27 if (RealNotifySync->OwningThread != CurrentThread)
30 RealNotifySync->OwningThread = CurrentThread;
33 RealNotifySync->OwnerCount++;
43 RealNotifySync->OwnerCount--;
45 if (!RealNotifySync->OwnerCount)
48 RealNotifySync->OwningThread = (
ULONG_PTR)0;
52#define FsRtlNotifyGetLastPartOffset(FullLen, TargLen, Type, Chr) \
53 for (FullPosition = 0; FullPosition < FullLen; ++FullPosition) \
54 if (((Type)NotifyChange->FullDirectoryName->Buffer)[FullPosition] == Chr) \
55 ++FullNumberOfParts; \
56 for (LastPartOffset = 0; LastPartOffset < TargLen; ++LastPartOffset) { \
57 if ( ((Type)TargetDirectory.Buffer)[LastPartOffset] == Chr) { \
58 ++TargetNumberOfParts; \
59 if (TargetNumberOfParts == FullNumberOfParts) \
93 Irp->IoStatus.Information = 0;
112 NotifyChange->
Buffer ==
Irp->AssociatedIrp.SystemBuffer))
170 PoolQuotaCharged =
FALSE;
176 PoolQuotaCharged =
TRUE;
190 if (PoolQuotaCharged)
270 NextEntry = NextEntry->
Flink)
297 NextEntry = NextEntry->
Flink)
346 if (!NotifyChange->AllocatedBuffer)
349 NotifyChange->Buffer =
NULL;
357 if (
Irp->AssociatedIrp.SystemBuffer)
359 Buffer =
Irp->AssociatedIrp.SystemBuffer;
360 goto CopyAndComplete;
366 goto CopyAndComplete;
372 goto CopyAndComplete;
376 Irp->AssociatedIrp.SystemBuffer = NotifyChange->AllocatedBuffer;
378 goto ReleaseAndComplete;
395 if (NotifyChange->AllocatedBuffer !=
Irp->AssociatedIrp.SystemBuffer &&
396 NotifyChange->AllocatedBuffer)
402 NotifyChange->AllocatedBuffer = 0;
403 NotifyChange->ThisBufferLength = 0;
405 NotifyChange->Buffer =
NULL;
428 NotifyChange->DataLength = 0;
429 NotifyChange->LastEntry = 0;
461 Irp->IoStatus.Information = 0;
507 ULONG AlreadyWritten = 0, ResultSize;
524 if (ParentName->Length)
528 AlreadyWritten = ParentName->Length +
sizeof(
WCHAR);
542 if (!ParentName->Length)
550 &ResultSize, ParentName->Buffer,
553 AlreadyWritten = ResultSize +
sizeof(
WCHAR);
561 AlreadyWritten += ResultSize;
792 DPRINT(
"FsRtlNotifyFilterChangeDirectory(): %p, %p, %p, %wZ, %u, %u, %u, %p, %p, %p, %p\n",
846 NotifyChange->
Flags &= ~NOTIFY_IMMEDIATELY;
1016 BOOLEAN IsStream, IsParent, PoolQuotaCharged;
1018 ULONG NumberOfBytes, TargetNumberOfParts, FullNumberOfParts, LastPartOffset, ParentNameOffset, ParentNameLength;
1021 TargetDirectory.Length = 0;
1022 TargetDirectory.MaximumLength = 0;
1023 TargetDirectory.Buffer =
NULL;
1027 ParentName.Length = 0;
1028 ParentName.MaximumLength = 0;
1029 ParentName.Buffer =
NULL;
1034 DPRINT(
"FsRtlNotifyFilterReportChange(%p, %p, %p, %u, %p, %p, %p, %x, %x, %p, %p)\n",
1052 NextEntry = NextEntry->
Flink)
1075 IntNormalizedParentName.MaximumLength =
1080 IntNormalizedParentName.MaximumLength =
1160 ParentName.Buffer =
NULL;
1161 ParentName.Length = 0;
1196 ParentName.Length = 0;
1207 if (TargetDirectory.Buffer ==
NULL)
1215 TargetDirectory.MaximumLength = TargetDirectory.Length;
1218 TargetNumberOfParts = 0;
1221 FullNumberOfParts = 1;
1225 TargetDirectory.Length,
PSTR,
'\\');
1230 TargetDirectory.Length /
