17#define NASSERTS_RENAME
24 "FileDirectoryInformation",
25 "FileFullDirectoryInformation",
26 "FileBothDirectoryInformation",
27 "FileBasicInformation",
28 "FileStandardInformation",
29 "FileInternalInformation",
31 "FileAccessInformation",
32 "FileNameInformation",
33 "FileRenameInformation",
34 "FileLinkInformation",
35 "FileNamesInformation",
36 "FileDispositionInformation",
37 "FilePositionInformation",
38 "FileFullEaInformation",
39 "FileModeInformation",
40 "FileAlignmentInformation",
42 "FileAllocationInformation",
43 "FileEndOfFileInformation",
44 "FileAlternateNameInformation",
45 "FileStreamInformation",
46 "FilePipeInformation",
47 "FilePipeLocalInformation",
48 "FilePipeRemoteInformation",
49 "FileMailslotQueryInformation",
50 "FileMailslotSetInformation",
51 "FileCompressionInformation",
52 "FileObjectIdInformation",
53 "FileCompletionInformation",
54 "FileMoveClusterInformation",
55 "FileQuotaInformation",
56 "FileReparsePointInformation",
57 "FileNetworkOpenInformation",
58 "FileAttributeTagInformation",
59 "FileTrackingInformation",
60 "FileIdBothDirectoryInformation",
61 "FileIdFullDirectoryInformation",
62 "FileValidDataLengthInformation",
63 "FileShortNameInformation",
64 "FileMaximumInformation"
110 DPRINT(
"FsdSetPositionInformation()\n");
112 DPRINT(
"PositionInfo %p\n", PositionInfo);
134 DPRINT(
"VfatGetPositionInformation()\n");
142 DPRINT(
"Getting position %I64x\n",
159 DPRINT(
"VfatSetBasicInformation()\n");
184 DPRINT(
"Setting temporary attribute on a directory!\n");
194 DPRINT(
"Setting directory attribute on a file!\n");
202 DPRINT(
"Setting attributes 0x%02x\n", *
FCB->Attributes);
213 &
FCB->entry.FatX.CreationDate,
222 &
FCB->entry.FatX.AccessDate,
223 &
FCB->entry.FatX.AccessTime);
231 &
FCB->entry.FatX.UpdateDate,
232 &
FCB->entry.FatX.UpdateTime);
242 &
FCB->entry.Fat.CreationDate,
251 &
FCB->entry.Fat.AccessDate,
260 &
FCB->entry.Fat.UpdateDate,
261 &
FCB->entry.Fat.UpdateTime);
289 DPRINT(
"VfatGetBasicInformation()\n");
299 FCB->entry.FatX.CreationDate,
303 FCB->entry.FatX.AccessDate,
304 FCB->entry.FatX.AccessTime,
307 FCB->entry.FatX.UpdateDate,
308 FCB->entry.FatX.UpdateTime,
315 FCB->entry.Fat.CreationDate,
319 FCB->entry.Fat.AccessDate,
323 FCB->entry.Fat.UpdateDate,
324 FCB->entry.Fat.UpdateTime,
337 DPRINT(
"Synthesizing FILE_ATTRIBUTE_NORMAL\n");
355 DPRINT(
"FsdSetDispositionInformation(<%wZ>, Delete %u)\n", &
FCB->PathNameU, DispositionInfo->
DeleteFile);
358 ASSERT(DeviceExt->FatInfo.BytesPerCluster != 0);
391 DPRINT(
"MmFlushImageSection returned FALSE\n");
421 DPRINT(
"vfatPrepareTargetForRename(%p, %p, %wZ, %d, %wZ, %p)\n", DeviceExt, ParentFCB,
NewName, ReplaceIfExists, ParentName);
436 DPRINT(
"And this is a readonly file!\n");
449 DPRINT(
"MmFlushImageSection failed.\n");
463 DPRINT(
"There are still open handles for this file.\n");
471 DPRINT(
"Effectively deleting the file.\n");
485 else if (*ParentFCB !=
NULL)
565#ifdef NASSERTS_RENAME
566#pragma push_macro("ASSERT")
568#define ASSERT(x) ((VOID) 0)
584 ULONG OldReferences, NewReferences;
587 DPRINT(
"VfatSetRenameInfo(%p, %p, %p, %p, %p)\n",
FileObject,
FCB, DeviceExt, RenameInfo, TargetFileObject);
596#ifdef NASSERTS_RENAME
613 (
PVOID *)&RootFileObject,
620 RootFCB = RootFileObject->FsContext;
626 if (TargetFileObject ==
NULL)
640 if (RenameInfoString.
