wmifuncs.h File Reference

Go to the source code of this file.

Macros
#define	TRACE_INFORMATION_CLASS_DEFINE

Functions
	_IRQL_requires_max_ (APC_LEVEL) NTKERNELAPI NTSTATUS NTAPI WmiQueryTraceInformation(_In_ TRACE_INFORMATION_CLASS TraceInformationClass
	_Out_writes_bytes_ (TraceInformationLength) PVOID TraceInformation
	_IRQL_requires_max_ (PASSIVE_LEVEL) NTSTATUS NTKERNELAPI NTAPI EtwRegister(_In_ LPCGUID ProviderId
	_IRQL_requires_max_ (HIGH_LEVEL) BOOLEAN NTKERNELAPI NTAPI EtwEventEnabled(_In_ REGHANDLE RegHandle
	_When_ (ControlCode==EVENT_ACTIVITY_CTRL_CREATE_ID, _IRQL_requires_max_(HIGH_LEVEL)) _When_(ControlCode!
	_Inout_updates_bytes_ (sizeof(GUID)) LPGUID ActivityId)
_In_ PCEVENT_DESCRIPTOR _In_opt_ LPCGUID _In_ ULONG	_In_reads_opt_ (UserDataCount) PEVENT_DATA_DESCRIPTOR UserData)

Variables
_In_ ULONG	TraceInformationLength
_In_ ULONG _Out_opt_ PULONG	RequiredLength
_In_ ULONG _Out_opt_ PULONG _In_opt_ PVOID	Buffer
_In_opt_ PETWENABLECALLBACK	EnableCallback
_In_opt_ PETWENABLECALLBACK _In_opt_ PVOID	CallbackContext
_In_opt_ PETWENABLECALLBACK _In_opt_ PVOID _Out_ PREGHANDLE	RegHandle
_In_ PCEVENT_DESCRIPTOR	EventDescriptor
_In_ UCHAR	Level
_In_ UCHAR _In_ ULONGLONG	Keyword
_In_ PCEVENT_DESCRIPTOR _In_opt_ LPCGUID	ActivityId
_In_ PCEVENT_DESCRIPTOR _In_opt_ LPCGUID _In_ ULONG	UserDataCount
_In_ PCEVENT_DESCRIPTOR _In_opt_ LPCGUID _In_opt_ LPCGUID	RelatedActivityId
_In_ UCHAR _In_ ULONGLONG _In_opt_ LPCGUID _In_ PCWSTR	String
_In_ PCEVENT_DESCRIPTOR _In_ ULONG64	Filter
_In_ PCEVENT_DESCRIPTOR _In_ ULONG64 _In_ ULONG	Flags

Macro Definition Documentation

TRACE_INFORMATION_CLASS_DEFINE

#define TRACE_INFORMATION_CLASS_DEFINE

Definition at line 64 of file wmifuncs.h.

Function Documentation

_In_reads_opt_()

_In_ PCEVENT_DESCRIPTOR _In_ ULONG64 _In_ ULONG _In_opt_ LPCGUID _In_opt_ LPCGUID _In_ ULONG _In_reads_opt_

(

UserDataCount

)

_Inout_updates_bytes_()

_Inout_updates_bytes_

(

sizeof(GUID)

)

_IRQL_requires_max_() [1/3]

_IRQL_requires_max_

(

APC_LEVEL

)

_IRQL_requires_max_() [2/3]

_IRQL_requires_max_

(

PASSIVE_LEVEL

)

Definition at line 64 of file Messaging.c.

{
    PFLT_SERVER_PORT_OBJECT PortObject;
    NTSTATUS Status;

    /* The caller must allow at least one connection */
    if (MaxConnections == 0)
    {
        return STATUS_INVALID_PARAMETER;
    }

    /* The request must be for a kernel handle */
    if (!(ObjectAttributes->Attributes & OBJ_KERNEL_HANDLE))
    {
        return STATUS_INVALID_PARAMETER;
    }

    /*
     * Get rundown protection on the target to stop the owner
     * from unloading whilst this port object is open. It gets
     * removed in the FltpServerPortClose callback
     */
    Status = FltObjectReference(Filter);
    if (!NT_SUCCESS(Status))
    {
        return Status;
    }

    /* Create the server port object for this filter */
    Status = ObCreateObject(KernelMode,
                            ServerPortObjectType,
                            ObjectAttributes,
                            KernelMode,
                            NULL,
                            sizeof(FLT_SERVER_PORT_OBJECT),
                            0,
                            0,
                            (PVOID *)&PortObject);
    if (NT_SUCCESS(Status))
    {
        /* Zero out the struct */
        RtlZeroMemory(PortObject, sizeof(FLT_SERVER_PORT_OBJECT));

        /* Increment the ref count on the target filter */
        FltpObjectPointerReference((PFLT_OBJECT)Filter);

        /* Setup the filter port object */
        PortObject->Filter = Filter;
        PortObject->ConnectNotify = ConnectNotifyCallback;
        PortObject->DisconnectNotify = DisconnectNotifyCallback;
        PortObject->MessageNotify = MessageNotifyCallback;
        PortObject->Cookie = ServerPortCookie;
        PortObject->MaxConnections = MaxConnections;

        /* Insert the object */
        Status = ObInsertObject(PortObject,
                                NULL,
                                STANDARD_RIGHTS_ALL | FILE_READ_DATA,
                                0,
                                NULL,
                                (PHANDLE)ServerPort);
        if (NT_SUCCESS(Status))
        {
            /* Lock the connection list */
            ExAcquireFastMutex(&Filter->ConnectionList.mLock);

            /* Add the new port object to the connection list and increment the count */
            InsertTailList(&Filter->ConnectionList.mList, &PortObject->FilterLink);
            Filter->ConnectionList.mCount++;

            /* Unlock the connection list*/
            ExReleaseFastMutex(&Filter->ConnectionList.mLock);
        }
    }

    if (!NT_SUCCESS(Status))
    {
        /* Allow the filter to be cleaned up */
        FltObjectDereference(Filter);
    }

    return Status;
}

_IRQL_requires_max_() [3/3]

_IRQL_requires_max_

(

HIGH_LEVEL

)

Definition at line 68 of file ke.h.

