38 if (
Irp->AssociatedIrp.SystemBuffer)
97 FinalStatus = KernelIosb->Status;
151 NormalRoutine =
NULL;
152 NormalContext =
NULL;
291 if ((
FileObject->CompletionContext) && (UserApcRoutine))
322 (
PVOID*)&EventObject,
348 LockedForSynch =
TRUE;
433 CompletionInfo = *(
FileObject->CompletionContext);
450 if (CompletionInfo.
Port !=
NULL && UserApcContext !=
NULL)
479 Irp->UserEvent = EventObject;
480 Irp->Overlay.AsynchronousParameters.UserApcRoutine = UserApcRoutine;
481 Irp->Overlay.AsynchronousParameters.UserApcContext = UserApcContext;
487 Irp->AssociatedIrp.SystemBuffer =
NULL;
489 Irp->Tail.Overlay.AuxiliaryBuffer =
NULL;
529 Irp->AssociatedIrp.SystemBuffer =
576 Irp->AssociatedIrp.SystemBuffer =
599 if (!
Irp->MdlAddress)
699 Irp->Overlay.AsynchronousParameters.UserApcRoutine =
NULL;
808 Irp->Overlay.AsynchronousParameters.UserApcRoutine =
NULL;
810 Irp->AssociatedIrp.SystemBuffer =
Buffer;
818 Stack->Parameters.QueryFile.FileInformationClass = FileInfoClass;
900 FileName.Buffer = RenameInfo->FileName;
901 FileName.Length = RenameInfo->FileNameLength;
902 FileName.MaximumLength = RenameInfo->FileNameLength;
907 RenameInfo->RootDirectory,
919 FileObjectExtension =
FileObject->FileObjectExtension;
964 !RenameInfo->ReplaceIfExists &&
978 (
PVOID *)&TargetFileObject,
996 Stack->Parameters.SetFile.FileObject = TargetFileObject;
1066 while (StackDO !=
NULL)
1075 StackDO = StackDO->AttachedDevice;
1100 DriverName.
Length = DriverPathInfo->DriverNameLength;
1101 DriverName.
MaximumLength = DriverPathInfo->DriverNameLength;
1102 DriverName.
Buffer = &DriverPathInfo->DriverName[0];
1179 Irp->UserIosb = StatusBlock;
1249 Irp->UserIosb = StatusBlock;
1359 Irp->Overlay.AsynchronousParameters.UserApcRoutine =
NULL;
1585 Irp->Overlay.AsynchronousParameters.UserApcRoutine =
NULL;
1715 LockedForSync =
TRUE;
1735 Irp->Overlay.AsynchronousParameters.UserApcRoutine =
ApcRoutine;
1736 Irp->Overlay.AsynchronousParameters.UserApcContext =
ApcContext;
1842 CapturedLength = *
Length;
1869 &CapturedByteOffset,
1914 return KernelIosb.
Status;
1929 LockedForSync =
TRUE;
1946 Irp->Overlay.AsynchronousParameters.UserApcRoutine =
ApcRoutine;
1947 Irp->Overlay.AsynchronousParameters.UserApcContext =
ApcContext;
1967 *LocalLength = CapturedLength;
1968 Irp->Tail.Overlay.AuxiliaryBuffer = (
PVOID)LocalLength;
2038 if (CapturedFileName.
Length)
2048 CapturedFileName.
Length +
2054 CapturedFileName.
Length);
2077#define CHECK_LENGTH(class, struct) \
2079 if (Length < sizeof(struct)) \
2080 return STATUS_INFO_LENGTH_MISMATCH; \
2151 LockedForSynch =
TRUE;
2170 Irp->Overlay.AsynchronousParameters.UserApcRoutine =
ApcRoutine;
2171 Irp->Overlay.AsynchronousParameters.UserApcContext =
ApcContext;
2173 Irp->Tail.Overlay.AuxiliaryBuffer = AuxBuffer;
2174 Irp->AssociatedIrp.SystemBuffer =
NULL;
2183 Irp->AssociatedIrp.SystemBuffer =
2238 StackPtr->
Flags = 0;
2295 PVOID NormalContext;
2404 CurrentByteOffset =
FileObject->CurrentByteOffset;
2487 return KernelIosb.
Status;
2502 Irp->Overlay.AsynchronousParameters.UserApcRoutine =
NULL;
2506 Irp->AssociatedIrp.SystemBuffer =
NULL;
2519 Irp->AssociatedIrp.SystemBuffer =
2550 AccessBuffer =
Irp->AssociatedIrp.SystemBuffer;
2557 ModeBuffer =
Irp->AssociatedIrp.SystemBuffer;
2564 AlignmentBuffer =
Irp->AssociatedIrp.SystemBuffer;
2571 AllBuffer =
Irp->AssociatedIrp.SystemBuffer;
2663 NormalRoutine =
NULL;
2664 NormalContext =
NULL;
2723 ULONG CapturedKey = 0;
2826 if (
Key) CapturedKey = *
Key;
2830 if ((CapturedByteOffset.
