29 #define FLT_MGR_BASELINE (((OSVER(NTDDI_VERSION) == NTDDI_WIN2K) && (SPVER(NTDDI_VERSION) >= SPVER(NTDDI_WIN2KSP4))) || \ 30 ((OSVER(NTDDI_VERSION) == NTDDI_WINXP) && (SPVER(NTDDI_VERSION) >= SPVER(NTDDI_WINXPSP2))) || \ 31 ((OSVER(NTDDI_VERSION) == NTDDI_WS03) && (SPVER(NTDDI_VERSION) >= SPVER(NTDDI_WS03SP1))) || \ 32 (NTDDI_VERSION >= NTDDI_VISTA)) 34 #define FLT_MGR_AFTER_XPSP2 (((OSVER(NTDDI_VERSION) == NTDDI_WIN2K) && (SPVER(NTDDI_VERSION) >= SPVER(NTDDI_WIN2KSP4))) || \ 35 ((OSVER(NTDDI_VERSION) == NTDDI_WINXP) && (SPVER(NTDDI_VERSION) > SPVER(NTDDI_WINXPSP2))) || \ 36 ((OSVER(NTDDI_VERSION) == NTDDI_WS03) && (SPVER(NTDDI_VERSION) >= SPVER(NTDDI_WS03SP1))) || \ 37 (NTDDI_VERSION >= NTDDI_VISTA)) 39 #define FLT_MGR_LONGHORN (NTDDI_VERSION >= NTDDI_VISTA) 40 #define FLT_MGR_WIN7 (NTDDI_VERSION >= NTDDI_WIN7) 49 #define FLT_ASSERT(_e) NT_ASSERT(_e) 50 #define FLT_ASSERTMSG(_m, _e) NT_ASSERTMSG(_m, _e) 52 #define FLT_ASSERT(_e) ASSERT(_e) 53 #define FLT_ASSERTMSG(_m, _e) ASSERTMSG(_m, _e) 56 #define Add2Ptr(P,I) ((PVOID)((PUCHAR)(P) + (I))) 57 #define PtrOffset(B,O) ((ULONG)((ULONG_PTR)(O) - (ULONG_PTR)(B))) 59 #define ROUND_TO_SIZE(_length, _alignment) \ 60 ((((ULONG_PTR)(_length)) + ((_alignment)-1)) & ~(ULONG_PTR) ((_alignment) - 1)) 62 #define IS_ALIGNED(_pointer, _alignment) \ 63 ((((ULONG_PTR) (_pointer)) & ((_alignment) - 1)) == 0) 65 #define IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION ((UCHAR)-1) 66 #define IRP_MJ_RELEASE_FOR_SECTION_SYNCHRONIZATION ((UCHAR)-2) 67 #define IRP_MJ_ACQUIRE_FOR_MOD_WRITE ((UCHAR)-3) 68 #define IRP_MJ_RELEASE_FOR_MOD_WRITE ((UCHAR)-4) 69 #define IRP_MJ_ACQUIRE_FOR_CC_FLUSH ((UCHAR)-5) 70 #define IRP_MJ_RELEASE_FOR_CC_FLUSH ((UCHAR)-6) 71 #define IRP_MJ_FAST_IO_CHECK_IF_POSSIBLE ((UCHAR)-13) 72 #define IRP_MJ_NETWORK_QUERY_OPEN ((UCHAR)-14) 73 #define IRP_MJ_MDL_READ ((UCHAR)-15) 74 #define IRP_MJ_MDL_READ_COMPLETE ((UCHAR)-16) 75 #define IRP_MJ_PREPARE_MDL_WRITE ((UCHAR)-17) 76 #define IRP_MJ_MDL_WRITE_COMPLETE ((UCHAR)-18) 77 #define IRP_MJ_VOLUME_MOUNT ((UCHAR)-19) 78 #define IRP_MJ_VOLUME_DISMOUNT ((UCHAR)-20) 79 #define IRP_MJ_OPERATION_END ((UCHAR)0x80) 80 #define FLT_INTERNAL_OPERATION_COUNT 22 82 #define NULL_CONTEXT ((PFLT_CONTEXT)NULL) 92 typedef struct _KTRANSACTION *PKTRANSACTION;
95 #if !defined(_AMD64_) && !defined(_IA64_) && !defined(_ARM_) 399 #if !defined(_AMD64_) && !defined(_IA64_) && !defined(_ARM_) 414 #define FLTFL_CALLBACK_DATA_REISSUE_MASK 0x0000FFFF 415 #define FLTFL_CALLBACK_DATA_IRP_OPERATION 0x00000001 416 #define FLTFL_CALLBACK_DATA_FAST_IO_OPERATION 0x00000002 417 #define FLTFL_CALLBACK_DATA_FS_FILTER_OPERATION 0x00000004 418 #define FLTFL_CALLBACK_DATA_SYSTEM_BUFFER 0x00000008 419 #define FLTFL_CALLBACK_DATA_GENERATED_IO 0x00010000 420 #define FLTFL_CALLBACK_DATA_REISSUED_IO 0x00020000 421 #define FLTFL_CALLBACK_DATA_DRAINING_IO 0x00040000 422 #define FLTFL_CALLBACK_DATA_POST_OPERATION 0x00080000 423 #define FLTFL_CALLBACK_DATA_NEW_SYSTEM_BUFFER 0x00100000 424 #define FLTFL_CALLBACK_DATA_DIRTY 0x80000000 426 #define FLT_SET_CALLBACK_DATA_DIRTY(Data) FltSetCallbackDataDirty(Data) 427 #define FLT_CLEAR_CALLBACK_DATA_DIRTY(Data) FltClearCallbackDataDirty(Data) 428 #define FLT_IS_CALLBACK_DATA_DIRTY(Data) FltIsCallbackDataDirty(Data) 430 #define FLT_IS_IRP_OPERATION(Data) (FlagOn((Data)->Flags, FLTFL_CALLBACK_DATA_IRP_OPERATION)) 431 #define FLT_IS_FASTIO_OPERATION(Data) (FlagOn((Data)->Flags, FLTFL_CALLBACK_DATA_FAST_IO_OPERATION)) 432 #define FLT_IS_FS_FILTER_OPERATION(Data) (FlagOn((Data)->Flags, FLTFL_CALLBACK_DATA_FS_FILTER_OPERATION)) 433 #define FLT_IS_REISSUED_IO(Data) (FlagOn((Data)->Flags, FLTFL_CALLBACK_DATA_REISSUED_IO)) 434 #define FLT_IS_SYSTEM_BUFFER(Data) (FlagOn((Data)->Flags, FLTFL_CALLBACK_DATA_SYSTEM_BUFFER)) 438 #define FLT_VOLUME_CONTEXT 0x0001 439 #define FLT_INSTANCE_CONTEXT 0x0002 440 #define FLT_FILE_CONTEXT 0x0004 441 #define FLT_STREAM_CONTEXT 0x0008 442 #define FLT_STREAMHANDLE_CONTEXT 0x0010 443 #define FLT_TRANSACTION_CONTEXT 0x0020 444 #define FLT_CONTEXT_END 0xffff 446 #define FLT_ALL_CONTEXTS (FLT_VOLUME_CONTEXT | FLT_INSTANCE_CONTEXT | \ 447 FLT_FILE_CONTEXT | FLT_STREAM_CONTEXT | \ 448 FLT_STREAMHANDLE_CONTEXT | FLT_TRANSACTION_CONTEXT) 454 #define FLT_ALLOCATE_CALLBACK_DATA_PREALLOCATE_ALL_MEMORY 0x00000001 511 #define FLTFL_CONTEXT_REGISTRATION_NO_EXACT_SIZE_MATCH 0x0001 513 #define FLT_VARIABLE_SIZED_CONTEXTS ((SIZE_T)-1) 529 #define FLTFL_INSTANCE_SETUP_AUTOMATIC_ATTACHMENT 0x00000001 530 #define FLTFL_INSTANCE_SETUP_MANUAL_ATTACHMENT 0x00000002 531 #define FLTFL_INSTANCE_SETUP_NEWLY_MOUNTED_VOLUME 0x00000004 535 #define FLTFL_INSTANCE_SETUP_DETACHED_VOLUME 0x00000008 537 #define FLT_MAX_TRANSACTION_NOTIFICATIONS (TRANSACTION_NOTIFY_PREPREPARE | \ 538 TRANSACTION_NOTIFY_PREPARE | \ 539 TRANSACTION_NOTIFY_COMMIT | \ 540 TRANSACTION_NOTIFY_ROLLBACK | \ 541 TRANSACTION_NOTIFY_COMMIT_FINALIZE) 550 _In_ FLT_FILESYSTEM_TYPE VolumeFilesystemType);
561 #define FLTFL_INSTANCE_TEARDOWN_MANUAL 0x00000001 562 #define FLTFL_INSTANCE_TEARDOWN_FILTER_UNLOAD 0x00000002 563 #define FLTFL_INSTANCE_TEARDOWN_MANDATORY_FILTER_UNLOAD 0x00000004 564 #define FLTFL_INSTANCE_TEARDOWN_VOLUME_DISMOUNT 0x00000008 565 #define FLTFL_INSTANCE_TEARDOWN_INTERNAL_ERROR 0x00000010 594 #define FLTFL_POST_OPERATION_DRAINING 0x00000001 605 #define FLTFL_OPERATION_REGISTRATION_SKIP_PAGING_IO 0x00000001 606 #define FLTFL_OPERATION_REGISTRATION_SKIP_CACHED_IO 0x00000002 607 #define FLTFL_OPERATION_REGISTRATION_SKIP_NON_DASD_IO 0x00000004 647 #define FLT_TAG_DATA_BUFFER_HEADER_SIZE FIELD_OFFSET(FLT_TAG_DATA_BUFFER, GenericReparseBuffer) 651 #define FLTFL_FILTER_UNLOAD_MANDATORY 0x00000001 674 #define FLTFL_NORMALIZE_NAME_CASE_SENSITIVE 0x01 675 #define FLTFL_NORMALIZE_NAME_DESTINATION_FILE_NAME 0x02 712 #define FLT_REGISTRATION_VERSION_0200 0x0200 713 #define FLT_REGISTRATION_VERSION_0201 0x0201 714 #define FLT_REGISTRATION_VERSION_0202 0x0202 715 #define FLT_REGISTRATION_VERSION_0203 0x0203 718 #define FLT_REGISTRATION_VERSION FLT_REGISTRATION_VERSION_0202 720 #define FLT_REGISTRATION_VERSION FLT_REGISTRATION_VERSION_0200 725 #define FLTFL_REGISTRATION_DO_NOT_SUPPORT_SERVICE_STOP 0x00000001 726 #define FLTFL_REGISTRATION_SUPPORT_NPFS_MSFS 