fltkernel.h

Go to the documentation of this file.

/*
 * fltkernel.h
 *
 * This file is part of the ReactOS DDK package.
 *
 * Contributors:
 *   Amine Khaldi (amine.khaldi@reactos.org)
 *
 * THIS SOFTWARE IS NOT COPYRIGHTED
 *
 * This source code is offered for use in the public domain. You may
 * use, modify or distribute it freely.
 *
 * This code is distributed in the hope that it will be useful but
 * WITHOUT ANY WARRANTY. ALL WARRANTIES, EXPRESS OR IMPLIED ARE HEREBY
 * DISCLAIMED. This includes but is not limited to warranties of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 *
 */
#pragma once

#ifndef __FLTKERNEL__
#define __FLTKERNEL__

#ifdef __cplusplus
extern "C" {
#endif

#define FLT_MGR_BASELINE (((OSVER(NTDDI_VERSION) == NTDDI_WIN2K) && (SPVER(NTDDI_VERSION) >= SPVER(NTDDI_WIN2KSP4))) || \
                          ((OSVER(NTDDI_VERSION) == NTDDI_WINXP) && (SPVER(NTDDI_VERSION) >= SPVER(NTDDI_WINXPSP2))) || \
                          ((OSVER(NTDDI_VERSION) == NTDDI_WS03)  && (SPVER(NTDDI_VERSION) >= SPVER(NTDDI_WS03SP1)))  || \
                          (NTDDI_VERSION >= NTDDI_VISTA))

#define FLT_MGR_AFTER_XPSP2 (((OSVER(NTDDI_VERSION) == NTDDI_WIN2K) && (SPVER(NTDDI_VERSION) >= SPVER(NTDDI_WIN2KSP4))) || \
                             ((OSVER(NTDDI_VERSION) == NTDDI_WINXP) && (SPVER(NTDDI_VERSION) >  SPVER(NTDDI_WINXPSP2))) || \
                             ((OSVER(NTDDI_VERSION) == NTDDI_WS03)  && (SPVER(NTDDI_VERSION) >= SPVER(NTDDI_WS03SP1)))  || \
                             (NTDDI_VERSION >= NTDDI_VISTA))

#define FLT_MGR_LONGHORN (NTDDI_VERSION >= NTDDI_VISTA)
#define FLT_MGR_WIN7 (NTDDI_VERSION >= NTDDI_WIN7)

#include <ntifs.h>
#include <fltuserstructures.h>
#include <initguid.h>

#if FLT_MGR_BASELINE

#if FLT_MGR_LONGHORN
#define FLT_ASSERT(_e) NT_ASSERT(_e)
#define FLT_ASSERTMSG(_m, _e) NT_ASSERTMSG(_m, _e)
#else
#define FLT_ASSERT(_e) ASSERT(_e)
#define FLT_ASSERTMSG(_m, _e) ASSERTMSG(_m, _e)
#endif /* FLT_MGR_LONGHORN */

#define Add2Ptr(P,I) ((PVOID)((PUCHAR)(P) + (I)))
#define PtrOffset(B,O) ((ULONG)((ULONG_PTR)(O) - (ULONG_PTR)(B)))

#define ROUND_TO_SIZE(_length, _alignment) \
  ((((ULONG_PTR)(_length)) + ((_alignment)-1)) & ~(ULONG_PTR) ((_alignment) - 1))

#define IS_ALIGNED(_pointer, _alignment) \
  ((((ULONG_PTR) (_pointer)) & ((_alignment) - 1)) == 0)

#define IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION ((UCHAR)-1)
#define IRP_MJ_RELEASE_FOR_SECTION_SYNCHRONIZATION ((UCHAR)-2)
#define IRP_MJ_ACQUIRE_FOR_MOD_WRITE               ((UCHAR)-3)
#define IRP_MJ_RELEASE_FOR_MOD_WRITE               ((UCHAR)-4)
#define IRP_MJ_ACQUIRE_FOR_CC_FLUSH                ((UCHAR)-5)
#define IRP_MJ_RELEASE_FOR_CC_FLUSH                ((UCHAR)-6)
#define IRP_MJ_FAST_IO_CHECK_IF_POSSIBLE           ((UCHAR)-13)
#define IRP_MJ_NETWORK_QUERY_OPEN                  ((UCHAR)-14)
#define IRP_MJ_MDL_READ                            ((UCHAR)-15)
#define IRP_MJ_MDL_READ_COMPLETE                   ((UCHAR)-16)
#define IRP_MJ_PREPARE_MDL_WRITE                   ((UCHAR)-17)
#define IRP_MJ_MDL_WRITE_COMPLETE                  ((UCHAR)-18)
#define IRP_MJ_VOLUME_MOUNT                        ((UCHAR)-19)
#define IRP_MJ_VOLUME_DISMOUNT                     ((UCHAR)-20)
#define IRP_MJ_OPERATION_END                       ((UCHAR)0x80)
#define FLT_INTERNAL_OPERATION_COUNT               22

#define NULL_CONTEXT ((PFLT_CONTEXT)NULL)

typedef struct _FLT_FILTER *PFLT_FILTER;
typedef struct _FLT_VOLUME *PFLT_VOLUME;
typedef struct _FLT_INSTANCE *PFLT_INSTANCE;
typedef struct _FLT_PORT *PFLT_PORT;

typedef PVOID PFLT_CONTEXT;

#if !FLT_MGR_LONGHORN
typedef struct _KTRANSACTION *PKTRANSACTION;
#endif

#if !defined(_AMD64_) && !defined(_IA64_) && !defined(_ARM_)
#include "pshpack4.h"
#endif

typedef union _FLT_PARAMETERS {
  struct {
    PIO_SECURITY_CONTEXT SecurityContext;
    ULONG Options;
    USHORT POINTER_ALIGNMENT FileAttributes;
    USHORT ShareAccess;
    ULONG POINTER_ALIGNMENT EaLength;
    PVOID EaBuffer;
    LARGE_INTEGER AllocationSize;
  } Create;
  struct {
    PIO_SECURITY_CONTEXT SecurityContext;
    ULONG Options;
    USHORT POINTER_ALIGNMENT Reserved;
    USHORT ShareAccess;
    PVOID Parameters;
  } CreatePipe;
  struct {
    PIO_SECURITY_CONTEXT SecurityContext;
    ULONG Options;
    USHORT POINTER_ALIGNMENT Reserved;
    USHORT ShareAccess;
    PVOID Parameters;
  } CreateMailslot;
  struct {
    ULONG Length;
    ULONG POINTER_ALIGNMENT Key;
    LARGE_INTEGER ByteOffset;
    PVOID ReadBuffer;
    PMDL MdlAddress;
  } Read;
  struct {
    ULONG Length;
    ULONG POINTER_ALIGNMENT Key;
    LARGE_INTEGER ByteOffset;
    PVOID WriteBuffer;
    PMDL MdlAddress;
  } Write;
  struct {
    ULONG Length;
    FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass;
    PVOID InfoBuffer;
  } QueryFileInformation;
  struct {
    ULONG Length;
    FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass;
    PFILE_OBJECT ParentOfTarget;
    _ANONYMOUS_UNION union {
      _ANONYMOUS_STRUCT struct {
        BOOLEAN ReplaceIfExists;
        BOOLEAN AdvanceOnly;
      } DUMMYSTRUCTNAME;
      ULONG ClusterCount;
      HANDLE DeleteHandle;
    } DUMMYUNIONNAME;
    PVOID InfoBuffer;
  } SetFileInformation;
  struct {
    ULONG Length;
    PVOID EaList;
    ULONG EaListLength;
    ULONG POINTER_ALIGNMENT EaIndex;
    PVOID EaBuffer;
    PMDL MdlAddress;
  } QueryEa;
  struct {
    ULONG Length;
    PVOID EaBuffer;
    PMDL MdlAddress;
  } SetEa;
  struct {
    ULONG Length;
    FS_INFORMATION_CLASS POINTER_ALIGNMENT FsInformationClass;
    PVOID VolumeBuffer;
  } QueryVolumeInformation;
  struct {
    ULONG Length;
    FS_INFORMATION_CLASS POINTER_ALIGNMENT FsInformationClass;
    PVOID VolumeBuffer;
  } SetVolumeInformation;
  union {
    struct {
      ULONG Length;
      PUNICODE_STRING FileName;
      FILE_INFORMATION_CLASS FileInformationClass;
      ULONG POINTER_ALIGNMENT FileIndex;
      PVOID DirectoryBuffer;
      PMDL MdlAddress;
    } QueryDirectory;
    struct {
      ULONG Length;
      ULONG POINTER_ALIGNMENT CompletionFilter;
      ULONG POINTER_ALIGNMENT Spare1;
      ULONG POINTER_ALIGNMENT Spare2;
      PVOID DirectoryBuffer;
      PMDL MdlAddress;
    } NotifyDirectory;
  } DirectoryControl;
  union {
    struct {
      PVPB Vpb;
      PDEVICE_OBJECT DeviceObject;
    } VerifyVolume;
    struct {
      ULONG OutputBufferLength;
      ULONG POINTER_ALIGNMENT InputBufferLength;
      ULONG POINTER_ALIGNMENT FsControlCode;
    } Common;
    struct {
      ULONG OutputBufferLength;
      ULONG POINTER_ALIGNMENT InputBufferLength;
      ULONG POINTER_ALIGNMENT FsControlCode;
      PVOID InputBuffer;
      PVOID OutputBuffer;
      PMDL OutputMdlAddress;
    } Neither;
    struct {
      ULONG OutputBufferLength;
      ULONG POINTER_ALIGNMENT InputBufferLength;
      ULONG POINTER_ALIGNMENT FsControlCode;
      PVOID SystemBuffer;
    } Buffered;
    struct {
      ULONG OutputBufferLength;
      ULONG POINTER_ALIGNMENT InputBufferLength;
      ULONG POINTER_ALIGNMENT FsControlCode;
      PVOID InputSystemBuffer;
      PVOID OutputBuffer;
      PMDL OutputMdlAddress;
    } Direct;
  } FileSystemControl;
  union {
    struct {
      ULONG OutputBufferLength;
      ULONG POINTER_ALIGNMENT InputBufferLength;
      ULONG POINTER_ALIGNMENT IoControlCode;
    } Common;
    struct {
      ULONG OutputBufferLength;
      ULONG POINTER_ALIGNMENT InputBufferLength;
      ULONG POINTER_ALIGNMENT IoControlCode;
      PVOID InputBuffer;
      PVOID OutputBuffer;
      PMDL OutputMdlAddress;
    } Neither;
    struct {
      ULONG OutputBufferLength;
      ULONG POINTER_ALIGNMENT InputBufferLength;
      ULONG POINTER_ALIGNMENT IoControlCode;
      PVOID SystemBuffer;
    } Buffered;
    struct {
      ULONG OutputBufferLength;
      ULONG POINTER_ALIGNMENT InputBufferLength;
      ULONG POINTER_ALIGNMENT IoControlCode;
      PVOID InputSystemBuffer;
      PVOID OutputBuffer;
      PMDL OutputMdlAddress;
    } Direct;
    struct {
      ULONG OutputBufferLength;
      ULONG POINTER_ALIGNMENT InputBufferLength;
      ULONG POINTER_ALIGNMENT IoControlCode;
      PVOID InputBuffer;
      PVOID OutputBuffer;
    } FastIo;
  } DeviceIoControl;
  struct {
    PLARGE_INTEGER Length;
    ULONG POINTER_ALIGNMENT Key;
    LARGE_INTEGER ByteOffset;
    PEPROCESS ProcessId;
    BOOLEAN FailImmediately;
    BOOLEAN ExclusiveLock;
  } LockControl;
  struct {
    SECURITY_INFORMATION SecurityInformation;
    ULONG POINTER_ALIGNMENT Length;
    PVOID SecurityBuffer;
    PMDL MdlAddress;
  } QuerySecurity;
  struct {
    SECURITY_INFORMATION SecurityInformation;
    PSECURITY_DESCRIPTOR SecurityDescriptor;
  } SetSecurity;
  struct {
    ULONG_PTR ProviderId;
    PVOID DataPath;
    ULONG BufferSize;
    PVOID Buffer;
  } WMI;
  struct {
    ULONG Length;
    PSID StartSid;
    PFILE_GET_QUOTA_INFORMATION SidList;
    ULONG SidListLength;
    PVOID QuotaBuffer;
    PMDL MdlAddress;
  } QueryQuota;
  struct {
    ULONG Length;
    PVOID QuotaBuffer;
    PMDL MdlAddress;
  } SetQuota;
  union {
    struct {
      PCM_RESOURCE_LIST AllocatedResources;
      PCM_RESOURCE_LIST AllocatedResourcesTranslated;
    } StartDevice;
    struct {
      DEVICE_RELATION_TYPE Type;
    } QueryDeviceRelations;
    struct {
      CONST GUID *InterfaceType;
      USHORT Size;
      USHORT Version;
      PINTERFACE Interface;
      PVOID InterfaceSpecificData;
    } QueryInterface;
    struct {
      PDEVICE_CAPABILITIES Capabilities;
    } DeviceCapabilities;
    struct {
      PIO_RESOURCE_REQUIREMENTS_LIST IoResourceRequirementList;
    } FilterResourceRequirements;
    struct {
      ULONG WhichSpace;
      PVOID Buffer;
      ULONG Offset;
      ULONG POINTER_ALIGNMENT Length;
    } ReadWriteConfig;
    struct {
      BOOLEAN Lock;
    } SetLock;
    struct {
      BUS_QUERY_ID_TYPE IdType;
    } QueryId;
    struct {
      DEVICE_TEXT_TYPE DeviceTextType;
      LCID POINTER_ALIGNMENT LocaleId;
    } QueryDeviceText;
    struct {
      BOOLEAN InPath;
      BOOLEAN Reserved[3];
      DEVICE_USAGE_NOTIFICATION_TYPE POINTER_ALIGNMENT Type;
    } UsageNotification;
  } Pnp;
  struct {
    FS_FILTER_SECTION_SYNC_TYPE SyncType;
    ULONG PageProtection;
  } AcquireForSectionSynchronization;
  struct {
    PLARGE_INTEGER EndingOffset;
    PERESOURCE *ResourceToRelease;
  } AcquireForModifiedPageWriter;
  struct {
    PERESOURCE ResourceToRelease;
  } ReleaseForModifiedPageWriter;
  struct {
    LARGE_INTEGER FileOffset;
    ULONG Length;
    ULONG POINTER_ALIGNMENT LockKey;
    BOOLEAN POINTER_ALIGNMENT CheckForReadOperation;
  } FastIoCheckIfPossible;
  struct {
    PIRP Irp;
    PFILE_NETWORK_OPEN_INFORMATION NetworkInformation;
  } NetworkQueryOpen;
  struct {
    LARGE_INTEGER FileOffset;
    ULONG POINTER_ALIGNMENT Length;
    ULONG POINTER_ALIGNMENT Key;
    PMDL *MdlChain;
  } MdlRead;
  struct {
    PMDL MdlChain;
  } MdlReadComplete;
  struct {
    LARGE_INTEGER FileOffset;
    ULONG POINTER_ALIGNMENT Length;
    ULONG POINTER_ALIGNMENT Key;
    PMDL *MdlChain;
  } PrepareMdlWrite;
  struct {
    LARGE_INTEGER FileOffset;
    PMDL MdlChain;
  } MdlWriteComplete;
  struct {
    ULONG DeviceType;
  } MountVolume;
  struct {
    PVOID Argument1;
    PVOID Argument2;
    PVOID Argument3;
    PVOID Argument4;
    PVOID Argument5;
    LARGE_INTEGER Argument6;
  } Others;
} FLT_PARAMETERS, *PFLT_PARAMETERS;

