ReactOS 0.4.15-dev-8131-g4988de4
Filter.c File Reference
#include "fltmgr.h"
#include "fltmgrint.h"
#include "Registry.h"
#include <debug.h>
Include dependency graph for Filter.c:

Go to the source code of this file.

Macros

#define NDEBUG
 
#define SERVICES_KEY   L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\"
 
#define MAX_KEY_LENGTH   0x200
 

Functions

NTSTATUS FltpStartingToDrainObject (_Inout_ PFLT_OBJECT Object)
 
VOID FltpMiniFilterDriverUnload ()
 
NTSTATUS FltpAttachFrame (_In_ PUNICODE_STRING Altitude, _Inout_ PFLTP_FRAME *Frame)
 
static NTSTATUS GetFilterAltitude (_In_ PFLT_FILTER Filter, _Inout_ PUNICODE_STRING AltitudeString)
 
static NTSTATUS GetFilterFrame (_In_ PFLT_FILTER Filter, _In_ PUNICODE_STRING Altitude, _Out_ PFLTP_FRAME *Frame)
 
NTSTATUS NTAPI FltLoadFilter (_In_ PCUNICODE_STRING FilterName)
 
NTSTATUS NTAPI FltUnloadFilter (_In_ PCUNICODE_STRING FilterName)
 
NTSTATUS NTAPI FltRegisterFilter (_In_ PDRIVER_OBJECT DriverObject, _In_ const FLT_REGISTRATION *Registration, _Out_ PFLT_FILTER *RetFilter)
 
VOID FLTAPI FltUnregisterFilter (_In_ PFLT_FILTER Filter)
 
NTSTATUS NTAPI FltStartFiltering (_In_ PFLT_FILTER Filter)
 
NTSTATUS NTAPI FltGetFilterFromName (_In_ PCUNICODE_STRING FilterName, _Out_ PFLT_FILTER *RetFilter)
 

Variables

LIST_ENTRY FilterList
 
ERESOURCE FilterListLock
 

Macro Definition Documentation

◆ MAX_KEY_LENGTH

#define MAX_KEY_LENGTH   0x200

Definition at line 22 of file Filter.c.

◆ NDEBUG

#define NDEBUG

Definition at line 15 of file Filter.c.

◆ SERVICES_KEY

#define SERVICES_KEY   L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\"

Definition at line 21 of file Filter.c.

Function Documentation

◆ FltGetFilterFromName()

NTSTATUS NTAPI FltGetFilterFromName ( _In_ PCUNICODE_STRING  FilterName,
_Out_ PFLT_FILTER RetFilter 
)

Definition at line 403 of file Filter.c.

405{
407 UNREFERENCED_PARAMETER(FilterName);
408 *RetFilter = NULL;
410}
#define UNIMPLEMENTED
Definition: debug.h:118
#define NULL
Definition: types.h:112
_Must_inspect_result_ _In_ CONST FLT_REGISTRATION _Outptr_ PFLT_FILTER * RetFilter
Definition: fltkernel.h:992
#define UNREFERENCED_PARAMETER(P)
Definition: ntbasedef.h:317
#define STATUS_NOT_IMPLEMENTED
Definition: ntstatus.h:239

◆ FltLoadFilter()

NTSTATUS NTAPI FltLoadFilter ( _In_ PCUNICODE_STRING  FilterName)

Definition at line 62 of file Filter.c.

63{
64 UNICODE_STRING DriverServiceName;
65 UNICODE_STRING ServicesKey;
67
68 /* Setup the base services key */
70
71 /* Initialize the string data */
72 DriverServiceName.Length = 0;
73 DriverServiceName.Buffer = (PWCH)Buffer;
74 DriverServiceName.MaximumLength = MAX_KEY_LENGTH;
75
76 /* Create the full service key for this filter */
77 RtlCopyUnicodeString(&DriverServiceName, &ServicesKey);
78 RtlAppendUnicodeStringToString(&DriverServiceName, FilterName);
79
80 /* Ask the kernel to load it for us */
81 return ZwLoadDriver(&DriverServiceName);
82}
#define SERVICES_KEY
Definition: Filter.c:21
#define MAX_KEY_LENGTH
Definition: Filter.c:22
Definition: bufpool.h:45
NTSYSAPI VOID NTAPI RtlCopyUnicodeString(PUNICODE_STRING DestinationString, PUNICODE_STRING SourceString)
NTSYSAPI NTSTATUS NTAPI RtlAppendUnicodeStringToString(PUNICODE_STRING Destination, PUNICODE_STRING Source)
NTSYSAPI VOID NTAPI RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString)
WCHAR * PWCH
Definition: ntbasedef.h:410
USHORT MaximumLength
Definition: env_spec_w32.h:370
char CHAR
Definition: xmlstorage.h:175

Referenced by HandleLoadUnloadIoctl().