Buffer[0] ==
L'\\' && RenameInfoString.
Buffer[1] ==
L'?' &&
641 RenameInfoString.
Buffer[2] ==
L'?' && RenameInfoString.
Buffer[3] ==
L'\\' &&
642 RenameInfoString.
Buffer[5] ==
L':' && (RenameInfoString.
Buffer[4] >=
L'A' &&
643 RenameInfoString.
Buffer[4] <=
L'Z'))
673 (
PVOID *)&TargetFileObject,
686 TargetFileObject =
NULL;
699 else if (RenameInfo->
FileName[0] !=
L'\\')
706 else if (TargetFileObject !=
NULL)
717 if (TargetFileObject !=
NULL)
721 TargetFileObject =
NULL;
735 else if (RenameInfo->
FileName[0] !=
L'\\')
743 else if (TargetFileObject !=
NULL)
758 if (TargetFileObject !=
NULL)
762 TargetFileObject =
NULL;
799 DPRINT(
"Old dir: %wZ, Old file: %wZ\n", &SourcePath, &SourceFile);
801 DPRINT(
"New dir: %wZ, New file: %wZ\n", &NewPath, &NewFile);
849 ParentFCB =
FCB->parentFcb;
899 OldParent =
FCB->parentFcb;
900#ifdef NASSERTS_RENAME
915 NewReferences = ParentFCB->
RefCount;
916#ifdef NASSERTS_RENAME
960#ifdef NASSERTS_RENAME
961#pragma pop_macro("ASSERT")
1054 Fcb->entry.FatX.CreationDate,
1058 Fcb->entry.FatX.AccessDate,
1059 Fcb->entry.FatX.AccessTime,
1062 Fcb->entry.FatX.UpdateDate,
1063 Fcb->entry.FatX.UpdateTime,
1070 Fcb->entry.Fat.CreationDate,
1074 Fcb->entry.Fat.AccessDate,
1078 Fcb->entry.Fat.UpdateDate,
1079 Fcb->entry.Fat.UpdateTime,
1103 DPRINT(
"Synthesizing FILE_ATTRIBUTE_NORMAL\n");
1127 if (DeviceExt->FatInfo.FatType ==
FAT12 ||
1128 DeviceExt->FatInfo.FatType ==
FAT16)
1131 DPRINT1(
"VFAT: FileEaInformation not implemented!\n");
1200 Fcb->entry.FatX.FileSize =
Size;
1202 Fcb->entry.Fat.FileSize =
Size;
1218 ULONG Cluster, FirstCluster;
1226 DPRINT(
"VfatSetAllocationSizeInformation(File <%wZ>, AllocationSize %d %u)\n",
1230 OldSize =
Fcb->entry.FatX.FileSize;
1232 OldSize =
Fcb->entry.Fat.FileSize;
1248 AllocSizeChanged =
TRUE;
1249 if (FirstCluster == 0)
1251 Fcb->LastCluster =
Fcb->LastOffset = 0;
1259 if (FirstCluster == 0xffffffff)
1270 NCluster = Cluster = FirstCluster;
1283 Fcb->entry.FatX.FirstCluster = FirstCluster;
1287 if (DeviceExt->FatInfo.FatType ==
FAT32)
1289 Fcb->entry.Fat.FirstCluster = (
unsigned short)(FirstCluster & 0x0000FFFF);
1290 Fcb->entry.Fat.FirstClusterHigh = FirstCluster >> 16;
1294 ASSERT((FirstCluster >> 16) == 0);
1295 Fcb->entry.Fat.FirstCluster = (
unsigned short)(FirstCluster & 0x0000FFFF);
1301 if (
Fcb->LastCluster > 0)
1305 Cluster =
Fcb->LastCluster;
1327 Fcb->LastCluster = Cluster;
1353 else if (
NewSize + ClusterSize <= Fcb->RFCB.AllocationSize.u.LowPart)
1355 DPRINT(
"Check for the ability to set file size\n");
1359 DPRINT(
"Couldn't set file size!\n");
1362 DPRINT(
"Can set file size\n");
1364 AllocSizeChanged =
TRUE;
1366 Fcb->LastCluster =
Fcb->LastOffset = 0;
1383 Fcb->entry.FatX.FirstCluster = 0;