#if !defined(_AMD64_) && !defined(_IA64_) && !defined(_ARM_)
#include "poppack.h"
#endif

typedef struct _FLT_IO_PARAMETER_BLOCK {
  ULONG IrpFlags;
  UCHAR MajorFunction;
  UCHAR MinorFunction;
  UCHAR OperationFlags;
  UCHAR Reserved;
  PFILE_OBJECT TargetFileObject;
  PFLT_INSTANCE TargetInstance;
  FLT_PARAMETERS Parameters;
} FLT_IO_PARAMETER_BLOCK, *PFLT_IO_PARAMETER_BLOCK;

#define FLTFL_CALLBACK_DATA_REISSUE_MASK        0x0000FFFF
#define FLTFL_CALLBACK_DATA_IRP_OPERATION       0x00000001
#define FLTFL_CALLBACK_DATA_FAST_IO_OPERATION   0x00000002
#define FLTFL_CALLBACK_DATA_FS_FILTER_OPERATION 0x00000004
#define FLTFL_CALLBACK_DATA_SYSTEM_BUFFER       0x00000008
#define FLTFL_CALLBACK_DATA_GENERATED_IO        0x00010000
#define FLTFL_CALLBACK_DATA_REISSUED_IO         0x00020000
#define FLTFL_CALLBACK_DATA_DRAINING_IO         0x00040000
#define FLTFL_CALLBACK_DATA_POST_OPERATION      0x00080000
#define FLTFL_CALLBACK_DATA_NEW_SYSTEM_BUFFER   0x00100000
#define FLTFL_CALLBACK_DATA_DIRTY               0x80000000

#define FLT_SET_CALLBACK_DATA_DIRTY(Data)   FltSetCallbackDataDirty(Data)
#define FLT_CLEAR_CALLBACK_DATA_DIRTY(Data) FltClearCallbackDataDirty(Data)
#define FLT_IS_CALLBACK_DATA_DIRTY(Data)    FltIsCallbackDataDirty(Data)

#define FLT_IS_IRP_OPERATION(Data)       (FlagOn((Data)->Flags, FLTFL_CALLBACK_DATA_IRP_OPERATION))
#define FLT_IS_FASTIO_OPERATION(Data)    (FlagOn((Data)->Flags, FLTFL_CALLBACK_DATA_FAST_IO_OPERATION))
#define FLT_IS_FS_FILTER_OPERATION(Data) (FlagOn((Data)->Flags, FLTFL_CALLBACK_DATA_FS_FILTER_OPERATION))
#define FLT_IS_REISSUED_IO(Data)         (FlagOn((Data)->Flags, FLTFL_CALLBACK_DATA_REISSUED_IO))
#define FLT_IS_SYSTEM_BUFFER(Data)       (FlagOn((Data)->Flags, FLTFL_CALLBACK_DATA_SYSTEM_BUFFER))

typedef USHORT FLT_CONTEXT_TYPE;

#define FLT_VOLUME_CONTEXT       0x0001
#define FLT_INSTANCE_CONTEXT     0x0002
#define FLT_FILE_CONTEXT         0x0004
#define FLT_STREAM_CONTEXT       0x0008
#define FLT_STREAMHANDLE_CONTEXT 0x0010
#define FLT_TRANSACTION_CONTEXT  0x0020
#define FLT_CONTEXT_END          0xffff

#define FLT_ALL_CONTEXTS (FLT_VOLUME_CONTEXT | FLT_INSTANCE_CONTEXT | \
                          FLT_FILE_CONTEXT | FLT_STREAM_CONTEXT |     \
                          FLT_STREAMHANDLE_CONTEXT | FLT_TRANSACTION_CONTEXT)

typedef ULONG FLT_CALLBACK_DATA_FLAGS;

#if FLT_MGR_WIN7
typedef ULONG FLT_ALLOCATE_CALLBACK_DATA_FLAGS;
#define FLT_ALLOCATE_CALLBACK_DATA_PREALLOCATE_ALL_MEMORY 0x00000001
#endif /* FLT_MGR_WIN7 */

typedef struct _FLT_CALLBACK_DATA {
  FLT_CALLBACK_DATA_FLAGS Flags;
  PETHREAD CONST Thread;
  PFLT_IO_PARAMETER_BLOCK CONST Iopb;
  IO_STATUS_BLOCK IoStatus;
  struct _FLT_TAG_DATA_BUFFER *TagData;
  _ANONYMOUS_UNION union {
    _ANONYMOUS_STRUCT struct {
      LIST_ENTRY QueueLinks;
      PVOID QueueContext[2];
    } DUMMYSTRUCTNAME;
    PVOID FilterContext[4];
  } DUMMYUNIONNAME;
  KPROCESSOR_MODE RequestorMode;
} FLT_CALLBACK_DATA, *PFLT_CALLBACK_DATA;

typedef struct _FLT_RELATED_OBJECTS {
  USHORT CONST Size;
  USHORT CONST TransactionContext;
  PFLT_FILTER CONST Filter;
  PFLT_VOLUME CONST Volume;
  PFLT_INSTANCE CONST Instance;
  PFILE_OBJECT CONST FileObject;
  PKTRANSACTION CONST Transaction;
} FLT_RELATED_OBJECTS, *PFLT_RELATED_OBJECTS;
typedef const struct _FLT_RELATED_OBJECTS *PCFLT_RELATED_OBJECTS;

typedef struct _FLT_RELATED_CONTEXTS {
  PFLT_CONTEXT VolumeContext;
  PFLT_CONTEXT InstanceContext;
  PFLT_CONTEXT FileContext;
  PFLT_CONTEXT StreamContext;
  PFLT_CONTEXT StreamHandleContext;
  PFLT_CONTEXT TransactionContext;
} FLT_RELATED_CONTEXTS, *PFLT_RELATED_CONTEXTS;

typedef VOID
(FLTAPI *PFLT_CONTEXT_CLEANUP_CALLBACK)(
    _In_ PFLT_CONTEXT Context,
    _In_ FLT_CONTEXT_TYPE ContextType);

typedef PVOID
(FLTAPI *PFLT_CONTEXT_ALLOCATE_CALLBACK)(
    _In_ POOL_TYPE PoolType,
    _In_ SIZE_T Size,
    _In_ FLT_CONTEXT_TYPE ContextType);

typedef VOID
(FLTAPI *PFLT_CONTEXT_FREE_CALLBACK)(
    _In_ PVOID Pool,
    _In_ FLT_CONTEXT_TYPE ContextType);

typedef USHORT FLT_CONTEXT_REGISTRATION_FLAGS;

#define FLTFL_CONTEXT_REGISTRATION_NO_EXACT_SIZE_MATCH 0x0001

#define FLT_VARIABLE_SIZED_CONTEXTS ((SIZE_T)-1)

typedef struct _FLT_CONTEXT_REGISTRATION {
    FLT_CONTEXT_TYPE ContextType;
    FLT_CONTEXT_REGISTRATION_FLAGS Flags;
    PFLT_CONTEXT_CLEANUP_CALLBACK ContextCleanupCallback;
    SIZE_T Size;
    ULONG PoolTag;
    PFLT_CONTEXT_ALLOCATE_CALLBACK ContextAllocateCallback;
    PFLT_CONTEXT_FREE_CALLBACK ContextFreeCallback;
    PVOID Reserved1;
} FLT_CONTEXT_REGISTRATION, *PFLT_CONTEXT_REGISTRATION;
typedef const struct _FLT_CONTEXT_REGISTRATION *PCFLT_CONTEXT_REGISTRATION;

typedef ULONG FLT_INSTANCE_SETUP_FLAGS;

#define FLTFL_INSTANCE_SETUP_AUTOMATIC_ATTACHMENT 0x00000001
#define FLTFL_INSTANCE_SETUP_MANUAL_ATTACHMENT    0x00000002
#define FLTFL_INSTANCE_SETUP_NEWLY_MOUNTED_VOLUME 0x00000004

#if FLT_MGR_LONGHORN

#define FLTFL_INSTANCE_SETUP_DETACHED_VOLUME        0x00000008

#define FLT_MAX_TRANSACTION_NOTIFICATIONS (TRANSACTION_NOTIFY_PREPREPARE | \
                                           TRANSACTION_NOTIFY_PREPARE |    \
                                           TRANSACTION_NOTIFY_COMMIT |     \
                                           TRANSACTION_NOTIFY_ROLLBACK |   \
                                           TRANSACTION_NOTIFY_COMMIT_FINALIZE)

#endif /* FLT_MGR_LONGHORN */

typedef NTSTATUS
(FLTAPI *PFLT_INSTANCE_SETUP_CALLBACK)(
    _In_ PCFLT_RELATED_OBJECTS FltObjects,
    _In_ FLT_INSTANCE_SETUP_FLAGS Flags,
    _In_ DEVICE_TYPE VolumeDeviceType,
    _In_ FLT_FILESYSTEM_TYPE VolumeFilesystemType);

typedef ULONG FLT_INSTANCE_QUERY_TEARDOWN_FLAGS;

typedef NTSTATUS
(FLTAPI *PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK)(
    _In_ PCFLT_RELATED_OBJECTS FltObjects,
    _In_ FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags);

typedef ULONG FLT_INSTANCE_TEARDOWN_FLAGS;

#define FLTFL_INSTANCE_TEARDOWN_MANUAL                  0x00000001
#define FLTFL_INSTANCE_TEARDOWN_FILTER_UNLOAD           0x00000002
#define FLTFL_INSTANCE_TEARDOWN_MANDATORY_FILTER_UNLOAD 0x00000004
#define FLTFL_INSTANCE_TEARDOWN_VOLUME_DISMOUNT         0x00000008
#define FLTFL_INSTANCE_TEARDOWN_INTERNAL_ERROR          0x00000010

typedef VOID
(FLTAPI *PFLT_INSTANCE_TEARDOWN_CALLBACK)(
    _In_ PCFLT_RELATED_OBJECTS FltObjects,
    _In_ FLT_INSTANCE_TEARDOWN_FLAGS Reason);

typedef enum _FLT_PREOP_CALLBACK_STATUS {
  FLT_PREOP_SUCCESS_WITH_CALLBACK,
  FLT_PREOP_SUCCESS_NO_CALLBACK,
  FLT_PREOP_PENDING,
  FLT_PREOP_DISALLOW_FASTIO,
  FLT_PREOP_COMPLETE,
  FLT_PREOP_SYNCHRONIZE
} FLT_PREOP_CALLBACK_STATUS, *PFLT_PREOP_CALLBACK_STATUS;

typedef FLT_PREOP_CALLBACK_STATUS
(FLTAPI *PFLT_PRE_OPERATION_CALLBACK)(
    _Inout_ PFLT_CALLBACK_DATA Data,
    _In_ PCFLT_RELATED_OBJECTS FltObjects,
    _Outptr_result_maybenull_ PVOID *CompletionContext);

typedef enum _FLT_POSTOP_CALLBACK_STATUS {
  FLT_POSTOP_FINISHED_PROCESSING,
  FLT_POSTOP_MORE_PROCESSING_REQUIRED
} FLT_POSTOP_CALLBACK_STATUS, *PFLT_POSTOP_CALLBACK_STATUS;

typedef ULONG FLT_POST_OPERATION_FLAGS;