0x00000002 755 #define FLTFL_IO_OPERATION_NON_CACHED 0x00000001 756 #define FLTFL_IO_OPERATION_PAGING 0x00000002 757 #define FLTFL_IO_OPERATION_DO_NOT_UPDATE_BYTE_OFFSET 0x00000004 760 #define FLTFL_IO_OPERATION_SYNCHRONOUS_PAGING 0x00000008 772 #define FLT_VALID_FILE_NAME_FORMATS 0x000000ff 774 #define FLT_FILE_NAME_NORMALIZED 0x01 775 #define FLT_FILE_NAME_OPENED 0x02 776 #define FLT_FILE_NAME_SHORT 0x03 778 #define FltGetFileNameFormat( _NameOptions ) ((_NameOptions) & FLT_VALID_FILE_NAME_FORMATS) 780 #define FLT_VALID_FILE_NAME_QUERY_METHODS 0x0000ff00 782 #define FLT_FILE_NAME_QUERY_DEFAULT 0x0100 783 #define FLT_FILE_NAME_QUERY_CACHE_ONLY 0x0200 784 #define FLT_FILE_NAME_QUERY_FILESYSTEM_ONLY 0x0300 785 #define FLT_FILE_NAME_QUERY_ALWAYS_ALLOW_CACHE_LOOKUP 0x0400 787 #define FltGetFileNameQueryMethod( _NameOptions ) ((_NameOptions) & FLT_VALID_FILE_NAME_QUERY_METHODS) 789 #define FLT_VALID_FILE_NAME_FLAGS 0xff000000 791 #define FLT_FILE_NAME_REQUEST_FROM_CURRENT_PROVIDER 0x01000000 792 #define FLT_FILE_NAME_DO_NOT_CACHE 0x02000000 794 #if FLT_MGR_AFTER_XPSP2 795 #define FLT_FILE_NAME_ALLOW_QUERY_ON_REPARSE 0x04000000 800 #define FLTFL_FILE_NAME_PARSED_FINAL_COMPONENT 0x0001 801 #define FLTFL_FILE_NAME_PARSED_EXTENSION 0x0002 802 #define FLTFL_FILE_NAME_PARSED_STREAM 0x0004 803 #define FLTFL_FILE_NAME_PARSED_PARENT_DIR 0x0008 835 #define FLT_PORT_CONNECT 0x0001 836 #define FLT_PORT_ALL_ACCESS (FLT_PORT_CONNECT | STANDARD_RIGHTS_ALL) 973 FltCheckAndGrowNameControl(
981 FltPurgeFileNameInformationCache(
1011 FltGetRoutineAddress(
1018 FltCompletePendedPreOperation(
1026 FltCompletePendedPostOperation(
1033 FltRequestOperationStatusCallback(
1042 FltAllocatePoolAlignedWithTag(
1051 FltFreePoolAlignedWithTag(
1084 FltReferenceFileNameInformation(
1099 FltParseFileNameInformation(
1170 FltAttachVolumeAtAltitude(
1190 FltAllocateCallbackData(
1198 FltFreeCallbackData(
1204 FltReuseCallbackData(
1211 FltPerformSynchronousIo(
1219 FltPerformAsynchronousIo(
1302 FltQueryInformationFile(
1314 FltSetInformationFile(
1325 FltQueryVolumeInformationFile(
1337 FltQuerySecurityObject(
1349 FltSetSecurityObject(
1381 FltDeviceIoControlFile(
1396 FltReissueSynchronousIo(
1417 FltCreateSystemVolumeInformationFolder(
1423 FltSupportsFileContexts(
1429 FltSupportsStreamContexts(
1435 FltSupportsStreamHandleContexts(
1466 FltSetVolumeContext(
1475 FltSetInstanceContext(
1494 FltSetStreamContext(
1504 FltSetStreamHandleContext(
1520 FltDeleteVolumeContext(
1528 FltDeleteInstanceContext(
1535 FltDeleteFileContext(
1543 FltDeleteStreamContext(
1551 FltDeleteStreamHandleContext(
1559 FltGetVolumeContext(
1567 FltGetInstanceContext(
1582 FltGetStreamContext(
1590 FltGetStreamHandleContext(
1598 FltReferenceContext(
1617 FltGetVolumeFromName(
1625 FltGetVolumeInstanceFromName(
1634 FltGetVolumeFromInstance(
1641 FltGetFilterFromInstance(
1648 FltGetVolumeFromFileObject(
1656 FltGetVolumeFromDeviceObject(
1678 FltGetLowerInstance(
1685 FltGetUpperInstance(
1699 FltGetBottomInstance(
1712 FltGetFilterInformation(
1722 FltGetInstanceInformation(
1742 FltIsVolumeWritable(
1750 FltGetVolumeGuidName(
1759 FltQueryVolumeInformation(
1770 FltSetVolumeInformation(
1781 FltEnumerateFilters(
1800 FltEnumerateInstances(
1811 FltEnumerateFilterInformation(
1822 FltEnumerateInstanceInformationByFilter(
1834 FltEnumerateInstanceInformationByVolume(
1846 FltEnumerateVolumeInformation(
1871 FltCreateCommunicationPort(
1884 FltCloseCommunicationPort(
1931 FltSetCancelCompletion(
1939 FltClearCancelCompletion(
1951 FltAllocateDeferredIoWorkItem(
VOID);
1956 FltFreeDeferredIoWorkItem(
1963 FltAllocateGenericWorkItem(
VOID);
1968 FltFreeGenericWorkItem(
1975 FltQueueDeferredIoWorkItem(
1986 FltQueueGenericWorkItem(
2067 FltInitializeOplock(
2073 FltUninitializeOplock(
2099 FltOplockIsFastIoPossible(
2105 FltCurrentBatchOplock(
2122 FltAllocateFileLock(
2145 FltCheckLockForReadAccess(
2153 FltCheckLockForWriteAccess(
2161 FltAcquireResourceExclusive(
2168 FltAcquireResourceShared(
2181 FltInitializePushLock(
2194 FltAcquirePushLockExclusive(
2201 FltAcquirePushLockShared(
2225 FltGetRequestorProcess(
2231 FltGetRequestorProcessId(
2237 FltNotifyFilterChangeDirectory(
2255 #if FLT_MGR_AFTER_XPSP2 2315 #if FLT_MGR_LONGHORN 2343 FltQueryDirectoryFile(
2357 FltSupportsFileContextsEx(
2364 FltSetTransactionContext(
2374 FltDeleteTransactionContext(
2382 FltGetTransactionContext(
2390 FltIsFltMgrVolumeDeviceObject(
2396 FltGetVolumeInformation(
2406 FltGetFileSystemType(
2414 FltIsVolumeSnapshot(
2423 FltCancellableWaitForSingleObject(
2433 FltCancellableWaitForMultipleObjects(
2444 FltGetRequestorProcessIdEx(
2451 FltEnlistInTransaction(
2460 FltRollbackEnlistment(
2468 FltPrePrepareComplete(
2492 FltCommitFinalizeComplete(
2500 FltRollbackComplete(
2509 FltAllocateExtraCreateParameterList(
2518 FltAllocateExtraCreateParameter(
2530 FltInitExtraCreateParameterLookasideList(
2540 FltDeleteExtraCreateParameterLookasideList(
2549 FltAllocateExtraCreateParameterFromLookasideList(
2561 FltInsertExtraCreateParameter(
2569 FltFindExtraCreateParameter(
2579 FltRemoveExtraCreateParameter(
2589 FltFreeExtraCreateParameterList(
2596 FltFreeExtraCreateParameter(
2603 FltGetEcpListFromCallbackData(
2611 FltSetEcpListIntoCallbackData(
2619 FltGetNextExtraCreateParameter(
2637 FltIsEcpAcknowledged(
2644 FltIsEcpFromUserMode(
2651 FltRetrieveIoPriorityInfo(
2660 FltApplyPriorityInfoThread(
2668 FltGetIoPriorityHint(
2674 FltGetIoPriorityHintFromCallbackData(
2680 FltSetIoPriorityHintIntoCallbackData(
2687 FltGetIoPriorityHintFromFileObject(
2694 FltSetIoPriorityHintIntoFileObject(
2701 FltGetIoPriorityHintFromThread(
2707 FltSetIoPriorityHintIntoThread(
2719 FltAllocateCallbackDataEx(
2729 FltGetNewSystemBufferAddress(
2770 FltOplockBreakToNone(
2780 FltOplockBreakToNoneEx(
2791 FltOplockIsSharedRequest(
2814 FltGetRequestorSessionId(
2821 FltAdjustDeviceStackSizeForIoRedirection(
2829 FltIsIoRedirectionAllowed(
2837 FltIsIoRedirectionAllowedForOperation(
_Must_inspect_result_ *NumberFiltersReturned PFLT_FILTER * FilterList
ULONG POINTER_ALIGNMENT Spare1
#define FLTFL_IO_OPERATION_SYNCHRONOUS_PAGING
_Inout_ PLIST_ENTRY _In_ PVOID FsContext