QuadPart < 0) && (CapturedByteOffset.
QuadPart != -2))
2845 (
PVOID*)&EventObject,
2873 (CapturedByteOffset.
u.HighPart == -1)))
2876 CapturedByteOffset =
FileObject->CurrentByteOffset;
2887 &CapturedByteOffset,
2932 return KernelIosb.
Status;
2959 Irp->Overlay.AsynchronousParameters.UserApcRoutine =
ApcRoutine;
2960 Irp->Overlay.AsynchronousParameters.UserApcContext =
ApcContext;
2962 Irp->UserEvent = EventObject;
2966 Irp->AssociatedIrp.SystemBuffer =
NULL;
2987 Irp->AssociatedIrp.SystemBuffer =
3111 PVOID NormalContext;
3271 Irp->Overlay.AsynchronousParameters.UserApcRoutine =
NULL;
3275 Irp->AssociatedIrp.SystemBuffer =
NULL;
3288 Irp->AssociatedIrp.SystemBuffer =
3333 CompletionInfo =
Irp->AssociatedIrp.SystemBuffer;
3376 Irp->IoStatus.Information = 0;
3383 RenameInfo =
Irp->AssociatedIrp.SystemBuffer;
3509 NormalRoutine =
NULL;
3510 NormalContext =
NULL;
3617 CapturedLength = *
Length;
3635 &CapturedByteOffset,
3655 return KernelIosb.
Status;
3697 Irp->Overlay.AsynchronousParameters.UserApcRoutine =
NULL;
3714 *LocalLength = CapturedLength;
3715 Irp->Tail.Overlay.AuxiliaryBuffer = (
PVOID)LocalLength;
3781 ULONG CapturedKey = 0;
3889 if (
Key) CapturedKey = *
Key;
3893 if (CapturedByteOffset.
QuadPart < -2)
3907 CapturedByteOffset.
u.HighPart = -1;
3918 (
PVOID*)&EventObject,
3946 (CapturedByteOffset.
u.HighPart == -1)))
3949 CapturedByteOffset =
FileObject->CurrentByteOffset;
3960 &CapturedByteOffset,
4003 return KernelIosb.
Status;
4030 Irp->Overlay.AsynchronousParameters.UserApcRoutine =
ApcRoutine;
4031 Irp->Overlay.AsynchronousParameters.UserApcContext =
ApcContext;
4033 Irp->UserEvent = EventObject;
4037 Irp->AssociatedIrp.SystemBuffer =
NULL;
4060 Irp->AssociatedIrp.SystemBuffer =
4325 if (DriverPathInfo !=
NULL)
4373 Irp->Overlay.AsynchronousParameters.UserApcRoutine =
NULL;
4374 Irp->UserBuffer = FsInformation;
4375 Irp->AssociatedIrp.SystemBuffer =
NULL;
4387 Irp->AssociatedIrp.SystemBuffer =
4554 Irp->Overlay.AsynchronousParameters.UserApcRoutine =
NULL;
4555 Irp->UserBuffer = FsInformation;
4556 Irp->AssociatedIrp.SystemBuffer =
NULL;
4568 Irp->AssociatedIrp.SystemBuffer =
_In_ PVOID _In_ ULONG _Out_ PVOID _In_ ULONG _Inout_ PULONG _In_ KPROCESSOR_MODE PreviousMode
#define OBJ_NAME_PATH_SEPARATOR
#define InterlockedIncrement
#define FILE_DELETE_ON_CLOSE
_In_ ULONG _In_ BATTERY_QUERY_INFORMATION_LEVEL _In_ LONG _In_ ULONG _Out_ PULONG ReturnedLength
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
#define STATUS_NOT_IMPLEMENTED
#define NT_SUCCESS(StatCode)
UNICODE_STRING * PUNICODE_STRING
#define ExAllocatePoolWithTag(hernya, size, tag)
#define PsGetCurrentThread()
#define KeRaiseIrql(irql, oldIrql)
#define KeWaitForSingleObject(pEvt, foo, a, b, c)
#define KeInitializeEvent(pEvt, foo, foo2)
#define KeLowerIrql(oldIrql)
#define KeSetEvent(pEvt, foo, foo2)
#define NonPagedPoolCacheAligned
struct _UNICODE_STRING UNICODE_STRING
VOID NTAPI KeClearEvent(IN PKEVENT Event)
#define ExGetPreviousMode
VOID NTAPI ProbeForRead(IN CONST VOID *Address, IN SIZE_T Length, IN ULONG Alignment)
VOID NTAPI ProbeForWrite(IN PVOID Address, IN SIZE_T Length, IN ULONG Alignment)
#define FILE_WRITE_TO_END_OF_FILE
#define BooleanFlagOn(F, SF)
IN OUT PVCB IN PDEVICE_OBJECT TargetDeviceObject
IN PLARGE_INTEGER IN PLARGE_INTEGER PEPROCESS ULONG BOOLEAN BOOLEAN ExclusiveLock
