1 #ifndef _FLTMGR_INTERNAL_H
2 #define _FLTMGR_INTERNAL_H
5 #define MAX_CONTEXT_TYPES 6
8 typedef enum _FLT_OBJECT_FLAGS
10 FLT_OBFL_DRAINING
= 1,
12 FLT_OBFL_TYPE_INSTANCE
= 0x1000000,
13 FLT_OBFL_TYPE_FILTER
= 0x2000000,
14 FLT_OBFL_TYPE_VOLUME
= 0x4000000
16 } FLT_OBJECT_FLAGS
, *PFLT_OBJECT_FLAGS
;
18 typedef enum _FLT_FILTER_FLAGS
20 FLTFL_MANDATORY_UNLOAD_IN_PROGRESS
= 1,
21 FLTFL_FILTERING_INITIATED
= 2
23 } FLT_FILTER_FLAGS
, *PFLT_FILTER_FLAGS
;
25 typedef struct _FLT_OBJECT
// size = 0x14
27 volatile FLT_OBJECT_FLAGS Flags
;
29 EX_RUNDOWN_REF RundownRef
;
30 LIST_ENTRY PrimaryLink
;
32 } FLT_OBJECT
, *PFLT_OBJECT
;
34 typedef struct _ALLOCATE_CONTEXT_HEADER
37 PFLT_CONTEXT_CLEANUP_CALLBACK ContextCleanupCallback
;
38 struct _ALLOCATE_CONTEXT_HEADER
*Next
;
39 FLT_CONTEXT_TYPE ContextType
;
43 } ALLOCATE_CONTEXT_HEADER
, *PALLOCATE_CONTEXT_HEADER
;
45 typedef struct _FLT_RESOURCE_LIST_HEAD
51 } FLT_RESOURCE_LIST_HEAD
, *PFLT_RESOURCE_LIST_HEAD
;
53 typedef struct _FLT_MUTEX_LIST_HEAD
59 } FLT_MUTEX_LIST_HEAD
, *PFLT_MUTEX_LIST_HEAD
;
61 typedef struct _FLT_TYPE
66 } FLT_TYPE
, *PFLT_TYPE
;
68 // http://fsfilters.blogspot.co.uk/2010/02/filter-manager-concepts-part-1.html
69 typedef struct _FLTP_FRAME
74 ERESOURCE AltitudeLock
;
75 UNICODE_STRING AltitudeIntervalLow
;
76 UNICODE_STRING AltitudeIntervalHigh
;
77 char LargeIrpCtrlStackSize
;
78 char SmallIrpCtrlStackSize
;
79 FLT_RESOURCE_LIST_HEAD RegisteredFilters
;
80 FLT_RESOURCE_LIST_HEAD AttachedVolumes
;
81 LIST_ENTRY MountingVolumes
;
82 FLT_MUTEX_LIST_HEAD AttachedFileSystems
;
83 FLT_MUTEX_LIST_HEAD ZombiedFltObjectContexts
;
84 ERESOURCE FilterUnloadLock
;
85 FAST_MUTEX DeviceObjectAttachLock
;
88 void *LookasidePoolToFree
;
89 //FLTP_IRPCTRL_STACK_PROFILER IrpCtrlStackProfiler;
90 NPAGED_LOOKASIDE_LIST SmallIrpCtrlLookasideList
;
91 NPAGED_LOOKASIDE_LIST LargeIrpCtrlLookasideList
;
92 //STATIC_IRP_CONTROL GlobalSIC;
94 } FLTP_FRAME
, *PFLTP_FRAME
;
96 typedef struct _FLT_FILTER
// size = 0x120
101 UNICODE_STRING DefaultAltitude
;
102 FLT_FILTER_FLAGS Flags
;
103 PDRIVER_OBJECT DriverObject
;
104 FLT_RESOURCE_LIST_HEAD InstanceList
;
105 PVOID VerifierExtension
;
106 PFLT_FILTER_UNLOAD_CALLBACK FilterUnload
;
107 PFLT_INSTANCE_SETUP_CALLBACK InstanceSetup
;
108 PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK InstanceQueryTeardown
;
