21 #define SERVICES_KEY L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\" 22 #define MAX_KEY_LENGTH 0x200 72 DriverServiceName.
Length = 0;
81 return ZwLoadDriver(&DriverServiceName);
100 DriverServiceName.
Length = 0;
119 ULONG CallbackBufferSize;
120 ULONG FilterBufferSize;
352 CurrentEntry = CurrentEntry->
Flink;
491 if (InstBuffer ==
NULL)
536 if (AltBuffer ==
NULL)
552 AltitudeString->Length = BytesRequired;
553 AltitudeString->MaximumLength = BytesRequired;
554 AltitudeString->Buffer = AltBuffer;
FLT_RESOURCE_LIST_HEAD InstanceList
#define STATUS_FLT_DELETING_OBJECT
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
#define IRP_MJ_VOLUME_MOUNT
static NTSTATUS GetFilterAltitude(_In_ PFLT_FILTER Filter, _Inout_ PUNICODE_STRING AltitudeString)
struct _FLT_OPERATION_REGISTRATION FLT_OPERATION_REGISTRATION
NTSTATUS FltpStartingToDrainObject(_Inout_ PFLT_OBJECT Object)
NTSTATUS FltpRegisterContexts(_In_ PFLT_FILTER Filter, _In_ const FLT_CONTEXT_REGISTRATION *Context)
#define STATUS_INSUFFICIENT_RESOURCES
struct png_info_def **typedef void(__cdecl typeof(png_destroy_read_struct))(struct png_struct_def **
CONST FLT_OPERATION_REGISTRATION * OperationRegistration
#define OBJ_CASE_INSENSITIVE
NTSTATUS NTAPI FltStartFiltering(_In_ PFLT_FILTER Filter)
#define UNREFERENCED_PARAMETER(P)
#define STATUS_INVALID_PARAMETER
NTSYSAPI NTSTATUS NTAPI ZwClose(_In_ HANDLE Handle)
PFLT_NORMALIZE_CONTEXT_CLEANUP NormalizeContextCleanup
_Must_inspect_result_ _In_ PFSRTL_PER_STREAM_CONTEXT Ptr
VOID FLTAPI FltObjectDereference(_Inout_ PVOID Object)
NTSTATUS ExInitializeResourceLite(PULONG res)
NTSTATUS NTAPI ExDeleteResourceLite(IN PERESOURCE Resource)
PFLT_INSTANCE_TEARDOWN_CALLBACK InstanceTeardownStartCallback
PFLT_INSTANCE_SETUP_CALLBACK InstanceSetupCallback
PFLT_INSTANCE_TEARDOWN_CALLBACK InstanceTeardownStart
PFLT_NORMALIZE_NAME_COMPONENT NormalizeNameComponentCallback
#define OBJ_KERNEL_HANDLE
FLT_MUTEX_LIST_HEAD ActiveOpens
#define FLT_MAJOR_VERSION
void __cdecl __debugbreak(void)
PFLT_FILTER_UNLOAD_CALLBACK OldDriverUnload
NTSYSAPI VOID NTAPI RtlCopyUnicodeString(PUNICODE_STRING DestinationString, PUNICODE_STRING SourceString)
_Must_inspect_result_ _In_ CONST FLT_REGISTRATION _Outptr_ PFLT_FILTER * RetFilter
#define STATUS_BUFFER_TOO_SMALL
DRIVER_UNLOAD * PDRIVER_UNLOAD
return STATUS_NOT_IMPLEMENTED
PFLT_NORMALIZE_CONTEXT_CLEANUP NormalizeContextCleanupCallback
NTSTATUS(* NTAPI)(IN PFILE_FULL_EA_INFORMATION EaBuffer, IN ULONG EaLength, OUT PULONG ErrorOffset)
#define FM_TAG_UNICODE_STRING
EX_RUNDOWN_REF RundownRef
_Must_inspect_result_ _In_opt_ PFLT_FILTER Filter
PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK InstanceQueryTeardownCallback
PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK InstanceQueryTeardown
PDRIVER_OBJECT DriverObject
NTSYSAPI NTSTATUS NTAPI ZwUnloadDriver(_In_ PUNICODE_STRING DriverServiceName)
VOID FLTAPI FltUnregisterFilter(_In_ PFLT_FILTER Filter)
NTSTATUS FltpReadRegistryValue(_In_ HANDLE KeyHandle, _In_ PUNICODE_STRING ValueName, _In_opt_ ULONG Type, _Out_writes_bytes_(BufferSize) PVOID Buffer, _In_ ULONG BufferSize, _Out_opt_ PULONG BytesRequired)
PFLT_INSTANCE_SETUP_CALLBACK InstanceSetup