◆ FltpAttachFrame()

NTSTATUS FltpAttachFrame ( _In_ PUNICODE_STRING  Altitude,
_Inout_ PFLTP_FRAME Frame 
)

Definition at line 439 of file Filter.c.

442{
445 *Frame = NULL;
446 return STATUS_SUCCESS;
447}
_Must_inspect_result_ _Inout_ PFLT_VOLUME _In_ PCUNICODE_STRING Altitude
Definition: fltkernel.h:1173
#define STATUS_SUCCESS
Definition: shellext.h:65

Referenced by FltRegisterFilter().

◆ FltpMiniFilterDriverUnload()

VOID FltpMiniFilterDriverUnload ( )

Definition at line 432 of file Filter.c.

433{
434 __debugbreak();
435}
void __cdecl __debugbreak(void)
Definition: intrin_ppc.h:698

Referenced by FltRegisterFilter().

◆ FltpStartingToDrainObject()

NTSTATUS FltpStartingToDrainObject ( _Inout_ PFLT_OBJECT  Object)

Definition at line 416 of file Filter.c.

417{
418 /*
419 * Set the draining flag for the filter. This let's us force
420 * a post op callback for minifilters currently awaiting one.
421 */
422 if (InterlockedOr((PLONG)&Object->Flags, FLT_OBFL_DRAINING) & 1)
423 {
424 /* We've been called once, we're already being deleted */
426 }
427
428 return STATUS_SUCCESS;
429}
@ FLT_OBFL_DRAINING
Definition: fltmgrint.h:10
#define InterlockedOr
Definition: interlocked.h:224
#define STATUS_FLT_DELETING_OBJECT
Definition: ntstatus.h:1432
int32_t * PLONG
Definition: typedefs.h:58
_Must_inspect_result_ _In_ WDFCOLLECTION _In_ WDFOBJECT Object

Referenced by FltUnregisterFilter().

◆ FltRegisterFilter()

NTSTATUS NTAPI FltRegisterFilter ( _In_ PDRIVER_OBJECT  DriverObject,
_In_ const FLT_REGISTRATION Registration,
_Out_ PFLT_FILTER RetFilter 
)

Definition at line 112 of file Filter.c.