sizeof(
WCHAR),
PWSTR,
L'\\');
1236 ParentNameOffset = NotifyChange->
CharacterSize + LastPartOffset;
1237 ParentName.Buffer = &TargetDirectory.Buffer[ParentNameOffset];
1238 ParentNameLength = TargetDirectory.Length;
1247 ParentNameLength -= ParentNameOffset;
1248 ParentName.Length = ParentNameLength;
1249 ParentName.MaximumLength = ParentNameLength;
1320 FileNotifyInfo =
NULL;
1326 NotifyChange->
LastEntry = AlignedDataLength;
1333 if (
Irp->AssociatedIrp.SystemBuffer !=
NULL)
1337 else if (
Irp->MdlAddress !=
NULL)
1353 PoolQuotaCharged =
FALSE;
1358 PoolQuotaCharged =
TRUE;
1367 if (PoolQuotaCharged)
1426 NotifyChange->
Flags &= ~NOTIFY_LATER;
1602 *NotifySync = RealNotifySync;
static PIO_STACK_LOCATION IoGetCurrentIrpStackLocation(PIRP Irp)
#define InterlockedIncrement
#define InterlockedDecrement
_In_ ULONG _In_opt_ WDFREQUEST _In_opt_ PVOID _In_ size_t _In_ PVOID _In_ size_t _Out_ size_t * DataLength
#define RemoveEntryList(Entry)
#define InsertTailList(ListHead, Entry)
#define ExAllocatePoolWithTag(hernya, size, tag)
#define IsListEmpty(ListHead)
#define RemoveHeadList(ListHead)
#define InitializeListHead(ListHead)
#define ROUND_UP(n, align)
_Inout_ PLIST_ENTRY _In_ PVOID _In_ PSTRING _In_ BOOLEAN _In_ BOOLEAN _In_ ULONG _In_ PFLT_CALLBACK_DATA _In_opt_ PCHECK_FOR_TRAVERSE_ACCESS TraverseCallback
_Inout_ PLIST_ENTRY _In_ PVOID _In_ PSTRING _In_ BOOLEAN _In_ BOOLEAN _In_ ULONG _In_ PFLT_CALLBACK_DATA _In_opt_ PCHECK_FOR_TRAVERSE_ACCESS _In_opt_ PSECURITY_SUBJECT_CONTEXT _In_opt_ PFILTER_REPORT_CHANGE FilterCallback
_Inout_ PLIST_ENTRY _In_ PVOID _In_ PSTRING FullDirectoryName
_Inout_ PLIST_ENTRY _In_ PVOID _In_ PSTRING _In_ BOOLEAN _In_ BOOLEAN _In_ ULONG CompletionFilter
_Inout_ PLIST_ENTRY _In_ PVOID _In_ PSTRING _In_ BOOLEAN WatchTree
_Inout_ PLIST_ENTRY _In_ PVOID _In_ PSTRING _In_ BOOLEAN _In_ BOOLEAN IgnoreBuffer
_Inout_ PLIST_ENTRY NotifyList
_Inout_ PLIST_ENTRY _In_ PVOID _In_ PSTRING _In_ BOOLEAN _In_ BOOLEAN _In_ ULONG _In_ PFLT_CALLBACK_DATA _In_opt_ PCHECK_FOR_TRAVERSE_ACCESS _In_opt_ PSECURITY_SUBJECT_CONTEXT SubjectContext
_Inout_ PLIST_ENTRY _In_ PVOID FsContext
#define DELETE_IN_PROCESS
#define CLEANUP_IN_PROCESS
#define NOTIFY_IMMEDIATELY
struct _REAL_NOTIFY_SYNC * PREAL_NOTIFY_SYNC
struct _NOTIFY_CHANGE * PNOTIFY_CHANGE
_In_ PLIST_ENTRY _In_ PSTRING _In_ USHORT _In_opt_ PSTRING _In_opt_ PSTRING _In_ ULONG _In_ ULONG _In_opt_ PVOID TargetContext
_In_ PLIST_ENTRY _In_ PSTRING _In_ USHORT TargetNameOffset
_In_ PLIST_ENTRY _In_ PSTRING _In_ USHORT _In_opt_ PSTRING _In_opt_ PSTRING NormalizedParentName
_In_ PLIST_ENTRY _In_ PSTRING _In_ USHORT _In_opt_ PSTRING _In_opt_ PSTRING _In_ ULONG _In_ ULONG _In_opt_ PVOID _In_opt_ PVOID FilterContext
_In_ PLIST_ENTRY _In_ PVOID _In_ PSTRING _In_ BOOLEAN _In_ BOOLEAN _In_ ULONG _In_opt_ PIRP NotifyIrp
_In_ PLIST_ENTRY _In_ PSTRING FullTargetName
_In_ PLIST_ENTRY _In_ PSTRING _In_ USHORT _In_opt_ PSTRING StreamName