#define FLTFL_POST_OPERATION_DRAINING 0x00000001

typedef FLT_POSTOP_CALLBACK_STATUS
(FLTAPI *PFLT_POST_OPERATION_CALLBACK)(
    _Inout_ PFLT_CALLBACK_DATA Data,
    _In_ PCFLT_RELATED_OBJECTS FltObjects,
    _In_opt_ PVOID CompletionContext,
    _In_ FLT_POST_OPERATION_FLAGS Flags);

typedef ULONG FLT_OPERATION_REGISTRATION_FLAGS;

#define FLTFL_OPERATION_REGISTRATION_SKIP_PAGING_IO   0x00000001
#define FLTFL_OPERATION_REGISTRATION_SKIP_CACHED_IO   0x00000002
#define FLTFL_OPERATION_REGISTRATION_SKIP_NON_DASD_IO 0x00000004

typedef struct _FLT_OPERATION_REGISTRATION {
  UCHAR MajorFunction;
  FLT_OPERATION_REGISTRATION_FLAGS Flags;
  PFLT_PRE_OPERATION_CALLBACK PreOperation;
  PFLT_POST_OPERATION_CALLBACK PostOperation;
  PVOID Reserved1;
} FLT_OPERATION_REGISTRATION, *PFLT_OPERATION_REGISTRATION;

typedef struct _FLT_TAG_DATA_BUFFER {
  ULONG FileTag;
  USHORT TagDataLength;
  USHORT UnparsedNameLength;
  _ANONYMOUS_UNION union {
    struct {
      USHORT SubstituteNameOffset;
      USHORT SubstituteNameLength;
      USHORT PrintNameOffset;
      USHORT PrintNameLength;
      ULONG Flags;
      WCHAR PathBuffer[1];
    } SymbolicLinkReparseBuffer;
    struct {
      USHORT SubstituteNameOffset;
      USHORT SubstituteNameLength;
      USHORT PrintNameOffset;
      USHORT PrintNameLength;
      WCHAR PathBuffer[1];
    } MountPointReparseBuffer;
    struct {
      UCHAR DataBuffer[1];
    } GenericReparseBuffer;
    struct {
      GUID TagGuid;
      UCHAR DataBuffer[1];
    } GenericGUIDReparseBuffer;
  } DUMMYUNIONNAME;
} FLT_TAG_DATA_BUFFER, *PFLT_TAG_DATA_BUFFER;

#define FLT_TAG_DATA_BUFFER_HEADER_SIZE FIELD_OFFSET(FLT_TAG_DATA_BUFFER, GenericReparseBuffer)

typedef ULONG FLT_FILTER_UNLOAD_FLAGS;

#define FLTFL_FILTER_UNLOAD_MANDATORY               0x00000001

typedef NTSTATUS
(FLTAPI *PFLT_FILTER_UNLOAD_CALLBACK)(
    FLT_FILTER_UNLOAD_FLAGS Flags);

typedef struct _FLT_NAME_CONTROL {
  UNICODE_STRING Name;
} FLT_NAME_CONTROL, *PFLT_NAME_CONTROL;

typedef ULONG FLT_FILE_NAME_OPTIONS;

typedef NTSTATUS
(FLTAPI *PFLT_GENERATE_FILE_NAME)(
    _In_ PFLT_INSTANCE Instance,
    _In_ PFILE_OBJECT FileObject,
    _In_opt_ PFLT_CALLBACK_DATA CallbackData,
    _In_ FLT_FILE_NAME_OPTIONS NameOptions,
    _Out_ PBOOLEAN CacheFileNameInformation,
    _Out_ PFLT_NAME_CONTROL FileName);

typedef ULONG FLT_NORMALIZE_NAME_FLAGS;

#define FLTFL_NORMALIZE_NAME_CASE_SENSITIVE        0x01
#define FLTFL_NORMALIZE_NAME_DESTINATION_FILE_NAME 0x02

typedef NTSTATUS
(FLTAPI *PFLT_NORMALIZE_NAME_COMPONENT)(
    _In_ PFLT_INSTANCE Instance,
    _In_ PCUNICODE_STRING ParentDirectory,
    _In_ USHORT VolumeNameLength,
    _In_ PCUNICODE_STRING Component,
    _Out_writes_bytes_(ExpandComponentNameLength) PFILE_NAMES_INFORMATION ExpandComponentName,
    _In_ ULONG ExpandComponentNameLength,
    _In_ FLT_NORMALIZE_NAME_FLAGS Flags,
    _Inout_ PVOID *NormalizationContext);

typedef NTSTATUS
(FLTAPI *PFLT_NORMALIZE_NAME_COMPONENT_EX)(
    _In_ PFLT_INSTANCE Instance,
    _In_ PFILE_OBJECT FileObject,
    _In_ PCUNICODE_STRING ParentDirectory,
    _In_ USHORT VolumeNameLength,
    _In_ PCUNICODE_STRING Component,
    _Out_writes_bytes_(ExpandComponentNameLength) PFILE_NAMES_INFORMATION ExpandComponentName,
    _In_ ULONG ExpandComponentNameLength,
    _In_ FLT_NORMALIZE_NAME_FLAGS Flags,
    _Inout_ PVOID *NormalizationContext);

typedef VOID
(FLTAPI *PFLT_NORMALIZE_CONTEXT_CLEANUP)(
    _In_opt_ PVOID *NormalizationContext);

#if FLT_MGR_LONGHORN
typedef NTSTATUS
(FLTAPI *PFLT_TRANSACTION_NOTIFICATION_CALLBACK)(
    _In_ PCFLT_RELATED_OBJECTS FltObjects,
    _In_ PFLT_CONTEXT TransactionContext,
    _In_ ULONG NotificationMask);
#endif /* FLT_MGR_LONGHORN */

#define FLT_REGISTRATION_VERSION_0200  0x0200
#define FLT_REGISTRATION_VERSION_0201  0x0201
#define FLT_REGISTRATION_VERSION_0202  0x0202
#define FLT_REGISTRATION_VERSION_0203  0x0203

#if FLT_MGR_LONGHORN
#define FLT_REGISTRATION_VERSION FLT_REGISTRATION_VERSION_0202
#else
#define FLT_REGISTRATION_VERSION FLT_REGISTRATION_VERSION_0200
#endif

typedef ULONG FLT_REGISTRATION_FLAGS;

#define FLTFL_REGISTRATION_DO_NOT_SUPPORT_SERVICE_STOP 0x00000001
#define FLTFL_REGISTRATION_SUPPORT_NPFS_MSFS           0x00000002

typedef struct _FLT_REGISTRATION {
  USHORT Size;
  USHORT Version;
  FLT_REGISTRATION_FLAGS Flags;
  CONST FLT_CONTEXT_REGISTRATION *ContextRegistration;
  CONST FLT_OPERATION_REGISTRATION *OperationRegistration;
  PFLT_FILTER_UNLOAD_CALLBACK FilterUnloadCallback;
  PFLT_INSTANCE_SETUP_CALLBACK InstanceSetupCallback;
  PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK InstanceQueryTeardownCallback;
  PFLT_INSTANCE_TEARDOWN_CALLBACK InstanceTeardownStartCallback;
  PFLT_INSTANCE_TEARDOWN_CALLBACK InstanceTeardownCompleteCallback;
  PFLT_GENERATE_FILE_NAME GenerateFileNameCallback;
  PFLT_NORMALIZE_NAME_COMPONENT NormalizeNameComponentCallback;
  PFLT_NORMALIZE_CONTEXT_CLEANUP NormalizeContextCleanupCallback;
#if FLT_MGR_LONGHORN
  PFLT_TRANSACTION_NOTIFICATION_CALLBACK TransactionNotificationCallback;
  PFLT_NORMALIZE_NAME_COMPONENT_EX NormalizeNameComponentExCallback;
#endif /* FLT_MGR_LONGHORN */
} FLT_REGISTRATION, *PFLT_REGISTRATION;

typedef VOID
(FLTAPI *PFLT_COMPLETED_ASYNC_IO_CALLBACK)(
    _In_ PFLT_CALLBACK_DATA CallbackData,
    _In_ PFLT_CONTEXT Context);

typedef ULONG FLT_IO_OPERATION_FLAGS;

#define FLTFL_IO_OPERATION_NON_CACHED                   0x00000001
#define FLTFL_IO_OPERATION_PAGING                       0x00000002
#define FLTFL_IO_OPERATION_DO_NOT_UPDATE_BYTE_OFFSET    0x00000004

#if FLT_MGR_LONGHORN
#define FLTFL_IO_OPERATION_SYNCHRONOUS_PAGING           0x00000008
#endif

typedef VOID
(FLTAPI *PFLT_GET_OPERATION_STATUS_CALLBACK)(
    _In_ PCFLT_RELATED_OBJECTS FltObjects,
    _In_ PFLT_IO_PARAMETER_BLOCK IopbSnapshot,
    _In_ NTSTATUS OperationStatus,
    _In_opt_ PVOID RequesterContext);

typedef ULONG FLT_FILE_NAME_OPTIONS;

#define FLT_VALID_FILE_NAME_FORMATS 0x000000ff

#define FLT_FILE_NAME_NORMALIZED    0x01
#define FLT_FILE_NAME_OPENED        0x02
#define FLT_FILE_NAME_SHORT         0x03

#define FltGetFileNameFormat( _NameOptions ) ((_NameOptions) & FLT_VALID_FILE_NAME_FORMATS)

#define FLT_VALID_FILE_NAME_QUERY_METHODS               0x0000ff00

#define FLT_FILE_NAME_QUERY_DEFAULT                   0x0100
#define FLT_FILE_NAME_QUERY_CACHE_ONLY                0x0200
#define FLT_FILE_NAME_QUERY_FILESYSTEM_ONLY           0x0300
#define FLT_FILE_NAME_QUERY_ALWAYS_ALLOW_CACHE_LOOKUP 0x0400

#define FltGetFileNameQueryMethod( _NameOptions ) ((_NameOptions) & FLT_VALID_FILE_NAME_QUERY_METHODS)

#define FLT_VALID_FILE_NAME_FLAGS                     0xff000000

#define FLT_FILE_NAME_REQUEST_FROM_CURRENT_PROVIDER   0x01000000
#define FLT_FILE_NAME_DO_NOT_CACHE                    0x02000000

#if FLT_MGR_AFTER_XPSP2
#define FLT_FILE_NAME_ALLOW_QUERY_ON_REPARSE          0x04000000
#endif

typedef USHORT FLT_FILE_NAME_PARSED_FLAGS;

#define FLTFL_FILE_NAME_PARSED_FINAL_COMPONENT      0x0001
#define FLTFL_FILE_NAME_PARSED_EXTENSION            0x0002
#define FLTFL_FILE_NAME_PARSED_STREAM               0x0004
#define FLTFL_FILE_NAME_PARSED_PARENT_DIR           0x0008

typedef struct _FLT_FILE_NAME_INFORMATION {
  USHORT Size;
  FLT_FILE_NAME_PARSED_FLAGS NamesParsed;
  FLT_FILE_NAME_OPTIONS Format;
  UNICODE_STRING Name;
  UNICODE_STRING Volume;
  UNICODE_STRING Share;
  UNICODE_STRING Extension;
  UNICODE_STRING Stream;
  UNICODE_STRING FinalComponent;
  UNICODE_STRING ParentDir;
} FLT_FILE_NAME_INFORMATION, *PFLT_FILE_NAME_INFORMATION;

typedef enum _FLT_SET_CONTEXT_OPERATION {
  FLT_SET_CONTEXT_REPLACE_IF_EXISTS,
  FLT_SET_CONTEXT_KEEP_IF_EXISTS
} FLT_SET_CONTEXT_OPERATION, *PFLT_SET_CONTEXT_OPERATION;

typedef struct _FLT_VOLUME_PROPERTIES {
  DEVICE_TYPE DeviceType;
  ULONG DeviceCharacteristics;
  ULONG DeviceObjectFlags;
  ULONG AlignmentRequirement;
  USHORT SectorSize;
  USHORT Reserved0;
  UNICODE_STRING FileSystemDriverName;
  UNICODE_STRING FileSystemDeviceName;
  UNICODE_STRING RealDeviceName;
} FLT_VOLUME_PROPERTIES, *PFLT_VOLUME_PROPERTIES;

