#include <ntos/fstypes.h>
-/* Some comments on the Prototypes that aren't in the GNU IFS:
+/* Some comments on the Prototypes that aren't in the IFS:
-The following come from alternate sources, or guessed from documentation:
-FsRtlNotifyFullChangeDirectory GOOGLE GROUPS
-FsRtlIsPagingFile OSR DOCUMENTATION
-FsRtlAcquireFileExclusive (GUESS: The function takes a single parameter. The function name is "AcquireFile". Logical assumption says this is a File Object. NTFSD ML Post confirms.)
-FsRtlReleaseFile (GUESS: The function takes a single parameter. The function name is "AcquireFile". Logical assumption says this is a File Object. NTFSD ML Post confirms.)
FsRtlMdlReadCompleteDev (FsRtlMdlReadComplete is on GNU IFS. The Dev Suffix simply means an extra PDEVICE_OBJECT param)
FsRtlMdlReadDev (FsRtlMdlReadDev is on GNU IFS. The Dev Suffix simply means an extra PDEVICE_OBJECT param)
FsRtlMdlWriteCompleteDev FsRtlMdlWriteCompleteDev is on GNU IFS. The Dev Suffix simply means an extra PDEVICE_OBJECT param)
FsRtlPrepareMdlWrite (Compared with CcMdlWrite, which is already documented)
FsRtlPrepareMdlWriteDev (Same as above, and add a pointer to device object (Dev suffix)
-FsRtlGetNextMcbEntry(FsRtlGetNextLargeMcbEntry is documented and uses LONGLONGs. Logical assumption that this one only uses LONGS and non-large MCB (Documented))
-
-Stream Context. Going along with public OSR documenttion:
-
-FsRtlInsertPerStreamContext:
-"This call is used by the file system filter driver to associate a given context block
-(allocated by the filter and initialized using FsRtlInitPerStreamContext) with the stream associated with the given file object."
-Notice we are told "given context block...initialized using FsRtlInitPerStreamContext". This function description tells us:
-" provide space for the FSRTL_PER_STREAM_CONTEXT block in the filter driver\92s context structure"
-Therefore, one of the parameters is PFSRTL_PER_STREAM_CONTEXT.
-"with the stream associated with the given file object." The OSR Documentations then mentions:
-"Tracking per-file (or \93per stream\94) context information in FSRTL_ADVANCED_FCB_HEADER"
-So we are associating a FSRTL_PER_STREAM_CONTEXT block with the FSRTL_ADVANCED_FCB_HEADER associated with the file object.
-FSRTL_ADVANCED_FCB_HEADER is documented by a search through Google.
-FSRTL_PER_STREAM_CONTEXT is *NOT* documented anywhere else then in the IFS, so it has been removed.
-
-FsRtlLookupPerStreamContextInternal
-"FsRtlLookupPerStreamContext \96 this call is used by the file system filter driver to locate a given context
-block that is associated with the file object. Typically, a file system filter driver will identify its
-own context block using unique OwnerId and InstanceId parameters when creating the context block and subsequently
-when locating the associated information."
-OSR tells us here that the last two parameters are OwnerId and InstanceId. It also says it will find a given context block,
-so there's our Return Value. (Although, not being documented, we must put PVOID). It looks into a file object's stream, so we
-probably need that FCB header again.
-
-FsRtlRemovePerStreamContext
-OSR is vague, so all we know for sure is that we are sending an FCB Header. The return value isn't NTSTATUS, but seems to be a
-pointer. We don't know what the two other parameters are, so they have been marked as unknown.
-
-FsRtlTeardownPerStreamContexts
-OSR doens't tell a lot, but we only have one parameter. It must be the FCB Header. Furthermore, the CVS of Captive implements
-this function as a stub, and confirms the theory.
*/
IN BOOLEAN IgnoreCase,
IN PWCHAR UpcaseTable OPTIONAL
);
-DWORD
+NTSTATUS
STDCALL
FsRtlBalanceReads (
- DWORD Unknown0
+ PDEVICE_OBJECT TargetDevice
);
BOOLEAN
STDCALL
BOOLEAN STDCALL
FsRtlIsDbcsInExpression(IN PANSI_STRING Expression,
IN PANSI_STRING Name);
+
+BOOLEAN
+STDCALL
+FsRtlIsFatDbcsLegal(IN ANSI_STRING DbcsName,
+ IN BOOLEAN WildCardsPermissible,
+ IN BOOLEAN PathNamePermissible,
+ IN BOOLEAN LeadingBackslashPermissible);
-BOOLEAN STDCALL
-FsRtlIsFatDbcsLegal(IN ANSI_STRING Name,
- IN BOOLEAN Unknown2,
- IN BOOLEAN Unknown3,
- IN BOOLEAN Unknown4);
-
-BOOLEAN STDCALL
-FsRtlIsHpfsDbcsLegal(IN ANSI_STRING Name,
- IN BOOLEAN Unknown2,
- IN BOOLEAN Unknown3,
- IN BOOLEAN Unknown4);
+BOOLEAN
+STDCALL
+FsRtlIsHpfsDbcsLegal(IN ANSI_STRING DbcsName,
+ IN BOOLEAN WildCardsPermissible,
+ IN BOOLEAN PathNamePermissible,
+ IN BOOLEAN LeadingBackslashPermissible);
BOOLEAN
STDCALL
VOID
STDCALL
-FsRtlPostPagingFileStackOverflow (
- ULONG Unknown0,
- ULONG Unknown1,
- ULONG Unknown2
- );
+FsRtlPostPagingFileStackOverflow(IN PVOID Context,
+ IN PKEVENT Event,
+ IN PFSRTL_STACK_OVERFLOW_ROUTINE StackOverflowRoutine) ;
VOID
STDCALL
-FsRtlPostStackOverflow (
- ULONG Unknown0,
- ULONG Unknown1,
- ULONG Unknown2
- );
+FsRtlPostStackOverflow (IN PVOID Context,
+ IN PKEVENT Event,
+ IN PFSRTL_STACK_OVERFLOW_ROUTINE StackOverflowRoutine) ;
BOOLEAN
STDCALL
NTSTATUS
STDCALL
-FsRtlRegisterFileSystemFilterCallbacks (
- IN PVOID Unknown1,
- IN PVOID Unknown2
- );
+FsRtlRegisterFileSystemFilterCallbacks(IN PDRIVER_OBJECT FilterDriverObject,
+ IN PFS_FILTER_CALLBACKS Callbacks);
NTSTATUS STDCALL
FsRtlRegisterUncProvider(IN OUT PHANDLE Handle,
STDCALL
FsRtlRemovePerStreamContext (
IN PFSRTL_ADVANCED_FCB_HEADER StreamContext,
- IN PVOID Unknown1 OPTIONAL,
- IN PVOID Unknown2 OPTIONAL
+ IN PVOID OwnerId OPTIONAL,
+ IN PVOID InstanceId OPTIONAL
);
PVOID /* PFSRTL_PER_FILE_OBJECT_CONTEXT*/