115{
118 PFLTP_FRAME Frame;
119 ULONG CallbackBufferSize;
120 ULONG FilterBufferSize;
121 ULONG Count = 0;
122 PCHAR Ptr;
124
125 *RetFilter = NULL;
126
127 /* Make sure we're targeting the correct major revision */
128 if ((Registration->Version & 0xFF00) != FLT_MAJOR_VERSION)
129 {
131 }
132
133 /* Make sure our namespace callbacks are valid */
136 {
138 }
139
140 /* Count the number of operations that were requested */
143 {
144 Count++;
145
146 /* Bail when we find the last one */
147 if (Callbacks->MajorFunction == IRP_MJ_OPERATION_END)
148 break;
149
150 /* Move to the next item */
151 Callbacks++;
152 }
153
154 /* Calculate the buffer sizes */
155 CallbackBufferSize = Count * sizeof(FLT_OPERATION_REGISTRATION);
156 FilterBufferSize = sizeof(FLT_FILTER) +
157 CallbackBufferSize +
158 DriverObject->DriverExtension->ServiceKeyName.Length;
159
160 /* Allocate a buffer to hold our filter data */
162 FilterBufferSize,
165 RtlZeroMemory(Filter, FilterBufferSize);
166
167 /* Find the end of the fixed struct */
168 Ptr = (PCHAR)(Filter + 1);
169
170 /* Store a copy of the driver object of this filter */
172
173 /* Initialize the base object data */
178
179 /* Set the callback addresses */
188
189 /* Initialize the instance list */
193
197
201
202 /* Initialize the usermode port list */
206
207 /* We got this far, assume success from here */
209
210 /* Check if the caller requested any context data */
212 {
213 /* Register the contexts for this filter */
215 if (NT_SUCCESS(Status))
216 {
217 goto Quit;
218 }
219 }
220
221 /* Check if the caller is registering any callbacks */
223 {
224 /* The callback data comes after the fixed struct */
226 Ptr += (Count * sizeof(FLT_OPERATION_REGISTRATION));
227
228 /* Tag the operation data onto the end of the filter data */
230
231 /* walk through the requested callbacks */
233 Callbacks->MajorFunction != IRP_MJ_OPERATION_END;
234 Callbacks++)
235 {
236 // http://fsfilters.blogspot.co.uk/2011/03/how-file-system-filters-attach-to_17.html
237 /* Check if this is an attach to a volume */
238 if (Callbacks->MajorFunction == IRP_MJ_VOLUME_MOUNT)
239 {
240 Filter->PreVolumeMount = Callbacks->PreOperation;
241 Filter->PostVolumeMount = Callbacks->PostOperation;
242 }
243 else if (Callbacks->MajorFunction == IRP_MJ_SHUTDOWN)
244 {
245 Callbacks->PostOperation = NULL;
246 }
247 }
248 }
249
250 /* Add the filter name buffer onto the end of the data and fill in the string */
251 Filter->Name.Length = 0;
252 Filter->Name.MaximumLength = DriverObject->DriverExtension->ServiceKeyName.Length;
254 RtlCopyUnicodeString(&Filter->Name, &DriverObject->DriverExtension->ServiceKeyName);
255
256 /* Lookup the altitude of the mini-filter */
258 if (!NT_SUCCESS(Status))
259 {
260 goto Quit;
261 }
262
263 /* Lookup the filter frame */
266 {
267 /* Store the frame this mini-filter's main struct */
268 Filter->Frame = Frame;
269
271 }
272
273 if (!NT_SUCCESS(Status))
274 {
275 goto Quit;
276 }
277
278 //
279 // - Slot the filter into the correct altitude location
280 // - More stuff??
281 //
282
283 /* Store any existing driver unload routine before we make any changes */
285
286 /* Check we opted not to have an unload routine, or if we want to stop the driver from being unloaded */
288 {
290 }
291 else
292 {
293 DriverObject->DriverUnload = (PDRIVER_UNLOAD)NULL;
294 }
295
296
297Quit:
298
299 if (NT_SUCCESS(Status))
300 {
301 DPRINT1("Loaded FS mini-filter %wZ\n", &DriverObject->DriverExtension->ServiceKeyName);
302 *RetFilter = Filter;
303 }
304 else
305 {
306 DPRINT1("Failed to load FS mini-filter %wZ : 0x%X\n", &DriverObject->DriverExtension->ServiceKeyName, Status);
307
308 // Add cleanup for context resources
309
312 }
313
314 return Status;
315}
NTSTATUS FltpRegisterContexts(_In_ PFLT_FILTER Filter, _In_ const FLT_CONTEXT_REGISTRATION *Context)
Definition: Context.c:43
static NTSTATUS GetFilterAltitude(_In_ PFLT_FILTER Filter, _Inout_ PUNICODE_STRING AltitudeString)
Definition: Filter.c:453
static NTSTATUS GetFilterFrame(_In_ PFLT_FILTER Filter, _In_ PUNICODE_STRING Altitude, _Out_ PFLTP_FRAME *Frame)
Definition: Filter.c:584
NTSTATUS FltpAttachFrame(_In_ PUNICODE_STRING Altitude, _Inout_ PFLTP_FRAME *Frame)
Definition: Filter.c:439
VOID FltpMiniFilterDriverUnload()
Definition: Filter.c:432
NTSTATUS FLTAPI FltObjectReference(_Inout_ PVOID Object)
Definition: Object.c:41
LONG NTSTATUS
Definition: precomp.h:26
#define DPRINT1
Definition: precomp.h:8
const struct winhelp_callbacks Callbacks
Definition: callback.c:161
while(CdLookupNextInitialFileDirent(IrpContext, Fcb, FileContext))
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
#define ExAllocatePoolWithTag(hernya, size, tag)
Definition: env_spec_w32.h:350