#define FLT_PORT_CONNECT        0x0001
#define FLT_PORT_ALL_ACCESS     (FLT_PORT_CONNECT | STANDARD_RIGHTS_ALL)

typedef NTSTATUS
(FLTAPI *PFLT_MESSAGE_NOTIFY)(
    _In_opt_ PVOID PortCookie,
    _In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer,
    _In_ ULONG InputBufferLength,
    _Out_writes_bytes_to_opt_(OutputBufferLength,*ReturnOutputBufferLength) PVOID OutputBuffer,
    _In_ ULONG OutputBufferLength,
    _Out_ PULONG ReturnOutputBufferLength);

typedef NTSTATUS
(FLTAPI *PFLT_CONNECT_NOTIFY)(
    _In_ PFLT_PORT ClientPort,
    _In_opt_ PVOID ServerPortCookie,
    _In_reads_bytes_opt_(SizeOfContext) PVOID ConnectionContext,
    _In_ ULONG SizeOfContext,
    _Outptr_result_maybenull_ PVOID *ConnectionPortCookie);

typedef VOID
(FLTAPI *PFLT_DISCONNECT_NOTIFY)(
    _In_opt_ PVOID ConnectionCookie);

typedef VOID
(FLTAPI *PFLT_COMPLETE_CANCELED_CALLBACK)(
    _In_ PFLT_CALLBACK_DATA CallbackData);

typedef struct _FLT_DEFERRED_IO_WORKITEM *PFLT_DEFERRED_IO_WORKITEM;
typedef struct _FLT_GENERIC_WORKITEM *PFLT_GENERIC_WORKITEM;

typedef VOID
(FLTAPI *PFLT_DEFERRED_IO_WORKITEM_ROUTINE)(
    _In_ PFLT_DEFERRED_IO_WORKITEM FltWorkItem,
    _In_ PFLT_CALLBACK_DATA CallbackData,
    _In_opt_ PVOID Context);

typedef VOID
(FLTAPI *PFLT_GENERIC_WORKITEM_ROUTINE)(
    _In_ PFLT_GENERIC_WORKITEM FltWorkItem,
    _In_ PVOID FltObject,
    _In_opt_ PVOID Context);

typedef IO_CSQ_IRP_CONTEXT FLT_CALLBACK_DATA_QUEUE_IO_CONTEXT, *PFLT_CALLBACK_DATA_QUEUE_IO_CONTEXT;

typedef struct _FLT_CALLBACK_DATA_QUEUE FLT_CALLBACK_DATA_QUEUE, *PFLT_CALLBACK_DATA_QUEUE;

typedef NTSTATUS
(FLTAPI *PFLT_CALLBACK_DATA_QUEUE_INSERT_IO)(
    _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq,
    _In_ PFLT_CALLBACK_DATA Cbd,
    _In_opt_ PVOID InsertContext);

typedef VOID
(FLTAPI *PFLT_CALLBACK_DATA_QUEUE_REMOVE_IO)(
    _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq,
    _In_ PFLT_CALLBACK_DATA Cbd);

typedef PFLT_CALLBACK_DATA
(FLTAPI *PFLT_CALLBACK_DATA_QUEUE_PEEK_NEXT_IO)(
    _In_ PFLT_CALLBACK_DATA_QUEUE Cbdq,
    _In_opt_ PFLT_CALLBACK_DATA Cbd,
    _In_opt_ PVOID PeekContext);

typedef VOID
(FLTAPI *PFLT_CALLBACK_DATA_QUEUE_ACQUIRE)(
    _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq,
    _Out_opt_ PKIRQL Irql);

typedef VOID
(FLTAPI *PFLT_CALLBACK_DATA_QUEUE_RELEASE)(
    _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq,
    _In_opt_ KIRQL Irql);

typedef VOID
(FLTAPI *PFLT_CALLBACK_DATA_QUEUE_COMPLETE_CANCELED_IO)(
    _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq,
    _Inout_ PFLT_CALLBACK_DATA Cbd);

typedef ULONG FLT_CALLBACK_DATA_QUEUE_FLAGS;

typedef struct _FLT_CALLBACK_DATA_QUEUE {
  IO_CSQ Csq;
  FLT_CALLBACK_DATA_QUEUE_FLAGS Flags;
  PFLT_INSTANCE Instance;
  PFLT_CALLBACK_DATA_QUEUE_INSERT_IO InsertIo;
  PFLT_CALLBACK_DATA_QUEUE_REMOVE_IO RemoveIo;
  PFLT_CALLBACK_DATA_QUEUE_PEEK_NEXT_IO PeekNextIo;
  PFLT_CALLBACK_DATA_QUEUE_ACQUIRE Acquire;
  PFLT_CALLBACK_DATA_QUEUE_RELEASE Release;
  PFLT_CALLBACK_DATA_QUEUE_COMPLETE_CANCELED_IO CompleteCanceledIo;
} FLT_CALLBACK_DATA_QUEUE, *PFLT_CALLBACK_DATA_QUEUE;

typedef NTSTATUS
(*PFLT_COMPLETE_LOCK_CALLBACK_DATA_ROUTINE)(
    _In_opt_ PVOID Context,
    _In_ PFLT_CALLBACK_DATA CallbackData);

typedef VOID
(FLTAPI *PFLTOPLOCK_WAIT_COMPLETE_ROUTINE)(
    _In_ PFLT_CALLBACK_DATA CallbackData,
    _In_opt_ PVOID Context);

typedef VOID
(FLTAPI *PFLTOPLOCK_PREPOST_CALLBACKDATA_ROUTINE)(
    _In_ PFLT_CALLBACK_DATA CallbackData,
    _In_opt_ PVOID Context);

VOID
FLTAPI
FltSetCallbackDataDirty(
    _Inout_ PFLT_CALLBACK_DATA Data);

VOID
FLTAPI
FltClearCallbackDataDirty(
    _Inout_ PFLT_CALLBACK_DATA Data);

BOOLEAN
FLTAPI
FltIsCallbackDataDirty(
    _In_ PFLT_CALLBACK_DATA Data);

_Must_inspect_result_
BOOLEAN
FLTAPI
FltDoCompletionProcessingWhenSafe(
    _In_ PFLT_CALLBACK_DATA Data,
    _In_ PCFLT_RELATED_OBJECTS FltObjects,
    _In_opt_ PVOID CompletionContext,
    _In_ FLT_POST_OPERATION_FLAGS Flags,
    _In_ PFLT_POST_OPERATION_CALLBACK SafePostCallback,
    _Out_ PFLT_POSTOP_CALLBACK_STATUS RetPostOperationStatus);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltCheckAndGrowNameControl(
    _Inout_ PFLT_NAME_CONTROL NameCtrl,
    _In_ USHORT NewSize);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltPurgeFileNameInformationCache(
    _In_ PFLT_INSTANCE Instance,
    _In_opt_ PFILE_OBJECT FileObject);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltRegisterFilter(
    _In_ PDRIVER_OBJECT Driver,
    _In_ CONST FLT_REGISTRATION *Registration,
    _Outptr_ PFLT_FILTER *RetFilter);

_IRQL_requires_max_(APC_LEVEL)
VOID
FLTAPI
FltUnregisterFilter(
    _In_ PFLT_FILTER Filter);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltStartFiltering(
    _In_ PFLT_FILTER Filter);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
PVOID
FLTAPI
FltGetRoutineAddress(
    _In_ PCSTR FltMgrRoutineName);

_When_(CallbackStatus==FLT_PREOP_COMPLETE, _IRQL_requires_max_(DISPATCH_LEVEL))
_When_(CallbackStatus!=FLT_PREOP_COMPLETE, _IRQL_requires_max_(APC_LEVEL))
VOID
FLTAPI
FltCompletePendedPreOperation(
    _In_ PFLT_CALLBACK_DATA CallbackData,
    _In_ FLT_PREOP_CALLBACK_STATUS CallbackStatus,
    _In_opt_ PVOID Context);

_IRQL_requires_max_(DISPATCH_LEVEL)
VOID
FLTAPI
FltCompletePendedPostOperation(
    _In_ PFLT_CALLBACK_DATA CallbackData);

_Must_inspect_result_
_IRQL_requires_max_(DISPATCH_LEVEL)
NTSTATUS
FLTAPI
FltRequestOperationStatusCallback(
    _In_ PFLT_CALLBACK_DATA Data,
    _In_ PFLT_GET_OPERATION_STATUS_CALLBACK CallbackRoutine,
    _In_opt_ PVOID RequesterContext);

_When_((PoolType==NonPagedPoolNx), _IRQL_requires_max_(DISPATCH_LEVEL))
_When_((PoolType!=NonPagedPoolNx), _IRQL_requires_max_(APC_LEVEL))
PVOID
FLTAPI
FltAllocatePoolAlignedWithTag(
    _In_ PFLT_INSTANCE Instance,
    _In_ POOL_TYPE PoolType,
    _In_ SIZE_T NumberOfBytes,
    _In_ ULONG Tag);

_IRQL_requires_max_(DISPATCH_LEVEL)
VOID
FLTAPI
FltFreePoolAlignedWithTag(
    _In_ PFLT_INSTANCE Instance,
    _In_ PVOID Buffer,
    _In_ ULONG Tag);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltGetFileNameInformation(
    _In_ PFLT_CALLBACK_DATA CallbackData,
    _In_ FLT_FILE_NAME_OPTIONS NameOptions,
    _Outptr_ PFLT_FILE_NAME_INFORMATION *FileNameInformation);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltGetFileNameInformationUnsafe(
    _In_ PFILE_OBJECT FileObject,
    _In_opt_ PFLT_INSTANCE Instance,
    _In_ FLT_FILE_NAME_OPTIONS NameOptions,
    _Outptr_ PFLT_FILE_NAME_INFORMATION *FileNameInformation);

_IRQL_requires_max_(APC_LEVEL)
VOID
FLTAPI
FltReleaseFileNameInformation(
    _In_ PFLT_FILE_NAME_INFORMATION FileNameInformation);

_IRQL_requires_max_(APC_LEVEL)
VOID
FLTAPI
FltReferenceFileNameInformation(
    _In_ PFLT_FILE_NAME_INFORMATION FileNameInformation);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltParseFileName(
    _In_ PCUNICODE_STRING FileName,
    _Inout_opt_ PUNICODE_STRING Extension,
    _Inout_opt_ PUNICODE_STRING Stream,
    _Inout_opt_ PUNICODE_STRING FinalComponent);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltParseFileNameInformation(
    _Inout_ PFLT_FILE_NAME_INFORMATION FileNameInformation);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltGetTunneledName(
    _In_ PFLT_CALLBACK_DATA CallbackData,
    _In_ PFLT_FILE_NAME_INFORMATION FileNameInformation,
    _Outptr_result_maybenull_ PFLT_FILE_NAME_INFORMATION *RetTunneledFileNameInformation);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltGetVolumeName(
    _In_ PFLT_VOLUME Volume,
    _Inout_opt_ PUNICODE_STRING VolumeName,
    _Out_opt_ PULONG BufferSizeNeeded);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltGetDestinationFileNameInformation(
    _In_ PFLT_INSTANCE Instance,
    _In_ PFILE_OBJECT FileObject,
    _In_opt_ HANDLE RootDirectory,
    _In_reads_bytes_(FileNameLength) PWSTR FileName,
    _In_ ULONG FileNameLength,
    _In_ FLT_FILE_NAME_OPTIONS NameOptions,
    _Outptr_ PFLT_FILE_NAME_INFORMATION *RetFileNameInformation);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltIsDirectory(
    _In_ PFILE_OBJECT FileObject,
    _In_ PFLT_INSTANCE Instance,
    _Out_ PBOOLEAN IsDirectory);

_Must_inspect_result_
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSTATUS
FLTAPI
FltLoadFilter(
    _In_ PCUNICODE_STRING FilterName);

_Must_inspect_result_
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSTATUS
FLTAPI
FltUnloadFilter(
    _In_ PCUNICODE_STRING FilterName);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltAttachVolume(
    _Inout_ PFLT_FILTER Filter,
    _Inout_ PFLT_VOLUME Volume,
    _In_opt_ PCUNICODE_STRING InstanceName,
    _Outptr_opt_result_maybenull_ PFLT_INSTANCE *RetInstance);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltAttachVolumeAtAltitude(
    _Inout_ PFLT_FILTER Filter,
    _Inout_ PFLT_VOLUME Volume,
    _In_ PCUNICODE_STRING Altitude,
    _In_opt_ PCUNICODE_STRING InstanceName,
    _Outptr_opt_result_maybenull_ PFLT_INSTANCE *RetInstance);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltDetachVolume(
    _Inout_ PFLT_FILTER Filter,
    _Inout_ PFLT_VOLUME Volume,
    _In_opt_ PCUNICODE_STRING InstanceName);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltAllocateCallbackData(
    _In_ PFLT_INSTANCE Instance,
    _In_opt_ PFILE_OBJECT FileObject,
    _Outptr_ PFLT_CALLBACK_DATA *RetNewCallbackData);

_IRQL_requires_max_(DISPATCH_LEVEL)
VOID
FLTAPI
FltFreeCallbackData(
    _In_ PFLT_CALLBACK_DATA CallbackData);

_IRQL_requires_max_(APC_LEVEL)
VOID
FLTAPI
FltReuseCallbackData(
    _Inout_ PFLT_CALLBACK_DATA CallbackData);

_When_(FlagOn(CallbackData->Iopb->IrpFlags, IRP_PAGING_IO), _IRQL_requires_max_(APC_LEVEL))
_When_(!FlagOn(CallbackData->Iopb->IrpFlags, IRP_PAGING_IO), _IRQL_requires_max_(PASSIVE_LEVEL))
VOID
FLTAPI
FltPerformSynchronousIo(
    _Inout_ PFLT_CALLBACK_DATA CallbackData);

_Must_inspect_result_
_When_( FlagOn(CallbackData->Iopb->IrpFlags, IRP_PAGING_IO), _IRQL_requires_max_(APC_LEVEL))
_When_( !FlagOn(CallbackData->Iopb->IrpFlags, IRP_PAGING_IO), _IRQL_requires_max_(PASSIVE_LEVEL))
NTSTATUS
FLTAPI
FltPerformAsynchronousIo(
    _Inout_ PFLT_CALLBACK_DATA CallbackData,
    _In_ PFLT_COMPLETED_ASYNC_IO_CALLBACK CallbackRoutine,
    _In_ PVOID CallbackContext);

_Must_inspect_result_
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSTATUS
FLTAPI
FltCreateFile(
    _In_ PFLT_FILTER Filter,
    _In_opt_ PFLT_INSTANCE Instance,
    _Out_ PHANDLE FileHandle,
    _In_ ACCESS_MASK DesiredAccess,
    _In_ POBJECT_ATTRIBUTES ObjectAttributes,
    _Out_ PIO_STATUS_BLOCK IoStatusBlock,
    _In_opt_ PLARGE_INTEGER AllocationSize,
    _In_ ULONG FileAttributes,
    _In_ ULONG ShareAccess,
    _In_ ULONG CreateDisposition,
    _In_ ULONG CreateOptions,
    _In_reads_bytes_opt_(EaLength)PVOID EaBuffer,
    _In_ ULONG EaLength,
    _In_ ULONG Flags);

