	FLT_MINOR_VERSION   0x0000
#define	FM_TAG_DISPATCH_TABLE   'ifMF'
#define	FM_TAG_REGISTRY_DATA   'rtMF'
#define	FM_TAG_DEV_OBJ_PTRS   'ldMF'
#define	FM_TAG_UNICODE_STRING   'suMF'
#define	FM_TAG_FILTER   'lfMF'
#define	FM_TAG_CONTEXT_REGISTA   'rcMF'
#define	FM_TAG_CCB   'bcMF'
#define	FM_TAG_TEMP_REGISTRY   'rtMF'
#define	MAX_DEVNAME_LENGTH   64

Typedefs
typedef struct _DRIVER_DATA	DRIVER_DATA
typedef struct _DRIVER_DATA *	PDRIVER_DATA
typedef struct _FLTMGR_DEVICE_EXTENSION	FLTMGR_DEVICE_EXTENSION
typedef struct _FLTMGR_DEVICE_EXTENSION *	PFLTMGR_DEVICE_EXTENSION

Functions
NTSTATUS	FltpRegisterContexts (_In_ PFLT_FILTER Filter, _In_ const FLT_CONTEXT_REGISTRATION *Context)
VOID	FltpExInitializeRundownProtection (_Out_ PEX_RUNDOWN_REF RundownRef)
BOOLEAN	FltpExAcquireRundownProtection (_Inout_ PEX_RUNDOWN_REF RundownRef)
BOOLEAN	FltpExReleaseRundownProtection (_Inout_ PEX_RUNDOWN_REF RundownRef)
NTSTATUS NTAPI	FltpObjectRundownWait (_Inout_ PEX_RUNDOWN_REF RundownRef)
BOOLEAN	FltpExRundownCompleted (_Inout_ PEX_RUNDOWN_REF RundownRef)
NTSTATUS	FltpGetBaseDeviceObjectName (_In_ PDEVICE_OBJECT DeviceObject, _Inout_ PUNICODE_STRING ObjectName)
NTSTATUS	FltpGetObjectName (_In_ PVOID Object, _Inout_ PUNICODE_STRING ObjectName)
NTSTATUS	FltpReallocateUnicodeString (_In_ PUNICODE_STRING String, _In_ SIZE_T NewLength, _In_ BOOLEAN CopyExisting)
VOID	FltpFreeUnicodeString (_In_ PUNICODE_STRING String)

Macro Definition Documentation

DRIVER_NAME

#define DRIVER_NAME   L"FltMgr"

Definition at line 12 of file fltmgr.h.

FLT_MAJOR_VERSION

#define FLT_MAJOR_VERSION   0x0200

Definition at line 14 of file fltmgr.h.

FLT_MINOR_VERSION

#define FLT_MINOR_VERSION   0x0000

Definition at line 15 of file fltmgr.h.

FM_TAG_CCB

#define FM_TAG_CCB   'bcMF'

Definition at line 23 of file fltmgr.h.

FM_TAG_CONTEXT_REGISTA

#define FM_TAG_CONTEXT_REGISTA   'rcMF'

Definition at line 22 of file fltmgr.h.

FM_TAG_DEV_OBJ_PTRS

#define FM_TAG_DEV_OBJ_PTRS   'ldMF'

Definition at line 19 of file fltmgr.h.

FM_TAG_DISPATCH_TABLE

#define FM_TAG_DISPATCH_TABLE   'ifMF'

Definition at line 17 of file fltmgr.h.

FM_TAG_FILTER

#define FM_TAG_FILTER   'lfMF'

Definition at line 21 of file fltmgr.h.

FM_TAG_REGISTRY_DATA

#define FM_TAG_REGISTRY_DATA   'rtMF'

Definition at line 18 of file fltmgr.h.

FM_TAG_TEMP_REGISTRY

#define FM_TAG_TEMP_REGISTRY   'rtMF'

Definition at line 24 of file fltmgr.h.

FM_TAG_UNICODE_STRING

#define FM_TAG_UNICODE_STRING   'suMF'

Definition at line 20 of file fltmgr.h.

MAX_DEVNAME_LENGTH

#define MAX_DEVNAME_LENGTH   64

Definition at line 26 of file fltmgr.h.

Typedef Documentation

DRIVER_DATA

typedef struct _DRIVER_DATA DRIVER_DATA

FLTMGR_DEVICE_EXTENSION

typedef struct _FLTMGR_DEVICE_EXTENSION FLTMGR_DEVICE_EXTENSION

PDRIVER_DATA

typedef struct _DRIVER_DATA * PDRIVER_DATA

PFLTMGR_DEVICE_EXTENSION

typedef struct _FLTMGR_DEVICE_EXTENSION * PFLTMGR_DEVICE_EXTENSION

Function Documentation

FltpExAcquireRundownProtection()

BOOLEAN FltpExAcquireRundownProtection

(

_Inout_ PEX_RUNDOWN_REF

RundownRef

)

Definition at line 218 of file Object.c.