{
    return (KIRQL)__readcr8();
}

_Out_writes_bytes_()

_Out_writes_bytes_

(

TraceInformationLength

)

_When_()

_When_	(	ControlCode	= =EVENT_ACTIVITY_CTRL_CREATE_ID,
		_IRQL_requires_max_(HIGH_LEVEL)
	)

Variable Documentation

ActivityId

_In_ PCEVENT_DESCRIPTOR _In_ ULONG64 _In_ ULONG _In_opt_ LPCGUID ActivityId

Definition at line 119 of file wmifuncs.h.

Referenced by STRUCT().

Buffer

_In_ ULONG _Out_opt_ PULONG _In_opt_ PVOID Buffer

Definition at line 29 of file wmifuncs.h.

CallbackContext

_In_opt_ PETWENABLECALLBACK _In_opt_ PVOID CallbackContext

Definition at line 76 of file wmifuncs.h.

EnableCallback

_In_opt_ PETWENABLECALLBACK EnableCallback

Definition at line 76 of file wmifuncs.h.

EventDescriptor

_In_ PCEVENT_DESCRIPTOR EventDescriptor

Definition at line 93 of file wmifuncs.h.

Referenced by EventDescCreate(), EventDescGetChannel(), EventDescGetId(), EventDescGetKeyword(), EventDescGetLevel(), EventDescGetOpcode(), EventDescGetTask(), EventDescGetVersion(), EventDescOrKeyword(), EventDescSetChannel(), EventDescSetId(), EventDescSetKeyword(), EventDescSetLevel(), EventDescSetOpcode(), EventDescSetTask(), EventDescSetVersion(), and EventDescZero().

Filter

_In_ PCEVENT_DESCRIPTOR _In_ ULONG64 Filter

Definition at line 156 of file wmifuncs.h.

Flags

_In_ PCEVENT_DESCRIPTOR _In_ ULONG64 _In_ ULONG Flags

Definition at line 156 of file wmifuncs.h.

Keyword

_In_ UCHAR _In_ ULONGLONG Keyword

Definition at line 101 of file wmifuncs.h.

Level

_In_ UCHAR Level

Definition at line 101 of file wmifuncs.h.

RegHandle

_In_opt_ PETWENABLECALLBACK _In_opt_ PVOID _Out_ PREGHANDLE RegHandle

Definition at line 76 of file wmifuncs.h.

Referenced by GetLongestChildKeyName(), GetNthChildKeyName(), KeI386VdmInitialize(), OpenChildKeyRead(), OpenRegistryKey(), QueryRegistryValue(), QueryRegistryValueString(), QueryRegistryValueStringMulti(), ReadStringFromRegistry(), and test_SetupDiInstallClassExA().

RelatedActivityId

_In_ PCEVENT_DESCRIPTOR _In_ ULONG64 _In_ ULONG _In_opt_ LPCGUID _In_opt_ LPCGUID RelatedActivityId

Definition at line 130 of file wmifuncs.h.

RequiredLength

_In_ ULONG _Out_opt_ PULONG RequiredLength

Definition at line 29 of file wmifuncs.h.

Referenced by AcpiExInsertIntoField(), AcpiNsExternalizeName(), AcpiUtInitializeBuffer(), ExpQueryModuleInformation(), Ext2QueryVolumeInformation(), FFSQueryVolumeInformation(), ImageGetCertificateData(), IntCopyRegistryKey(), IopActionInterrogateDeviceStack(), IopDetectResourceConflict(), IopDoNameTransmogrify(), IoReportDetectedDevice(), LsarEnumerateAccounts(), LsarpEnumeratePrivileges(), NtAdjustPrivilegesToken(), NtQueryInformationAtom(), NtQueryInformationJobObject(), NtQueryInformationToken(), NtSetInformationJobObject(), RegOpenUserClassesRoot(), RfsdQueryVolumeInformation(), RtlpCallQueryRegistryRoutine(), SamrEnumerateAliasesInDomain(), SamrEnumerateDomainsInSamServer(), SamrEnumerateGroupsInDomain(), SamrEnumerateUsersInDomain(), SeCaptureSidAndAttributesArray(), and SeQueryInformationToken().

String

_In_ UCHAR _In_ ULONGLONG _In_opt_ LPCGUID _In_ PCWSTR String

Definition at line 142 of file wmifuncs.h.

TraceInformationLength

_In_ ULONG TraceInformationLength

Definition at line 29 of file wmifuncs.h.

UserDataCount

_In_ PCEVENT_DESCRIPTOR _In_ ULONG64 _In_ ULONG _In_opt_ LPCGUID _In_opt_ LPCGUID _In_ ULONG UserDataCount

Definition at line 119 of file wmifuncs.h.