NTSTATUS ExInitializeResourceLite(PULONG res)
Definition: env_spec_w32.h:641
#define ExDeleteResourceLite(res)
Definition: env_spec_w32.h:647
#define NonPagedPool
Definition: env_spec_w32.h:307
#define InitializeListHead(ListHead)
Definition: env_spec_w32.h:944
#define FlagOn(_F, _SF)
Definition: ext2fs.h:179
_Must_inspect_result_ _In_ CONST FLT_REGISTRATION * Registration
Definition: fltkernel.h:991
struct _FLT_OPERATION_REGISTRATION FLT_OPERATION_REGISTRATION
_Must_inspect_result_ _In_opt_ PFLT_FILTER Filter
Definition: fltkernel.h:1801
#define IRP_MJ_VOLUME_MOUNT
Definition: fltkernel.h:77
#define FLTFL_REGISTRATION_DO_NOT_SUPPORT_SERVICE_STOP
Definition: fltkernel.h:725
struct _FLT_OPERATION_REGISTRATION * PFLT_OPERATION_REGISTRATION
#define IRP_MJ_OPERATION_END
Definition: fltkernel.h:79
NTSTATUS(FLTAPI * PFLT_FILTER_UNLOAD_CALLBACK)(FLT_FILTER_UNLOAD_FLAGS Flags)
Definition: fltkernel.h:654
#define FM_TAG_FILTER
Definition: fltmgr.h:21
VOID FltpExInitializeRundownProtection(_Out_ PEX_RUNDOWN_REF RundownRef)
Definition: Object.c:212
#define FLT_MAJOR_VERSION
Definition: fltmgr.h:14
@ FLT_OBFL_TYPE_FILTER
Definition: fltmgrint.h:13
struct _FLT_FILTER FLT_FILTER
_Must_inspect_result_ _In_ PFSRTL_PER_STREAM_CONTEXT Ptr
Definition: fsrtlfuncs.h:898
Status
Definition: gdiplustypes.h:25
if(dx< 0)
Definition: linetemp.h:194
#define PCHAR
Definition: match.c:90
#define ExFreePoolWithTag(_P, _T)
Definition: module.h:1109
int Count
Definition: noreturn.cpp:7
#define STATUS_NOT_FOUND
Definition: shellext.h:72
PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK InstanceQueryTeardown
Definition: fltmgrint.h:108
FLT_MUTEX_LIST_HEAD PortList
Definition: fltmgrint.h:122
FLT_RESOURCE_LIST_HEAD InstanceList
Definition: fltmgrint.h:104
PFLT_GENERATE_FILE_NAME GenerateFileName
Definition: fltmgrint.h:115
FLT_OBJECT Base
Definition: fltmgrint.h:98
FLT_MUTEX_LIST_HEAD ConnectionList
Definition: fltmgrint.h:121
PFLT_FILTER_UNLOAD_CALLBACK OldDriverUnload
Definition: fltmgrint.h:119
PFLT_FILTER_UNLOAD_CALLBACK FilterUnload
Definition: fltmgrint.h:106
FLT_FILTER_FLAGS Flags
Definition: fltmgrint.h:102
PFLTP_FRAME Frame
Definition: fltmgrint.h:99
PFLT_NORMALIZE_CONTEXT_CLEANUP NormalizeContextCleanup
Definition: fltmgrint.h:117
PFLT_INSTANCE_SETUP_CALLBACK InstanceSetup
Definition: fltmgrint.h:107
PFLT_INSTANCE_TEARDOWN_CALLBACK InstanceTeardownComplete
Definition: fltmgrint.h:110
PDRIVER_OBJECT DriverObject
Definition: fltmgrint.h:103
PFLT_INSTANCE_TEARDOWN_CALLBACK InstanceTeardownStart
Definition: fltmgrint.h:109
PFLT_OPERATION_REGISTRATION Operations
Definition: fltmgrint.h:118
PVOID PreVolumeMount
Definition: fltmgrint.h:113
UNICODE_STRING Name
Definition: fltmgrint.h:100
PFLT_NORMALIZE_NAME_COMPONENT NormalizeNameComponent
Definition: fltmgrint.h:116
FLT_MUTEX_LIST_HEAD ActiveOpens
Definition: fltmgrint.h:120
UNICODE_STRING DefaultAltitude
Definition: fltmgrint.h:101
PVOID PostVolumeMount
Definition: fltmgrint.h:114
LIST_ENTRY mList
Definition: fltmgrint.h:56
FAST_MUTEX mLock
Definition: fltmgrint.h:55
EX_RUNDOWN_REF RundownRef
Definition: fltmgrint.h:29
ULONG PointerCount
Definition: fltmgrint.h:28
volatile FLT_OBJECT_FLAGS Flags
Definition: fltmgrint.h:27
PFLT_INSTANCE_TEARDOWN_CALLBACK InstanceTeardownStartCallback
Definition: fltkernel.h:737
PFLT_NORMALIZE_NAME_COMPONENT NormalizeNameComponentCallback
Definition: fltkernel.h:740
PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK InstanceQueryTeardownCallback
Definition: fltkernel.h:736
PFLT_NORMALIZE_CONTEXT_CLEANUP NormalizeContextCleanupCallback
Definition: fltkernel.h:741
PFLT_GENERATE_FILE_NAME GenerateFileNameCallback
Definition: fltkernel.h:739
PFLT_INSTANCE_SETUP_CALLBACK InstanceSetupCallback
Definition: fltkernel.h:735
CONST FLT_CONTEXT_REGISTRATION * ContextRegistration
Definition: fltkernel.h:732
PFLT_INSTANCE_TEARDOWN_CALLBACK InstanceTeardownCompleteCallback
Definition: fltkernel.h:738
PFLT_FILTER_UNLOAD_CALLBACK FilterUnloadCallback
Definition: fltkernel.h:734
CONST FLT_OPERATION_REGISTRATION * OperationRegistration
Definition: fltkernel.h:733
#define RtlCopyMemory(Destination, Source, Length)
Definition: typedefs.h:263
#define RtlZeroMemory(Destination, Length)
Definition: typedefs.h:262
uint32_t ULONG
Definition: typedefs.h:59
char * PCHAR
Definition: typedefs.h:51
#define STATUS_INVALID_PARAMETER
Definition: udferr_usr.h:135
#define STATUS_INSUFFICIENT_RESOURCES
Definition: udferr_usr.h:158
_Must_inspect_result_ _In_ PDRIVER_OBJECT DriverObject
Definition: wdfdriver.h:213
FORCEINLINE VOID ExInitializeFastMutex(_Out_ PFAST_MUTEX FastMutex)
Definition: exfuncs.h:274
DRIVER_UNLOAD * PDRIVER_UNLOAD
Definition: iotypes.h:2253
#define IRP_MJ_SHUTDOWN

