+/* FILE_OBJECT.Flags */
+
+#define FO_FILE_OPEN 0x00000001
+#define FO_SYNCHRONOUS_IO 0x00000002
+#define FO_ALERTABLE_IO 0x00000004
+#define FO_NO_INTERMEDIATE_BUFFERING 0x00000008
+#define FO_WRITE_THROUGH 0x00000010
+#define FO_SEQUENTIAL_ONLY 0x00000020
+#define FO_CACHE_SUPPORTED 0x00000040
+#define FO_NAMED_PIPE 0x00000080
+#define FO_STREAM_FILE 0x00000100
+#define FO_MAILSLOT 0x00000200
+#define FO_GENERATE_AUDIT_ON_CLOSE 0x00000400
+#define FO_QUEUE_IRP_TO_THREAD 0x00000400
+#define FO_DIRECT_DEVICE_OPEN 0x00000800
+#define FO_FILE_MODIFIED 0x00001000
+#define FO_FILE_SIZE_CHANGED 0x00002000
+#define FO_CLEANUP_COMPLETE 0x00004000
+#define FO_TEMPORARY_FILE 0x00008000
+#define FO_DELETE_ON_CLOSE 0x00010000
+#define FO_OPENED_CASE_SENSITIVE 0x00020000
+#define FO_HANDLE_CREATED 0x00040000
+#define FO_FILE_FAST_IO_READ 0x00080000
+#define FO_RANDOM_ACCESS 0x00100000
+#define FO_FILE_OPEN_CANCELLED 0x00200000
+#define FO_VOLUME_OPEN 0x00400000
+#define FO_REMOTE_ORIGIN 0x01000000
+#define FO_DISALLOW_EXCLUSIVE 0x02000000
+#define FO_SKIP_COMPLETION_PORT 0x02000000
+#define FO_SKIP_SET_EVENT 0x04000000
+#define FO_SKIP_SET_FAST_IO 0x08000000
+
+/* VPB.Flags */
+#define VPB_MOUNTED 0x0001
+#define VPB_LOCKED 0x0002
+#define VPB_PERSISTENT 0x0004
+#define VPB_REMOVE_PENDING 0x0008
+#define VPB_RAW_MOUNT 0x0010
+#define VPB_DIRECT_WRITES_ALLOWED 0x0020
+
+#define MAXIMUM_VOLUME_LABEL_LENGTH (32 * sizeof(WCHAR))
+
+/* IRP.Flags */
+
+#define SL_FORCE_ACCESS_CHECK 0x01
+#define SL_OPEN_PAGING_FILE 0x02
+#define SL_OPEN_TARGET_DIRECTORY 0x04
+#define SL_CASE_SENSITIVE 0x80
+
+#define SL_KEY_SPECIFIED 0x01
+#define SL_OVERRIDE_VERIFY_VOLUME 0x02
+#define SL_WRITE_THROUGH 0x04
+#define SL_FT_SEQUENTIAL_WRITE 0x08
+
+#define SL_FAIL_IMMEDIATELY 0x01
+#define SL_EXCLUSIVE_LOCK 0x02
+
+#define SL_RESTART_SCAN 0x01
+#define SL_RETURN_SINGLE_ENTRY 0x02
+#define SL_INDEX_SPECIFIED 0x04
+
+#define SL_WATCH_TREE 0x01
+
+#define SL_ALLOW_RAW_MOUNT 0x01
+
+#define CTL_CODE(DeviceType, Function, Method, Access)( \
+ ((DeviceType) << 16) | ((Access) << 14) | ((Function) << 2) | (Method))
+
+#define DEVICE_TYPE_FROM_CTL_CODE(ctl) (((ULONG) (ctl & 0xffff0000)) >> 16)
+
+#define IRP_NOCACHE 0x00000001
+#define IRP_PAGING_IO 0x00000002
+#define IRP_MOUNT_COMPLETION 0x00000002
+#define IRP_SYNCHRONOUS_API 0x00000004
+#define IRP_ASSOCIATED_IRP 0x00000008
+#define IRP_BUFFERED_IO 0x00000010
+#define IRP_DEALLOCATE_BUFFER 0x00000020
+#define IRP_INPUT_OPERATION 0x00000040