IN OUT PVCB IN PDEVICE_OBJECT IN PVPB Vpb
IN PLARGE_INTEGER IN PLARGE_INTEGER PEPROCESS ULONG BOOLEAN FailImmediately
IN PDCB IN PCCB IN VBO IN OUT PULONG OUT PDIRENT OUT PBCB OUT PVBO ByteOffset
struct _FileName FileName
_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_ BOOLEAN _In_ ULONG _In_opt_ PULONG _In_ BOOLEAN RestartScan
_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_ BOOLEAN _In_ ULONG EaListLength
_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_ FS_INFORMATION_CLASS FsInformationClass
_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE FileHandle
_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_ BOOLEAN ReturnSingleEntry
_Inout_ PLIST_ENTRY _In_ PVOID _In_ PSTRING _In_ BOOLEAN _In_ BOOLEAN _In_ ULONG CompletionFilter
_Inout_ PLIST_ENTRY _In_ PVOID _In_ PSTRING _In_ BOOLEAN WatchTree
_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_ BOOLEAN _In_ ULONG _In_opt_ PULONG EaIndex
_In_ FILTER_INFORMATION_CLASS InformationClass
@ FilePositionInformation
@ FileMoveClusterInformation
@ FileDirectoryInformation
@ FileAlignmentInformation
@ FileIdBothDirectoryInformation
@ FileCompletionInformation
@ FileFullDirectoryInformation
@ FileBothDirectoryInformation
@ FileIdFullDirectoryInformation
enum _FILE_INFORMATION_CLASS FILE_INFORMATION_CLASS
#define FILE_SYNCHRONOUS_IO_NONALERT
@ FileFsDeviceInformation
@ FileFsMaximumInformation
#define FILE_NO_INTERMEDIATE_BUFFERING
#define FILE_WRITE_THROUGH
#define FILE_SEQUENTIAL_ONLY
#define FILE_SYNCHRONOUS_IO_ALERT
enum _FSINFOCLASS FS_INFORMATION_CLASS
#define FILE_OPEN_FOR_BACKUP_INTENT
VOID FASTCALL KeReleaseQueuedSpinLock(IN KSPIN_LOCK_QUEUE_NUMBER LockNumber, IN KIRQL OldIrql)
KIRQL FASTCALL KeAcquireQueuedSpinLock(IN KSPIN_LOCK_QUEUE_NUMBER LockNumber)
_Inout_ PUSB_DEVICE_HANDLE DeviceHandle
#define OBJ_KERNEL_HANDLE
#define OBJ_CASE_INSENSITIVE
struct _FILE_MODE_INFORMATION FILE_MODE_INFORMATION
#define EXCEPTION_EXECUTE_HANDLER
#define InterlockedExchangeAdd
#define InterlockedCompareExchangePointer
UCHAR IopSetFsOperationLength[]
UCHAR IopQueryOperationLength[]
UCHAR IopSetOperationLength[]
ULONG IopQueryFsOperationAccess[]
UCHAR IopQueryFsOperationLength[]
ULONG IopSetFsOperationAccess[]
ACCESS_MASK IopQueryOperationAccess[]
ACCESS_MASK IopSetOperationAccess[]
static __inline NTSTATUS IopLockFileObject(_In_ PFILE_OBJECT FileObject, _In_ KPROCESSOR_MODE WaitMode)
FORCEINLINE VOID IopQueueIrpToThread(IN PIRP Irp)
static __inline VOID IopUpdateTransferCount(IN IOP_TRANSFER_TYPE Type, IN ULONG TransferCount)
static __inline VOID IopUpdateOperationCount(IN IOP_TRANSFER_TYPE Type)
static __inline VOID IopUnlockFileObject(IN PFILE_OBJECT FileObject)
NTSTATUS NTAPI NtFsControlFile(IN HANDLE DeviceHandle, IN HANDLE Event OPTIONAL, IN PIO_APC_ROUTINE UserApcRoutine OPTIONAL, IN PVOID UserApcContext OPTIONAL, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG IoControlCode, IN PVOID InputBuffer, IN ULONG InputBufferLength OPTIONAL, OUT PVOID OutputBuffer, IN ULONG OutputBufferLength OPTIONAL)
NTSTATUS NTAPI NtReadFileScatter(IN HANDLE FileHandle, IN HANDLE Event OPTIONAL, IN PIO_APC_ROUTINE UserApcRoutine OPTIONAL, IN PVOID UserApcContext OPTIONAL, OUT PIO_STATUS_BLOCK UserIoStatusBlock, IN FILE_SEGMENT_ELEMENT BufferDescription[], IN ULONG BufferLength, IN PLARGE_INTEGER ByteOffset, IN PULONG Key OPTIONAL)