_Must_inspect_result_ *NumberFiltersReturned PFLT_FILTER _In_ ULONG FilterListSize
PFLT_CONTEXT TransactionContext
ULONG FLT_IO_OPERATION_FLAGS
_Must_inspect_result_ _In_ FSRTL_ALLOCATE_ECPLIST_FLAGS _Outptr_ PECP_LIST * EcpList
_Out_opt_ PIO_PRIORITY_INFO OutputPriorityInfo
BOOLEAN POINTER_ALIGNMENT CheckForReadOperation
ULONG POINTER_ALIGNMENT Length
_Must_inspect_result_ _Inout_ PFLT_VOLUME Volume
PFLT_TRANSACTION_NOTIFICATION_CALLBACK TransactionNotificationCallback
struct _FLT_NAME_CONTROL * PFLT_NAME_CONTROL
_Must_inspect_result_ _In_ PFLT_PORT _In_ ULONG _Out_writes_bytes_opt_ ReplyLength PVOID _Inout_opt_ PULONG _In_opt_ PLARGE_INTEGER Timeout
_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_ FILE_INFORMATION_CLASS _In_ BOOLEAN _In_opt_ PUNICODE_STRING FileName
PDEVICE_OBJECT DeviceObject
PFILE_NETWORK_OPEN_INFORMATION NetworkInformation
struct _FLT_OPERATION_REGISTRATION FLT_OPERATION_REGISTRATION
ULONG FSRTL_ALLOCATE_ECPLIST_FLAGS
VOID(FLTAPI * PFLT_CALLBACK_DATA_QUEUE_ACQUIRE)(_Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _Out_opt_ PKIRQL Irql)
_Inout_ PLIST_ENTRY _In_ PVOID _In_ PSTRING _In_ BOOLEAN _In_ BOOLEAN _In_ ULONG _In_ PFLT_CALLBACK_DATA _In_opt_ PCHECK_FOR_TRAVERSE_ACCESS _In_opt_ PSECURITY_SUBJECT_CONTEXT SubjectContext
struct _FLT_TAG_DATA_BUFFER::@1964::@1968 GenericGUIDReparseBuffer
_ANONYMOUS_UNION union _FLT_PARAMETERS::@1912::@1938 DUMMYUNIONNAME
#define _Must_inspect_result_
ULONG FLT_INSTANCE_QUERY_TEARDOWN_FLAGS
_Must_inspect_result_ _In_ PFILE_OBJECT _In_opt_ PLARGE_INTEGER _In_ ULONG _In_ FLT_IO_OPERATION_FLAGS _Out_opt_ PULONG BytesWritten
struct _FLT_PARAMETERS::@1923 WMI
_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_ FS_INFORMATION_CLASS FsInformationClass
enum _BUS_QUERY_ID_TYPE BUS_QUERY_ID_TYPE
struct _FLT_PARAMETERS::@1917::@1941 NotifyDirectory
_Must_inspect_result_ _In_ PFLT_CALLBACK_DATA CallbackData
_In_ IO_PRIORITY_HINT PriorityHint
ULONG POINTER_ALIGNMENT EaIndex
struct _FLT_PARAMETERS::@1926::@1957 ReadWriteConfig
struct _FLT_PARAMETERS::@1926::@1954 QueryInterface
_Must_inspect_result_ _In_ PFLT_CALLBACK_DATA _In_opt_ PVOID _In_opt_ PFLTOPLOCK_WAIT_COMPLETE_ROUTINE _In_opt_ PFLTOPLOCK_PREPOST_CALLBACKDATA_ROUTINE PrePostCallbackDataRoutine
_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG IoControlCode
_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_ BOOLEAN _In_ ULONG _In_opt_ PULONG _In_ BOOLEAN RestartScan
CONST FLT_OPERATION_REGISTRATION * OperationRegistration
ULONG POINTER_ALIGNMENT FileIndex
_Must_inspect_result_ _In_ PFLT_CALLBACK_DATA _In_opt_ PVOID _In_opt_ PFLTOPLOCK_WAIT_COMPLETE_ROUTINE WaitCompletionRoutine
PFLT_CALLBACK_DATA(FLTAPI * PFLT_CALLBACK_DATA_QUEUE_PEEK_NEXT_IO)(_In_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _In_opt_ PFLT_CALLBACK_DATA Cbd, _In_opt_ PVOID PeekContext)
_Must_inspect_result_ _Inout_opt_ PUNICODE_STRING _Out_opt_ PULONG BufferSizeNeeded
VOID(FLTAPI * PFLT_GET_OPERATION_STATUS_CALLBACK)(_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ PFLT_IO_PARAMETER_BLOCK IopbSnapshot, _In_ NTSTATUS OperationStatus, _In_opt_ PVOID RequesterContext)
struct _FLT_PARAMETERS::@1926::@1955 DeviceCapabilities
FLT_POSTOP_CALLBACK_STATUS(FLTAPI * PFLT_POST_OPERATION_CALLBACK)(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_opt_ PVOID CompletionContext, _In_ FLT_POST_OPERATION_FLAGS Flags)
_Must_inspect_result_ _In_opt_ PUNLOCK_ROUTINE UnlockRoutine
_Must_inspect_result_ _Out_writes_to_opt_(VolumeListSize, *NumberVolumesReturned) PFLT_VOLUME *VolumeList
union _FLT_PARAMETERS::@1926 Pnp
enum _FLT_POSTOP_CALLBACK_STATUS FLT_POSTOP_CALLBACK_STATUS
_FLT_SET_CONTEXT_OPERATION
struct _FLT_PARAMETERS::@1935 MdlWriteComplete
NTSTATUS NTAPI FltStartFiltering(_In_ PFLT_FILTER Filter)
_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_ ULONG _Out_writes_bytes_to_opt_(OutputBufferLength, *LengthReturned) PVOID OutputBuffer
PFLT_NORMALIZE_NAME_COMPONENT_EX NormalizeNameComponentExCallback
struct _FLT_CONTEXT_REGISTRATION * PFLT_CONTEXT_REGISTRATION
FILE_INFORMATION_CLASS FileInformationClass
_Must_inspect_result_ _In_ PFLT_CALLBACK_DATA Data
NTSTATUS FLTAPI FltBuildDefaultSecurityDescriptor(_Outptr_ PSECURITY_DESCRIPTOR *SecurityDescriptor, _In_ ACCESS_MASK DesiredAccess)
NTSTATUS FLTAPI FltDecodeParameters(_In_ PFLT_CALLBACK_DATA CallbackData, _Outptr_opt_ PMDL **MdlAddressPointer, _Outptr_opt_result_bytebuffer_(**Length) PVOID **Buffer, _Outptr_opt_ PULONG *Length, _Out_opt_ LOCK_OPERATION *DesiredAccess)
struct _FLT_FILTER * PFLT_FILTER
_In_ USHORT _In_ ULONG _In_ PSOCKADDR _In_ PSOCKADDR _Reserved_ ULONG _In_opt_ PVOID _In_opt_ const WSK_CLIENT_CONNECTION_DISPATCH _In_opt_ PEPROCESS _In_opt_ PETHREAD _In_opt_ PSECURITY_DESCRIPTOR SecurityDescriptor
_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_ BOOLEAN _In_ ULONG _In_opt_ PULONG EaIndex
struct _FLT_PARAMETERS::@1937 Others
PSECURITY_DESCRIPTOR SecurityDescriptor
#define FLT_IS_IRP_OPERATION(Data)
_Must_inspect_result_ _Outptr_ PFLT_PORT * ServerPort
ULONG FLT_OPERATION_REGISTRATION_FLAGS
_Inout_ PVOID _In_ FSRTL_ECP_LOOKASIDE_FLAGS _In_ SIZE_T Size
struct _FLT_PARAMETERS::@1921 QuerySecurity
_In_ PFLT_INSTANCE _Out_opt_ PBOOLEAN SourceDeviceStackSizeModified
struct _FLT_VOLUME * PFLT_VOLUME
BOOLEAN FLTAPI FltOplockKeysEqual(_In_opt_ PFILE_OBJECT Fo1, _In_opt_ PFILE_OBJECT Fo2)
enum _FLT_PREOP_CALLBACK_STATUS * PFLT_PREOP_CALLBACK_STATUS
enum _DEVICE_USAGE_NOTIFICATION_TYPE DEVICE_USAGE_NOTIFICATION_TYPE
ULONG FSRTL_ECP_LOOKASIDE_FLAGS
struct _FLT_PARAMETERS::@1918::@1946 Direct
VOID FLTAPI FltObjectDereference(_Inout_ PVOID Object)
_Must_inspect_result_ NTSTATUS FLTAPI FltCbdqInsertIo(_Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _In_ PFLT_CALLBACK_DATA Cbd, _In_opt_ PFLT_CALLBACK_DATA_QUEUE_IO_CONTEXT Context, _In_opt_ PVOID InsertContext)
_Must_inspect_result_ _In_ PFLT_CALLBACK_DATA _In_ PFLT_DEFERRED_IO_WORKITEM_ROUTINE WorkerRoutine
_In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _Out_ PIO_STATUS_BLOCK _In_opt_ PLARGE_INTEGER _In_ ULONG _In_ ULONG _In_ ULONG _In_ ULONG _In_opt_ PVOID EaBuffer
USHORT POINTER_ALIGNMENT Reserved
VOID(FLTAPI * PFLT_CALLBACK_DATA_QUEUE_REMOVE_IO)(_Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _In_ PFLT_CALLBACK_DATA Cbd)