Referenced by DriverEntry(), and TestFltRegisterFilter().

◆ FltStartFiltering()

NTSTATUS NTAPI FltStartFiltering ( _In_ PFLT_FILTER  Filter)

Definition at line 377 of file Filter.c.

378{
380
381 /* Grab a ref to the filter */
383 if (NT_SUCCESS(Status))
384 {
385 /* Make sure we aren't already starting up */
387 {
388 // Startup
389 }
390 else
391 {
393 }
394
396 }
397
398 return Status;
399}
VOID FLTAPI FltObjectDereference(_Inout_ PVOID Object)
Definition: Object.c:53
@ FLTFL_FILTERING_INITIATED
Definition: fltmgrint.h:21

Referenced by DriverEntry().

◆ FltUnloadFilter()

NTSTATUS NTAPI FltUnloadFilter ( _In_ PCUNICODE_STRING  FilterName)

Definition at line 86 of file Filter.c.

87{
88 //
89 //FIXME: This is a temp hack, it needs properly implementing
90 //
91
92 UNICODE_STRING DriverServiceName;
93 UNICODE_STRING ServicesKey;
95
96 /* Setup the base services key */
98
99 /* Initialize the string data */
100 DriverServiceName.Length = 0;
101 DriverServiceName.Buffer = (PWCH)Buffer;
102 DriverServiceName.MaximumLength = MAX_KEY_LENGTH;
103
104 /* Create the full service key for this filter */
105 RtlCopyUnicodeString(&DriverServiceName, &ServicesKey);
106 RtlAppendUnicodeStringToString(&DriverServiceName, FilterName);
107 return ZwUnloadDriver(&DriverServiceName);
108}
NTSYSAPI NTSTATUS NTAPI ZwUnloadDriver(_In_ PUNICODE_STRING DriverServiceName)

Referenced by HandleLoadUnloadIoctl().

◆ FltUnregisterFilter()

VOID FLTAPI FltUnregisterFilter ( _In_ PFLT_FILTER  Filter)

Definition at line 319 of file Filter.c.