{
    return ExAcquireRundownProtection(RundownRef);
}

FltpExInitializeRundownProtection()

VOID FltpExInitializeRundownProtection

(

_Out_ PEX_RUNDOWN_REF

RundownRef

)

Definition at line 212 of file Object.c.

{
    ExInitializeRundownProtection(RundownRef);
}

Referenced by FltRegisterFilter().

FltpExReleaseRundownProtection()

BOOLEAN FltpExReleaseRundownProtection

(

_Inout_ PEX_RUNDOWN_REF

RundownRef

)

Definition at line 224 of file Object.c.

{
    ExReleaseRundownProtection(RundownRef);
    return TRUE;
}

FltpExRundownCompleted()

BOOLEAN FltpExRundownCompleted

(

_Inout_ PEX_RUNDOWN_REF

RundownRef

)

Definition at line 231 of file Object.c.

{
    return _InterlockedExchange((PLONG)RundownRef, 1);
}

Referenced by FltUnregisterFilter().

FltpFreeUnicodeString()

VOID FltpFreeUnicodeString

(

_In_ PUNICODE_STRING

String

)

Definition at line 24 of file Lib.c.

{
    /* Free up any existing buffer */
    if (String->Buffer)
    {
        ExFreePoolWithTag(String->Buffer, FM_TAG_UNICODE_STRING);
    }
 
    /* Empty the string */
    String->Buffer = NULL;
    String->Length = 0;
    String->MaximumLength = 0;
}

Referenced by FltpEnumerateFileSystemVolumes(), and FltpFsNotification().

FltpGetBaseDeviceObjectName()

NTSTATUS FltpGetBaseDeviceObjectName	(	_In_ PDEVICE_OBJECT	DeviceObject,
		_Inout_ PUNICODE_STRING	ObjectName
	)

Definition at line 245 of file Object.c.

{
    PDEVICE_OBJECT BaseDeviceObject;
    NTSTATUS Status;
 
    /*
    * Get the lowest device object on the stack, which may be the
    * object we were passed, and lookup the name for that object
    */
    BaseDeviceObject = IoGetDeviceAttachmentBaseRef(DeviceObject);
    Status = FltpGetObjectName(BaseDeviceObject, ObjectName);
    ObDereferenceObject(BaseDeviceObject);
 
    return Status;
}

Referenced by FltpEnumerateFileSystemVolumes(), and FltpFsNotification().

FltpGetObjectName()

NTSTATUS FltpGetObjectName	(	_In_ PVOID	Object,
		_Inout_ PUNICODE_STRING	ObjectName
	)

Definition at line 263 of file Object.c.

{
    OBJECT_NAME_INFORMATION LocalNameInfo;
    POBJECT_NAME_INFORMATION ObjectNameInfo = &LocalNameInfo;
    ULONG ReturnLength;
    NTSTATUS Status;
 
    if (ObjectName == NULL)
        return STATUS_INVALID_PARAMETER;
 
    /* Get the size of the buffer required to hold the nameinfo */
    Status = ObQueryNameString(Object,
                               &LocalNameInfo,
                               sizeof(LocalNameInfo),
                               &ReturnLength);
    if (Status == STATUS_INFO_LENGTH_MISMATCH)
    {
        ObjectNameInfo = ExAllocatePoolWithTag(PagedPool,
                                               ReturnLength,
                                               FM_TAG_UNICODE_STRING);
        if (ObjectNameInfo == NULL) return STATUS_INSUFFICIENT_RESOURCES;
 
        /* Get the actual name info now we have the buffer to hold it */
        Status = ObQueryNameString(Object,
                                   ObjectNameInfo,
                                   ReturnLength,
                                   &ReturnLength);
    }
 
 
    if (NT_SUCCESS(Status))
    {
        /* Make sure the buffer we were passed is large enough to hold the string */
        if (ObjectName->MaximumLength < ObjectNameInfo->Name.Length)
        {
            /* It wasn't, let's enlarge the buffer */
            Status = FltpReallocateUnicodeString(ObjectName,
                                                 ObjectNameInfo->Name.Length,
                                                 FALSE);
 
        }
 
        if (NT_SUCCESS(Status))
        {
            /* Copy the object name into the callers buffer */
            RtlCopyUnicodeString(ObjectName, &ObjectNameInfo->Name);
        }
    }
 
    if (ObjectNameInfo != &LocalNameInfo)
    {
        ExFreePoolWithTag(ObjectNameInfo, FM_TAG_UNICODE_STRING);
    }
 
    return Status;
}

Referenced by FltpAttachToFileSystemDevice(), and FltpEnumerateFileSystemVolumes().

FltpObjectRundownWait()

NTSTATUS NTAPI FltpObjectRundownWait

(

_Inout_ PEX_RUNDOWN_REF

RundownRef

)

Definition at line 238 of file Object.c.