109 PFLT_INSTANCE_TEARDOWN_CALLBACK InstanceTeardownStart
;
110 PFLT_INSTANCE_TEARDOWN_CALLBACK InstanceTeardownComplete
;
111 PALLOCATE_CONTEXT_HEADER SupportedContextsListHead
;
112 PALLOCATE_CONTEXT_HEADER SupportedContexts
[MAX_CONTEXT_TYPES
];
113 PVOID PreVolumeMount
;
114 PVOID PostVolumeMount
;
115 PFLT_GENERATE_FILE_NAME GenerateFileName
;
116 PFLT_NORMALIZE_NAME_COMPONENT NormalizeNameComponent
;
117 PFLT_NORMALIZE_CONTEXT_CLEANUP NormalizeContextCleanup
;
118 PFLT_OPERATION_REGISTRATION Operations
;
119 PFLT_FILTER_UNLOAD_CALLBACK OldDriverUnload
;
120 FLT_MUTEX_LIST_HEAD ActiveOpens
;
121 FLT_MUTEX_LIST_HEAD ConnectionList
;
122 FLT_MUTEX_LIST_HEAD PortList
;
123 EX_PUSH_LOCK PortLock
;
125 } FLT_FILTER
, *PFLT_FILTER
;
127 typedef enum _FLT_yINSTANCE_FLAGS
129 INSFL_CAN_BE_DETACHED
= 0x01,
130 INSFL_DELETING
= 0x02,
133 } FLT_INSTANCE_FLAGS
, *PFLT_INSTANCE_FLAGS
;
137 typedef struct _FLT_INSTANCE
// size = 0x144 (324)
140 ULONG OperationRundownRef
;
141 PVOID Volume
; //PFLT_VOLUME
143 FLT_INSTANCE_FLAGS Flags
;
144 UNICODE_STRING Altitude
;
146 LIST_ENTRY FilterLink
;
147 ERESOURCE ContextLock
;
148 PVOID Context
; //PCONTEXT_NODE
149 PVOID TrackCompletionNodes
; //PRACK_COMPLETION_NODES
150 PVOID CallbackNodes
[50]; //PCALLBACK_NODE
152 } FLT_INSTANCE
, *PFLT_INSTANCE
;
155 typedef struct _TREE_ROOT
157 RTL_SPLAY_LINKS
*Tree
;
159 } TREE_ROOT
, *PTREE_ROOT
;
161 typedef struct _CONTEXT_LIST_CTRL
165 } CONTEXT_LIST_CTRL
, *PCONTEXT_LIST_CTRL
;
167 // http://fsfilters.blogspot.co.uk/2010/02/filter-manager-concepts-part-6.html
168 typedef struct _STREAM_LIST_CTRL
// size = 0xC8 (200)
171 FSRTL_PER_STREAM_CONTEXT ContextCtrl
;
172 LIST_ENTRY VolumeLink
;
173 ULONG Flags
; //STREAM_LIST_CTRL_FLAGS Flags;
175 ERESOURCE ContextLock
;
176 CONTEXT_LIST_CTRL StreamContexts
;
177 CONTEXT_LIST_CTRL StreamHandleContexts
;
178 ERESOURCE NameCacheLock
;
179 LARGE_INTEGER LastRenameCompleted
;
180 ULONG NormalizedNameCache
; //NAME_CACHE_LIST_CTRL NormalizedNameCache;
181 ULONG ShortNameCache
; // NAME_CACHE_LIST_CTRL ShortNameCache;
182 ULONG OpenedNameCache
; // NAME_CACHE_LIST_CTRL OpenedNameCache;
183 int AllNameContextsTemporary
;
185 } STREAM_LIST_CTRL
, *PSTREAM_LIST_CTRL
;
188 typedef struct _FLT_SERVER_PORT_OBJECT
190 LIST_ENTRY FilterLink
;
191 PFLT_CONNECT_NOTIFY ConnectNotify
;
192 PFLT_DISCONNECT_NOTIFY DisconnectNotify