_In_ PLIST_ENTRY _In_ PSTRING _In_ USHORT _In_opt_ PSTRING _In_opt_ PSTRING _In_ ULONG FilterMatch
BOOLEAN(NTAPI * PCHECK_FOR_TRAVERSE_ACCESS)(_In_ PVOID NotifyContext, _In_opt_ PVOID TargetContext, _In_ PSECURITY_SUBJECT_CONTEXT SubjectContext)
BOOLEAN(NTAPI * PFILTER_REPORT_CHANGE)(_In_ PVOID NotifyContext, _In_ PVOID FilterContext)
#define KeGetCurrentThread
#define EXCEPTION_EXECUTE_HANDLER
IoSetCancelRoutine(Irp, CancelRoutine)
#define RtlEqualMemory(dst, src, len)
#define ExFreePoolWithTag(_P, _T)
_Use_decl_annotations_ NTSTATUS NTAPI RtlOemToUnicodeN(_Out_ PWCHAR UnicodeString, _In_ ULONG UnicodeSize, _Out_opt_ PULONG ResultSize, _In_ PCCH OemString, _In_ ULONG OemSize)
VOID FASTCALL ExReleaseFastMutexUnsafe(IN OUT PFAST_MUTEX FastMutex)
VOID FASTCALL ExAcquireFastMutexUnsafe(IN OUT PFAST_MUTEX FastMutex)
VOID NTAPI FsRtlCancelNotify(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
VOID NTAPI FsRtlNotifyFullReportChange(IN PNOTIFY_SYNC NotifySync, IN PLIST_ENTRY NotifyList, IN PSTRING FullTargetName, IN USHORT TargetNameOffset, IN PSTRING StreamName OPTIONAL, IN PSTRING NormalizedParentName OPTIONAL, IN ULONG FilterMatch, IN ULONG Action, IN PVOID TargetContext)
VOID NTAPI FsRtlNotifyUninitializeSync(IN PNOTIFY_SYNC *NotifySync)
BOOLEAN FsRtlNotifySetCancelRoutine(IN PIRP Irp, IN PNOTIFY_CHANGE NotifyChange OPTIONAL)
VOID NTAPI FsRtlNotifyCleanup(IN PNOTIFY_SYNC NotifySync, IN PLIST_ENTRY NotifyList, IN PVOID FsContext)
VOID FsRtlNotifyCompleteIrpList(IN PNOTIFY_CHANGE NotifyChange, IN NTSTATUS Status)
VOID FsRtlNotifyCompleteIrp(IN PIRP Irp, IN PNOTIFY_CHANGE NotifyChange, IN ULONG DataLength, IN NTSTATUS Status, IN BOOLEAN SkipCompletion)
VOID NTAPI FsRtlNotifyChangeDirectory(IN PNOTIFY_SYNC NotifySync, IN PVOID FsContext, IN PSTRING FullDirectoryName, IN PLIST_ENTRY NotifyList, IN BOOLEAN WatchTree, IN ULONG CompletionFilter, IN PIRP NotifyIrp)
FORCEINLINE VOID FsRtlNotifyReleaseFastMutex(IN PREAL_NOTIFY_SYNC RealNotifySync)
VOID FsRtlCheckNotifyForDelete(IN PLIST_ENTRY NotifyList, IN PVOID FsContext)
VOID NTAPI FsRtlNotifyFilterChangeDirectory(IN PNOTIFY_SYNC NotifySync, IN PLIST_ENTRY NotifyList, IN PVOID FsContext, IN PSTRING FullDirectoryName, IN BOOLEAN WatchTree, IN BOOLEAN IgnoreBuffer, IN ULONG CompletionFilter, IN PIRP NotifyIrp, IN PCHECK_FOR_TRAVERSE_ACCESS TraverseCallback OPTIONAL, IN PSECURITY_SUBJECT_CONTEXT SubjectContext OPTIONAL, IN PFILTER_REPORT_CHANGE FilterCallback OPTIONAL)
PNOTIFY_CHANGE FsRtlIsNotifyOnList(IN PLIST_ENTRY NotifyList, IN PVOID FsContext)
BOOLEAN FsRtlNotifyUpdateBuffer(OUT PFILE_NOTIFY_INFORMATION OutputBuffer, IN ULONG Action, IN PSTRING ParentName, IN PSTRING TargetName, IN PSTRING StreamName, IN BOOLEAN IsUnicode, IN ULONG DataLength)
FORCEINLINE VOID FsRtlNotifyAcquireFastMutex(IN PREAL_NOTIFY_SYNC RealNotifySync)
VOID NTAPI FsRtlNotifyInitializeSync(IN PNOTIFY_SYNC *NotifySync)
VOID NTAPI FsRtlNotifyReportChange(IN PNOTIFY_SYNC NotifySync, IN PLIST_ENTRY NotifyList, IN PSTRING FullTargetName, IN PUSHORT FileNamePartLength, IN ULONG FilterMatch)