{
    //return FltpExWaitForRundownProtectionRelease(RundownRef);
    return 0;
}

Referenced by FltUnregisterFilter().

FltpReallocateUnicodeString()

NTSTATUS FltpReallocateUnicodeString	(	_In_ PUNICODE_STRING	String,
		_In_ SIZE_T	NewLength,
		_In_ BOOLEAN	CopyExisting
	)

Definition at line 39 of file Lib.c.

{
    PWCH NewBuffer;
 
    /* Don't bother reallocating if the buffer is smaller */
    if (NewLength <= String->MaximumLength)
    {
        String->Length = 0;
        return STATUS_SUCCESS;
    }
 
    /* Allocate a new buffer at the size requested */
    NewBuffer = ExAllocatePoolWithTag(PagedPool, NewLength, FM_TAG_UNICODE_STRING);
    if (NewBuffer == NULL) return STATUS_INSUFFICIENT_RESOURCES;
 
    if (CopyExisting)
    {
        /* Copy the old data across */
        RtlCopyMemory(NewBuffer, String->Buffer, String->Length);
    }
    else
    {
        /* Reset the length */
        String->Length = 0;
    }
 
    /* Free any old buffer */
    if (String->Buffer)
        ExFreePoolWithTag(String->Buffer, FM_TAG_UNICODE_STRING);
 
    /* Update the lengths */
    String->Buffer = NewBuffer;
    String->MaximumLength = NewLength;
 
    return STATUS_SUCCESS;
}

Referenced by FltpGetObjectName().

FltpRegisterContexts()

NTSTATUS FltpRegisterContexts	(	_In_ PFLT_FILTER	Filter,
		_In_ const FLT_CONTEXT_REGISTRATION *	Context
	)

Definition at line 43 of file Context.c.

{
    PCFLT_CONTEXT_REGISTRATION ContextPtr;
    PALLOCATE_CONTEXT_HEADER ContextHeader, Prev;
    PVOID Buffer;
    ULONG BufferSize = 0;
    USHORT i;
    NTSTATUS Status;
 
    /* Loop through all entries in the context registration array */
    ContextPtr = Context;
    while (ContextPtr)
    {
        /* Bail if we found the terminator */
        if (ContextPtr->ContextType == FLT_CONTEXT_END)
            break;
 
        /* Make sure we have a valid context  */
        if (IsContextTypeValid(ContextPtr->ContextType))
        {
            /* Each context is backed by a crtl struct. Reserve space for it */
            BufferSize += sizeof(STREAM_LIST_CTRL);
        }
 
        /* Move to the next entry */
        ContextPtr++;
    }
 
    /* Bail if we found no valid registration requests */
    if (BufferSize == 0)
    {
        return STATUS_SUCCESS;
    }
 
    /* Allocate the pool that'll hold the context crtl structs */
    Buffer = ExAllocatePoolWithTag(NonPagedPool, BufferSize, FM_TAG_CONTEXT_REGISTA);
    if (!Buffer) return STATUS_INSUFFICIENT_RESOURCES;
 
    RtlZeroMemory(Buffer, BufferSize);
 
    /* Setup our loop data */
    ContextHeader = Buffer;
    Prev = NULL;
    Status = STATUS_SUCCESS;
 
    for (i = 0; i < MAX_CONTEXT_TYPES; i++)
    {
        ContextPtr = (PFLT_CONTEXT_REGISTRATION)Context;
        while (ContextPtr)
        {
            /* We don't support variable sized contents yet */
            FLT_ASSERT(ContextPtr->Size != FLT_VARIABLE_SIZED_CONTEXTS);
 
            /* Bail if we found the terminator */
            if (ContextPtr->ContextType == FLT_CONTEXT_END)
                break;
 
            /* Size and pooltag are only checked when ContextAllocateCallback is null */
            if (ContextPtr->ContextAllocateCallback == FALSE && ContextPtr->PoolTag == FALSE)
            {
                Status = STATUS_FLT_INVALID_CONTEXT_REGISTRATION;
                goto Quit;
            }
 
            /* Make sure we have a valid context  */
            if (IsContextTypeValid(ContextPtr->ContextType))
            {
                Status = SetupContextHeader(Filter, ContextPtr, ContextHeader);
                if (NT_SUCCESS(Status))
                {
                    if (Prev)
                    {
                        Prev->Next = ContextHeader;
                    }
 
                    Filter->SupportedContexts[i] = ContextHeader;
                }
            }
 
            Prev = ContextHeader;
 
            /* Move to the next entry */
            ContextPtr++;
        }
    }
 
Quit:
    if (NT_SUCCESS(Status))
    {
        Filter->SupportedContextsListHead = Buffer;
    }
    else
    {
        ExFreePoolWithTag(Buffer, FM_TAG_CONTEXT_REGISTA);
        //FIXME: Cleanup anything that SetupContextHeader may have allocated
    }
 
    return Status;
}

Referenced by FltRegisterFilter().