1387 if (DeviceExt->FatInfo.FatType ==
FAT32)
1389 Fcb->entry.Fat.FirstCluster = 0;
1390 Fcb->entry.Fat.FirstClusterHigh = 0;
1394 Fcb->entry.Fat.FirstCluster = 0;
1398 NCluster = Cluster = FirstCluster;
1409 if (DeviceExt->FatInfo.FatType ==
FAT32)
1421 if (AllocSizeChanged)
1451 DPRINT(
"VfatQueryInformation is called for '%s'\n",
1456 DPRINT1(
"IRP_MJ_QUERY_INFORMATION without FCB!\n");
1573 DPRINT(
"VfatSetInformation(IrpContext %p)\n", IrpContext);
1581 DPRINT(
"VfatSetInformation is called for '%s'\n",
1585 DPRINT(
"SystemBuffer %p\n", SystemBuffer);
1589 DPRINT1(
"IRP_MJ_SET_INFORMATION without FCB!\n");
1599 DPRINT(
"Check for the ability to set file size\n");
1603 DPRINT(
"Couldn't set file size!\n");
1607 DPRINT(
"Can set file size\n");
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
#define STATUS_NOT_SUPPORTED
#define STATUS_NOT_IMPLEMENTED
ULONG vfatDirEntryGetFirstCluster(PDEVICE_EXTENSION pDeviceExt, PDIR_ENTRY pFatDirEntry)
NTSTATUS vfatRenameEntry(IN PDEVICE_EXTENSION DeviceExt, IN PVFATFCB pFcb, IN PUNICODE_STRING FileName, IN BOOLEAN CaseChangeOnly)
NTSTATUS VfatMoveEntry(IN PDEVICE_EXTENSION DeviceExt, IN PVFATFCB pFcb, IN PUNICODE_STRING FileName, IN PVFATFCB ParentFcb)
NTSTATUS VfatUpdateEntry(IN PDEVICE_EXTENSION DeviceExt, IN PVFATFCB pFcb)
#define NT_SUCCESS(StatCode)
#define FILE_ATTRIBUTE_NORMAL
unsigned short(__cdecl typeof(TIFFCurrentDirectory))(struct tiff *)
static const WCHAR Cleanup[]
#define IRPCONTEXT_CANWAIT
NTSTATUS VfatCloseFile(PDEVICE_EXTENSION DeviceExt, PFILE_OBJECT FileObject)
BOOLEAN FsdDosDateTimeToSystemTime(PDEVICE_EXTENSION DeviceExt, USHORT DosDate, USHORT DosTime, PLARGE_INTEGER SystemTime)
BOOLEAN FsdSystemTimeToDosDateTime(PDEVICE_EXTENSION DeviceExt, PLARGE_INTEGER SystemTime, PUSHORT pDosDate, PUSHORT pDosTime)
NTSTATUS FAT32UpdateFreeClustersCount(PDEVICE_EXTENSION DeviceExt)
NTSTATUS WriteCluster(PDEVICE_EXTENSION DeviceExt, ULONG ClusterToWrite, ULONG NewValue)
NTSTATUS NextCluster(PDEVICE_EXTENSION DeviceExt, ULONG FirstCluster, PULONG CurrentCluster, BOOLEAN Extend)
NTSTATUS OffsetToCluster(PDEVICE_EXTENSION DeviceExt, ULONG FirstCluster, ULONG FileOffset, PULONG Cluster, BOOLEAN Extend)
BOOLEAN IsDotOrDotDot(PCUNICODE_STRING Name)
#define ExAllocatePoolWithTag(hernya, size, tag)
#define IsListEmpty(ListHead)
#define ExAcquireResourceExclusiveLite(res, wait)
#define ExAcquireResourceSharedLite(res, wait)
#define ROUND_DOWN(n, align)
#define ExGetPreviousMode
#define FCB_DELETE_PENDING
#define BooleanFlagOn(F, SF)
IN PFCB IN PFILE_OBJECT FileObject IN ULONG AllocationSize
_Must_inspect_result_ _In_ USHORT NewSize
@ FilePositionInformation
@ FileEndOfFileInformation
@ FileInternalInformation
@ FileAlternateNameInformation