;
193 PFLT_MESSAGE_NOTIFY MessageNotify
;
197 LONG NumberOfConnections
;
200 } FLT_SERVER_PORT_OBJECT
, *PFLT_SERVER_PORT_OBJECT
;
203 typedef struct _FLT_MESSAGE_WAITER_QUEUE
206 FLT_MUTEX_LIST_HEAD WaiterQ
;
207 ULONG MinimumWaiterLength
;
208 KSEMAPHORE Semaphore
;
211 } FLT_MESSAGE_WAITER_QUEUE
, *PFLT_MESSAGE_WAITER_QUEUE
;
214 typedef struct _FLT_PORT_OBJECT
216 LIST_ENTRY FilterLink
;
217 PFLT_SERVER_PORT_OBJECT ServerPort
;
219 EX_RUNDOWN_REF MsgNotifRundownRef
;
221 FLT_MESSAGE_WAITER_QUEUE MsgQ
;
223 KEVENT DisconnectEvent
;
224 BOOLEAN Disconnected
;
226 } FLT_PORT_OBJECT
, *PFLT_PORT_OBJECT
;
229 typedef enum _FLT_VOLUME_FLAGS
231 VOLFL_NETWORK_FILESYSTEM
= 0x1,
232 VOLFL_PENDING_MOUNT_SETUP_NOTIFIES
= 0x2,
233 VOLFL_MOUNT_SETUP_NOTIFIES_CALLED
= 0x4,
234 VOLFL_MOUNTING
= 0x8,
235 VOLFL_SENT_SHUTDOWN_IRP
= 0x10,
236 VOLFL_ENABLE_NAME_CACHING
= 0x20,
237 VOLFL_FILTER_EVER_ATTACHED
= 0x40,
238 VOLFL_STANDARD_LINK_NOT_SUPPORTED
= 0x80
240 } FLT_VOLUME_FLAGS
, *PFLT_VOLUME_FLAGS
;
243 typedef enum _CALLBACK_NODE_FLAGS
245 CBNFL_SKIP_PAGING_IO
= 0x1,
246 CBNFL_SKIP_CACHED_IO
= 0x2,
247 CBNFL_USE_NAME_CALLBACK_EX
= 0x4,
248 CBNFL_SKIP_NON_DASD_IO
= 0x8
250 } CALLBACK_NODE_FLAGS
, *PCALLBACK_NODE_FLAGS
;
253 typedef struct _CALLBACK_CTRL
255 LIST_ENTRY OperationLists
[50];
256 CALLBACK_NODE_FLAGS OperationFlags
[50];
258 } CALLBACK_CTRL
, *PCALLBACK_CTRL
;
261 typedef struct _NAME_CACHE_LIST_CTRL_STATS
269 ULONG RemovedDueToCase
;
271 } NAME_CACHE_LIST_CTRL_STATS
, *PNAME_CACHE_LIST_CTRL_STATS
;
274 typedef struct _NAME_CACHE_VOLUME_CTRL_STATS
276 ULONG AllContextsTemporary
;
277 ULONG PurgeNameCache
;
278 NAME_CACHE_LIST_CTRL_STATS NormalizedNames
;
279 NAME_CACHE_LIST_CTRL_STATS OpenedNames
;
280 NAME_CACHE_LIST_CTRL_STATS ShortNames
;
281 ULONG AncestorLookup
;
285 } NAME_CACHE_VOLUME_CTRL_STATS
, *PNAME_CACHE_VOLUME_CTRL_STATS
;
288 typedef struct _NAME_CACHE_VOLUME_CTRL
291 ULONG AllContextsTemporary
;
292 LARGE_INTEGER LastRenameCompleted
;
293 NAME_CACHE_VOLUME_CTRL_STATS Stats
;
295 } NAME_CACHE_VOLUME_CTRL
, *PNAME_CACHE_VOLUME_CTRL
;
298 typedef struct _FLT_VOLUME
301 FLT_VOLUME_FLAGS Flags
;
302 FLT_FILESYSTEM_TYPE FileSystemType
;
303 PDEVICE_OBJECT DeviceObject
;
304 PDEVICE_OBJECT DiskDeviceObject
;
305 PFLT_VOLUME FrameZeroVolume
;
306 PFLT_VOLUME VolumeInNextFrame
;