_Must_inspect_result_
_IRQL_requires_max_(PASSIVE_LEVEL)
_When_((Flags|FLTFL_IO_OPERATION_PAGING|FLTFL_IO_OPERATION_SYNCHRONOUS_PAGING),_IRQL_requires_max_(APC_LEVEL))
NTSTATUS
FLTAPI
FltReadFile(
    _In_ PFLT_INSTANCE InitiatingInstance,
    _In_ PFILE_OBJECT FileObject,
    _In_opt_ PLARGE_INTEGER ByteOffset,
    _In_ ULONG Length,
    _Out_writes_bytes_to_(Length,*BytesRead) PVOID Buffer,
    _In_ FLT_IO_OPERATION_FLAGS Flags,
    _Out_opt_ PULONG BytesRead,
    _In_opt_ PFLT_COMPLETED_ASYNC_IO_CALLBACK CallbackRoutine,
    _In_opt_ PVOID CallbackContext);

_Must_inspect_result_
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSTATUS
FLTAPI
FltTagFile(
    _In_ PFLT_INSTANCE InitiatingInstance,
    _In_ PFILE_OBJECT FileObject,
    _In_ ULONG FileTag,
    _In_opt_ GUID *Guid,
    _In_reads_bytes_(DataBufferLength) PVOID DataBuffer,
    _In_ USHORT DataBufferLength);

_Must_inspect_result_
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSTATUS
FLTAPI
FltUntagFile(
    _In_ PFLT_INSTANCE InitiatingInstance,
    _In_ PFILE_OBJECT FileObject,
    _In_ ULONG FileTag,
    _In_opt_ GUID *Guid);

_Must_inspect_result_
_IRQL_requires_max_(PASSIVE_LEVEL)
_When_((Flags|FLTFL_IO_OPERATION_PAGING|FLTFL_IO_OPERATION_SYNCHRONOUS_PAGING),_IRQL_requires_max_(APC_LEVEL))
NTSTATUS
FLTAPI
FltWriteFile(
    _In_ PFLT_INSTANCE InitiatingInstance,
    _In_ PFILE_OBJECT FileObject,
    _In_opt_ PLARGE_INTEGER ByteOffset,
    _In_ ULONG Length,
    _In_reads_bytes_(Length) PVOID Buffer,
    _In_ FLT_IO_OPERATION_FLAGS Flags,
    _Out_opt_ PULONG BytesWritten,
    _In_opt_ PFLT_COMPLETED_ASYNC_IO_CALLBACK CallbackRoutine,
    _In_opt_ PVOID CallbackContext);

_Must_inspect_result_
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSTATUS
FLTAPI
FltQueryInformationFile(
    _In_ PFLT_INSTANCE Instance,
    _In_ PFILE_OBJECT FileObject,
    _Out_writes_bytes_to_(Length,*LengthReturned) PVOID FileInformation,
    _In_ ULONG Length,
    _In_ FILE_INFORMATION_CLASS FileInformationClass,
    _Out_opt_ PULONG LengthReturned);

_Must_inspect_result_
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSTATUS
FLTAPI
FltSetInformationFile(
    _In_ PFLT_INSTANCE Instance,
    _In_ PFILE_OBJECT FileObject,
    _In_reads_bytes_(Length) PVOID FileInformation,
    _In_ ULONG Length,
    _In_ FILE_INFORMATION_CLASS FileInformationClass);

_Must_inspect_result_
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSTATUS
FLTAPI
FltQueryVolumeInformationFile(
    _In_ PFLT_INSTANCE Instance,
    _In_ PFILE_OBJECT FileObject,
    _Out_writes_bytes_to_(Length,*LengthReturned) PVOID FsInformation,
    _In_ ULONG Length,
    _In_ FS_INFORMATION_CLASS FsInformationClass,
    _Out_opt_ PULONG LengthReturned);

_Must_inspect_result_
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSTATUS
FLTAPI
FltQuerySecurityObject(
    _In_ PFLT_INSTANCE Instance,
    _In_ PFILE_OBJECT FileObject,
    _In_ SECURITY_INFORMATION SecurityInformation,
    _Inout_updates_bytes_opt_(Length) PSECURITY_DESCRIPTOR SecurityDescriptor,
    _In_ ULONG Length,
    _Out_opt_ PULONG LengthNeeded);

_Must_inspect_result_
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSTATUS
FLTAPI
FltSetSecurityObject(
    _In_ PFLT_INSTANCE Instance,
    _In_ PFILE_OBJECT FileObject,
    _In_ SECURITY_INFORMATION SecurityInformation,
    _In_ PSECURITY_DESCRIPTOR SecurityDescriptor);

_Must_inspect_result_
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSTATUS
FLTAPI
FltFlushBuffers(
    _In_ PFLT_INSTANCE Instance,
    _In_ PFILE_OBJECT FileObject);

_Must_inspect_result_
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSTATUS
FLTAPI
FltFsControlFile(
    _In_ PFLT_INSTANCE Instance,
    _In_  PFILE_OBJECT FileObject,
    _In_ ULONG FsControlCode,
    _In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer,
    _In_ ULONG InputBufferLength,
    _Out_writes_bytes_to_opt_(OutputBufferLength,*LengthReturned) PVOID OutputBuffer,
    _In_ ULONG OutputBufferLength,
    _Out_opt_ PULONG LengthReturned);

_Must_inspect_result_
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSTATUS
FLTAPI
FltDeviceIoControlFile(
    _In_ PFLT_INSTANCE Instance,
    _In_ PFILE_OBJECT FileObject,
    _In_ ULONG IoControlCode,
    _In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer,
    _In_ ULONG InputBufferLength,
    _Out_writes_bytes_to_opt_(OutputBufferLength,*LengthReturned) PVOID OutputBuffer,
    _In_ ULONG OutputBufferLength,
    _Out_opt_ PULONG LengthReturned);

_Must_inspect_result_
_When_(FlagOn(CallbackData->Iopb->IrpFlags, IRP_PAGING_IO), _IRQL_requires_max_(APC_LEVEL))
_When_(!FlagOn(CallbackData->Iopb->IrpFlags, IRP_PAGING_IO), _IRQL_requires_max_(PASSIVE_LEVEL))
VOID
FLTAPI
FltReissueSynchronousIo(
   _In_ PFLT_INSTANCE InitiatingInstance,
   _In_ PFLT_CALLBACK_DATA CallbackData);

_IRQL_requires_max_(PASSIVE_LEVEL)
NTSTATUS
FLTAPI
FltClose(
   _In_ HANDLE FileHandle);

_IRQL_requires_max_(PASSIVE_LEVEL)
VOID
FLTAPI
FltCancelFileOpen(
    _In_ PFLT_INSTANCE Instance,
    _In_ PFILE_OBJECT FileObject);

_Must_inspect_result_
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSTATUS
FLTAPI
FltCreateSystemVolumeInformationFolder(
    _In_ PFLT_INSTANCE Instance);

_IRQL_requires_max_(APC_LEVEL)
BOOLEAN
FLTAPI
FltSupportsFileContexts(
    _In_ PFILE_OBJECT FileObject);

_IRQL_requires_max_(APC_LEVEL)
BOOLEAN
FLTAPI
FltSupportsStreamContexts(
    _In_ PFILE_OBJECT FileObject);

_IRQL_requires_max_(APC_LEVEL)
BOOLEAN
FLTAPI
FltSupportsStreamHandleContexts(
    _In_ PFILE_OBJECT FileObject);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltAllocateContext(
    _In_ PFLT_FILTER Filter,
    _In_ FLT_CONTEXT_TYPE ContextType,
    _In_ SIZE_T ContextSize,
    _In_ POOL_TYPE PoolType,
    _Outptr_result_bytebuffer_(ContextSize) PFLT_CONTEXT *ReturnedContext);

_IRQL_requires_max_(APC_LEVEL)
VOID
FLTAPI
FltGetContexts(
    _In_ PCFLT_RELATED_OBJECTS FltObjects,
    _In_ FLT_CONTEXT_TYPE DesiredContexts,
    _Out_ PFLT_RELATED_CONTEXTS Contexts);

_IRQL_requires_max_(APC_LEVEL)
VOID
FLTAPI
FltReleaseContexts(
    _In_ PFLT_RELATED_CONTEXTS Contexts);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltSetVolumeContext(
    _In_ PFLT_VOLUME Volume,
    _In_ FLT_SET_CONTEXT_OPERATION Operation,
    _In_ PFLT_CONTEXT NewContext,
    _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltSetInstanceContext(
    _In_ PFLT_INSTANCE Instance,
    _In_ FLT_SET_CONTEXT_OPERATION Operation,
    _In_ PFLT_CONTEXT NewContext,
    _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltSetFileContext(
    _In_ PFLT_INSTANCE Instance,
    _In_ PFILE_OBJECT FileObject,
    _In_ FLT_SET_CONTEXT_OPERATION Operation,
    _In_ PFLT_CONTEXT NewContext,
    _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltSetStreamContext(
    _In_ PFLT_INSTANCE Instance,
    _In_ PFILE_OBJECT FileObject,
    _In_ FLT_SET_CONTEXT_OPERATION Operation,
    _In_ PFLT_CONTEXT NewContext,
    _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltSetStreamHandleContext(
    _In_ PFLT_INSTANCE Instance,
    _In_ PFILE_OBJECT FileObject,
    _In_ FLT_SET_CONTEXT_OPERATION Operation,
    _In_ PFLT_CONTEXT NewContext,
    _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext);

_IRQL_requires_max_(APC_LEVEL)
VOID
FLTAPI
FltDeleteContext(
    _In_ PFLT_CONTEXT Context);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltDeleteVolumeContext(
    _In_ PFLT_FILTER Filter,
    _In_ PFLT_VOLUME Volume,
    _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltDeleteInstanceContext(
    _In_ PFLT_INSTANCE Instance,
    _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltDeleteFileContext(
    _In_ PFLT_INSTANCE Instance,
    _In_ PFILE_OBJECT FileObject,
    _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltDeleteStreamContext(
    _In_ PFLT_INSTANCE Instance,
    _In_ PFILE_OBJECT FileObject,
    _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltDeleteStreamHandleContext(
    _In_ PFLT_INSTANCE Instance,
    _In_ PFILE_OBJECT FileObject,
    _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltGetVolumeContext(
    _In_ PFLT_FILTER Filter,
    _In_ PFLT_VOLUME Volume,
    _Outptr_ PFLT_CONTEXT *Context);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltGetInstanceContext(
    _In_ PFLT_INSTANCE Instance,
    _Outptr_ PFLT_CONTEXT *Context);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltGetFileContext(
    _In_ PFLT_INSTANCE Instance,
    _In_ PFILE_OBJECT FileObject,
    _Outptr_ PFLT_CONTEXT *Context);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltGetStreamContext(
    _In_ PFLT_INSTANCE Instance,
    _In_ PFILE_OBJECT FileObject,
    _Outptr_ PFLT_CONTEXT *Context);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltGetStreamHandleContext(
    _In_ PFLT_INSTANCE Instance,
    _In_ PFILE_OBJECT FileObject,
    _Outptr_ PFLT_CONTEXT *Context);

_IRQL_requires_max_(DISPATCH_LEVEL)
VOID
FLTAPI
FltReferenceContext(
    _In_ PFLT_CONTEXT Context);

_IRQL_requires_max_(DISPATCH_LEVEL)
VOID
FLTAPI
FltReleaseContext(
    _In_ PFLT_CONTEXT Context);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltGetFilterFromName(
    _In_ PCUNICODE_STRING FilterName,
    _Outptr_ PFLT_FILTER *RetFilter);

_IRQL_requires_max_(PASSIVE_LEVEL)
NTSTATUS
FLTAPI
FltGetVolumeFromName(
    _In_ PFLT_FILTER Filter,
    _In_ PCUNICODE_STRING VolumeName,
    _Outptr_ PFLT_VOLUME *RetVolume);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltGetVolumeInstanceFromName(
    _In_opt_ PFLT_FILTER Filter,
    _In_ PFLT_VOLUME Volume,
    _In_opt_ PCUNICODE_STRING InstanceName,
    _Outptr_ PFLT_INSTANCE *RetInstance);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltGetVolumeFromInstance(
    _In_ PFLT_INSTANCE Instance,
    _Outptr_ PFLT_VOLUME *RetVolume);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltGetFilterFromInstance(
    _In_ PFLT_INSTANCE Instance,
    _Outptr_ PFLT_FILTER *RetFilter);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltGetVolumeFromFileObject(
    _In_ PFLT_FILTER Filter,
    _In_ PFILE_OBJECT FileObject,
    _Outptr_ PFLT_VOLUME *RetVolume);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltGetVolumeFromDeviceObject(
    _In_ PFLT_FILTER Filter,
    _In_ PDEVICE_OBJECT DeviceObject,
    _Outptr_ PFLT_VOLUME *RetVolume);

_IRQL_requires_max_(DISPATCH_LEVEL)
NTSTATUS
FLTAPI
FltGetDeviceObject(
    _In_ PFLT_VOLUME Volume,
    _Outptr_ PDEVICE_OBJECT *DeviceObject);