struct _FLT_CALLBACK_DATA_QUEUE * PFLT_CALLBACK_DATA_QUEUE
PLARGE_INTEGER EndingOffset
PVOID InterfaceSpecificData
_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_ BOOLEAN ReturnSingleEntry
VOID(FLTAPI * PFLTOPLOCK_WAIT_COMPLETE_ROUTINE)(_In_ PFLT_CALLBACK_DATA CallbackData, _In_opt_ PVOID Context)
struct _FLT_RELATED_OBJECTS * PFLT_RELATED_OBJECTS
struct _FLT_PARAMETERS::@1926::@1956 FilterResourceRequirements
_In_ PCUNICODE_STRING _Outptr_ PFLT_VOLUME * RetVolume
struct _FLT_PARAMETERS::@1917::@1940 QueryDirectory
_Must_inspect_result_ _In_ FLT_CONTEXT_TYPE _In_ SIZE_T _In_ POOL_TYPE _Outptr_result_bytebuffer_(ContextSize) PFLT_CONTEXT *ReturnedContext)
_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_ ULONG _In_ ULONG OutputBufferLength
static OUT PIO_STATUS_BLOCK OUT PVOID FileInformation
_Must_inspect_result_ _In_ ULONG _Out_ PULONG NumberVolumesReturned
PFLT_INSTANCE_TEARDOWN_CALLBACK InstanceTeardownStartCallback
PFLT_INSTANCE_SETUP_CALLBACK InstanceSetupCallback
_Inout_ __drv_aliasesMem PSLIST_ENTRY _Inout_ PSLIST_ENTRY _In_ ULONG Count
ULONG FLT_INSTANCE_TEARDOWN_FLAGS
VOID(FLTAPI * PFLTOPLOCK_PREPOST_CALLBACKDATA_ROUTINE)(_In_ PFLT_CALLBACK_DATA CallbackData, _In_opt_ PVOID Context)
_Inout_ PLIST_ENTRY _In_ PVOID _In_ PSTRING _In_ BOOLEAN WatchTree
_Must_inspect_result_ _Inout_ PFLT_VOLUME _In_opt_ PCUNICODE_STRING _Outptr_opt_result_maybenull_ PFLT_INSTANCE * RetInstance
_Outptr_ PFLT_PORT * ClientPort
_Requires_lock_not_held_(Vcb->fcb_lock) _Acquires_shared_lock_(Vcb -> fcb_lock) static __inline void acquire_fcb_lock_shared(device_extension *Vcb)
PFLT_CALLBACK_DATA_QUEUE_REMOVE_IO RemoveIo
_Must_inspect_result_ _In_ LPCGUID EcpType
NTSTATUS FLTAPI FltEnumerateVolumes(_In_ PFLT_FILTER Filter, _Out_writes_to_opt_(VolumeListSize, *NumberVolumesReturned) PFLT_VOLUME *VolumeList, _In_ ULONG VolumeListSize, _Out_ PULONG NumberVolumesReturned)
_Must_inspect_result_ _In_ FLT_CONTEXT_TYPE _In_ SIZE_T ContextSize
PFLT_NORMALIZE_NAME_COMPONENT NormalizeNameComponentCallback
_Must_inspect_result_ _Out_ PBOOLEAN IsSnapshotVolume
LARGE_INTEGER AllocationSize
BOOLEAN(NTAPI * PFILTER_REPORT_CHANGE)(_In_ PVOID NotifyContext, _In_ PVOID FilterContext)
struct _FLT_PARAMETERS::@1918::@1942 VerifyVolume
UNICODE_STRING FileSystemDriverName
struct _FLT_PARAMETERS::@1928 AcquireForModifiedPageWriter
struct _FLT_CALLBACK_DATA FLT_CALLBACK_DATA
_Must_inspect_result_ _In_ ULONG Index
struct _FLT_PARAMETERS::@1916 SetVolumeInformation
struct _FLT_PARAMETERS::@1918::@1944 Neither
_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE _In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _Out_ PIO_STATUS_BLOCK _In_opt_ PLARGE_INTEGER _In_ ULONG _In_ ULONG ShareAccess
struct _FLT_RELATED_CONTEXTS FLT_RELATED_CONTEXTS
PFLT_CONTEXT StreamHandleContext
struct _FLT_TAG_DATA_BUFFER * PFLT_TAG_DATA_BUFFER
enum _DEVICE_TEXT_TYPE DEVICE_TEXT_TYPE
CONST GUID * InterfaceType
PFLT_INSTANCE TargetInstance
VOID(FLTAPI * PFLT_GENERIC_WORKITEM_ROUTINE)(_In_ PFLT_GENERIC_WORKITEM FltWorkItem, _In_ PVOID FltObject, _In_opt_ PVOID Context)
struct _FLT_PARAMETERS::@1920 LockControl
FLT_PARAMETERS Parameters
_In_ PFLT_INSTANCE _Out_ PBOOLEAN _Out_opt_ PBOOLEAN RedirectionAllowedAllIo
struct _FLT_PARAMETERS::@1934 PrepareMdlWrite
_Inout_opt_ PUNICODE_STRING _Inout_opt_ PUNICODE_STRING _Inout_opt_ PUNICODE_STRING FinalComponent
_Must_inspect_result_ _In_ PFILE_OBJECT _In_opt_ HANDLE RootDirectory
FLT_OPERATION_REGISTRATION_FLAGS Flags
_Inout_ PLIST_ENTRY _In_ PVOID _In_ PSTRING _In_ BOOLEAN _In_ BOOLEAN _In_ ULONG _In_ PFLT_CALLBACK_DATA _In_opt_ PCHECK_FOR_TRAVERSE_ACCESS _In_opt_ PSECURITY_SUBJECT_CONTEXT _In_opt_ PFILTER_REPORT_CHANGE FilterCallback
enum _FLT_SET_CONTEXT_OPERATION * PFLT_SET_CONTEXT_OPERATION
_Must_inspect_result_ _In_ PFILE_OBJECT _In_opt_ HANDLE _In_ ULONG _In_ FLT_FILE_NAME_OPTIONS _Outptr_ PFLT_FILE_NAME_INFORMATION * RetFileNameInformation
_Must_inspect_result_ _In_ CONST FLT_REGISTRATION _Outptr_ PFLT_FILTER * RetFilter
VOID FLTAPI FltCbdqEnable(_Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq)
_In_ FLT_CONTEXT_TYPE DesiredContexts
NTSTATUS FLTAPI FltCbdqInitialize(_In_ PFLT_INSTANCE Instance, _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _In_ PFLT_CALLBACK_DATA_QUEUE_INSERT_IO CbdqInsertIo, _In_ PFLT_CALLBACK_DATA_QUEUE_REMOVE_IO CbdqRemoveIo, _In_ PFLT_CALLBACK_DATA_QUEUE_PEEK_NEXT_IO CbdqPeekNextIo, _In_ PFLT_CALLBACK_DATA_QUEUE_ACQUIRE CbdqAcquire, _In_ PFLT_CALLBACK_DATA_QUEUE_RELEASE CbdqRelease, _In_ PFLT_CALLBACK_DATA_QUEUE_COMPLETE_CANCELED_IO CbdqCompleteCanceledIo)
_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE _In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _Out_ PIO_STATUS_BLOCK _In_opt_ PLARGE_INTEGER _In_ ULONG _In_ ULONG _In_ ULONG CreateDisposition
struct _FLT_PORT * PFLT_PORT
struct _FLT_NAME_CONTROL FLT_NAME_CONTROL
struct _FLT_PARAMETERS::@1924 QueryQuota
ULONG FLT_FILE_NAME_OPTIONS
VOID(FLTAPI * PFLT_COMPLETED_ASYNC_IO_CALLBACK)(_In_ PFLT_CALLBACK_DATA CallbackData, _In_ PFLT_CONTEXT Context)
FS_FILTER_SECTION_SYNC_TYPE SyncType
struct _FLT_PARAMETERS::@1922 SetSecurity
PIO_SECURITY_CONTEXT SecurityContext
_Must_inspect_result_ _Out_ PIO_STATUS_BLOCK Iosb
_Must_inspect_result_ _In_ PFLT_PORT _In_ ULONG _Out_writes_bytes_opt_ ReplyLength PVOID _Inout_opt_ PULONG ReplyLength
_In_ ULONG VolumePropertiesLength
struct _FLT_PARAMETERS::@1931 NetworkQueryOpen
struct _FLT_PARAMETERS::@1932 MdlRead
PFLT_CALLBACK_DATA_QUEUE_RELEASE Release
_Must_inspect_result_ _In_ PFLT_GET_OPERATION_STATUS_CALLBACK CallbackRoutine
_Must_inspect_result_ _Out_ PHANDLE _Outptr_opt_ PFILE_OBJECT * VolumeFileObject
_Outptr_ PFLT_INSTANCE * UpperInstance
const struct _FLT_CONTEXT_REGISTRATION * PCFLT_CONTEXT_REGISTRATION
_Must_inspect_result_ _In_ ULONG Flags
enum _FLT_PREOP_CALLBACK_STATUS FLT_PREOP_CALLBACK_STATUS
ULONG FLT_POST_OPERATION_FLAGS
LONG FLTAPI FltCompareInstanceAltitudes(_In_ PFLT_INSTANCE Instance1, _In_ PFLT_INSTANCE Instance2)
struct _FLT_FILE_NAME_INFORMATION * PFLT_FILE_NAME_INFORMATION
union _FLT_PARAMETERS::@1918 FileSystemControl
PFLT_NORMALIZE_CONTEXT_CLEANUP NormalizeContextCleanupCallback
PDEVICE_CAPABILITIES Capabilities
FLT_CONTEXT_REGISTRATION_FLAGS Flags
