#include <fltkernel.h>
#include <pseh/pseh2.h>
-#define DRIVER_NAME L"RosFltMgr"
+#define DRIVER_NAME L"FltMgr"
-#define FLT_MAJOR_VERSION 0x02
-#define FLT_MINOR_VERSION 0x00 //win2k3
+#define FLT_MAJOR_VERSION 0x0200
+#define FLT_MINOR_VERSION 0x0000 //win2k3
#define FM_TAG_DISPATCH_TABLE 'ifMF'
#define FM_TAG_REGISTRY_DATA 'rtMF'
#define FM_TAG_DEV_OBJ_PTRS 'ldMF'
#define FM_TAG_UNICODE_STRING 'suMF'
#define FM_TAG_FILTER 'lfMF'
+#define FM_TAG_CONTEXT_REGISTA 'rcMF'
+
+#define MAX_DEVNAME_LENGTH 64
typedef struct _DRIVER_DATA
PDEVICE_OBJECT DeviceObject;
UNICODE_STRING ServiceKey;
+ PDEVICE_OBJECT CommsDeviceObject;
+
PFAST_IO_DISPATCH FastIoDispatch;
FAST_MUTEX FilterAttachLock;
} DRIVER_DATA, *PDRIVER_DATA;
-
-typedef enum _FLT_OBJECT_FLAGS
+typedef struct _FLTMGR_DEVICE_EXTENSION
{
- FLT_OBFL_DRAINING = 1,
- FLT_OBFL_ZOMBIED = 2,
- FLT_OBFL_TYPE_INSTANCE = 0x1000000,
- FLT_OBFL_TYPE_FILTER = 0x2000000,
- FLT_OBFL_TYPE_VOLUME = 0x4000000
+ /* The file system we're attached to */
+ PDEVICE_OBJECT AttachedToDeviceObject;
-} FLT_OBJECT_FLAGS, *PFLT_OBJECT_FLAGS;
-
-typedef enum _FLT_FILTER_FLAGS
-{
- FLTFL_MANDATORY_UNLOAD_IN_PROGRESS = 1,
- FLTFL_FILTERING_INITIATED = 2
-
-} FLT_FILTER_FLAGS, *PFLT_FILTER_FLAGS;
-
-typedef struct _FLT_OBJECT // size = 0x14
-{
- volatile FLT_OBJECT_FLAGS Flags;
- ULONG PointerCount;
- EX_RUNDOWN_REF RundownRef;
- LIST_ENTRY PrimaryLink;
-
-} FLT_OBJECT, *PFLT_OBJECT;
-
-typedef struct _FLT_RESOURCE_LIST_HEAD
-{
- ERESOURCE rLock;
- LIST_ENTRY rList;
- ULONG rCount;
-
-} FLT_RESOURCE_LIST_HEAD, *PFLT_RESOURCE_LIST_HEAD;
-
-typedef struct _FLT_MUTEX_LIST_HEAD
-{
- FAST_MUTEX mLock;
- LIST_ENTRY mList;
- ULONG mCount;
-
-} FLT_MUTEX_LIST_HEAD, *PFLT_MUTEX_LIST_HEAD;
-
-typedef struct _FLT_FILTER // size = 0x120
-{
- FLT_OBJECT Base;
- PVOID Frame; //FLTP_FRAME
- UNICODE_STRING Name;
- UNICODE_STRING DefaultAltitude;
- FLT_FILTER_FLAGS Flags;
- PDRIVER_OBJECT DriverObject;
- FLT_RESOURCE_LIST_HEAD InstanceList;
- PVOID VerifierExtension;
- PFLT_FILTER_UNLOAD_CALLBACK FilterUnload;
- PFLT_INSTANCE_SETUP_CALLBACK InstanceSetup;
- PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK InstanceQueryTeardown;
- PFLT_INSTANCE_TEARDOWN_CALLBACK InstanceTeardownStart;
- PFLT_INSTANCE_TEARDOWN_CALLBACK InstanceTeardownComplete;
- PVOID SupportedContextsListHead; //PALLOCATE_CONTEXT_HEADER
- PVOID SupportedContexts; //PALLOCATE_CONTEXT_HEADER
- PVOID PreVolumeMount;
- PVOID PostVolumeMount;
- PFLT_GENERATE_FILE_NAME GenerateFileName;
- PFLT_NORMALIZE_NAME_COMPONENT NormalizeNameComponent;
- PFLT_NORMALIZE_CONTEXT_CLEANUP NormalizeContextCleanup;
- PFLT_OPERATION_REGISTRATION Operations;
- PFLT_FILTER_UNLOAD_CALLBACK OldDriverUnload;
- FLT_MUTEX_LIST_HEAD ActiveOpens;
- FLT_MUTEX_LIST_HEAD PortList;
- EX_PUSH_LOCK PortLock;
-
-} FLT_FILTER, *PFLT_FILTER;
-
-typedef enum _FLT_INSTANCE_FLAGS
-{
- INSFL_CAN_BE_DETACHED = 0x01,
- INSFL_DELETING = 0x02,
- INSFL_INITING = 0x04
-
-} FLT_INSTANCE_FLAGS, *PFLT_INSTANCE_FLAGS;
-
-typedef struct _FLT_INSTANCE // size = 0x144
-{
- FLT_OBJECT Base;
- ULONG OperationRundownRef;
- PVOID Volume; //PFLT_VOLUME
- PFLT_FILTER Filter;
- FLT_INSTANCE_FLAGS Flags;
- UNICODE_STRING Altitude;
- UNICODE_STRING Name;
- LIST_ENTRY FilterLink;
- ERESOURCE ContextLock;
- PVOID Context;
- PVOID TrackCompletionNodes;
- PVOID CallbackNodes;
-
-} FLT_INSTANCE, *PFLT_INSTANCE;
+ /* The storage stack(disk) accociated with the file system device object we're attached to */
+ PDEVICE_OBJECT StorageStackDeviceObject;
+ /* Either physical drive for volume device objects otherwise
+ * it's the name of the control device we're attached to */
+ UNICODE_STRING DeviceName;
+ WCHAR DeviceNameBuffer[MAX_DEVNAME_LENGTH];
+} FLTMGR_DEVICE_EXTENSION, *PFLTMGR_DEVICE_EXTENSION;
+NTSTATUS
+FltpRegisterContexts(
+ _In_ PFLT_FILTER Filter,
+ _In_ const FLT_CONTEXT_REGISTRATION *Context
+);
VOID
FltpExInitializeRundownProtection(