308 UNICODE_STRING DeviceName
;
309 UNICODE_STRING GuidName
;
310 UNICODE_STRING CDODeviceName
;
311 UNICODE_STRING CDODriverName
;
312 FLT_RESOURCE_LIST_HEAD InstanceList
;
313 CALLBACK_CTRL Callbacks
;
314 EX_PUSH_LOCK ContextLock
;
315 CONTEXT_LIST_CTRL VolumeContexts
;
316 FLT_RESOURCE_LIST_HEAD StreamListCtrls
;
317 FLT_RESOURCE_LIST_HEAD FileListCtrls
;
318 NAME_CACHE_VOLUME_CTRL NameCacheCtrl
;
319 ERESOURCE MountNotifyLock
;
320 ULONG TargetedOpenActiveCount
;
321 EX_PUSH_LOCK TxVolContextListLock
;
322 TREE_ROOT TxVolContexts
;
324 } FLT_VOLUME
, *PFLT_VOLUME
;
327 typedef struct _MANAGER_CCB
330 unsigned int Iterator
;
332 } MANAGER_CCB
, *PMANAGER_CCB
;
334 typedef struct _FILTER_CCB
337 unsigned int Iterator
;
339 } FILTER_CCB
, *PFILTER_CCB
;
341 typedef struct _INSTANCE_CCB
343 PFLT_INSTANCE Instance
;
345 } INSTANCE_CCB
, *PINSTANCE_CCB
;
347 typedef struct _VOLUME_CCB
349 UNICODE_STRING Volume
;
350 unsigned int Iterator
;
352 } VOLUME_CCB
, *PVOLUME_CCB
;
354 typedef struct _PORT_CCB
356 PFLT_PORT_OBJECT Port
;
357 FLT_MUTEX_LIST_HEAD ReplyWaiterList
;
359 } PORT_CCB
, *PPORT_CCB
;
362 typedef union _CCB_TYPE
366 INSTANCE_CCB Instance
;
370 } CCB_TYPE
, *PCCB_TYPE
;
373 typedef struct _FLT_CCB
378 } FLT_CCB
, *PFLT_CCB
;
381 FltpExInitializeRundownProtection(
382 _Out_ PEX_RUNDOWN_REF RundownRef
386 FltpExAcquireRundownProtection(
387 _Inout_ PEX_RUNDOWN_REF RundownRef
391 FltpExReleaseRundownProtection(
392 _Inout_ PEX_RUNDOWN_REF RundownRef
397 FltpObjectRundownWait(
398 _Inout_ PEX_RUNDOWN_REF RundownRef
402 FltpExRundownCompleted(
403 _Inout_ PEX_RUNDOWN_REF RundownRef
408 FltpGetBaseDeviceObjectName(
409 _In_ PDEVICE_OBJECT DeviceObject
,
410 _Inout_ PUNICODE_STRING ObjectName
416 _Inout_ PUNICODE_STRING ObjectName
420 FltpObjectPointerReference(
421 _In_ PFLT_OBJECT Object
425 FltpObjectPointerDereference(
426 _In_ PFLT_OBJECT Object
430 FltpReallocateUnicodeString(
431 _In_ PUNICODE_STRING String
,
432 _In_ SIZE_T NewLength
,
433 _In_ BOOLEAN CopyExisting
437 FltpFreeUnicodeString(
438 _In_ PUNICODE_STRING String
444 FltpDeviceControlHandler(
445 _In_ PDEVICE_OBJECT DeviceObject
,
451 _In_ PDEVICE_OBJECT DeviceObject
,
457 _In_ PDEVICE_OBJECT DeviceObject
,
463 _In_ PDEVICE_OBJECT DeviceObject
,
468 FltpSetupCommunicationObjects(
469 _In_ PDRIVER_OBJECT DriverObject
472 #endif /* _FLTMGR_INTERNAL_H */