@ FileAllocationInformation
@ FileNetworkOpenInformation
@ FileDispositionInformation
struct _FILE_NETWORK_OPEN_INFORMATION FILE_NETWORK_OPEN_INFORMATION
enum _FILE_INFORMATION_CLASS FILE_INFORMATION_CLASS
struct _FILE_INTERNAL_INFORMATION FILE_INTERNAL_INFORMATION
#define FILE_OPEN_FOR_BACKUP_INTENT
VOID NTAPI CcSetFileSizes(IN PFILE_OBJECT FileObject, IN PCC_FILE_SIZES FileSizes)
#define OBJ_KERNEL_HANDLE
#define OBJ_CASE_INSENSITIVE
POBJECT_TYPE IoFileObjectType
#define ExFreePoolWithTag(_P, _T)
#define FILE_STANDARD_INFORMATION
#define FILE_BASIC_INFORMATION
static OUT PIO_STATUS_BLOCK IoStatusBlock
static OUT PIO_STATUS_BLOCK OUT PVOID IN ULONG IN FILE_INFORMATION_CLASS FileInformationClass
#define InitializeObjectAttributes(p, n, a, r, s)
_In_ UINT _In_ UINT BytesToCopy
NTSYSAPI NTSTATUS NTAPI ZwClose(_In_ HANDLE Handle)
_In_ HANDLE _In_opt_ HANDLE _Out_opt_ PHANDLE TargetHandle
NTSYSAPI VOID NTAPI RtlCopyUnicodeString(PUNICODE_STRING DestinationString, PUNICODE_STRING SourceString)
#define FILE_ATTRIBUTE_READONLY
NTSYSAPI NTSTATUS NTAPI RtlAppendUnicodeStringToString(PUNICODE_STRING Destination, PUNICODE_STRING Source)
#define FILE_ATTRIBUTE_HIDDEN
#define FILE_ATTRIBUTE_SYSTEM
struct _FILE_POSITION_INFORMATION FILE_POSITION_INFORMATION
struct _FILE_ALIGNMENT_INFORMATION FILE_ALIGNMENT_INFORMATION
#define FILE_ATTRIBUTE_ARCHIVE
#define FILE_ATTRIBUTE_DIRECTORY
#define FILE_ATTRIBUTE_TEMPORARY
#define UNREFERENCED_PARAMETER(P)
VOID FASTCALL ExReleaseResourceLite(IN PERESOURCE Resource)
BOOLEAN NTAPI FsRtlAreNamesEqual(IN PCUNICODE_STRING Name1, IN PCUNICODE_STRING Name2, IN BOOLEAN IgnoreCase, IN PCWCH UpcaseTable OPTIONAL)
PDEVICE_OBJECT NTAPI IoGetRelatedDeviceObject(IN PFILE_OBJECT FileObject)
NTSTATUS NTAPI IoCreateFile(OUT PHANDLE FileHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PLARGE_INTEGER AllocationSize OPTIONAL, IN ULONG FileAttributes, IN ULONG ShareAccess, IN ULONG Disposition, IN ULONG CreateOptions, IN PVOID EaBuffer OPTIONAL, IN ULONG EaLength, IN CREATE_FILE_TYPE CreateFileType, IN PVOID ExtraCreateParameters OPTIONAL, IN ULONG Options)
#define STATUS_USER_MAPPED_FILE
#define STATUS_NOT_SAME_DEVICE
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
BOOLEAN NTAPI MmCanFileBeTruncated(_In_ PSECTION_OBJECT_POINTERS SectionObjectPointer, _In_opt_ PLARGE_INTEGER NewFileSize)
BOOLEAN NTAPI MmFlushImageSection(IN PSECTION_OBJECT_POINTERS SectionObjectPointer, IN MMFLUSH_TYPE FlushType)
struct _FILE_ACCESS_INFORMATION FILE_ACCESS_INFORMATION
#define FileStandardInformation
#define STATUS_CANNOT_DELETE
#define STATUS_BUFFER_OVERFLOW
base of all file and directory entries
PDEVICE_OBJECT DeviceObject
PDEVICE_EXTENSION DeviceExt
FSRTL_COMMON_FCB_HEADER RFCB