_IRQL_requires_max_(DISPATCH_LEVEL)
NTSTATUS
FLTAPI
FltGetDiskDeviceObject(
    _In_ PFLT_VOLUME Volume,
    _Outptr_ PDEVICE_OBJECT *DiskDeviceObject);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltGetLowerInstance(
    _In_ PFLT_INSTANCE CurrentInstance,
    _Outptr_ PFLT_INSTANCE *LowerInstance);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltGetUpperInstance(
    _In_ PFLT_INSTANCE CurrentInstance,
    _Outptr_ PFLT_INSTANCE *UpperInstance);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltGetTopInstance(
    _In_ PFLT_VOLUME Volume,
    _Outptr_ PFLT_INSTANCE *Instance);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltGetBottomInstance(
    _In_ PFLT_VOLUME Volume,
    _Outptr_ PFLT_INSTANCE *Instance);

LONG
FLTAPI
FltCompareInstanceAltitudes(
    _In_ PFLT_INSTANCE Instance1,
    _In_ PFLT_INSTANCE Instance2);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltGetFilterInformation(
    _In_ PFLT_FILTER Filter,
    _In_ FILTER_INFORMATION_CLASS InformationClass,
    _Out_writes_bytes_to_opt_(BufferSize, *BytesReturned) PVOID Buffer,
    _In_ ULONG BufferSize,
    _Out_ PULONG BytesReturned);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltGetInstanceInformation(
    _In_ PFLT_INSTANCE Instance,
    _In_ INSTANCE_INFORMATION_CLASS InformationClass,
    _Out_writes_bytes_to_opt_(BufferSize,*BytesReturned) PVOID Buffer,
    _In_ ULONG BufferSize,
    _Out_ PULONG BytesReturned);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltGetVolumeProperties(
    _In_ PFLT_VOLUME Volume,
    _Out_writes_bytes_to_opt_(VolumePropertiesLength,*LengthReturned) PFLT_VOLUME_PROPERTIES VolumeProperties,
    _In_ ULONG VolumePropertiesLength,
    _Out_ PULONG LengthReturned);

_Must_inspect_result_
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSTATUS
FLTAPI
FltIsVolumeWritable(
    _In_ PVOID FltObject,
    _Out_ PBOOLEAN IsWritable);

_Must_inspect_result_
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSTATUS
FLTAPI
FltGetVolumeGuidName(
    _In_ PFLT_VOLUME Volume,
    _Out_ PUNICODE_STRING VolumeGuidName,
    _Out_opt_ PULONG BufferSizeNeeded);

_Must_inspect_result_
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSTATUS
FLTAPI
FltQueryVolumeInformation(
    _In_ PFLT_INSTANCE Instance,
    _Out_ PIO_STATUS_BLOCK Iosb,
    _Out_writes_bytes_(Length) PVOID FsInformation,
    _In_ ULONG Length,
    _In_ FS_INFORMATION_CLASS FsInformationClass);

_Must_inspect_result_
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSTATUS
FLTAPI
FltSetVolumeInformation(
    _In_ PFLT_INSTANCE Instance,
    _Out_ PIO_STATUS_BLOCK Iosb,
    _Out_writes_bytes_(Length) PVOID FsInformation,
    _In_ ULONG Length,
    _In_ FS_INFORMATION_CLASS FsInformationClass);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltEnumerateFilters(
    _Out_writes_to_opt_(FilterListSize,*NumberFiltersReturned) PFLT_FILTER *FilterList,
    _In_ ULONG FilterListSize,
    _Out_ PULONG NumberFiltersReturned);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltEnumerateVolumes(
    _In_ PFLT_FILTER Filter,
    _Out_writes_to_opt_(VolumeListSize,*NumberVolumesReturned) PFLT_VOLUME *VolumeList,
    _In_ ULONG VolumeListSize,
    _Out_ PULONG NumberVolumesReturned);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltEnumerateInstances(
    _In_opt_ PFLT_VOLUME Volume,
    _In_opt_ PFLT_FILTER Filter,
    _Out_writes_to_opt_(InstanceListSize,*NumberInstancesReturned) PFLT_INSTANCE *InstanceList,
    _In_ ULONG InstanceListSize,
    _Out_ PULONG NumberInstancesReturned);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltEnumerateFilterInformation(
    _In_ ULONG Index,
    _In_ FILTER_INFORMATION_CLASS InformationClass,
    _Out_writes_bytes_to_opt_(BufferSize,*BytesReturned) PVOID Buffer,
    _In_ ULONG BufferSize,
    _Out_ PULONG BytesReturned);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltEnumerateInstanceInformationByFilter(
    _In_ PFLT_FILTER Filter,
    _In_ ULONG Index,
    _In_ INSTANCE_INFORMATION_CLASS InformationClass,
    _Out_writes_bytes_to_opt_(BufferSize,*BytesReturned) PVOID Buffer,
    _In_ ULONG BufferSize,
    _Out_ PULONG BytesReturned);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltEnumerateInstanceInformationByVolume(
    _In_ PFLT_VOLUME Volume,
    _In_ ULONG Index,
    _In_ INSTANCE_INFORMATION_CLASS InformationClass,
    _Out_writes_bytes_to_opt_(BufferSize,*BytesReturned) PVOID Buffer,
    _In_ ULONG BufferSize,
    _Out_ PULONG BytesReturned);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltEnumerateVolumeInformation(
    _In_ PFLT_FILTER Filter,
    _In_ ULONG Index,
    _In_ FILTER_VOLUME_INFORMATION_CLASS InformationClass,
    _Out_writes_bytes_to_opt_(BufferSize,*BytesReturned) PVOID Buffer,
    _In_ ULONG BufferSize,
    _Out_ PULONG BytesReturned);

_Must_inspect_result_
_IRQL_requires_max_(DISPATCH_LEVEL)
NTSTATUS
FLTAPI
FltObjectReference(
    _Inout_ PVOID FltObject);

_IRQL_requires_max_(DISPATCH_LEVEL)
VOID
FLTAPI
FltObjectDereference(
    _Inout_ PVOID FltObject);

_Must_inspect_result_
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSTATUS
FLTAPI
FltCreateCommunicationPort(
    _In_ PFLT_FILTER Filter,
    _Outptr_ PFLT_PORT *ServerPort,
    _In_ POBJECT_ATTRIBUTES ObjectAttributes,
    _In_opt_ PVOID ServerPortCookie,
    _In_ PFLT_CONNECT_NOTIFY ConnectNotifyCallback,
    _In_ PFLT_DISCONNECT_NOTIFY DisconnectNotifyCallback,
    _In_opt_ PFLT_MESSAGE_NOTIFY MessageNotifyCallback,
    _In_ LONG MaxConnections);

_IRQL_requires_max_(PASSIVE_LEVEL)
VOID
FLTAPI
FltCloseCommunicationPort(
    _In_ PFLT_PORT ServerPort);

_IRQL_requires_max_(PASSIVE_LEVEL)
VOID
FLTAPI
FltCloseClientPort(
    _In_ PFLT_FILTER Filter,
    _Outptr_ PFLT_PORT *ClientPort);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltSendMessage(
    _In_ PFLT_FILTER Filter,
    _In_ PFLT_PORT *ClientPort,
    _In_reads_bytes_(SenderBufferLength) PVOID SenderBuffer,
    _In_ ULONG SenderBufferLength,
    _Out_writes_bytes_opt_(*ReplyLength) PVOID ReplyBuffer,
    _Inout_opt_ PULONG ReplyLength,
    _In_opt_ PLARGE_INTEGER Timeout);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltBuildDefaultSecurityDescriptor(
    _Outptr_ PSECURITY_DESCRIPTOR *SecurityDescriptor,
    _In_ ACCESS_MASK DesiredAccess);

_IRQL_requires_max_(APC_LEVEL)
VOID
FLTAPI
FltFreeSecurityDescriptor(
    _In_ PSECURITY_DESCRIPTOR SecurityDescriptor);

_Must_inspect_result_
_IRQL_requires_max_(DISPATCH_LEVEL)
BOOLEAN
FLTAPI
FltCancelIo(
    _In_ PFLT_CALLBACK_DATA CallbackData);

_IRQL_requires_max_(DISPATCH_LEVEL)
NTSTATUS
FLTAPI
FltSetCancelCompletion(
    _In_ PFLT_CALLBACK_DATA CallbackData,
    _In_ PFLT_COMPLETE_CANCELED_CALLBACK CanceledCallback);

_Must_inspect_result_
_IRQL_requires_max_(DISPATCH_LEVEL)
NTSTATUS
FLTAPI
FltClearCancelCompletion(
    _In_ PFLT_CALLBACK_DATA CallbackData);

BOOLEAN
FLTAPI
FltIsIoCanceled(
    _In_ PFLT_CALLBACK_DATA CallbackData);

_Must_inspect_result_
_IRQL_requires_max_(DISPATCH_LEVEL)
PFLT_DEFERRED_IO_WORKITEM
FLTAPI
FltAllocateDeferredIoWorkItem(VOID);

_IRQL_requires_max_(DISPATCH_LEVEL)
VOID
FLTAPI
FltFreeDeferredIoWorkItem(
    _In_ PFLT_DEFERRED_IO_WORKITEM FltWorkItem);

_Must_inspect_result_
_IRQL_requires_max_(DISPATCH_LEVEL)
PFLT_GENERIC_WORKITEM
FLTAPI
FltAllocateGenericWorkItem(VOID);

_IRQL_requires_max_(DISPATCH_LEVEL)
VOID
FLTAPI
FltFreeGenericWorkItem(
    _In_ PFLT_GENERIC_WORKITEM FltWorkItem);

_Must_inspect_result_
_IRQL_requires_max_(DISPATCH_LEVEL)
NTSTATUS
FLTAPI
FltQueueDeferredIoWorkItem(
    _In_ PFLT_DEFERRED_IO_WORKITEM FltWorkItem,
    _In_ PFLT_CALLBACK_DATA Data,
    _In_ PFLT_DEFERRED_IO_WORKITEM_ROUTINE WorkerRoutine,
    _In_ WORK_QUEUE_TYPE QueueType,
    _In_ PVOID Context);

_Must_inspect_result_
_IRQL_requires_max_(DISPATCH_LEVEL)
NTSTATUS
FLTAPI
FltQueueGenericWorkItem(
    _In_ PFLT_GENERIC_WORKITEM FltWorkItem,
    _In_ PVOID FltObject,
    _In_ PFLT_GENERIC_WORKITEM_ROUTINE WorkerRoutine,
    _In_ WORK_QUEUE_TYPE QueueType,
    _In_opt_ PVOID Context);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltLockUserBuffer(
    _In_ PFLT_CALLBACK_DATA CallbackData);

NTSTATUS
FLTAPI
FltDecodeParameters(
    _In_ PFLT_CALLBACK_DATA CallbackData,
    _Outptr_opt_ PMDL **MdlAddressPointer,
    _Outptr_opt_result_bytebuffer_(**Length) PVOID **Buffer,
    _Outptr_opt_ PULONG *Length,
    _Out_opt_ LOCK_OPERATION *DesiredAccess);

PMDL
FASTCALL
FltGetSwappedBufferMdlAddress(
    _In_ PFLT_CALLBACK_DATA CallbackData);

VOID
FASTCALL
FltRetainSwappedBufferMdlAddress(
    _In_ PFLT_CALLBACK_DATA CallbackData);

NTSTATUS
FLTAPI
FltCbdqInitialize(
    _In_ PFLT_INSTANCE Instance,
    _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq,
    _In_ PFLT_CALLBACK_DATA_QUEUE_INSERT_IO CbdqInsertIo,
    _In_ PFLT_CALLBACK_DATA_QUEUE_REMOVE_IO CbdqRemoveIo,
    _In_ PFLT_CALLBACK_DATA_QUEUE_PEEK_NEXT_IO CbdqPeekNextIo,
    _In_ PFLT_CALLBACK_DATA_QUEUE_ACQUIRE CbdqAcquire,
    _In_ PFLT_CALLBACK_DATA_QUEUE_RELEASE CbdqRelease,
    _In_ PFLT_CALLBACK_DATA_QUEUE_COMPLETE_CANCELED_IO CbdqCompleteCanceledIo);

VOID
FLTAPI
FltCbdqEnable(
    _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq);

VOID
FLTAPI
FltCbdqDisable(
    _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq);

_Must_inspect_result_
NTSTATUS
FLTAPI
FltCbdqInsertIo(
    _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq,
    _In_ PFLT_CALLBACK_DATA Cbd,
    _In_opt_ PFLT_CALLBACK_DATA_QUEUE_IO_CONTEXT Context,
    _In_opt_ PVOID InsertContext);

_Must_inspect_result_
PFLT_CALLBACK_DATA
FLTAPI
FltCbdqRemoveIo(
    _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq,
    _In_ PFLT_CALLBACK_DATA_QUEUE_IO_CONTEXT Context);

_Must_inspect_result_
PFLT_CALLBACK_DATA
FLTAPI
FltCbdqRemoveNextIo(
    _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq,
    _In_opt_ PVOID PeekContext);

_IRQL_requires_max_(APC_LEVEL)
VOID
FLTAPI
FltInitializeOplock(
    _Out_ POPLOCK Oplock);