320{
322 PLIST_ENTRY CurrentEntry;
324
325 /* Set the draining flag */
327 if (!NT_SUCCESS(Status))
328 {
329 /* Someone already unregistered us, just remove our ref and bail */
331 return;
332 }
333
334 /* Lock the instance list */
337
338 /* Set the first entry in the list */
339 CurrentEntry = Filter->InstanceList.rList.Flink;
340
341 /* Free all instances referenced by the filter */
342 while (CurrentEntry != &Filter->InstanceList.rList)
343 {
344 /* Get the record pointer */
345 Instance = CONTAINING_RECORD(CurrentEntry, FLT_INSTANCE, FilterLink);
346
347 // FIXME: implement
348 (void)Instance;
349
350 /* Reset the pointer and move to next entry */
351 Instance = NULL;
352 CurrentEntry = CurrentEntry->Flink;
353 }
354
355 /* We're done with instances now */
358
359 /* Remove the reference from the base object */
361
362 /* Wait until we're sure nothing is using the filter */
364
365 /* Delete the instance list lock */
367
368 /* We're finished cleaning up now */
370
371 /* Hand the memory back */
373}
NTSTATUS FltpStartingToDrainObject(_Inout_ PFLT_OBJECT Object)
Definition: Filter.c:416
#define TRUE
Definition: types.h:120
#define ExAcquireResourceSharedLite(res, wait)
Definition: env_spec_w32.h:621
BOOLEAN FltpExRundownCompleted(_Inout_ PEX_RUNDOWN_REF RundownRef)
Definition: Object.c:231
NTSTATUS NTAPI FltpObjectRundownWait(_Inout_ PEX_RUNDOWN_REF RundownRef)
Definition: Object.c:238
#define KeLeaveCriticalRegion()
Definition: ke_x.h:119
#define KeEnterCriticalRegion()
Definition: ke_x.h:88
VOID FASTCALL ExReleaseResourceLite(IN PERESOURCE Resource)
Definition: resource.c:1822
Definition: typedefs.h:120
struct _LIST_ENTRY * Flink
Definition: typedefs.h:121
#define CONTAINING_RECORD(address, type, field)
Definition: typedefs.h:260
_Must_inspect_result_ _In_ WDFDEVICE _In_ PWDF_WMI_INSTANCE_CONFIG _In_opt_ PWDF_OBJECT_ATTRIBUTES _Out_opt_ WDFWMIINSTANCE * Instance
Definition: wdfwmi.h:481

Referenced by DriverEntry(), FilterUnload(), TestFltRegisterFilter(), and TestRegFilterUnload().

◆ GetFilterAltitude()

static NTSTATUS GetFilterAltitude ( _In_ PFLT_FILTER  Filter,
_Inout_ PUNICODE_STRING  AltitudeString 
)
static

Definition at line 453 of file Filter.c.