struct _IO_STACK_LOCATION::@3980::@3989 QueryFile
union _IO_STACK_LOCATION::@1581 Parameters
struct _IO_STACK_LOCATION::@3980::@3990 SetFile
union _IRP::@1583 AssociatedIrp
struct _VFATFCB * parentFcb
LIST_ENTRY ParentListHead
#define FIELD_OFFSET(t, f)
#define RtlCopyMemory(Destination, Source, Length)
#define RtlZeroMemory(Destination, Length)
#define CONTAINING_RECORD(address, type, field)
#define STATUS_DIRECTORY_NOT_EMPTY
#define STATUS_ACCESS_DENIED
#define STATUS_INVALID_PARAMETER
#define STATUS_OBJECT_NAME_COLLISION
#define STATUS_OBJECT_NAME_INVALID
#define STATUS_INSUFFICIENT_RESOURCES
struct _LARGE_INTEGER::@2304 u
struct _VFATFCB * PVFATFCB
FORCEINLINE BOOLEAN vfatFCBIsReadOnly(PVFATFCB FCB)
#define ROUND_UP_64(n, align)
FORCEINLINE BOOLEAN vfatFCBIsDirectory(PVFATFCB FCB)
FORCEINLINE BOOLEAN VfatIsDirectoryEmpty(PDEVICE_EXTENSION DeviceExt, struct _VFATFCB *Fcb)
FORCEINLINE NTSTATUS VfatDelEntry(PDEVICE_EXTENSION DeviceExt, struct _VFATFCB *Fcb, struct _VFAT_MOVE_CONTEXT *MoveContext)
FORCEINLINE BOOLEAN vfatVolumeIsFatX(PDEVICE_EXTENSION DeviceExt)
FORCEINLINE NTSTATUS VfatMarkIrpContextForQueue(PVFAT_IRP_CONTEXT IrpContext)
FORCEINLINE VOID vfatReportChange(IN PDEVICE_EXTENSION DeviceExt, IN PVFATFCB Fcb, IN ULONG FilterMatch, IN ULONG Action)
VOID vfatSplitPathName(PUNICODE_STRING PathNameU, PUNICODE_STRING DirNameU, PUNICODE_STRING FileNameU)
BOOLEAN vfatFCBIsRoot(PVFATFCB FCB)
NTSTATUS vfatSetFCBNewDirName(PDEVICE_EXTENSION pVCB, PVFATFCB Fcb, PVFATFCB ParentFcb)
NTSTATUS vfatGetFCBForFile(PDEVICE_EXTENSION pVCB, PVFATFCB *pParentFCB, PVFATFCB *pFCB, PUNICODE_STRING pFileNameU)
VOID vfatReleaseFCB(PDEVICE_EXTENSION pVCB, PVFATFCB pFCB)
VOID vfatGrabFCB(PDEVICE_EXTENSION pVCB, PVFATFCB pFCB)
static NTSTATUS VfatGetInternalInformation(PVFATFCB Fcb, PDEVICE_EXTENSION DeviceExt, PFILE_INTERNAL_INFORMATION InternalInfo, PULONG BufferLength)
static NTSTATUS vfatPrepareTargetForRename(IN PDEVICE_EXTENSION DeviceExt, IN PVFATFCB *ParentFCB, IN PUNICODE_STRING NewName, IN BOOLEAN ReplaceIfExists, IN PUNICODE_STRING ParentName, OUT PBOOLEAN Deleted)
static NTSTATUS VfatSetBasicInformation(PFILE_OBJECT FileObject, PVFATFCB FCB, PDEVICE_EXTENSION DeviceExt, PFILE_BASIC_INFORMATION BasicInfo)
static NTSTATUS VfatSetRenameInformation(PFILE_OBJECT FileObject, PVFATFCB FCB, PDEVICE_EXTENSION DeviceExt, PFILE_RENAME_INFORMATION RenameInfo, PFILE_OBJECT TargetFileObject)
static VOID UpdateFileSize(PFILE_OBJECT FileObject, PVFATFCB Fcb, ULONG Size, ULONG ClusterSize, BOOLEAN IsFatX)
NTSTATUS VfatSetInformation(PVFAT_IRP_CONTEXT IrpContext)
NTSTATUS VfatGetBasicInformation(PFILE_OBJECT FileObject, PVFATFCB FCB, PDEVICE_EXTENSION DeviceExt, PFILE_BASIC_INFORMATION BasicInfo, PULONG BufferLength)