_IRQL_requires_max_(APC_LEVEL)
VOID
FLTAPI
FltUninitializeOplock(
    _In_ POPLOCK Oplock);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
FLT_PREOP_CALLBACK_STATUS
FLTAPI
FltOplockFsctrl(
    _In_ POPLOCK Oplock,
    _In_ PFLT_CALLBACK_DATA CallbackData,
    _In_ ULONG OpenCount);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
FLT_PREOP_CALLBACK_STATUS
FLTAPI
FltCheckOplock(
    _In_ POPLOCK Oplock,
    _In_ PFLT_CALLBACK_DATA CallbackData,
    _In_opt_ PVOID Context,
    _In_opt_ PFLTOPLOCK_WAIT_COMPLETE_ROUTINE WaitCompletionRoutine,
    _In_opt_ PFLTOPLOCK_PREPOST_CALLBACKDATA_ROUTINE PrePostCallbackDataRoutine);

_IRQL_requires_max_(APC_LEVEL)
BOOLEAN
FLTAPI
FltOplockIsFastIoPossible(
    _In_ POPLOCK Oplock);

_IRQL_requires_max_(APC_LEVEL)
BOOLEAN
FLTAPI
FltCurrentBatchOplock(
    _In_ POPLOCK Oplock);

VOID
FLTAPI
FltInitializeFileLock(
    _Out_ PFILE_LOCK FileLock);

VOID
FLTAPI
FltUninitializeFileLock(
    _In_ PFILE_LOCK FileLock);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
PFILE_LOCK
FLTAPI
FltAllocateFileLock(
    _In_opt_ PFLT_COMPLETE_LOCK_CALLBACK_DATA_ROUTINE CompleteLockCallbackDataRoutine,
    _In_opt_ PUNLOCK_ROUTINE UnlockRoutine);

_IRQL_requires_max_(APC_LEVEL)
VOID
FLTAPI
FltFreeFileLock(
    _In_ PFILE_LOCK FileLock);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
FLT_PREOP_CALLBACK_STATUS
FLTAPI
FltProcessFileLock(
    _In_ PFILE_LOCK FileLock,
    _In_ PFLT_CALLBACK_DATA CallbackData,
    _In_opt_ PVOID Context);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
BOOLEAN
FLTAPI
FltCheckLockForReadAccess(
    _In_ PFILE_LOCK FileLock,
    _In_ PFLT_CALLBACK_DATA CallbackData);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
BOOLEAN
FLTAPI
FltCheckLockForWriteAccess(
    _In_ PFILE_LOCK FileLock,
    _In_ PFLT_CALLBACK_DATA CallbackData);

_Acquires_lock_(_Global_critical_region_)
_IRQL_requires_max_(APC_LEVEL)
VOID
FLTAPI
FltAcquireResourceExclusive(
    _Inout_ _Requires_lock_not_held_(*_Curr_) _Acquires_lock_(*_Curr_) PERESOURCE Resource);

_Acquires_lock_(_Global_critical_region_)
_IRQL_requires_max_(APC_LEVEL)
VOID
FLTAPI
FltAcquireResourceShared(
    _Inout_ _Requires_lock_not_held_(*_Curr_) _Acquires_lock_(*_Curr_) PERESOURCE Resource);

_Releases_lock_(_Global_critical_region_)
_IRQL_requires_max_(DISPATCH_LEVEL)
VOID
FLTAPI
FltReleaseResource(
    _Inout_ _Requires_lock_held_(*_Curr_) _Releases_lock_(*_Curr_) PERESOURCE Resource);

_IRQL_requires_max_(APC_LEVEL)
VOID
FLTAPI
FltInitializePushLock(
    _Out_ PEX_PUSH_LOCK PushLock);

_IRQL_requires_max_(APC_LEVEL)
VOID
FLTAPI
FltDeletePushLock(
    _In_ PEX_PUSH_LOCK PushLock);

_Acquires_lock_(_Global_critical_region_)
_IRQL_requires_max_(APC_LEVEL)
VOID
FLTAPI
FltAcquirePushLockExclusive(
    _Inout_ _Requires_lock_not_held_(*_Curr_) _Acquires_lock_(*_Curr_) PEX_PUSH_LOCK PushLock);

_Acquires_lock_(_Global_critical_region_)
_IRQL_requires_max_(APC_LEVEL)
VOID
FLTAPI
FltAcquirePushLockShared(
    _Inout_ _Requires_lock_not_held_(*_Curr_) _Acquires_lock_(*_Curr_) PEX_PUSH_LOCK PushLock);

_Releases_lock_(_Global_critical_region_)
_IRQL_requires_max_(APC_LEVEL)
VOID
FLTAPI
FltReleasePushLock(
    _Inout_ _Requires_lock_held_(*_Curr_) _Releases_lock_(*_Curr_) PEX_PUSH_LOCK PushLock);

BOOLEAN
FLTAPI
FltIsOperationSynchronous(
    _In_ PFLT_CALLBACK_DATA CallbackData);

_IRQL_requires_max_(DISPATCH_LEVEL)
BOOLEAN
FLTAPI
FltIs32bitProcess(
    _In_opt_ PFLT_CALLBACK_DATA CallbackData);

_IRQL_requires_max_(DISPATCH_LEVEL)
PEPROCESS
FLTAPI
FltGetRequestorProcess(
    _In_ PFLT_CALLBACK_DATA CallbackData);

_IRQL_requires_max_(DISPATCH_LEVEL)
ULONG
FLTAPI
FltGetRequestorProcessId(
    _In_ PFLT_CALLBACK_DATA CallbackData);

_IRQL_requires_max_(APC_LEVEL)
VOID
FLTAPI
FltNotifyFilterChangeDirectory(
    _Inout_ PNOTIFY_SYNC NotifySync,
    _Inout_ PLIST_ENTRY NotifyList,
    _In_ PVOID FsContext,
    _In_ PSTRING FullDirectoryName,
    _In_ BOOLEAN WatchTree,
    _In_ BOOLEAN IgnoreBuffer,
    _In_ ULONG CompletionFilter,
    _In_ PFLT_CALLBACK_DATA NotifyCallbackData,
    _In_opt_ PCHECK_FOR_TRAVERSE_ACCESS TraverseCallback,
    _In_opt_ PSECURITY_SUBJECT_CONTEXT SubjectContext,
    _In_opt_ PFILTER_REPORT_CHANGE FilterCallback);

PCHAR
FLTAPI
FltGetIrpName(
    _In_ UCHAR IrpMajorCode);

#if FLT_MGR_AFTER_XPSP2

_Must_inspect_result_
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSTATUS
FLTAPI
FltCreateFileEx(
    _In_ PFLT_FILTER Filter,
    _In_opt_ PFLT_INSTANCE Instance,
    _Out_ PHANDLE FileHandle,
    _Outptr_opt_ PFILE_OBJECT *FileObject,
    _In_ ACCESS_MASK DesiredAccess,
    _In_ POBJECT_ATTRIBUTES ObjectAttributes,
    _Out_ PIO_STATUS_BLOCK IoStatusBlock,
    _In_opt_ PLARGE_INTEGER AllocationSize,
    _In_ ULONG FileAttributes,
    _In_ ULONG ShareAccess,
    _In_ ULONG CreateDisposition,
    _In_ ULONG CreateOptions,
    _In_reads_bytes_opt_(EaLength) PVOID EaBuffer,
    _In_ ULONG EaLength,
    _In_ ULONG Flags);

_Must_inspect_result_
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSTATUS
FLTAPI
FltOpenVolume(
    _In_ PFLT_INSTANCE Instance,
    _Out_ PHANDLE VolumeHandle,
    _Outptr_opt_ PFILE_OBJECT *VolumeFileObject);

_Must_inspect_result_
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSTATUS
FLTAPI
FltQueryEaFile(
    _In_ PFLT_INSTANCE Instance,
    _In_ PFILE_OBJECT FileObject,
    _Out_writes_bytes_to_(Length,*LengthReturned) PVOID ReturnedEaData,
    _In_ ULONG Length,
    _In_ BOOLEAN ReturnSingleEntry,
    _In_reads_bytes_opt_(EaListLength) PVOID EaList,
    _In_ ULONG EaListLength,
    _In_opt_ PULONG EaIndex,
    _In_ BOOLEAN RestartScan,
    _Out_opt_ PULONG LengthReturned);

_Must_inspect_result_
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSTATUS
FLTAPI
FltSetEaFile(
    _In_ PFLT_INSTANCE Instance,
    _In_ PFILE_OBJECT FileObject,
    _In_reads_bytes_(Length) PVOID EaBuffer,
    _In_ ULONG Length);

#endif /* FLT_MGR_AFTER_XPSP2 */

#if FLT_MGR_LONGHORN

_Must_inspect_result_
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSTATUS
FLTAPI
FltCreateFileEx2(
    _In_ PFLT_FILTER Filter,
    _In_opt_ PFLT_INSTANCE Instance,
    _Out_ PHANDLE FileHandle,
    _Outptr_opt_ PFILE_OBJECT *FileObject,
    _In_ ACCESS_MASK DesiredAccess,
    _In_ POBJECT_ATTRIBUTES ObjectAttributes,
    _Out_ PIO_STATUS_BLOCK IoStatusBlock,
    _In_opt_ PLARGE_INTEGER AllocationSize,
    _In_ ULONG FileAttributes,
    _In_ ULONG ShareAccess,
    _In_ ULONG CreateDisposition,
    _In_ ULONG CreateOptions,
    _In_reads_bytes_opt_(EaLength) PVOID EaBuffer,
    _In_ ULONG EaLength,
    _In_ ULONG Flags,
    _In_opt_ PIO_DRIVER_CREATE_CONTEXT DriverContext);

_Must_inspect_result_
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSTATUS
FLTAPI
FltQueryDirectoryFile(
    _In_ PFLT_INSTANCE Instance,
    _In_ PFILE_OBJECT FileObject,
    _Out_writes_bytes_(Length) PVOID FileInformation,
    _In_ ULONG Length,
    _In_ FILE_INFORMATION_CLASS FileInformationClass,
    _In_ BOOLEAN ReturnSingleEntry,
    _In_opt_ PUNICODE_STRING FileName,
    _In_ BOOLEAN RestartScan,
    _Out_opt_ PULONG LengthReturned);

_IRQL_requires_max_(APC_LEVEL)
BOOLEAN
FLTAPI
FltSupportsFileContextsEx(
    _In_ PFILE_OBJECT FileObject,
    _In_opt_ PFLT_INSTANCE Instance);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltSetTransactionContext(
    _In_ PFLT_INSTANCE Instance,
    _In_ PKTRANSACTION Transaction,
    _In_ FLT_SET_CONTEXT_OPERATION Operation,
    _In_ PFLT_CONTEXT NewContext,
    _Outptr_opt_ PFLT_CONTEXT *OldContext);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltDeleteTransactionContext(
    _In_ PFLT_INSTANCE Instance,
    _In_ PKTRANSACTION Transaction,
    _Outptr_opt_ PFLT_CONTEXT *OldContext);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltGetTransactionContext(
    _In_ PFLT_INSTANCE Instance,
    _In_ PKTRANSACTION Transaction,
    _Outptr_ PFLT_CONTEXT *Context);

_IRQL_requires_max_(APC_LEVEL)
BOOLEAN
FLTAPI
FltIsFltMgrVolumeDeviceObject(
    _In_ PDEVICE_OBJECT DeviceObject);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltGetVolumeInformation(
    _In_ PFLT_VOLUME Volume,
    _In_ FILTER_VOLUME_INFORMATION_CLASS InformationClass,
    _Out_writes_bytes_to_opt_(BufferSize,*BytesReturned) PVOID Buffer,
    _In_ ULONG BufferSize,
    _Out_ PULONG BytesReturned);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltGetFileSystemType(
    _In_ PVOID FltObject,
    _Out_ PFLT_FILESYSTEM_TYPE FileSystemType);

_Must_inspect_result_
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSTATUS
FLTAPI
FltIsVolumeSnapshot(
    _In_ PVOID FltObject,
    _Out_ PBOOLEAN IsSnapshotVolume);

_Must_inspect_result_
_When_(((CallbackData!=NULL) && FLT_IS_IRP_OPERATION(CallbackData)), _IRQL_requires_max_(PASSIVE_LEVEL))
_When_((!((CallbackData!=NULL) && FLT_IS_IRP_OPERATION(CallbackData))), _IRQL_requires_max_(APC_LEVEL))
NTSTATUS
FLTAPI
FltCancellableWaitForSingleObject(
    _In_ PVOID Object,
    _In_opt_ PLARGE_INTEGER Timeout,
    _In_opt_ PFLT_CALLBACK_DATA CallbackData);

_Must_inspect_result_
_When_(((CallbackData!=NULL) && FLT_IS_IRP_OPERATION(CallbackData)), _IRQL_requires_max_(PASSIVE_LEVEL))
_When_((!((CallbackData!=NULL) && FLT_IS_IRP_OPERATION(CallbackData))), _IRQL_requires_max_(APC_LEVEL))
NTSTATUS
FLTAPI
FltCancellableWaitForMultipleObjects(
    _In_ ULONG Count,
    _In_reads_(Count) PVOID ObjectArray[],
    _In_ WAIT_TYPE WaitType,
    _In_opt_ PLARGE_INTEGER Timeout,
    _In_opt_ PKWAIT_BLOCK WaitBlockArray,
    _In_ PFLT_CALLBACK_DATA CallbackData);