_Acquires_exclusive_lock_ Resource _Acquires_shared_lock_ Resource _Inout_ PERESOURCE Resource
PFLT_POST_OPERATION_CALLBACK PostOperation
BOOLEAN(NTAPI * PCHECK_FOR_TRAVERSE_ACCESS)(_In_ PVOID NotifyContext, _In_opt_ PVOID TargetContext, _In_ PSECURITY_SUBJECT_CONTEXT SubjectContext)
VOID FASTCALL FltRetainSwappedBufferMdlAddress(_In_ PFLT_CALLBACK_DATA CallbackData)
_Must_inspect_result_ _Out_ PULONG SessionId
DWORD SECURITY_INFORMATION
struct _FLT_PARAMETERS::@1929 ReleaseForModifiedPageWriter
_In_ PDEVICE_OBJECT DeviceObject
VOID FLTAPI FltClearCallbackDataDirty(_Inout_ PFLT_CALLBACK_DATA Data)
struct _FLT_PARAMETERS::@1936 MountVolume
struct _FLT_VOLUME_PROPERTIES * PFLT_VOLUME_PROPERTIES
struct _FLT_PARAMETERS::@1919::@1951 FastIo
_Must_inspect_result_ _In_opt_ PFLT_FILTER Filter
_Must_inspect_result_ _In_ LPCGUID ULONG _In_ FSRTL_ALLOCATE_ECP_FLAGS _In_opt_ PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK _In_ ULONG _Outptr_ PVOID * EcpContext
struct _FLT_PARAMETERS::@1915 QueryVolumeInformation
struct _FLT_PARAMETERS::@1926::@1953 QueryDeviceRelations
PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK InstanceQueryTeardownCallback
USHORT SubstituteNameOffset
LCID POINTER_ALIGNMENT LocaleId
_In_ PFLT_INSTANCE TargetInstance
_Unreferenced_parameter_ PVOID * CompletionContext
_Inout_ PLIST_ENTRY _In_ PVOID _In_ PSTRING _In_ BOOLEAN _In_ BOOLEAN IgnoreBuffer
_In_ PECP_LIST _In_ LPCGUID _Outptr_opt_ PVOID _Out_opt_ ULONG * EcpContextSize
_Must_inspect_result_ _In_ LPCGUID ULONG _In_ FSRTL_ALLOCATE_ECP_FLAGS _In_opt_ PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK _In_ ULONG PoolTag
NTSTATUS FLTAPI FltDetachVolume(_Inout_ PFLT_FILTER Filter, _Inout_ PFLT_VOLUME Volume, _In_opt_ PCUNICODE_STRING InstanceName)
#define _Out_writes_bytes_opt_(a)
struct _FLT_PARAMETERS::@1909 Read
VOID FLTAPI FltUninitializeFileLock(_In_ PFILE_LOCK FileLock)
ULONG POINTER_ALIGNMENT LockKey
_Must_inspect_result_ _In_opt_ PFLT_FILTER _In_ ULONG _Out_ PULONG NumberInstancesReturned
struct _FLT_TAG_DATA_BUFFER * TagData
_IRQL_requires_same_ _In_ PKE_PROCESSOR_CHANGE_NOTIFY_CONTEXT _Inout_ PNTSTATUS OperationStatus
_Must_inspect_result_ _In_ PKTRANSACTION _In_ PFLT_CONTEXT _In_ NOTIFICATION_MASK NotificationMask
_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_ FILE_INFORMATION_CLASS _Out_opt_ PULONG LengthReturned
VOID FLTAPI FltCbdqDisable(_Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq)
USHORT POINTER_ALIGNMENT FileAttributes
NTSTATUS(FLTAPI * PFLT_CALLBACK_DATA_QUEUE_INSERT_IO)(_Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _In_ PFLT_CALLBACK_DATA Cbd, _In_opt_ PVOID InsertContext)
_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG FileTag
_Inout_ PLIST_ENTRY _In_ PVOID _In_ PSTRING _In_ BOOLEAN _In_ BOOLEAN _In_ ULONG _In_ PFLT_CALLBACK_DATA NotifyCallbackData
FLT_CONTEXT_TYPE ContextType
struct _FLT_PARAMETERS::@1918::@1943 Common
_Must_inspect_result_ _In_ PFILE_OBJECT _In_ SECURITY_INFORMATION SecurityInformation
VOID(FLTAPI * PFLT_CONTEXT_CLEANUP_CALLBACK)(_In_ PFLT_CONTEXT Context, _In_ FLT_CONTEXT_TYPE ContextType)
#define FLTFL_IO_OPERATION_PAGING
_Reserved_ PVOID Reserved
PFLT_CALLBACK_DATA_QUEUE_ACQUIRE Acquire
_Must_inspect_result_ _In_ PFLT_CALLBACK_DATA _In_ ULONG OpenCount
_Must_inspect_result_ __drv_aliasesMem _In_ PDEVICE_OBJECT _In_opt_ PVOID _In_ ULONG _Out_opt_ PVOID OutputBuffer
VOID FLTAPI FltUnregisterFilter(_In_ PFLT_FILTER Filter)
struct _FLT_PARAMETERS::@1911 QueryFileInformation
VOID(FLTAPI * PFLT_COMPLETE_CANCELED_CALLBACK)(_In_ PFLT_CALLBACK_DATA CallbackData)
_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE _In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _Out_ PIO_STATUS_BLOCK _In_opt_ PLARGE_INTEGER _In_ ULONG FileAttributes
_In_ PCUNICODE_STRING _In_ PVOID Driver
struct _FLT_PARAMETERS::@1927 AcquireForSectionSynchronization
enum _FSINFOCLASS FS_INFORMATION_CLASS
struct _FLT_PARAMETERS::@1926::@1952 StartDevice
enum _DEVICE_RELATION_TYPE DEVICE_RELATION_TYPE
#define POINTER_ALIGNMENT
ULONG FLT_CALLBACK_DATA_QUEUE_FLAGS
_Must_inspect_result_ _Inout_ PFLT_VOLUME _In_ PCUNICODE_STRING Altitude
USHORT FLT_CONTEXT_REGISTRATION_FLAGS
BOOLEAN FLTAPI FltIsOperationSynchronous(_In_ PFLT_CALLBACK_DATA CallbackData)
NTSTATUS(FLTAPI * PFLT_TRANSACTION_NOTIFICATION_CALLBACK)(_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ PFLT_CONTEXT TransactionContext, _In_ ULONG NotificationMask)
_ANONYMOUS_STRUCT struct _FLT_PARAMETERS::@1912::@1938::@1939 DUMMYSTRUCTNAME
VOID(NTAPI * PUNLOCK_ROUTINE)(_In_ PVOID Context, _In_ PFILE_LOCK_INFO FileLockInfo)
_In_ PIRP _In_ PVOID InsertContext
PFLT_CONTEXT_ALLOCATE_CALLBACK ContextAllocateCallback
PMDL FASTCALL FltGetSwappedBufferMdlAddress(_In_ PFLT_CALLBACK_DATA CallbackData)
enum _FILE_INFORMATION_CLASS FILE_INFORMATION_CLASS
PIO_RESOURCE_REQUIREMENTS_LIST IoResourceRequirementList
PFLT_GENERATE_FILE_NAME GenerateFileNameCallback
_Must_inspect_result_ *NumberFiltersReturned PFLT_FILTER _In_ ULONG _Out_ PULONG NumberFiltersReturned
struct _FLT_TAG_DATA_BUFFER::@1964::@1965 SymbolicLinkReparseBuffer
struct _FLT_PARAMETERS::@1910 Write
PCHAR FLTAPI FltGetIrpName(_In_ UCHAR IrpMajorCode)
union _FLT_PARAMETERS * PFLT_PARAMETERS
PFLT_CALLBACK_DATA_QUEUE_PEEK_NEXT_IO PeekNextIo
DEVICE_USAGE_NOTIFICATION_TYPE POINTER_ALIGNMENT Type
_In_ PFLT_COMPLETE_CANCELED_CALLBACK CanceledCallback
_Outptr_ PDEVICE_OBJECT * DiskDeviceObject
struct _FLT_PARAMETERS::@1925 SetQuota
struct _FLT_TAG_DATA_BUFFER FLT_TAG_DATA_BUFFER
PFILE_OBJECT TargetFileObject
NTSTATUS(FLTAPI * PFLT_INSTANCE_SETUP_CALLBACK)(_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_SETUP_FLAGS Flags, _In_ DEVICE_TYPE VolumeDeviceType, _In_ FLT_FILESYSTEM_TYPE VolumeFilesystemType)
USHORT SubstituteNameLength
NTSTATUS(FLTAPI * PFLT_NORMALIZE_NAME_COMPONENT)(_In_ PFLT_INSTANCE Instance, _In_ PCUNICODE_STRING ParentDirectory, _In_ USHORT VolumeNameLength, _In_ PCUNICODE_STRING Component, _Out_writes_bytes_(ExpandComponentNameLength) PFILE_NAMES_INFORMATION ExpandComponentName, _In_ ULONG ExpandComponentNameLength, _In_ FLT_NORMALIZE_NAME_FLAGS Flags, _Inout_ PVOID *NormalizationContext)
NTSTATUS(FLTAPI * PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK)(_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags)