NTSTATUS NTAPI NtFlushBuffersFile(IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock)
NTSTATUS NTAPI IopQueryDeviceInformation(IN PFILE_OBJECT FileObject, IN ULONG InformationClass, IN ULONG Length, OUT PVOID Information, OUT PULONG ReturnedLength, IN BOOLEAN File)
NTSTATUS NTAPI NtDeviceIoControlFile(IN HANDLE DeviceHandle, IN HANDLE Event OPTIONAL, IN PIO_APC_ROUTINE UserApcRoutine OPTIONAL, IN PVOID UserApcContext OPTIONAL, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG IoControlCode, IN PVOID InputBuffer, IN ULONG InputBufferLength OPTIONAL, OUT PVOID OutputBuffer, IN ULONG OutputBufferLength OPTIONAL)
NTSTATUS NTAPI NtQueryInformationFile(IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PVOID FileInformation, IN ULONG Length, IN FILE_INFORMATION_CLASS FileInformationClass)
NTSTATUS NTAPI NtSetQuotaInformationFile(IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PVOID Buffer, IN ULONG BufferLength)
NTSTATUS NTAPI NtSetVolumeInformationFile(IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PVOID FsInformation, IN ULONG Length, IN FS_INFORMATION_CLASS FsInformationClass)
NTSTATUS NTAPI NtSetEaFile(IN HANDLE FileHandle, IN PIO_STATUS_BLOCK IoStatusBlock, IN PVOID EaBuffer, IN ULONG EaBufferSize)
NTSTATUS NTAPI NtWriteFile(IN HANDLE FileHandle, IN HANDLE Event OPTIONAL, IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, IN PVOID ApcContext OPTIONAL, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PVOID Buffer, IN ULONG Length, IN PLARGE_INTEGER ByteOffset OPTIONAL, IN PULONG Key OPTIONAL)
NTSTATUS NTAPI NtSetInformationFile(IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PVOID FileInformation, IN ULONG Length, IN FILE_INFORMATION_CLASS FileInformationClass)
volatile LONG IoPageReadIrpAllocationFailure
NTSTATUS NTAPI IopOpenLinkOrRenameTarget(OUT PHANDLE Handle, IN PIRP Irp, IN PFILE_RENAME_INFORMATION RenameInfo, IN PFILE_OBJECT FileObject)
NTSTATUS NTAPI NtRequestDeviceWakeup(IN HANDLE DeviceHandle)
NTSTATUS NTAPI NtLockFile(IN HANDLE FileHandle, IN HANDLE EventHandle OPTIONAL, IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, IN PVOID ApcContext OPTIONAL, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PLARGE_INTEGER ByteOffset, IN PLARGE_INTEGER Length, IN ULONG Key, IN BOOLEAN FailImmediately, IN BOOLEAN ExclusiveLock)
NTSTATUS NTAPI NtNotifyChangeDirectoryFile(IN HANDLE FileHandle, IN HANDLE EventHandle OPTIONAL, IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, IN PVOID ApcContext OPTIONAL, OUT PIO_STATUS_BLOCK IoStatusBlock, OUT PVOID Buffer, IN ULONG BufferSize, IN ULONG CompletionFilter, IN BOOLEAN WatchTree)
static BOOLEAN IopVerifyDriverObjectOnStack(IN PDEVICE_OBJECT DeviceObject, IN PDRIVER_OBJECT DriverObject)
NTSTATUS NTAPI NtReadFile(IN HANDLE FileHandle, IN HANDLE Event OPTIONAL, IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, IN PVOID ApcContext OPTIONAL, OUT PIO_STATUS_BLOCK IoStatusBlock, OUT PVOID Buffer, IN ULONG Length, IN PLARGE_INTEGER ByteOffset OPTIONAL, IN PULONG Key OPTIONAL)
NTSTATUS NTAPI IopGetBasicInformationFile(IN PFILE_OBJECT FileObject, OUT PFILE_BASIC_INFORMATION BasicInfo)
volatile LONG IoPageReadNonPagefileIrpAllocationFailure
