wmifuncs.h File Reference

Go to the source code of this file.

Macros
#define	TRACE_INFORMATION_CLASS_DEFINE

Functions
	_IRQL_requires_max_ (APC_LEVEL) NTKERNELAPI NTSTATUS NTAPI WmiQueryTraceInformation(_In_ TRACE_INFORMATION_CLASS TraceInformationClass
	_Out_writes_bytes_ (TraceInformationLength) PVOID TraceInformation
	_IRQL_requires_max_ (PASSIVE_LEVEL) NTSTATUS NTKERNELAPI NTAPI EtwRegister(_In_ LPCGUID ProviderId
	_IRQL_requires_max_ (HIGH_LEVEL) BOOLEAN NTKERNELAPI NTAPI EtwEventEnabled(_In_ REGHANDLE RegHandle
	_When_ (ControlCode==EVENT_ACTIVITY_CTRL_CREATE_ID, _IRQL_requires_max_(HIGH_LEVEL)) _When_(ControlCode!
	_Inout_updates_bytes_ (sizeof(GUID)) LPGUID ActivityId)
_In_ PCEVENT_DESCRIPTOR _In_opt_ LPCGUID _In_ ULONG	_In_reads_opt_ (UserDataCount) PEVENT_DATA_DESCRIPTOR UserData)

Variables
_In_ ULONG	TraceInformationLength
_In_ ULONG _Out_opt_ PULONG	RequiredLength
_In_ ULONG _Out_opt_ PULONG _In_opt_ PVOID	Buffer
_In_opt_ PETWENABLECALLBACK	EnableCallback
_In_opt_ PETWENABLECALLBACK _In_opt_ PVOID	CallbackContext
_In_opt_ PETWENABLECALLBACK _In_opt_ PVOID _Out_ PREGHANDLE	RegHandle
_In_ PCEVENT_DESCRIPTOR	EventDescriptor
_In_ UCHAR	Level
_In_ UCHAR _In_ ULONGLONG	Keyword
_In_ PCEVENT_DESCRIPTOR _In_opt_ LPCGUID	ActivityId
_In_ PCEVENT_DESCRIPTOR _In_opt_ LPCGUID _In_ ULONG	UserDataCount
_In_ PCEVENT_DESCRIPTOR _In_opt_ LPCGUID _In_opt_ LPCGUID	RelatedActivityId
_In_ UCHAR _In_ ULONGLONG _In_opt_ LPCGUID _In_ PCWSTR	String
_In_ PCEVENT_DESCRIPTOR _In_ ULONG64	Filter
_In_ PCEVENT_DESCRIPTOR _In_ ULONG64 _In_ ULONG	Flags

Macro Definition Documentation

TRACE_INFORMATION_CLASS_DEFINE

#define TRACE_INFORMATION_CLASS_DEFINE

Definition at line 64 of file wmifuncs.h.

Function Documentation

_In_reads_opt_()

_In_ PCEVENT_DESCRIPTOR _In_ ULONG64 _In_ ULONG _In_opt_ LPCGUID _In_opt_ LPCGUID _In_ ULONG _In_reads_opt_

(

UserDataCount

)

_Inout_updates_bytes_()

_Inout_updates_bytes_

(

sizeof(GUID)

)

_IRQL_requires_max_() [1/3]

_IRQL_requires_max_

(

APC_LEVEL

)

_IRQL_requires_max_() [2/3]

_IRQL_requires_max_

(

PASSIVE_LEVEL

)

Definition at line 64 of file Messaging.c.

{
    PFLT_SERVER_PORT_OBJECT PortObject;
    NTSTATUS Status;

    /* The caller must allow at least one connection */
    if (MaxConnections == 0)
    {
        return STATUS_INVALID_PARAMETER;
    }

    /* The request must be for a kernel handle */
    if (!(ObjectAttributes->Attributes & OBJ_KERNEL_HANDLE))
    {
        return STATUS_INVALID_PARAMETER;
    }

    /*
     * Get rundown protection on the target to stop the owner
     * from unloading whilst this port object is open. It gets
     * removed in the FltpServerPortClose callback
     */
    Status = FltObjectReference(Filter);
    if (!NT_SUCCESS(Status))
    {
        return Status;
    }

    /* Create the server port object for this filter */
    Status = ObCreateObject(KernelMode,
                            ServerPortObjectType,
                            ObjectAttributes,
                            KernelMode,
                            NULL,
                            sizeof(FLT_SERVER_PORT_OBJECT),
                            0,
                            0,
                            (PVOID *)&PortObject);
    if (NT_SUCCESS(Status))
    {
        /* Zero out the struct */
        RtlZeroMemory(PortObject, sizeof(FLT_SERVER_PORT_OBJECT));

        /* Increment the ref count on the target filter */
        FltpObjectPointerReference((PFLT_OBJECT)Filter);

        /* Setup the filter port object */
        PortObject->Filter = Filter;
        PortObject->ConnectNotify = ConnectNotifyCallback;
        PortObject->DisconnectNotify = DisconnectNotifyCallback;
        PortObject->MessageNotify = MessageNotifyCallback;
        PortObject->Cookie = ServerPortCookie;
        PortObject->MaxConnections = MaxConnections;

        /* Insert the object */
        Status = ObInsertObject(PortObject,
                                NULL,
                                STANDARD_RIGHTS_ALL | FILE_READ_DATA,
                                0,
                                NULL,
                                (PHANDLE)ServerPort);
        if (NT_SUCCESS(Status))
        {
            /* Lock the connection list */
            ExAcquireFastMutex(&Filter->ConnectionList.mLock);

            /* Add the new port object to the connection list and increment the count */
            InsertTailList(&Filter->ConnectionList.mList, &PortObject->FilterLink);
            Filter->ConnectionList.mCount++;

            /* Unlock the connection list*/
            ExReleaseFastMutex(&Filter->ConnectionList.mLock);
        }
    }

    if (!NT_SUCCESS(Status))
    {
        /* Allow the filter to be cleaned up */
        FltObjectDereference(Filter);
    }

    return Status;
}

_IRQL_requires_max_() [3/3]

_IRQL_requires_max_

(

HIGH_LEVEL

)

Definition at line 68 of file ke.h.