_In_ FLT_SET_CONTEXT_OPERATION _In_ PFLT_CONTEXT _Outptr_opt_result_maybenull_ PFLT_CONTEXT * OldContext
_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE _In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _Out_ PIO_STATUS_BLOCK _In_opt_ PLARGE_INTEGER _In_ ULONG _In_ ULONG _In_ ULONG _In_ ULONG _In_ ULONG EaLength
_Must_inspect_result_ _Outptr_ PFLT_PORT _In_ POBJECT_ATTRIBUTES _In_opt_ PVOID _In_ PFLT_CONNECT_NOTIFY _In_ PFLT_DISCONNECT_NOTIFY DisconnectNotifyCallback
enum _FLT_SET_CONTEXT_OPERATION FLT_SET_CONTEXT_OPERATION
_Must_inspect_result_ _In_ CONST FLT_REGISTRATION * Registration
PERESOURCE ResourceToRelease
struct _FLT_OPERATION_REGISTRATION * PFLT_OPERATION_REGISTRATION
PERESOURCE * ResourceToRelease
_Must_inspect_result_ _Out_ PIO_STATUS_BLOCK _Out_writes_bytes_(Length) PVOID FsInformation
PFLT_FILTER_UNLOAD_CALLBACK FilterUnloadCallback
union _FLT_PARAMETERS::@1919 DeviceIoControl
struct _FLT_PARAMETERS::@1914 SetEa
IO_CSQ_IRP_CONTEXT FLT_CALLBACK_DATA_QUEUE_IO_CONTEXT
union _FLT_PARAMETERS FLT_PARAMETERS
PFLT_CONTEXT StreamContext
struct _FLT_PARAMETERS::@1913 QueryEa
#define _Outptr_result_maybenull_
NTSTATUS(FLTAPI * PFLT_MESSAGE_NOTIFY)(_In_opt_ PVOID PortCookie, _In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer, _In_ ULONG InputBufferLength, _Out_writes_bytes_to_opt_(OutputBufferLength, *ReturnOutputBufferLength) PVOID OutputBuffer, _In_ ULONG OutputBufferLength, _Out_ PULONG ReturnOutputBufferLength)
VOID(FLTAPI * PFLT_INSTANCE_TEARDOWN_CALLBACK)(_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_TEARDOWN_FLAGS Reason)
_Must_inspect_result_ _In_opt_ PFILE_OBJECT FileObject
enum _WAIT_TYPE WAIT_TYPE
_In_opt_ PFILE_OBJECT _In_opt_ PETHREAD Thread
struct _FLT_PARAMETERS::@1906 Create
_Must_inspect_result_ _Out_ PHANDLE VolumeHandle
_Must_inspect_result_ _In_opt_ PFLT_INSTANCE Instance
_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE _In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _Out_ PIO_STATUS_BLOCK _In_opt_ PLARGE_INTEGER _In_ ULONG _In_ ULONG _In_ ULONG _In_ ULONG CreateOptions
VOID FLTAPI FltSetCallbackDataDirty(_Inout_ PFLT_CALLBACK_DATA Data)
_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_opt_ GUID _In_ USHORT DataBufferLength
PFLT_CALLBACK_DATA_QUEUE_INSERT_IO InsertIo
NTSTATUS FLTAPI FltGetVolumeProperties(_In_ PFLT_VOLUME Volume, _Out_writes_bytes_to_opt_(VolumePropertiesLength, *LengthReturned) PFLT_VOLUME_PROPERTIES VolumeProperties, _In_ ULONG VolumePropertiesLength, _Out_ PULONG LengthReturned)
_In_ ULONG _In_ ULONG _In_ ULONG Length
DEVICE_TEXT_TYPE DeviceTextType
_Acquires_lock_(_Global_critical_region_) _IRQL_requires_max_(APC_LEVEL) VOID FLTAPI FltAcquireResourceExclusive(_Inout_ _Requires_lock_not_held_(*_Curr_) _Acquires_lock_(*_Curr_) PERESOURCE Resource)
FLT_CALLBACK_DATA_QUEUE_FLAGS Flags
_Must_inspect_result_ PFLT_CALLBACK_DATA FLTAPI FltCbdqRemoveIo(_Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _In_ PFLT_CALLBACK_DATA_QUEUE_IO_CONTEXT Context)
struct _FLT_PARAMETERS::@1908 CreateMailslot
_In_ PFLT_INSTANCE _Out_ PBOOLEAN RedirectionAllowed
_In_ FILTER_INFORMATION_CLASS _In_ ULONG BufferSize
_Must_inspect_result_ _In_ LPCGUID ULONG _In_ FSRTL_ALLOCATE_ECP_FLAGS _In_opt_ PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK CleanupCallback
_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE _In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _Out_ PIO_STATUS_BLOCK _In_opt_ PLARGE_INTEGER _In_ ULONG _In_ ULONG _In_ ULONG _In_ ULONG _In_ ULONG _In_ ULONG Flags
enum _WORK_QUEUE_TYPE WORK_QUEUE_TYPE
UNICODE_STRING RealDeviceName
_In_ FLT_PREOP_CALLBACK_STATUS CallbackStatus
struct _FLT_PARAMETERS::@1912 SetFileInformation
PFLT_CALLBACK_DATA_QUEUE_COMPLETE_CANCELED_IO CompleteCanceledIo
_Must_inspect_result_ _In_ PFLT_PORT _In_ ULONG _Out_writes_bytes_opt_ ReplyLength PVOID ReplyBuffer
NTSTATUS FLTAPI FltAttachVolume(_Inout_ PFLT_FILTER Filter, _Inout_ PFLT_VOLUME Volume, _In_opt_ PCUNICODE_STRING InstanceName, _Outptr_opt_result_maybenull_ PFLT_INSTANCE *RetInstance)
_In_ PECP_LIST _In_opt_ PVOID CurrentEcpContext
_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_ BOOLEAN _In_ ULONG EaListLength
ULONG POINTER_ALIGNMENT EaLength
_Must_inspect_result_ _In_ PFLT_INSTANCE _Out_ PBOOLEAN IsDirectory
PFLT_CONTEXT_CLEANUP_CALLBACK ContextCleanupCallback
_Releases_lock_(_Global_critical_region_) _IRQL_requires_max_(DISPATCH_LEVEL) VOID FLTAPI FltReleaseResource(_Inout_ _Requires_lock_held_(*_Curr_) _Releases_lock_(*_Curr_) PERESOURCE Resource)
_In_ FLT_PREOP_CALLBACK_STATUS _In_opt_ PVOID Context
_In_opt_ PFILE_OBJECT Fo2
BOOLEAN FLTAPI FltIsCallbackDataDirty(_In_ PFLT_CALLBACK_DATA Data)
VOID FLTAPI FltReleaseFileNameInformation(_In_ PFLT_FILE_NAME_INFORMATION FileNameInformation)
_Must_inspect_result_ _In_ PFLT_FILE_NAME_INFORMATION _Outptr_result_maybenull_ PFLT_FILE_NAME_INFORMATION * RetTunneledFileNameInformation
PFLT_CONTEXT_FREE_CALLBACK ContextFreeCallback
struct _FLT_PARAMETERS::@1926::@1961 UsageNotification
_FLT_PREOP_CALLBACK_STATUS
_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE _In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _Out_ PIO_STATUS_BLOCK _In_opt_ PLARGE_INTEGER _In_ ULONG _In_ ULONG _In_ ULONG _In_ ULONG _In_reads_bytes_opt_(EaLength) PVOID EaBuffer
struct _FLT_CALLBACK_DATA * PFLT_CALLBACK_DATA
FLT_CALLBACK_DATA_FLAGS Flags
enum _FLT_POSTOP_CALLBACK_STATUS * PFLT_POSTOP_CALLBACK_STATUS
_Must_inspect_result_ _In_ PFILE_OBJECT _In_opt_ PLARGE_INTEGER ByteOffset
struct _FLT_INSTANCE * PFLT_INSTANCE
ULONG POINTER_ALIGNMENT Spare2
FS_INFORMATION_CLASS POINTER_ALIGNMENT FsInformationClass
_Must_inspect_result_ _In_ USHORT NewSize
_In_ PECP_LIST _In_opt_ PVOID _Out_opt_ LPGUID _Outptr_opt_ PVOID _Out_opt_ ULONG * NextEcpContextSize
struct _FLT_IO_PARAMETER_BLOCK * PFLT_IO_PARAMETER_BLOCK
_Must_inspect_result_ _In_opt_ PFILE_OBJECT _Outptr_ PFLT_CALLBACK_DATA * RetNewCallbackData
PFLT_INSTANCE_TEARDOWN_CALLBACK InstanceTeardownCompleteCallback
IN PVOID IN PVOID IN USHORT IN USHORT Size
_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE FileHandle
NTSTATUS(FLTAPI * PFLT_FILTER_UNLOAD_CALLBACK)(FLT_FILTER_UNLOAD_FLAGS Flags)