NTSTATUS NTAPI IopDeviceFsIoControl(IN HANDLE DeviceHandle, IN HANDLE Event OPTIONAL, IN PIO_APC_ROUTINE UserApcRoutine OPTIONAL, IN PVOID UserApcContext OPTIONAL, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG IoControlCode, IN PVOID InputBuffer, IN ULONG InputBufferLength OPTIONAL, OUT PVOID OutputBuffer, IN ULONG OutputBufferLength OPTIONAL, IN BOOLEAN IsDevIoCtl)
NTSTATUS NTAPI NtQueryVolumeInformationFile(IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock, OUT PVOID FsInformation, IN ULONG Length, IN FS_INFORMATION_CLASS FsInformationClass)
NTSTATUS NTAPI IopPerformSynchronousRequest(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp, IN PFILE_OBJECT FileObject, IN BOOLEAN Deferred, IN KPROCESSOR_MODE PreviousMode, IN BOOLEAN SynchIo, IN IOP_TRANSFER_TYPE TransferType)
static BOOLEAN IopGetMountFlag(IN PDEVICE_OBJECT DeviceObject)
NTSTATUS NTAPI NtCancelDeviceWakeupRequest(IN HANDLE DeviceHandle)
NTSTATUS NTAPI IoQueryFileInformation(IN PFILE_OBJECT FileObject, IN FILE_INFORMATION_CLASS FileInformationClass, IN ULONG Length, OUT PVOID FileInformation, OUT PULONG ReturnedLength)
NTSTATUS NTAPI IoPageRead(IN PFILE_OBJECT FileObject, IN PMDL Mdl, IN PLARGE_INTEGER Offset, IN PKEVENT Event, IN PIO_STATUS_BLOCK StatusBlock)
NTSTATUS NTAPI NtQueryDirectoryFile(IN HANDLE FileHandle, IN HANDLE EventHandle OPTIONAL, IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, IN PVOID ApcContext OPTIONAL, OUT PIO_STATUS_BLOCK IoStatusBlock, OUT PVOID FileInformation, IN ULONG Length, IN FILE_INFORMATION_CLASS FileInformationClass, IN BOOLEAN ReturnSingleEntry, IN PUNICODE_STRING FileName OPTIONAL, IN BOOLEAN RestartScan)
NTSTATUS NTAPI NtQueryEaFile(IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock, OUT PVOID Buffer, IN ULONG Length, IN BOOLEAN ReturnSingleEntry, IN PVOID EaList OPTIONAL, IN ULONG EaListLength, IN PULONG EaIndex OPTIONAL, IN BOOLEAN RestartScan)
NTSTATUS NTAPI IoQueryVolumeInformation(IN PFILE_OBJECT FileObject, IN FS_INFORMATION_CLASS FsInformationClass, IN ULONG Length, OUT PVOID FsInformation, OUT PULONG ReturnedLength)
static ULONG IopGetFileMode(IN PFILE_OBJECT FileObject)
NTSTATUS NTAPI IoSetInformation(IN PFILE_OBJECT FileObject, IN FILE_INFORMATION_CLASS FileInformationClass, IN ULONG Length, IN PVOID FileInformation)
VOID NTAPI IopCleanupAfterException(IN PFILE_OBJECT FileObject, IN PIRP Irp OPTIONAL, IN PKEVENT Event OPTIONAL, IN PKEVENT LocalEvent OPTIONAL)
NTSTATUS NTAPI IopGetFileInformation(IN PFILE_OBJECT FileObject, IN ULONG Length, IN FILE_INFORMATION_CLASS FileInfoClass, OUT PVOID Buffer, OUT PULONG ReturnedLength)
NTSTATUS NTAPI IoSynchronousPageWrite(IN PFILE_OBJECT FileObject, IN PMDL Mdl, IN PLARGE_INTEGER Offset, IN PKEVENT Event, IN PIO_STATUS_BLOCK StatusBlock)
static NTSTATUS IopGetDriverPathInformation(IN PFILE_OBJECT FileObject, IN PFILE_FS_DRIVER_PATH_INFORMATION DriverPathInfo, IN ULONG Length)
NTSTATUS NTAPI IopFinalizeAsynchronousIo(IN NTSTATUS SynchStatus, IN PKEVENT Event, IN PIRP Irp, IN KPROCESSOR_MODE PreviousMode, IN PIO_STATUS_BLOCK KernelIosb, OUT PIO_STATUS_BLOCK IoStatusBlock)
#define CHECK_LENGTH(class, struct)
NTSTATUS NTAPI NtQueryQuotaInformationFile(IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock, OUT PVOID Buffer, IN ULONG Length, IN BOOLEAN ReturnSingleEntry, IN PVOID SidList OPTIONAL, IN ULONG SidListLength, IN PSID StartSid OPTIONAL, IN BOOLEAN RestartScan)