455{
456 UNICODE_STRING InstancesKey = RTL_CONSTANT_STRING(L"Instances");
457 UNICODE_STRING DefaultInstance = RTL_CONSTANT_STRING(L"DefaultInstance");
460 UNICODE_STRING FilterInstancePath;
461 ULONG BytesRequired;
462 HANDLE InstHandle = NULL;
463 HANDLE RootHandle;
464 PWCH InstBuffer = NULL;
465 PWCH AltBuffer = NULL;
467
468 /* Get a handle to the instances key in the filter's services key */
471 &InstancesKey,
472 &RootHandle);
473 if (!NT_SUCCESS(Status))
474 {
475 return Status;
476 }
477
478 /* Read the size 'default instances' string value */
479 Status = FltpReadRegistryValue(RootHandle,
480 &DefaultInstance,
481 REG_SZ,
482 NULL,
483 0,
484 &BytesRequired);
485
486 /* We should get a buffer too small error */
488 {
489 /* Allocate the buffer we need to hold the string */
490 InstBuffer = ExAllocatePoolWithTag(PagedPool, BytesRequired, FM_TAG_UNICODE_STRING);
491 if (InstBuffer == NULL)
492 {
494 goto Quit;
495 }
496
497 /* Now read the string value */
498 Status = FltpReadRegistryValue(RootHandle,
499 &DefaultInstance,
500 REG_SZ,
501 InstBuffer,
502 BytesRequired,
503 &BytesRequired);
504 }
505
506 if (!NT_SUCCESS(Status))
507 {
508 goto Quit;
509 }
510
511 /* Convert the string to a unicode_string */
512 RtlInitUnicodeString(&FilterInstancePath, InstBuffer);
513
514 /* Setup the attributes using the root key handle */
516 &FilterInstancePath,
518 RootHandle,
519 NULL);
520
521 /* Now open the key name which was stored in the default instance */
522 Status = ZwOpenKey(&InstHandle, KEY_QUERY_VALUE, &ObjectAttributes);
523 if (NT_SUCCESS(Status))
524 {
525 /* Get the size of the buffer that holds the altitude */
526 Status = FltpReadRegistryValue(InstHandle,
527 &Altitude,
528 REG_SZ,
529 NULL,
530 0,
531 &BytesRequired);
533 {
534 /* Allocate the required buffer */
535 AltBuffer = ExAllocatePoolWithTag(PagedPool, BytesRequired, FM_TAG_UNICODE_STRING);
536 if (AltBuffer == NULL)
537 {
539 goto Quit;
540 }
541
542 /* And now finally read in the actual altitude string */
543 Status = FltpReadRegistryValue(InstHandle,
544 &Altitude,
545 REG_SZ,
546 AltBuffer,
547 BytesRequired,
548 &BytesRequired);
549 if (NT_SUCCESS(Status))
550 {
551 /* We made it, setup the return buffer */
552 AltitudeString->Length = BytesRequired;
553 AltitudeString->MaximumLength = BytesRequired;
554 AltitudeString->Buffer = AltBuffer;
555 }
556 }
557 }
558
559Quit:
560 if (!NT_SUCCESS(Status))
561 {
562 if (AltBuffer)
563 {
565 }
566 }
567
568 if (InstBuffer)
569 {
571 }
572
573 if (InstHandle)
574 {
575 ZwClose(InstHandle);
576 }
577 ZwClose(RootHandle);
578
579 return Status;
580}
NTSTATUS FltpOpenFilterServicesKey(_In_ PFLT_FILTER Filter, _In_ ACCESS_MASK DesiredAccess, _In_opt_ PUNICODE_STRING SubKey, _Out_ PHANDLE Handle)
Definition: Registry.c:28
NTSTATUS FltpReadRegistryValue(_In_ HANDLE KeyHandle, _In_ PUNICODE_STRING ValueName, _In_opt_ ULONG Type, _Out_writes_bytes_(BufferSize) PVOID Buffer, _In_ ULONG BufferSize, _Out_opt_ PULONG BytesRequired)
Definition: Registry.c:67
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
Definition: conport.c:36
#define PagedPool
Definition: env_spec_w32.h:308
#define FM_TAG_UNICODE_STRING
Definition: fltmgr.h:20
#define OBJ_KERNEL_HANDLE
Definition: winternl.h:231
#define OBJ_CASE_INSENSITIVE
Definition: winternl.h:228
#define REG_SZ
Definition: layer.c:22
#define InitializeObjectAttributes(p, n, a, r, s)
Definition: reg.c:106
NTSYSAPI NTSTATUS NTAPI ZwClose(_In_ HANDLE Handle)
#define KEY_QUERY_VALUE
Definition: nt_native.h:1016
#define L(x)
Definition: ntvdm.h:50
#define STATUS_BUFFER_TOO_SMALL
Definition: shellext.h:69
#define RTL_CONSTANT_STRING(s)
Definition: tunneltest.c:14

Referenced by FltRegisterFilter().

◆ GetFilterFrame()

static NTSTATUS GetFilterFrame ( _In_ PFLT_FILTER  Filter,
_In_ PUNICODE_STRING  Altitude,
_Out_ PFLTP_FRAME Frame 
)
static

Definition at line 584 of file Filter.c.

587{
591
592 //
593 // Try to find a frame from our existing filter list (see FilterList)
594 // If none exists, create a new frame, add it and return it
595 //
596
597 *Frame = NULL;
598 return STATUS_SUCCESS;
599}

Referenced by FltRegisterFilter().

Variable Documentation

◆ FilterList

LIST_ENTRY FilterList

Definition at line 24 of file Filter.c.

◆ FilterListLock

ERESOURCE FilterListLock

Definition at line 25 of file Filter.c.

Referenced by CODE_SEG().