static NTSTATUS VfatSetDispositionInformation(PFILE_OBJECT FileObject, PVFATFCB FCB, PDEVICE_EXTENSION DeviceExt, PFILE_DISPOSITION_INFORMATION DispositionInfo)
static NTSTATUS VfatGetNetworkOpenInformation(PVFATFCB Fcb, PDEVICE_EXTENSION DeviceExt, PFILE_NETWORK_OPEN_INFORMATION NetworkInfo, PULONG BufferLength)
static NTSTATUS VfatGetPositionInformation(PFILE_OBJECT FileObject, PVFATFCB FCB, PDEVICE_EXTENSION DeviceExt, PFILE_POSITION_INFORMATION PositionInfo, PULONG BufferLength)
static VOID VfatRenameChildFCB(PDEVICE_EXTENSION DeviceExt, PVFATFCB FCB)
static NTSTATUS VfatGetAllInformation(PFILE_OBJECT FileObject, PVFATFCB Fcb, PDEVICE_EXTENSION DeviceExt, PFILE_ALL_INFORMATION Info, PULONG BufferLength)
NTSTATUS VfatSetAllocationSizeInformation(PFILE_OBJECT FileObject, PVFATFCB Fcb, PDEVICE_EXTENSION DeviceExt, PLARGE_INTEGER AllocationSize)
static NTSTATUS VfatGetNameInformation(PFILE_OBJECT FileObject, PVFATFCB FCB, PDEVICE_EXTENSION DeviceExt, PFILE_NAME_INFORMATION NameInfo, PULONG BufferLength)
static BOOLEAN IsThereAChildOpened(PVFATFCB FCB)
NTSTATUS VfatQueryInformation(PVFAT_IRP_CONTEXT IrpContext)
static NTSTATUS VfatGetEaInformation(PFILE_OBJECT FileObject, PVFATFCB Fcb, PDEVICE_EXTENSION DeviceExt, PFILE_EA_INFORMATION Info, PULONG BufferLength)
NTSTATUS VfatGetStandardInformation(PVFATFCB FCB, PFILE_STANDARD_INFORMATION StandardInfo, PULONG BufferLength)
const char * FileInformationClassNames[]
static NTSTATUS VfatSetPositionInformation(PFILE_OBJECT FileObject, PFILE_POSITION_INFORMATION PositionInfo)
_Must_inspect_result_ _In_ WDFCHILDLIST _In_ PWDF_CHILD_LIST_ITERATOR _Out_ WDFDEVICE _Inout_opt_ PWDF_CHILD_RETRIEVE_INFO Info
_Must_inspect_result_ _In_ WDFDMAENABLER _In_ _In_opt_ PWDF_OBJECT_ATTRIBUTES Attributes
_In_ WDFREQUEST _In_ WDFFILEOBJECT FileObject
_Must_inspect_result_ _In_ WDFDEVICE _In_ PWDF_DEVICE_PROPERTY_DATA _In_ DEVPROPTYPE _In_ ULONG Size
_Must_inspect_result_ _In_ WDFDEVICE _In_ DEVICE_REGISTRY_PROPERTY _In_ ULONG BufferLength
_Must_inspect_result_ _In_ WDFDEVICE _In_ WDFDEVICE Child
#define FILE_NOTIFY_CHANGE_SIZE
#define IO_FORCE_ACCESS_CHECK
#define IO_OPEN_TARGET_DIRECTORY
#define FILE_ACTION_MODIFIED
#define FILE_ACTION_RENAMED_OLD_NAME
#define FILE_NOTIFY_CHANGE_LAST_ACCESS
#define FILE_NOTIFY_CHANGE_ATTRIBUTES
#define FILE_ACTION_REMOVED
#define FILE_NOTIFY_CHANGE_FILE_NAME
#define FILE_ACTION_RENAMED_NEW_NAME
#define FILE_NOTIFY_CHANGE_CREATION
#define FILE_NOTIFY_CHANGE_LAST_WRITE
#define FILE_NOTIFY_CHANGE_EA
#define FILE_ACTION_ADDED
#define FILE_NOTIFY_CHANGE_DIR_NAME
#define ObDereferenceObject
_In_opt_ HANDLE _In_opt_ PIO_APC_ROUTINE _In_opt_ PVOID _Out_ PIO_STATUS_BLOCK _In_ ULONG NotifyFilter
_In_ PUNICODE_STRING NewName