NTSTATUS NTAPI NtWriteFileGather(IN HANDLE FileHandle, IN HANDLE Event OPTIONAL, IN PIO_APC_ROUTINE UserApcRoutine OPTIONAL, IN PVOID UserApcContext OPTIONAL, OUT PIO_STATUS_BLOCK UserIoStatusBlock, IN FILE_SEGMENT_ELEMENT BufferDescription[], IN ULONG BufferLength, IN PLARGE_INTEGER ByteOffset, IN PULONG Key OPTIONAL)
NTSTATUS NTAPI NtUnlockFile(IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PLARGE_INTEGER ByteOffset, IN PLARGE_INTEGER Length, IN ULONG Key OPTIONAL)
POBJECT_TYPE IoFileObjectType
VOID NTAPI MmProbeAndLockPages(IN PMDL Mdl, IN KPROCESSOR_MODE AccessMode, IN LOCK_OPERATION Operation)
#define ExFreePoolWithTag(_P, _T)
static OUT PIO_STATUS_BLOCK IoStatusBlock
static OUT PIO_STATUS_BLOCK OUT PVOID FileInformation
static OUT PIO_STATUS_BLOCK OUT PVOID IN ULONG IN FILE_INFORMATION_CLASS FileInformationClass
#define InitializeObjectAttributes(p, n, a, r, s)
#define IO_METHOD_FROM_CTL_CODE(C)
#define KeGetPreviousMode()
_In_opt_ HANDLE _In_opt_ PIO_APC_ROUTINE _In_opt_ PVOID ApcContext
_In_opt_ HANDLE _In_opt_ PIO_APC_ROUTINE ApcRoutine
#define IO_COMPLETION_MODIFY_STATE
#define FO_FILE_OBJECT_HAS_EXTENSION
VOID(NTAPI * PKNORMAL_ROUTINE)(IN PVOID NormalContext OPTIONAL, IN PVOID SystemArgument1 OPTIONAL, IN PVOID SystemArgument2 OPTIONAL)
_In_ HANDLE _In_opt_ HANDLE _Out_opt_ PHANDLE TargetHandle
DECLSPEC_NORETURN NTSYSAPI VOID NTAPI RtlRaiseStatus(_In_ NTSTATUS Status)
#define FILE_USE_FILE_POINTER_POSITION
#define FILE_LIST_DIRECTORY
struct _FILE_FS_DEVICE_INFORMATION FILE_FS_DEVICE_INFORMATION
struct _FILE_POSITION_INFORMATION FILE_POSITION_INFORMATION
struct _FILE_ALIGNMENT_INFORMATION FILE_ALIGNMENT_INFORMATION
#define FILE_DEVICE_IS_MOUNTED
#define METHOD_OUT_DIRECT
#define FILE_ATTRIBUTE_DIRECTORY
struct _FILE_POSITION_INFORMATION * PFILE_POSITION_INFORMATION
#define FILE_ADD_SUBDIRECTORY
#define FSCTL_DISMOUNT_VOLUME
VOID(* PIO_APC_ROUTINE)(IN PVOID ApcContext, IN PIO_STATUS_BLOCK IoStatusBlock, IN ULONG Reserved)
_In_ ULONG _In_ ULONG Offset
_In_ ULONG _In_ ULONG _In_ ULONG Length
#define FileFsDriverPathInformation
POBJECT_TYPE ExEventObjectType
enum _IOP_TRANSFER_TYPE IOP_TRANSFER_TYPE
VOID NTAPI IopCompleteRequest(IN PKAPC Apc, IN PKNORMAL_ROUTINE *NormalRoutine, IN PVOID *NormalContext, IN PVOID *SystemArgument1, IN PVOID *SystemArgument2)
POBJECT_TYPE IoCompletionType
PIRP NTAPI IopAllocateReserveIrp(IN CCHAR StackSize)
NTSTATUS NTAPI IopCleanupFailedIrp(IN PFILE_OBJECT FileObject, IN PKEVENT EventObject, IN PVOID Buffer OPTIONAL)
NTSTATUS NTAPI IoGetRelatedTargetDevice(IN PFILE_OBJECT FileObject, OUT PDEVICE_OBJECT *DeviceObject)
VOID NTAPI IopAbortInterruptedIrp(IN PKEVENT EventObject, IN PIRP Irp)
#define IOTRACE(x, fmt,...)
NTSTATUS NTAPI IoSetIoCompletion(IN PVOID IoCompletion, IN PVOID KeyContext, IN PVOID ApcContext, IN NTSTATUS IoStatus, IN ULONG_PTR IoStatusInformation, IN BOOLEAN Quota)
PDEVICE_OBJECT NTAPI IopGetDeviceAttachmentBase(IN PDEVICE_OBJECT DeviceObject)
BOOLEAN NTAPI MmIsFileObjectAPagingFile(PFILE_OBJECT FileObject)
PDEVICE_OBJECT NTAPI IoGetRelatedDeviceObject(IN PFILE_OBJECT FileObject)
PDEVICE_OBJECT NTAPI IoGetAttachedDevice(PDEVICE_OBJECT DeviceObject)
POBJECT_TYPE IoDriverObjectType