struct _FLT_PARAMETERS::@1930 FastIoCheckIfPossible
ULONG FLT_NORMALIZE_NAME_FLAGS
_Must_inspect_result_ _Outptr_ PFLT_PORT _In_ POBJECT_ATTRIBUTES _In_opt_ PVOID _In_ PFLT_CONNECT_NOTIFY ConnectNotifyCallback
PCM_RESOURCE_LIST AllocatedResourcesTranslated
SECURITY_INFORMATION SecurityInformation
_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_ ULONG InputBufferLength
VOID(FLTAPI * PFLT_CALLBACK_DATA_QUEUE_COMPLETE_CANCELED_IO)(_Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _Inout_ PFLT_CALLBACK_DATA Cbd)
enum _IO_PRIORITY_HINT IO_PRIORITY_HINT
_Must_inspect_result_ _In_ PFILE_OBJECT _In_opt_ HANDLE _In_ ULONG FileNameLength
ULONG FLT_REGISTRATION_FLAGS
#define _ANONYMOUS_STRUCT
ULONG FLT_ALLOCATE_CALLBACK_DATA_FLAGS
PFILE_OBJECT ParentOfTarget
_Must_inspect_result_ _In_ PFILE_OBJECT _In_opt_ PLARGE_INTEGER _In_ ULONG _In_ FLT_IO_OPERATION_FLAGS _Out_opt_ PULONG _In_opt_ PFLT_COMPLETED_ASYNC_IO_CALLBACK _In_opt_ PVOID CallbackContext
NTSTATUS(FLTAPI * PFLT_CONNECT_NOTIFY)(_In_ PFLT_PORT ClientPort, _In_opt_ PVOID ServerPortCookie, _In_reads_bytes_opt_(SizeOfContext) PVOID ConnectionContext, _In_ ULONG SizeOfContext, _Outptr_result_maybenull_ PVOID *ConnectionPortCookie)
#define _Outptr_opt_result_bytebuffer_(size)
const struct _FLT_RELATED_OBJECTS * PCFLT_RELATED_OBJECTS
_Must_inspect_result_ _In_ PFLT_GET_OPERATION_STATUS_CALLBACK _In_opt_ PVOID RequesterContext
struct _FLT_CALLBACK_DATA_QUEUE FLT_CALLBACK_DATA_QUEUE
_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE _In_ ACCESS_MASK DesiredAccess
NTSTATUS FLTAPI FltGetDestinationFileNameInformation(_In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _In_opt_ HANDLE RootDirectory, _In_reads_bytes_(FileNameLength) PWSTR FileName, _In_ ULONG FileNameLength, _In_ FLT_FILE_NAME_OPTIONS NameOptions, _Outptr_ PFLT_FILE_NAME_INFORMATION *RetFileNameInformation)
FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass
NTSTATUS FLTAPI FltGetFileNameInformation(_In_ PFLT_CALLBACK_DATA CallbackData, _In_ FLT_FILE_NAME_OPTIONS NameOptions, _Outptr_ PFLT_FILE_NAME_INFORMATION *FileNameInformation)
_ANONYMOUS_UNION union _FLT_CALLBACK_DATA::@1962 DUMMYUNIONNAME
_Must_inspect_result_ _In_ FLT_FILE_NAME_OPTIONS NameOptions
struct _FLT_PARAMETERS::@1918::@1945 Buffered
NTSTATUS NTAPI FltGetFilterFromName(_In_ PCUNICODE_STRING FilterName, _Out_ PFLT_FILTER *RetFilter)
_Outptr_ PFLT_INSTANCE * LowerInstance
ULONG FLT_INSTANCE_SETUP_FLAGS
enum _LOCK_OPERATION LOCK_OPERATION
ULONG POINTER_ALIGNMENT InputBufferLength
_In_ PFLT_INSTANCE _Out_ PBOOLEAN RedirectionAllowedThisIo
USHORT UnparsedNameLength
PFILE_GET_QUOTA_INFORMATION SidList
IO_CSQ_IRP_CONTEXT * PFLT_CALLBACK_DATA_QUEUE_IO_CONTEXT
NTSTATUS(FLTAPI * PFLT_GENERATE_FILE_NAME)(_In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _In_opt_ PFLT_CALLBACK_DATA CallbackData, _In_ FLT_FILE_NAME_OPTIONS NameOptions, _Out_ PBOOLEAN CacheFileNameInformation, _Out_ PFLT_NAME_CONTROL FileName)
NTSTATUS FLTAPI FltObjectReference(_Inout_ PVOID Object)
_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE _In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _Out_ PIO_STATUS_BLOCK _In_opt_ PLARGE_INTEGER AllocationSize
USHORT FLT_FILE_NAME_PARSED_FLAGS
_Must_inspect_result_ _In_ PKTRANSACTION _In_ PFLT_CONTEXT TransactionContext
NTSTATUS FLTAPI FltGetFileNameInformationUnsafe(_In_ PFILE_OBJECT FileObject, _In_opt_ PFLT_INSTANCE Instance, _In_ FLT_FILE_NAME_OPTIONS NameOptions, _Outptr_ PFLT_FILE_NAME_INFORMATION *FileNameInformation)
ULONG POINTER_ALIGNMENT Key
_Must_inspect_result_ _In_ PFLT_PORT _In_ ULONG SenderBufferLength
_Inout_ PLIST_ENTRY NotifyList
union _FLT_PARAMETERS::@1917 DirectoryControl
_Must_inspect_result_ _Outptr_ PFLT_PORT _In_ POBJECT_ATTRIBUTES _In_opt_ PVOID ServerPortCookie
_In_ FILTER_INFORMATION_CLASS _In_ ULONG _Out_ PULONG BytesReturned
struct _FLT_PARAMETERS::@1907 CreatePipe
_Must_inspect_result_ _In_ ULONG VolumeListSize
PVOID(FLTAPI * PFLT_CONTEXT_ALLOCATE_CALLBACK)(_In_ POOL_TYPE PoolType, _In_ SIZE_T Size, _In_ FLT_CONTEXT_TYPE ContextType)
#define _Outptr_opt_result_maybenull_
struct _FLT_PARAMETERS::@1926::@1960 QueryDeviceText
struct _FLT_GENERIC_WORKITEM * PFLT_GENERIC_WORKITEM
ULONG FLT_CALLBACK_DATA_FLAGS
_In_ FLT_CONTEXT_TYPE _Out_ PFLT_RELATED_CONTEXTS Contexts
struct _FLT_REGISTRATION * PFLT_REGISTRATION
FLT_REGISTRATION_FLAGS Flags
_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE _In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES ObjectAttributes
struct _FLT_REGISTRATION FLT_REGISTRATION
_Inout_ PLIST_ENTRY _In_ PVOID _In_ PSTRING _In_ BOOLEAN _In_ BOOLEAN _In_ ULONG CompletionFilter
NTSTATUS(FLTAPI * PFLT_NORMALIZE_NAME_COMPONENT_EX)(_In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _In_ PCUNICODE_STRING ParentDirectory, _In_ USHORT VolumeNameLength, _In_ PCUNICODE_STRING Component, _Out_writes_bytes_(ExpandComponentNameLength) PFILE_NAMES_INFORMATION ExpandComponentName, _In_ ULONG ExpandComponentNameLength, _In_ FLT_NORMALIZE_NAME_FLAGS Flags, _Inout_ PVOID *NormalizationContext)
struct _FLT_FILE_NAME_INFORMATION FLT_FILE_NAME_INFORMATION
_Must_inspect_result_ _Out_ PBOOLEAN IsWritable
struct _FLT_RELATED_OBJECTS FLT_RELATED_OBJECTS
VOID(FLTAPI * PFLT_DISCONNECT_NOTIFY)(_In_opt_ PVOID ConnectionCookie)
struct _FLT_PARAMETERS::@1926::@1959 QueryId
struct _FLT_IO_PARAMETER_BLOCK FLT_IO_PARAMETER_BLOCK
_In_opt_ PIRP _In_opt_ PVOID PeekContext
PFLT_CONTEXT VolumeContext
_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG FsControlCode
VOID FLTAPI FltFreeSecurityDescriptor(_In_ PSECURITY_DESCRIPTOR SecurityDescriptor)
VOID(FLTAPI * PFLT_DEFERRED_IO_WORKITEM_ROUTINE)(_In_ PFLT_DEFERRED_IO_WORKITEM FltWorkItem, _In_ PFLT_CALLBACK_DATA CallbackData, _In_opt_ PVOID Context)
ULONG POINTER_ALIGNMENT IoControlCode
CONST FLT_CONTEXT_REGISTRATION * ContextRegistration
struct _FLT_PARAMETERS::@1926::@1958 SetLock
enum _FS_FILTER_SECTION_SYNC_TYPE FS_FILTER_SECTION_SYNC_TYPE
_Inout_ PLIST_ENTRY _In_ PVOID _In_ PSTRING _In_ BOOLEAN _In_ BOOLEAN _In_ ULONG _In_ PFLT_CALLBACK_DATA _In_opt_ PCHECK_FOR_TRAVERSE_ACCESS TraverseCallback
_In_ FLT_SET_CONTEXT_OPERATION _In_ PFLT_CONTEXT NewContext
PFLT_IO_PARAMETER_BLOCK CONST Iopb
PCM_RESOURCE_LIST AllocatedResources