PFLT_MESSAGE_WAITER_QUEUE CONTAINING_RECORD(Csq, DEVICE_EXTENSION, IrpQueue)) -> WaiterQ.mLock) _IRQL_raises_(DISPATCH_LEVEL) VOID NTAPI FltpAcquireMessageWaiterLock(_In_ PIO_CSQ Csq, _Out_ PKIRQL Irql)
_Must_inspect_result_ _In_ PDRIVER_OBJECT DriverObject
_Must_inspect_result_ _Inout_ PFLT_VOLUME _In_ PCUNICODE_STRING Altitude
struct _LIST_ENTRY * Flink
PFLT_GENERATE_FILE_NAME GenerateFileNameCallback
const struct winhelp_callbacks Callbacks
NTSTATUS FltpOpenFilterServicesKey(_In_ PFLT_FILTER Filter, _In_ ACCESS_MASK DesiredAccess, _In_opt_ PUNICODE_STRING SubKey, _Out_ PHANDLE Handle)
#define NT_SUCCESS(StatCode)
_Must_inspect_result_ _In_ CONST FLT_REGISTRATION * Registration
struct _FLT_OPERATION_REGISTRATION * PFLT_OPERATION_REGISTRATION
FORCEINLINE VOID ExInitializeFastMutex(_Out_ PFAST_MUTEX FastMutex)
PFLT_FILTER_UNLOAD_CALLBACK FilterUnloadCallback
NTSTATUS FltpAttachFrame(_In_ PUNICODE_STRING Altitude, _Inout_ PFLTP_FRAME *Frame)
PFLT_OPERATION_REGISTRATION Operations
VOID FASTCALL ExReleaseResourceLite(IN PERESOURCE Resource)
#define ExAllocatePoolWithTag(hernya, size, tag)
VOID FltpExInitializeRundownProtection(_Out_ PEX_RUNDOWN_REF RundownRef)
#define KeEnterCriticalRegion()
PFLT_INSTANCE_TEARDOWN_CALLBACK InstanceTeardownCompleteCallback
NTSTATUS(FLTAPI * PFLT_FILTER_UNLOAD_CALLBACK)(FLT_FILTER_UNLOAD_FLAGS Flags)
volatile FLT_OBJECT_FLAGS Flags
_Must_inspect_result_ _In_ WDFCOLLECTION _In_ WDFOBJECT Object
PFLT_FILTER_UNLOAD_CALLBACK FilterUnload
VOID FltpMiniFilterDriverUnload()
#define KeLeaveCriticalRegion()
NTSTATUS NTAPI FltGetFilterFromName(_In_ PCUNICODE_STRING FilterName, _Out_ PFLT_FILTER *RetFilter)
PFLT_NORMALIZE_NAME_COMPONENT NormalizeNameComponent
BOOLEAN FltpExRundownCompleted(_Inout_ PEX_RUNDOWN_REF RundownRef)
NTSTATUS FLTAPI FltObjectReference(_Inout_ PVOID Object)
#define InitializeListHead(ListHead)
NTSYSAPI NTSTATUS NTAPI RtlAppendUnicodeStringToString(PUNICODE_STRING Destination, PUNICODE_STRING Source)
static NTSTATUS GetFilterFrame(_In_ PFLT_FILTER Filter, _In_ PUNICODE_STRING Altitude, _Out_ PFLTP_FRAME *Frame)
NTSTATUS NTAPI FltpObjectRundownWait(_Inout_ PEX_RUNDOWN_REF RundownRef)
BOOLEAN NTAPI ExAcquireResourceSharedLite(IN PERESOURCE Resource, IN BOOLEAN Wait)
CONST FLT_CONTEXT_REGISTRATION * ContextRegistration
NTSTATUS NTAPI FltRegisterFilter(_In_ PDRIVER_OBJECT DriverObject, _In_ const FLT_REGISTRATION *Registration, _Out_ PFLT_FILTER *RetFilter)
FLT_MUTEX_LIST_HEAD PortList
NTSYSAPI VOID NTAPI RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString)
#define RtlZeroMemory(Destination, Length)
#define InitializeObjectAttributes(p, n, a, r, s)
#define RtlCopyMemory(Destination, Source, Length)
#define ExFreePoolWithTag(_P, _T)
#define FLTFL_REGISTRATION_DO_NOT_SUPPORT_SERVICE_STOP
PFLT_GENERATE_FILE_NAME GenerateFileName
PFLT_INSTANCE_TEARDOWN_CALLBACK InstanceTeardownComplete
UNICODE_STRING DefaultAltitude
struct _FLT_FILTER FLT_FILTER
NTSTATUS NTAPI FltUnloadFilter(_In_ PCUNICODE_STRING FilterName)
NTSTATUS NTAPI FltLoadFilter(_In_ PCUNICODE_STRING FilterName)
FLT_MUTEX_LIST_HEAD ConnectionList
#define IRP_MJ_OPERATION_END
#define RTL_CONSTANT_STRING(s)