_IRQL_requires_max_(DISPATCH_LEVEL)
HANDLE
FLTAPI
FltGetRequestorProcessIdEx(
    _In_ PFLT_CALLBACK_DATA CallbackData);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltEnlistInTransaction(
    _In_ PFLT_INSTANCE Instance,
    _In_ PKTRANSACTION Transaction,
    _In_ PFLT_CONTEXT TransactionContext,
    _In_ NOTIFICATION_MASK NotificationMask);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltRollbackEnlistment(
    _In_ PFLT_INSTANCE Instance,
    _In_ PKTRANSACTION Transaction,
    _In_opt_ PFLT_CONTEXT TransactionContext);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltPrePrepareComplete(
    _In_ PFLT_INSTANCE Instance,
    _In_ PKTRANSACTION Transaction,
    _In_opt_ PFLT_CONTEXT TransactionContext);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltPrepareComplete(
    _In_ PFLT_INSTANCE Instance,
    _In_ PKTRANSACTION Transaction,
    _In_opt_ PFLT_CONTEXT TransactionContext);

_IRQL_requires_max_(PASSIVE_LEVEL)
NTSTATUS
FLTAPI
FltCommitComplete(
    _In_ PFLT_INSTANCE Instance,
    _In_ PKTRANSACTION Transaction,
    _In_opt_ PFLT_CONTEXT TransactionContext);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltCommitFinalizeComplete(
    _In_ PFLT_INSTANCE Instance,
    _In_ PKTRANSACTION Transaction,
    _In_opt_ PFLT_CONTEXT TransactionContext);

_IRQL_requires_max_(PASSIVE_LEVEL)
NTSTATUS
FLTAPI
FltRollbackComplete(
    _In_ PFLT_INSTANCE Instance,
    _In_ PKTRANSACTION Transaction,
    _In_opt_ PFLT_CONTEXT TransactionContext);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltAllocateExtraCreateParameterList(
    _In_ PFLT_FILTER Filter,
    _In_ FSRTL_ALLOCATE_ECPLIST_FLAGS Flags,
    _Outptr_ PECP_LIST *EcpList);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltAllocateExtraCreateParameter(
    _In_ PFLT_FILTER Filter,
    _In_ LPCGUID EcpType,
     ULONG SizeOfContext,
    _In_ FSRTL_ALLOCATE_ECP_FLAGS Flags,
    _In_opt_ PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK CleanupCallback,
    _In_ ULONG PoolTag,
    _Outptr_ PVOID *EcpContext);

_IRQL_requires_max_(APC_LEVEL)
VOID
FLTAPI
FltInitExtraCreateParameterLookasideList(
    _In_ PFLT_FILTER Filter,
    _Inout_ PVOID Lookaside,
    _In_ FSRTL_ECP_LOOKASIDE_FLAGS Flags,
    _In_ SIZE_T Size,
    _In_ ULONG Tag);

_IRQL_requires_max_(APC_LEVEL)
VOID
FLTAPI
FltDeleteExtraCreateParameterLookasideList(
    _In_ PFLT_FILTER Filter,
    _Inout_ PVOID Lookaside,
    _In_ FSRTL_ECP_LOOKASIDE_FLAGS Flags);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltAllocateExtraCreateParameterFromLookasideList(
    _In_ PFLT_FILTER Filter,
    _In_ LPCGUID EcpType,
    _In_ ULONG SizeOfContext,
    _In_ FSRTL_ALLOCATE_ECP_FLAGS Flags,
    _In_opt_ PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK CleanupCallback,
    _Inout_ PVOID LookasideList,
    _Outptr_ PVOID *EcpContext);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltInsertExtraCreateParameter(
    _In_ PFLT_FILTER Filter,
    _Inout_ PECP_LIST EcpList,
    _Inout_ PVOID EcpContext);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltFindExtraCreateParameter(
    _In_ PFLT_FILTER Filter,
    _In_ PECP_LIST EcpList,
    _In_ LPCGUID EcpType,
    _Outptr_opt_ PVOID *EcpContext,
    _Out_opt_ ULONG *EcpContextSize);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltRemoveExtraCreateParameter(
    _In_ PFLT_FILTER Filter,
    _Inout_ PECP_LIST EcpList,
    _In_ LPCGUID EcpType,
    _Outptr_ PVOID *EcpContext,
    _Out_opt_ ULONG *EcpContextSize);

_IRQL_requires_max_(APC_LEVEL)
VOID
FLTAPI
FltFreeExtraCreateParameterList(
    _In_ PFLT_FILTER Filter,
    _In_ PECP_LIST EcpList);

_IRQL_requires_max_(APC_LEVEL)
VOID
FLTAPI
FltFreeExtraCreateParameter(
    _In_ PFLT_FILTER Filter,
    _In_ PVOID EcpContext);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltGetEcpListFromCallbackData(
    _In_ PFLT_FILTER Filter,
    _In_ PFLT_CALLBACK_DATA CallbackData,
    _Outptr_result_maybenull_ PECP_LIST *EcpList);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltSetEcpListIntoCallbackData(
    _In_ PFLT_FILTER Filter,
    _In_ PFLT_CALLBACK_DATA CallbackData,
    _In_ PECP_LIST EcpList);

_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltGetNextExtraCreateParameter(
    _In_ PFLT_FILTER Filter,
    _In_ PECP_LIST EcpList,
    _In_opt_ PVOID CurrentEcpContext,
    _Out_opt_ LPGUID NextEcpType,
    _Outptr_opt_ PVOID *NextEcpContext,
    _Out_opt_ ULONG *NextEcpContextSize);

_IRQL_requires_max_(APC_LEVEL)
VOID
FLTAPI
FltAcknowledgeEcp(
    _In_ PFLT_FILTER Filter,
    _In_ PVOID EcpContext);

_IRQL_requires_max_(APC_LEVEL)
BOOLEAN
FLTAPI
FltIsEcpAcknowledged(
    _In_ PFLT_FILTER Filter,
    _In_ PVOID EcpContext);

_IRQL_requires_max_(APC_LEVEL)
BOOLEAN
FLTAPI
FltIsEcpFromUserMode(
    _In_ PFLT_FILTER Filter,
    _In_ PVOID EcpContext);

_IRQL_requires_max_(DISPATCH_LEVEL)
NTSTATUS
FLTAPI
FltRetrieveIoPriorityInfo(
    _In_opt_ PFLT_CALLBACK_DATA Data,
    _In_opt_ PFILE_OBJECT FileObject,
    _In_opt_ PETHREAD Thread,
    _Inout_ PIO_PRIORITY_INFO PriorityInfo);

_IRQL_requires_max_(DISPATCH_LEVEL)
NTSTATUS
FLTAPI
FltApplyPriorityInfoThread(
    _In_ PIO_PRIORITY_INFO InputPriorityInfo,
    _Out_opt_ PIO_PRIORITY_INFO OutputPriorityInfo,
    _In_ PETHREAD Thread);

_IRQL_requires_max_(DISPATCH_LEVEL)
IO_PRIORITY_HINT
FLTAPI
FltGetIoPriorityHint(
    _In_ PFLT_CALLBACK_DATA Data);

_IRQL_requires_max_(DISPATCH_LEVEL)
IO_PRIORITY_HINT
FLTAPI
FltGetIoPriorityHintFromCallbackData(
    _In_ PFLT_CALLBACK_DATA Data);

_IRQL_requires_max_(DISPATCH_LEVEL)
NTSTATUS
FLTAPI
FltSetIoPriorityHintIntoCallbackData(
    _In_ PFLT_CALLBACK_DATA Data,
    _In_ IO_PRIORITY_HINT PriorityHint);

_IRQL_requires_max_(DISPATCH_LEVEL)
IO_PRIORITY_HINT
FLTAPI
FltGetIoPriorityHintFromFileObject(
    _In_ PFILE_OBJECT FileObject);

_Must_inspect_result_
_IRQL_requires_max_(DISPATCH_LEVEL)
NTSTATUS
FLTAPI
FltSetIoPriorityHintIntoFileObject(
    _In_ PFILE_OBJECT FileObject,
    _In_ IO_PRIORITY_HINT PriorityHint);

_IRQL_requires_max_(DISPATCH_LEVEL)
IO_PRIORITY_HINT
FLTAPI
FltGetIoPriorityHintFromThread(
    _In_ PETHREAD Thread);

_IRQL_requires_max_(DISPATCH_LEVEL)
NTSTATUS
FLTAPI
FltSetIoPriorityHintIntoThread(
    _In_ PETHREAD Thread,
    _In_ IO_PRIORITY_HINT PriorityHint);

#endif /* FLT_MGR_LONGHORN */

#if FLT_MGR_WIN7

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltAllocateCallbackDataEx(
    _In_ PFLT_INSTANCE Instance,
    _In_opt_ PFILE_OBJECT FileObject,
    _In_ FLT_ALLOCATE_CALLBACK_DATA_FLAGS Flags,
    _Outptr_ PFLT_CALLBACK_DATA *RetNewCallbackData);

_Must_inspect_result_
_IRQL_requires_max_(DPC_LEVEL)
PVOID
FLTAPI
FltGetNewSystemBufferAddress(
    _In_ PFLT_CALLBACK_DATA CallbackData);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
FLT_PREOP_CALLBACK_STATUS
FLTAPI
FltCheckOplockEx(
    _In_ POPLOCK Oplock,
    _In_ PFLT_CALLBACK_DATA CallbackData,
    _In_ ULONG Flags,
    _In_opt_ PVOID Context,
    _In_opt_ PFLTOPLOCK_WAIT_COMPLETE_ROUTINE WaitCompletionRoutine,
    _In_opt_ PFLTOPLOCK_PREPOST_CALLBACKDATA_ROUTINE PrePostCallbackDataRoutine);

_IRQL_requires_max_(APC_LEVEL)
BOOLEAN
FLTAPI
FltCurrentOplock(
    _In_ POPLOCK Oplock);

_IRQL_requires_max_(APC_LEVEL)
BOOLEAN
FLTAPI
FltCurrentOplockH(
    _In_ POPLOCK Oplock);

_IRQL_requires_max_(APC_LEVEL)
FLT_PREOP_CALLBACK_STATUS
FLTAPI
FltOplockBreakH(
    _In_ POPLOCK Oplock,
    _In_ PFLT_CALLBACK_DATA CallbackData,
    _In_ ULONG Flags,
    _In_opt_ PVOID Context,
    _In_opt_ PFLTOPLOCK_WAIT_COMPLETE_ROUTINE WaitCompletionRoutine,
    _In_opt_ PFLTOPLOCK_PREPOST_CALLBACKDATA_ROUTINE PrePostCallbackDataRoutine);

_IRQL_requires_max_(APC_LEVEL)
FLT_PREOP_CALLBACK_STATUS
FLTAPI
FltOplockBreakToNone(
    _In_ POPLOCK Oplock,
    _In_ PFLT_CALLBACK_DATA CallbackData,
    _In_opt_ PVOID Context,
    _In_opt_ PFLTOPLOCK_WAIT_COMPLETE_ROUTINE WaitCompletionRoutine,
    _In_opt_ PFLTOPLOCK_PREPOST_CALLBACKDATA_ROUTINE PrePostCallbackDataRoutine);

_IRQL_requires_max_(APC_LEVEL)
FLT_PREOP_CALLBACK_STATUS
FLTAPI
FltOplockBreakToNoneEx(
    _In_ POPLOCK Oplock,
    _In_ PFLT_CALLBACK_DATA CallbackData,
    _In_ ULONG Flags,
    _In_opt_ PVOID Context,
    _In_opt_ PFLTOPLOCK_WAIT_COMPLETE_ROUTINE WaitCompletionRoutine,
    _In_opt_ PFLTOPLOCK_PREPOST_CALLBACKDATA_ROUTINE PrePostCallbackDataRoutine);

_IRQL_requires_max_(APC_LEVEL)
BOOLEAN
FLTAPI
FltOplockIsSharedRequest(
    _In_ PFLT_CALLBACK_DATA CallbackData);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
FLT_PREOP_CALLBACK_STATUS
FLTAPI
FltOplockFsctrlEx(
    _In_ POPLOCK Oplock,
    _In_ PFLT_CALLBACK_DATA CallbackData,
    _In_ ULONG OpenCount,
    _In_ ULONG Flags);

BOOLEAN
FLTAPI
FltOplockKeysEqual(
    _In_opt_ PFILE_OBJECT Fo1,
    _In_opt_ PFILE_OBJECT Fo2);

_Must_inspect_result_
_IRQL_requires_max_(APC_LEVEL)
NTSTATUS
FLTAPI
FltGetRequestorSessionId(
    _In_ PFLT_CALLBACK_DATA CallbackData,
    _Out_ PULONG SessionId);

_IRQL_requires_max_(DISPATCH_LEVEL)
NTSTATUS
FLTAPI
FltAdjustDeviceStackSizeForIoRedirection(
    _In_ PFLT_INSTANCE SourceInstance,
    _In_ PFLT_INSTANCE TargetInstance,
    _Out_opt_ PBOOLEAN SourceDeviceStackSizeModified);

_IRQL_requires_max_(DISPATCH_LEVEL)
NTSTATUS
FLTAPI
FltIsIoRedirectionAllowed(
    _In_ PFLT_INSTANCE SourceInstance,
    _In_ PFLT_INSTANCE TargetInstance,
    _Out_ PBOOLEAN RedirectionAllowed);

_IRQL_requires_max_(DISPATCH_LEVEL)
NTSTATUS
FLTAPI
FltIsIoRedirectionAllowedForOperation(
    _In_ PFLT_CALLBACK_DATA Data,
    _In_ PFLT_INSTANCE TargetInstance,
    _Out_ PBOOLEAN RedirectionAllowedThisIo,
    _Out_opt_ PBOOLEAN RedirectionAllowedAllIo);

#endif /* FLT_MGR_WIN7 */

#endif /* FLT_MGR_BASELINE */

#ifdef __cplusplus
} /* extern "C" */
#endif

#endif /* __FLTKERNEL__ */