{
    return (KIRQL)__readcr8();
}

_Out_writes_bytes_()

_Out_writes_bytes_

(

TraceInformationLength

)

_When_()

_When_	(	ControlCode	= =EVENT_ACTIVITY_CTRL_CREATE_ID,
		_IRQL_requires_max_(HIGH_LEVEL)
	)

Variable Documentation

ActivityId

_In_ PCEVENT_DESCRIPTOR _In_ ULONG64 _In_ ULONG _In_opt_ LPCGUID ActivityId

Definition at line 119 of file wmifuncs.h.

Referenced by STRUCT().

Buffer

_In_ ULONG _Out_opt_ PULONG _In_opt_ PVOID Buffer

Definition at line 29 of file wmifuncs.h.

CallbackContext

_In_opt_ PETWENABLECALLBACK _In_opt_ PVOID CallbackContext

Definition at line 76 of file wmifuncs.h.

EnableCallback

_In_opt_ PETWENABLECALLBACK EnableCallback

Definition at line 76 of file wmifuncs.h.

EventDescriptor

_In_ PCEVENT_DESCRIPTOR EventDescriptor

Definition at line 93 of file wmifuncs.h.

Referenced by EventDescCreate(), EventDescGetChannel(), EventDescGetId(), EventDescGetKeyword(), EventDescGetLevel(), EventDescGetOpcode(), EventDescGetTask(), EventDescGetVersion(), EventDescOrKeyword(), EventDescSetChannel(), EventDescSetId(), EventDescSetKeyword(), EventDescSetLevel(), EventDescSetOpcode(), EventDescSetTask(), EventDescSetVersion(), and EventDescZero().

Filter

_In_ PCEVENT_DESCRIPTOR _In_ ULONG64 Filter

Definition at line 156 of file wmifuncs.h.

Flags

_In_ PCEVENT_DESCRIPTOR _In_ ULONG64 _In_ ULONG Flags

Definition at line 156 of file wmifuncs.h.

Keyword

_In_ UCHAR _In_ ULONGLONG Keyword

Definition at line 101 of file wmifuncs.h.

Level

_In_ UCHAR Level

Definition at line 101 of file wmifuncs.h.

RegHandle

_In_opt_ PETWENABLECALLBACK _In_opt_ PVOID _Out_ PREGHANDLE RegHandle

Definition at line 76 of file wmifuncs.h.

Referenced by GetLongestChildKeyName(), GetNthChildKeyName(), KeI386VdmInitialize(), OpenChildKeyRead(), OpenRegistryKey(), QueryRegistryValue(), QueryRegistryValueString(), QueryRegistryValueStringMulti(), ReadStringFromRegistry(), and test_SetupDiInstallClassExA().

RelatedActivityId

_In_ PCEVENT_DESCRIPTOR _In_ ULONG64 _In_ ULONG _In_opt_ LPCGUID _In_opt_ LPCGUID RelatedActivityId

Definition at line 130 of file wmifuncs.h.

RequiredLength

_In_ ULONG _Out_opt_ PULONG RequiredLength

Definition at line 29 of file wmifuncs.h.

Referenced by AcpiExInsertIntoField(), AcpiNsExternalizeName(), AcpiUtInitializeBuffer(), DECLARE_INTERFACE_(), ExpQueryModuleInformation(), Ext2QueryVolumeInformation(), FFSQueryVolumeInformation(), CHubController::GetHubControllerSymbolicLink(), ImageGetCertificateData(), IntCopyRegistryKey(), IopActionInterrogateDeviceStack(), IopDetectResourceConflict(), IopDoNameTransmogrify(), IoReportDetectedDevice(), LsarEnumerateAccounts(), LsarpEnumeratePrivileges(), NtAdjustPrivilegesToken(), NtQueryInformationAtom(), NtQueryInformationJobObject(), NtQueryInformationToken(), NtSetInformationJobObject(), RegOpenUserClassesRoot(), RfsdQueryVolumeInformation(), RtlpCallQueryRegistryRoutine(), SamrEnumerateAliasesInDomain(), SamrEnumerateDomainsInSamServer(), SamrEnumerateGroupsInDomain(), SamrEnumerateUsersInDomain(), SeCaptureSidAndAttributesArray(), and SeQueryInformationToken().

String

_In_ UCHAR _In_ ULONGLONG _In_opt_ LPCGUID _In_ PCWSTR String

Definition at line 142 of file wmifuncs.h.

TraceInformationLength

_In_ ULONG TraceInformationLength

Definition at line 29 of file wmifuncs.h.

UserDataCount

_In_ PCEVENT_DESCRIPTOR _In_ ULONG64 _In_ ULONG _In_opt_ LPCGUID _In_opt_ LPCGUID _In_ ULONG UserDataCount

Definition at line 119 of file wmifuncs.h.