#define FsRtlNotifyGetLastPartOffset(FullLen, TargLen, Type, Chr)
VOID NTAPI FsRtlNotifyFilterReportChange(IN PNOTIFY_SYNC NotifySync, IN PLIST_ENTRY NotifyList, IN PSTRING FullTargetName, IN USHORT TargetNameOffset, IN PSTRING StreamName OPTIONAL, IN PSTRING NormalizedParentName OPTIONAL, IN ULONG FilterMatch, IN ULONG Action, IN PVOID TargetContext, IN PVOID FilterContext)
VOID NTAPI FsRtlNotifyFullChangeDirectory(IN PNOTIFY_SYNC NotifySync, IN PLIST_ENTRY NotifyList, IN PVOID FsContext, IN PSTRING FullDirectoryName, IN BOOLEAN WatchTree, IN BOOLEAN IgnoreBuffer, IN ULONG CompletionFilter, IN PIRP NotifyIrp, IN PCHECK_FOR_TRAVERSE_ACCESS TraverseCallback OPTIONAL, IN PSECURITY_SUBJECT_CONTEXT SubjectContext OPTIONAL)
#define IoCompleteRequest
VOID NTAPI IoReleaseCancelSpinLock(IN KIRQL Irql)
VOID NTAPI IoAcquireCancelSpinLock(OUT PKIRQL Irql)
#define STATUS_DELETE_PENDING
#define STATUS_NOTIFY_CLEANUP
#define STATUS_NOTIFY_ENUM_DIR
#define _SEH2_EXCEPT(...)
VOID NTAPI PsReturnProcessPagedPoolQuota(_In_ PEPROCESS Process, _In_ SIZE_T Amount)
Returns the paged pool quota that the process was taking up.
VOID NTAPI PsChargePoolQuota(_In_ PEPROCESS Process, _In_ POOL_TYPE PoolType, _In_ SIZE_T Amount)
Charges the pool quota of a given process. The kind of pool quota to charge is determined by the Pool...
PULONG MinorVersion OPTIONAL
struct _LIST_ENTRY * Flink
PSTRING FullDirectoryName
PSECURITY_SUBJECT_CONTEXT SubjectContext
PREAL_NOTIFY_SYNC NotifySync
PFILTER_REPORT_CHANGE FilterCallback
PCHECK_FOR_TRAVERSE_ACCESS TraverseCallback
VOID NTAPI SeReleaseSubjectContext(_In_ PSECURITY_SUBJECT_CONTEXT SubjectContext)
Releases both the primary and client tokens of a security subject context.
#define TAG_FS_NOTIFICATIONS
#define FIELD_OFFSET(t, f)
#define RtlCopyMemory(Destination, Source, Length)
#define RtlZeroMemory(Destination, Length)
#define CONTAINING_RECORD(address, type, field)
_In_ PDEVICE_OBJECT DeviceObject
_Must_inspect_result_ _In_ WDFDEVICE _In_ DEVICE_REGISTRY_PROPERTY _In_ ULONG BufferLength
_Must_inspect_result_ _In_ WDFIOTARGET _In_opt_ WDFREQUEST _In_opt_ PWDF_MEMORY_DESCRIPTOR OutputBuffer
_In_ WDFIOTARGET _In_ _Strict_type_match_ WDF_IO_TARGET_SENT_IO_ACTION Action
_In_ WDFREQUEST _In_ PIO_STACK_LOCATION Stack
FORCEINLINE VOID ExInitializeFastMutex(_Out_ PFAST_MUTEX FastMutex)
ActualNumberDriverObjects * sizeof(PDRIVER_OBJECT)) PDRIVER_OBJECT *DriverObjectList
_In_opt_ PDRIVER_CANCEL CancelRoutine
#define SL_PENDING_RETURNED
#define IRP_DEALLOCATE_BUFFER
#define FILE_ACTION_RENAMED_OLD_NAME
DRIVER_CANCEL * PDRIVER_CANCEL
#define FO_CLEANUP_COMPLETE
#define IO_DISK_INCREMENT
#define IRP_SYNCHRONOUS_PAGING_IO
#define POOL_RAISE_IF_ALLOCATION_FAILURE
_Must_inspect_result_ typedef _In_ PHYSICAL_ADDRESS _Inout_ PLARGE_INTEGER NumberOfBytes
#define MmGetSystemAddressForMdl(Mdl)
#define RtlOemStringToCountedUnicodeSize(STRING)