NTSTATUS NTAPI IoCreateFile(OUT PHANDLE FileHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PLARGE_INTEGER AllocationSize OPTIONAL, IN ULONG FileAttributes, IN ULONG ShareAccess, IN ULONG Disposition, IN ULONG CreateOptions, IN PVOID EaBuffer OPTIONAL, IN ULONG EaLength, IN CREATE_FILE_TYPE CreateFileType, IN PVOID ExtraCreateParameters OPTIONAL, IN ULONG Options)
NTSTATUS NTAPI IoCreateFileSpecifyDeviceObjectHint(OUT PHANDLE FileHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PLARGE_INTEGER AllocationSize OPTIONAL, IN ULONG FileAttributes, IN ULONG ShareAccess, IN ULONG Disposition, IN ULONG CreateOptions, IN PVOID EaBuffer OPTIONAL, IN ULONG EaLength, IN CREATE_FILE_TYPE CreateFileType, IN PVOID ExtraCreateParameters OPTIONAL, IN ULONG Options, IN PVOID DeviceObject)
PIRP NTAPI IoAllocateIrp(IN CCHAR StackSize, IN BOOLEAN ChargeQuota)
VOID NTAPI IoFreeIrp(IN PIRP Irp)
VOID NTAPI IoReleaseVpbSpinLock(IN KIRQL Irql)
VOID NTAPI IoAcquireVpbSpinLock(OUT PKIRQL Irql)
#define STATUS_INVALID_INFO_CLASS
#define STATUS_NOT_SAME_DEVICE
FAST_IO_DISPATCH FastIoDispatch
NTSTATUS NTAPI ObReferenceFileObjectForWrite(IN HANDLE Handle, IN KPROCESSOR_MODE AccessMode, OUT PFILE_OBJECT *FileObject, OUT POBJECT_HANDLE_INFORMATION HandleInformation)
NTSTATUS NTAPI ObCloseHandle(IN HANDLE Handle, IN KPROCESSOR_MODE AccessMode)
NTSTATUS NTAPI ObReferenceObjectByName(IN PUNICODE_STRING ObjectPath, IN ULONG Attributes, IN PACCESS_STATE PassedAccessState, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, IN OUT PVOID ParseContext, OUT PVOID *ObjectPtr)
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
NTSTATUS NTAPI IoReportTargetDeviceChange(IN PDEVICE_OBJECT PhysicalDeviceObject, IN PVOID NotificationStructure)
#define FILE_DEVICE_NETWORK_FILE_SYSTEM
#define _SEH2_GetExceptionCode()
#define _SEH2_EXCEPT(...)
#define _SEH2_YIELD(__stmt)
#define IRP_MJ_DIRECTORY_CONTROL
#define IRP_MN_QUERY_DIRECTORY
#define IRP_MN_NOTIFY_CHANGE_DIRECTORY
#define IRP_MJ_DEVICE_CONTROL
#define IRP_MJ_QUERY_VOLUME_INFORMATION
#define IRP_MJ_LOCK_CONTROL
#define IRP_MJ_SET_INFORMATION
#define IRP_MJ_QUERY_INFORMATION
#define ProbeForReadUnicodeString(Ptr)
#define ProbeForWriteIoStatusBlock(Ptr)
#define ProbeForReadUlong(Ptr)
#define ProbeForReadLargeInteger(Ptr)
struct _FILE_ACCESS_INFORMATION FILE_ACCESS_INFORMATION
#define FileAccessInformation
#define FileStandardInformation
#define STATUS_END_OF_FILE
#define STATUS_BUFFER_OVERFLOW
PULONG MinorVersion OPTIONAL
PFAST_IO_QUERY_STANDARD_INFO FastIoQueryStandardInfo
PFAST_IO_WRITE FastIoWrite
PFAST_IO_DEVICE_CONTROL FastIoDeviceControl
PFAST_IO_QUERY_BASIC_INFO FastIoQueryBasicInfo
PFAST_IO_UNLOCK_SINGLE FastIoUnlockSingle
PDEVICE_OBJECT TopDeviceObjectHint
struct _IO_STACK_LOCATION::@4104::@4118 SetVolume
struct _IO_STACK_LOCATION::@4104::@4117 QueryVolume
struct _IO_STACK_LOCATION::@4104::@4120 LockControl
struct _IO_STACK_LOCATION::@4104::@4111 NotifyDirectory
struct _IO_STACK_LOCATION::@4104::@4108 Read
struct _IO_STACK_LOCATION::@4104::@4109 Write
union _IO_STACK_LOCATION::@1611 Parameters
struct _IO_STACK_LOCATION::@4104::@4113 QueryFile
struct _IO_STACK_LOCATION::@4104::@4110 QueryDirectory
struct _IO_STACK_LOCATION::@4104::@4114 SetFile
struct _IO_STACK_LOCATION::@1611::@1612 DeviceIoControl
#define FIELD_OFFSET(t, f)
#define RtlCopyMemory(Destination, Source, Length)
#define STATUS_INVALID_DEVICE_REQUEST
#define STATUS_ACCESS_DENIED
#define STATUS_INVALID_PARAMETER