_Must_inspect_result_ _Inout_opt_ PUNICODE_STRING VolumeName
_Must_inspect_result_ _In_ PFILE_OBJECT _In_ SECURITY_INFORMATION _Inout_updates_bytes_opt_(Length) PSECURITY_DESCRIPTOR SecurityDescriptor
ULONG DeviceCharacteristics
_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_ FILE_INFORMATION_CLASS FileInformationClass
UNICODE_STRING FileSystemDeviceName
_Must_inspect_result_ _In_opt_ PFLT_FILTER _In_ ULONG InstanceListSize
NTSTATUS(* PFLT_COMPLETE_LOCK_CALLBACK_DATA_ROUTINE)(_In_opt_ PVOID Context, _In_ PFLT_CALLBACK_DATA CallbackData)
_Must_inspect_result_ _Inout_ PFLT_VOLUME _In_opt_ PCUNICODE_STRING InstanceName
NTSTATUS NTAPI FltRegisterFilter(_In_ PDRIVER_OBJECT DriverObject, _In_ const FLT_REGISTRATION *Registration, _Out_ PFLT_FILTER *RetFilter)
_Must_inspect_result_ PFLT_CALLBACK_DATA FLTAPI FltCbdqRemoveNextIo(_Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _In_opt_ PVOID PeekContext)
struct _FLT_DEFERRED_IO_WORKITEM * PFLT_DEFERRED_IO_WORKITEM
_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE _In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _Out_ PIO_STATUS_BLOCK IoStatusBlock
_ANONYMOUS_UNION union _FLT_TAG_DATA_BUFFER::@1964 DUMMYUNIONNAME
ULONG POINTER_ALIGNMENT FsControlCode
_Must_inspect_result_ typedef _In_ PHYSICAL_ADDRESS _Inout_ PLARGE_INTEGER NumberOfBytes
NTSTATUS FLTAPI FltGetVolumeName(_In_ PFLT_VOLUME Volume, _Inout_opt_ PUNICODE_STRING VolumeName, _Out_opt_ PULONG BufferSizeNeeded)
struct _FLT_TAG_DATA_BUFFER::@1964::@1966 MountPointReparseBuffer
_Must_inspect_result_ _In_ FLT_CONTEXT_TYPE ContextType
KPROCESSOR_MODE RequestorMode
_Must_inspect_result_ _In_ WAIT_TYPE _In_opt_ PLARGE_INTEGER _In_opt_ PKWAIT_BLOCK WaitBlockArray
_In_ FLT_SET_CONTEXT_OPERATION Operation
BOOLEAN FLTAPI FltIsIoCanceled(_In_ PFLT_CALLBACK_DATA CallbackData)
_Must_inspect_result_ _Outptr_ PFLT_PORT _In_ POBJECT_ATTRIBUTES _In_opt_ PVOID _In_ PFLT_CONNECT_NOTIFY _In_ PFLT_DISCONNECT_NOTIFY _In_opt_ PFLT_MESSAGE_NOTIFY _In_ LONG MaxConnections
_Must_inspect_result_ _In_ PFILE_OBJECT _In_ SECURITY_INFORMATION _In_ ULONG _Out_opt_ PULONG LengthNeeded
VOID(* PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK)(_Inout_ PVOID EcpContext, _In_ LPCGUID EcpType)
_Must_inspect_result_ _In_ PVOID FltObject
_In_opt_ PFILE_OBJECT _In_opt_ PETHREAD _Inout_ PIO_PRIORITY_INFO PriorityInfo
NTSTATUS FLTAPI FltGetDiskDeviceObject(_In_ PFLT_VOLUME Volume, _Outptr_ PDEVICE_OBJECT *DiskDeviceObject)
PFLT_PRE_OPERATION_CALLBACK PreOperation
_Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) NTSTATUS FLTAPI FltCheckAndGrowNameControl(_Inout_ PFLT_NAME_CONTROL NameCtrl
ULONG AlignmentRequirement
_When_(CallbackStatus==FLT_PREOP_COMPLETE, _IRQL_requires_max_(DISPATCH_LEVEL)) _When_(CallbackStatus!
_Must_inspect_result_ _In_ LPCGUID ULONG SizeOfContext
FLT_PREOP_CALLBACK_STATUS(FLTAPI * PFLT_PRE_OPERATION_CALLBACK)(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Outptr_result_maybenull_ PVOID *CompletionContext)
_In_ FILTER_INFORMATION_CLASS InformationClass
_In_ PECP_LIST _In_opt_ PVOID _Out_opt_ LPGUID NextEcpType
ULONG POINTER_ALIGNMENT CompletionFilter
struct _FLT_TAG_DATA_BUFFER::@1964::@1967 GenericReparseBuffer
VOID FLTAPI FltInitializeFileLock(_Out_ PFILE_LOCK FileLock)
VOID(FLTAPI * PFLT_CALLBACK_DATA_QUEUE_RELEASE)(_Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _In_opt_ KIRQL Irql)
struct _FLT_RELATED_CONTEXTS * PFLT_RELATED_CONTEXTS
_Must_inspect_result_ _In_ FLT_FILE_NAME_OPTIONS _Outptr_ PFLT_FILE_NAME_INFORMATION * FileNameInformation
PVOID PVOID PWCHAR PVOID USHORT PULONG Reason
_Must_inspect_result_ _In_ FLT_CONTEXT_TYPE _In_ SIZE_T _In_ POOL_TYPE PoolType
struct _FLT_PARAMETERS::@1933 MdlReadComplete
_ANONYMOUS_STRUCT struct _FLT_CALLBACK_DATA::@1962::@1963 DUMMYSTRUCTNAME
VOID(FLTAPI * PFLT_NORMALIZE_CONTEXT_CLEANUP)(_In_opt_ PVOID *NormalizationContext)
_Must_inspect_result_ _Outptr_ PFLT_PORT _In_ POBJECT_ATTRIBUTES _In_opt_ PVOID _In_ PFLT_CONNECT_NOTIFY _In_ PFLT_DISCONNECT_NOTIFY _In_opt_ PFLT_MESSAGE_NOTIFY MessageNotifyCallback
ULONG FLT_FILTER_UNLOAD_FLAGS
PFLT_CONTEXT InstanceContext
_Inout_opt_ PUNICODE_STRING Extension
_Inout_opt_ PUNICODE_STRING _Inout_opt_ PUNICODE_STRING Stream
struct _FLT_VOLUME_PROPERTIES FLT_VOLUME_PROPERTIES
_Must_inspect_result_ _Out_ PUNICODE_STRING VolumeGuidName
_Must_inspect_result_ _In_ PFILE_OBJECT _In_opt_ PLARGE_INTEGER _In_ ULONG _Out_writes_bytes_to_(Length, *BytesRead) PVOID Buffer
_In_ PECP_LIST _In_opt_ PVOID _Out_opt_ LPGUID _Outptr_opt_ PVOID * NextEcpContext
_Must_inspect_result_ _In_ PFILE_OBJECT _In_opt_ PLARGE_INTEGER _In_ ULONG _In_ FLT_IO_OPERATION_FLAGS _Out_opt_ PULONG BytesRead
_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE _Outptr_opt_ PFILE_OBJECT _In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _Out_ PIO_STATUS_BLOCK _In_opt_ PLARGE_INTEGER _In_ ULONG _In_ ULONG _In_ ULONG _In_ ULONG _In_ ULONG _In_ ULONG _In_opt_ PIO_DRIVER_CREATE_CONTEXT DriverContext
DEVICE_RELATION_TYPE Type
_Inout_ PLIST_ENTRY _In_ PVOID _In_ PSTRING FullDirectoryName
#define _Requires_lock_held_(a)
_Must_inspect_result_ _In_ PFLT_CALLBACK_DATA _In_ PFLT_DEFERRED_IO_WORKITEM_ROUTINE _In_ WORK_QUEUE_TYPE QueueType
_FLT_POSTOP_CALLBACK_STATUS
_Must_inspect_result_ BOOLEAN FLTAPI FltDoCompletionProcessingWhenSafe(_In_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_opt_ PVOID CompletionContext, _In_ FLT_POST_OPERATION_FLAGS Flags, _In_ PFLT_POST_OPERATION_CALLBACK SafePostCallback, _Out_ PFLT_POSTOP_CALLBACK_STATUS RetPostOperationStatus)
ULONG FSRTL_ALLOCATE_ECP_FLAGS
NTSTATUS NTAPI FltUnloadFilter(_In_ PCUNICODE_STRING FilterName)
_Must_inspect_result_ _In_ PFILE_OBJECT _In_opt_ HANDLE _In_reads_bytes_(FileNameLength) PWSTR FileName
NTSTATUS NTAPI FltLoadFilter(_In_ PCUNICODE_STRING FilterName)
struct _FLT_CONTEXT_REGISTRATION FLT_CONTEXT_REGISTRATION
_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_opt_ GUID * Guid
_Must_inspect_result_ _In_ LPCGUID _In_ ULONG _In_ FSRTL_ALLOCATE_ECP_FLAGS _In_opt_ PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK _Inout_ PVOID LookasideList
VOID(FLTAPI * PFLT_CONTEXT_FREE_CALLBACK)(_In_ PVOID Pool, _In_ FLT_CONTEXT_TYPE ContextType)
_Out_ PFLT_FILESYSTEM_TYPE FileSystemType