+#define IRP_SYNCHRONOUS_PAGING_IO 0x00000040
+#define IRP_CREATE_OPERATION 0x00000080
+#define IRP_READ_OPERATION 0x00000100
+#define IRP_WRITE_OPERATION 0x00000200
+#define IRP_CLOSE_OPERATION 0x00000400
+#define IRP_DEFER_IO_COMPLETION 0x00000800
+#define IRP_OB_QUERY_NAME 0x00001000
+#define IRP_HOLD_DEVICE_QUEUE 0x00002000
+
+#define IRP_QUOTA_CHARGED 0x01
+#define IRP_ALLOCATED_MUST_SUCCEED 0x02
+#define IRP_ALLOCATED_FIXED_SIZE 0x04
+#define IRP_LOOKASIDE_ALLOCATION 0x08
+
+/*
+** IRP function codes
+*/
+
+#define IRP_MJ_CREATE 0x00
+#define IRP_MJ_CREATE_NAMED_PIPE 0x01
+#define IRP_MJ_CLOSE 0x02
+#define IRP_MJ_READ 0x03
+#define IRP_MJ_WRITE 0x04
+#define IRP_MJ_QUERY_INFORMATION 0x05
+#define IRP_MJ_SET_INFORMATION 0x06
+#define IRP_MJ_QUERY_EA 0x07
+#define IRP_MJ_SET_EA 0x08
+#define IRP_MJ_FLUSH_BUFFERS 0x09
+#define IRP_MJ_QUERY_VOLUME_INFORMATION 0x0a
+#define IRP_MJ_SET_VOLUME_INFORMATION 0x0b
+#define IRP_MJ_DIRECTORY_CONTROL 0x0c
+#define IRP_MJ_FILE_SYSTEM_CONTROL 0x0d
+#define IRP_MJ_DEVICE_CONTROL 0x0e
+#define IRP_MJ_INTERNAL_DEVICE_CONTROL 0x0f
+#define IRP_MJ_SCSI 0x0f
+#define IRP_MJ_SHUTDOWN 0x10
+#define IRP_MJ_LOCK_CONTROL 0x11
+#define IRP_MJ_CLEANUP 0x12
+#define IRP_MJ_CREATE_MAILSLOT 0x13
+#define IRP_MJ_QUERY_SECURITY 0x14
+#define IRP_MJ_SET_SECURITY 0x15
+#define IRP_MJ_POWER 0x16
+#define IRP_MJ_SYSTEM_CONTROL 0x17
+#define IRP_MJ_DEVICE_CHANGE 0x18
+#define IRP_MJ_QUERY_QUOTA 0x19
+#define IRP_MJ_SET_QUOTA 0x1a
+#define IRP_MJ_PNP 0x1b
+#define IRP_MJ_PNP_POWER 0x1b
+#define IRP_MJ_MAXIMUM_FUNCTION 0x1b
+
+#define IRP_MN_SCSI_CLASS 0x01
+
+#define IRP_MN_START_DEVICE 0x00
+#define IRP_MN_QUERY_REMOVE_DEVICE 0x01
+#define IRP_MN_REMOVE_DEVICE 0x02
+#define IRP_MN_CANCEL_REMOVE_DEVICE 0x03
+#define IRP_MN_STOP_DEVICE 0x04
+#define IRP_MN_QUERY_STOP_DEVICE 0x05
+#define IRP_MN_CANCEL_STOP_DEVICE 0x06
+
+#define IRP_MN_QUERY_DEVICE_RELATIONS 0x07
+#define IRP_MN_QUERY_INTERFACE 0x08
+#define IRP_MN_QUERY_CAPABILITIES 0x09
+#define IRP_MN_QUERY_RESOURCES 0x0A
+#define IRP_MN_QUERY_RESOURCE_REQUIREMENTS 0x0B
+#define IRP_MN_QUERY_DEVICE_TEXT 0x0C
+#define IRP_MN_FILTER_RESOURCE_REQUIREMENTS 0x0D
+
+#define IRP_MN_READ_CONFIG 0x0F
+#define IRP_MN_WRITE_CONFIG 0x10
+#define IRP_MN_EJECT 0x11
+#define IRP_MN_SET_LOCK 0x12
+#define IRP_MN_QUERY_ID 0x13
+#define IRP_MN_QUERY_PNP_DEVICE_STATE 0x14
+#define IRP_MN_QUERY_BUS_INFORMATION 0x15
+#define IRP_MN_DEVICE_USAGE_NOTIFICATION 0x16
