WDK Mini Filter Example
delete.c File Reference
#include <fltKernel.h>
#include <dontuse.h>
#include <suppress.h>

Go to the source code of this file.

Data Structures

union  _DF_FILE_REFERENCE
 
struct  _DF_INSTANCE_CONTEXT
 
struct  _DF_STREAM_CONTEXT
 
struct  _DF_TRANSACTION_CONTEXT
 
struct  _DF_DELETE_NOTIFY
 

Macros

#define DFDBG_TRACE_ERRORS   0x00000001
 
#define DFDBG_TRACE_ROUTINES   0x00000002
 
#define DFDBG_TRACE_OPERATION_STATUS   0x00000004
 
#define DF_VOLUME_GUID_NAME_SIZE   48
 
#define DF_INSTANCE_CONTEXT_POOL_TAG   'nIfD'
 
#define DF_STREAM_CONTEXT_POOL_TAG   'xSfD'
 
#define DF_TRANSACTION_CONTEXT_POOL_TAG   'xTfD'
 
#define DF_ERESOURCE_POOL_TAG   'sRfD'
 
#define DF_DELETE_NOTIFY_POOL_TAG   'nDfD'
 
#define DF_STRING_POOL_TAG   'rSfD'
 
#define DF_CONTEXT_POOL_TYPE   PagedPool
 
#define DF_NOTIFICATION_MASK
 
#define DF_PRINT(...)   DbgPrintEx( DPFLTR_FLTMGR_ID, DPFLTR_ERROR_LEVEL, __VA_ARGS__ )
 
#define DF_DBG_PRINT(_dbgLevel, ...)
 
#define FlagOnAll(F, T)   (FlagOn( F, T ) == T)
 
#define DfSizeofFileId(FID)
 

Typedefs

typedef union _DF_FILE_REFERENCE DF_FILE_REFERENCE
 
typedef union _DF_FILE_REFERENCEPDF_FILE_REFERENCE
 
typedef struct _DF_INSTANCE_CONTEXT DF_INSTANCE_CONTEXT
 
typedef struct _DF_INSTANCE_CONTEXTPDF_INSTANCE_CONTEXT
 
typedef struct _DF_STREAM_CONTEXT DF_STREAM_CONTEXT
 
typedef struct _DF_STREAM_CONTEXTPDF_STREAM_CONTEXT
 
typedef struct _DF_TRANSACTION_CONTEXT DF_TRANSACTION_CONTEXT
 
typedef struct _DF_TRANSACTION_CONTEXTPDF_TRANSACTION_CONTEXT
 
typedef struct _DF_DELETE_NOTIFY DF_DELETE_NOTIFY
 
typedef struct _DF_DELETE_NOTIFYPDF_DELETE_NOTIFY
 

Functions

NTSTATUS DriverEntry (_In_ PDRIVER_OBJECT DriverObject, _In_ PUNICODE_STRING RegistryPath)
 
NTSTATUS DfUnload (_In_ FLT_FILTER_UNLOAD_FLAGS Flags)
 
NTSTATUS DfInstanceSetup (_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_SETUP_FLAGS Flags, _In_ DEVICE_TYPE VolumeDeviceType, _In_ FLT_FILESYSTEM_TYPE VolumeFilesystemType)
 
NTSTATUS DfInstanceQueryTeardown (_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags)
 
VOID DfInstanceTeardownStart (_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_TEARDOWN_FLAGS Flags)
 
VOID DfInstanceTeardownComplete (_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_TEARDOWN_FLAGS Flags)
 
NTSTATUS DfSetupInstanceContext (_In_ PCFLT_RELATED_OBJECTS FltObjects)
 
NTSTATUS DfAllocateContext (_In_ FLT_CONTEXT_TYPE ContextType, _Outptr_ PFLT_CONTEXT *Context)
 
NTSTATUS DfSetContext (_In_ PCFLT_RELATED_OBJECTS FltObjects, _When_(ContextType==FLT_INSTANCE_CONTEXT, _In_opt_) _When_(ContextType!=FLT_INSTANCE_CONTEXT, _In_) PVOID Target, _In_ FLT_CONTEXT_TYPE ContextType, _In_ PFLT_CONTEXT NewContext, _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext)
 
NTSTATUS DfGetContext (_In_ PCFLT_RELATED_OBJECTS FltObjects, _When_(ContextType==FLT_INSTANCE_CONTEXT, _In_opt_) _When_(ContextType!=FLT_INSTANCE_CONTEXT, _In_) PVOID Target, _In_ FLT_CONTEXT_TYPE ContextType, _Outptr_ PFLT_CONTEXT *Context)
 
NTSTATUS DfGetOrSetContext (_In_ PCFLT_RELATED_OBJECTS FltObjects, _When_(ContextType==FLT_INSTANCE_CONTEXT, _In_opt_) _When_(ContextType!=FLT_INSTANCE_CONTEXT, _In_) PVOID Target, _Outptr_ _Pre_valid_ PFLT_CONTEXT *Context, _In_ FLT_CONTEXT_TYPE ContextType)
 
VOID DfStreamContextCleanupCallback (_In_ PDF_STREAM_CONTEXT StreamContext, _In_ FLT_CONTEXT_TYPE ContextType)
 
VOID DfTransactionContextCleanupCallback (_In_ PDF_TRANSACTION_CONTEXT TransactionContext, _In_ FLT_CONTEXT_TYPE ContextType)
 
VOID DfInstanceContextCleanupCallback (_In_ PDF_INSTANCE_CONTEXT InstanceContext, _In_ FLT_CONTEXT_TYPE ContextType)
 