#define STATUS_OBJECT_NAME_COLLISION
#define STATUS_INFO_LENGTH_MISMATCH
#define STATUS_INSUFFICIENT_RESOURCES
struct _LARGE_INTEGER::@2379 u
_In_ PDEVICE_OBJECT DeviceObject
_Must_inspect_result_ _In_ WDFDEVICE _In_ ULONG _In_ ACCESS_MASK DesiredAccess
_Must_inspect_result_ _In_ WDFDEVICE _In_ DEVICE_REGISTRY_PROPERTY _In_ _Strict_type_match_ POOL_TYPE PoolType
_In_ WDFREQUEST _In_ WDFFILEOBJECT FileObject
_Must_inspect_result_ _In_ WDFDEVICE _In_ PIRP _In_ WDFQUEUE Queue
_Must_inspect_result_ _In_ WDFDEVICE _In_ DEVICE_REGISTRY_PROPERTY _In_ ULONG BufferLength
_In_ WDFDEVICE _In_ PVOID _In_opt_ PMDL Mdl
_Must_inspect_result_ _In_ PDRIVER_OBJECT DriverObject
_In_ WDFREQUEST _In_ size_t _In_ size_t _In_ ULONG IoControlCode
_In_ WDFREQUEST _In_ size_t OutputBufferLength
_In_ WDFREQUEST _In_ size_t _In_ size_t InputBufferLength
_Must_inspect_result_ _In_ WDFIOTARGET _In_opt_ WDFREQUEST _In_opt_ PWDF_MEMORY_DESCRIPTOR OutputBuffer
_Must_inspect_result_ _In_ WDFIOTARGET _In_opt_ WDFREQUEST _In_opt_ PWDF_MEMORY_DESCRIPTOR InputBuffer
_In_ WDFMEMORY _Out_opt_ size_t * BufferSize
_In_ WDFREQUEST _In_opt_ PFN_WDF_REQUEST_COMPLETION_ROUTINE _In_opt_ __drv_aliasesMem WDFCONTEXT CompletionContext
_In_ WDFREQUEST _In_ PIO_STACK_LOCATION Stack
_In_ WDFREQUEST _In_ NTSTATUS _In_ ULONG_PTR Information
#define EVENT_MODIFY_STATE
#define ExAllocatePoolWithQuotaTag(a, b, c)
__drv_aliasesMem FORCEINLINE PIO_STACK_LOCATION IoGetNextIrpStackLocation(_In_ PIRP Irp)
_In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _Out_ PIO_STATUS_BLOCK _In_opt_ PLARGE_INTEGER _In_ ULONG _In_ ULONG _In_ ULONG _In_ ULONG _In_opt_ PVOID EaBuffer
_Out_ PHANDLE EventHandle
_In_ PVOID NotificationStructure
#define IRP_DEALLOCATE_BUFFER
#define FO_SEQUENTIAL_ONLY
#define IRP_SYNCHRONOUS_API
#define IO_FORCE_ACCESS_CHECK
#define IO_OPEN_TARGET_DIRECTORY
#define IRP_INPUT_OPERATION
#define IO_NO_PARAMETER_CHECKING
#define IRP_MJ_FILE_SYSTEM_CONTROL
struct _FILE_MOVE_CLUSTER_INFORMATION * PFILE_MOVE_CLUSTER_INFORMATION
#define IRP_OB_QUERY_NAME
#define IRP_MJ_SET_VOLUME_INFORMATION
#define FO_OPENED_CASE_SENSITIVE
#define IRP_WRITE_OPERATION
#define SL_RETURN_SINGLE_ENTRY
#define IRP_DEFER_IO_COMPLETION
#define FO_DIRECT_DEVICE_OPEN
#define IRP_MJ_FLUSH_BUFFERS
#define IRP_READ_OPERATION
#define FO_NO_INTERMEDIATE_BUFFERING
#define FO_DELETE_ON_CLOSE
struct _TARGET_DEVICE_CUSTOM_NOTIFICATION TARGET_DEVICE_CUSTOM_NOTIFICATION
#define FILE_NOTIFY_VALID_MASK
#define SL_FAIL_IMMEDIATELY
#define FO_SYNCHRONOUS_IO
#define IRP_MN_UNLOCK_SINGLE
struct _FILE_FS_DRIVER_PATH_INFORMATION FILE_FS_DRIVER_PATH_INFORMATION
#define IRP_SYNCHRONOUS_PAGING_IO
#define SL_EXCLUSIVE_LOCK
struct _FILE_FS_DRIVER_PATH_INFORMATION * PFILE_FS_DRIVER_PATH_INFORMATION
_Requires_lock_held_ Interrupt _Releases_lock_ Interrupt _In_ _IRQL_restores_ KIRQL OldIrql
@ LockQueueIoDatabaseLock
#define MmGetMdlByteCount(_Mdl)
#define MmGetMdlVirtualAddress(_Mdl)
#define BYTES_TO_PAGES(Size)
_In_ ACCESS_MASK _In_opt_ POBJECT_TYPE _In_ KPROCESSOR_MODE _Out_ PVOID _Out_opt_ POBJECT_HANDLE_INFORMATION HandleInformation
#define ObDereferenceObject
#define ObReferenceObject
#define PsGetCurrentProcess
_Out_ PIO_STATUS_BLOCK _In_ ULONG _In_ BOOLEAN _In_ ULONG _In_opt_ PSID StartSid
_Out_ PIO_STATUS_BLOCK _In_ ULONG _In_ BOOLEAN _In_ ULONG SidListLength