+#define IRP_MN_SURPRISE_REMOVAL 0x17
+
+#define IRP_MN_WAIT_WAKE 0x00
+#define IRP_MN_POWER_SEQUENCE 0x01
+#define IRP_MN_SET_POWER 0x02
+#define IRP_MN_QUERY_POWER 0x03
+
+#define IRP_MN_QUERY_ALL_DATA 0x00
+#define IRP_MN_QUERY_SINGLE_INSTANCE 0x01
+#define IRP_MN_CHANGE_SINGLE_INSTANCE 0x02
+#define IRP_MN_CHANGE_SINGLE_ITEM 0x03
+#define IRP_MN_ENABLE_EVENTS 0x04
+#define IRP_MN_DISABLE_EVENTS 0x05
+#define IRP_MN_ENABLE_COLLECTION 0x06
+#define IRP_MN_DISABLE_COLLECTION 0x07
+#define IRP_MN_REGINFO 0x08
+#define IRP_MN_EXECUTE_METHOD 0x09
+
+#define IRP_MN_REGINFO_EX 0x0b
+
+typedef struct _VPB {
+ CSHORT Type;
+ CSHORT Size;
+ USHORT Flags;
+ USHORT VolumeLabelLength;
+ struct _DEVICE_OBJECT *DeviceObject;
+ struct _DEVICE_OBJECT *RealDevice;
+ ULONG SerialNumber;
+ ULONG ReferenceCount;
+ WCHAR VolumeLabel[MAXIMUM_VOLUME_LABEL_LENGTH / sizeof(WCHAR)];
+} VPB, *PVPB;
+
+typedef struct _DEVICE_OBJECT {
+ CSHORT Type;
+ USHORT Size;
+ LONG ReferenceCount;
+ struct _DRIVER_OBJECT *DriverObject;
+ struct _DEVICE_OBJECT *NextDevice;
+ struct _DEVICE_OBJECT *AttachedDevice;
+ struct _IRP *CurrentIrp;
+ PIO_TIMER Timer;
+ ULONG Flags;
+ ULONG Characteristics;
+ volatile PVPB Vpb;
+ PVOID DeviceExtension;
+ DEVICE_TYPE DeviceType;
+ CCHAR StackSize;
+ union {
+ LIST_ENTRY ListEntry;
+ WAIT_CONTEXT_BLOCK Wcb;
+ } Queue;
+ ULONG AlignmentRequirement;
+ KDEVICE_QUEUE DeviceQueue;
+ KDPC Dpc;
+ ULONG ActiveThreadCount;
+ PSECURITY_DESCRIPTOR SecurityDescriptor;
+ KEVENT DeviceLock;
+ USHORT SectorSize;
+ USHORT Spare1;
+ struct _DEVOBJ_EXTENSION *DeviceObjectExtension;
+ PVOID Reserved;
+} DEVICE_OBJECT, *PDEVICE_OBJECT;
+
+typedef struct _FILE_OBJECT
+{
+ CSHORT Type;
+ CSHORT Size;
+ PDEVICE_OBJECT DeviceObject;
+ PVPB Vpb;
+ PVOID FsContext;
+ PVOID FsContext2;
+ PSECTION_OBJECT_POINTERS SectionObjectPointer;
+ PVOID PrivateCacheMap;
+ NTSTATUS FinalStatus;
+ struct _FILE_OBJECT *RelatedFileObject;
+ BOOLEAN LockOperation;
+ BOOLEAN DeletePending;
+ BOOLEAN ReadAccess;
+ BOOLEAN WriteAccess;
+ BOOLEAN DeleteAccess;
+ BOOLEAN SharedRead;
+ BOOLEAN SharedWrite;
+ BOOLEAN SharedDelete;
+ ULONG Flags;
+ UNICODE_STRING FileName;
+ LARGE_INTEGER CurrentByteOffset;
+ volatile ULONG Waiters;
+ volatile ULONG Busy;
+ PVOID LastLock;
+ KEVENT Lock;
+ KEVENT Event;
+ volatile PIO_COMPLETION_CONTEXT CompletionContext;
+ KSPIN_LOCK IrpListLock;
+ LIST_ENTRY IrpList;
+ volatile PVOID FileObjectExtension;
+} FILE_OBJECT;
+typedef struct _FILE_OBJECT *PFILE_OBJECT;