NTSTATUS DfGetFileNameInformation (_In_ PFLT_CALLBACK_DATA Data, _Inout_ PDF_STREAM_CONTEXT StreamContext)
 
NTSTATUS DfAllocateUnicodeString (_Inout_ PUNICODE_STRING String)
 
VOID DfFreeUnicodeString (_Inout_ PUNICODE_STRING String)
 
NTSTATUS DfBuildFileIdString (_In_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ PDF_STREAM_CONTEXT StreamContext, _Out_ PUNICODE_STRING String)
 
NTSTATUS DfDetectDeleteByFileId (_In_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ PDF_STREAM_CONTEXT StreamContext)
 
NTSTATUS DfIsFileDeleted (_In_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ PDF_STREAM_CONTEXT StreamContext, _In_ BOOLEAN IsTransaction)
 
NTSTATUS DfAddTransDeleteNotify (_Inout_ PDF_STREAM_CONTEXT StreamContext, _Inout_ PDF_TRANSACTION_CONTEXT TransactionContext, _In_ BOOLEAN FileDelete)
 
VOID DfNotifyDelete (_In_ PDF_STREAM_CONTEXT StreamContext, _In_ BOOLEAN IsFile, _Inout_opt_ PDF_TRANSACTION_CONTEXT TransactionContext)
 
VOID DfNotifyDeleteOnTransactionEnd (_In_ PDF_DELETE_NOTIFY DeleteNotify, _In_ BOOLEAN Commit)
 
NTSTATUS DfProcessDelete (_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ PDF_STREAM_CONTEXT StreamContext)
 
FLT_PREOP_CALLBACK_STATUS DfPreCreateCallback (_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Outptr_result_maybenull_ PVOID *CompletionContext)
 
FLT_POSTOP_CALLBACK_STATUS DfPostCreateCallback (_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ PVOID CompletionContext, _In_ FLT_POST_OPERATION_FLAGS Flags)
 
FLT_PREOP_CALLBACK_STATUS DfPreSetInfoCallback (_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)
 
FLT_POSTOP_CALLBACK_STATUS DfPostSetInfoCallback (_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ PVOID CompletionContext, _In_ FLT_POST_OPERATION_FLAGS Flags)
 
FLT_PREOP_CALLBACK_STATUS DfPreCleanupCallback (_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)
 
FLT_POSTOP_CALLBACK_STATUS DfPostCleanupCallback (_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ PVOID CompletionContext, _In_ FLT_POST_OPERATION_FLAGS Flags)
 
NTSTATUS DfTransactionNotificationCallback (_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ PDF_TRANSACTION_CONTEXT TransactionContext, _In_ ULONG NotificationMask)
 
NTSTATUS DfGetVolumeGuidName (_In_ PCFLT_RELATED_OBJECTS FltObjects, _Inout_ PUNICODE_STRING VolumeGuidName)
 
NTSTATUS DfGetFileId (_In_ PFLT_CALLBACK_DATA Data, _Inout_ PDF_STREAM_CONTEXT StreamContext)
 

Variables

PFLT_FILTER gFilterHandle
 
ULONG gTraceFlags = DFDBG_TRACE_ERRORS
 
DRIVER_INITIALIZE DriverEntry
 
CONST FLT_CONTEXT_REGISTRATION Contexts []
 
CONST FLT_OPERATION_REGISTRATION Callbacks []
 
CONST FLT_REGISTRATION FilterRegistration
 

Macro Definition Documentation

◆ DF_CONTEXT_POOL_TYPE

#define DF_CONTEXT_POOL_TYPE   PagedPool

Definition at line 43 of file delete.c.

◆ DF_DBG_PRINT

#define DF_DBG_PRINT (   _dbgLevel,
  ... 
)
Value:
(FlagOn( gTraceFlags, (_dbgLevel) ) ? \
DF_PRINT( __VA_ARGS__ ): \
(0))
ULONG gTraceFlags
Definition: delete.c:70
#define FlagOn(_F, _SF)
Definition: minispy.h:247

Definition at line 56 of file delete.c.

◆ DF_DELETE_NOTIFY_POOL_TAG

#define DF_DELETE_NOTIFY_POOL_TAG   'nDfD'

Definition at line 40 of file delete.c.

◆ DF_ERESOURCE_POOL_TAG

#define DF_ERESOURCE_POOL_TAG   'sRfD'

Definition at line 39 of file delete.c.

◆ DF_INSTANCE_CONTEXT_POOL_TAG

#define DF_INSTANCE_CONTEXT_POOL_TAG   'nIfD'

Definition at line 36 of file delete.c.

◆ DF_NOTIFICATION_MASK

#define DF_NOTIFICATION_MASK
Value:
(TRANSACTION_NOTIFY_COMMIT_FINALIZE | \
TRANSACTION_NOTIFY_ROLLBACK)

Definition at line 45 of file delete.c.

◆ DF_PRINT

#define DF_PRINT (   ...)    DbgPrintEx( DPFLTR_FLTMGR_ID, DPFLTR_ERROR_LEVEL, __VA_ARGS__ )

Definition at line 53 of file delete.c.

◆ DF_STREAM_CONTEXT_POOL_TAG

#define DF_STREAM_CONTEXT_POOL_TAG   'xSfD'

Definition at line 37 of file delete.c.

◆ DF_STRING_POOL_TAG

#define DF_STRING_POOL_TAG   'rSfD'

Definition at line 41 of file delete.c.

◆ DF_TRANSACTION_CONTEXT_POOL_TAG

#define DF_TRANSACTION_CONTEXT_POOL_TAG   'xTfD'

Definition at line 38 of file delete.c.

◆ DF_VOLUME_GUID_NAME_SIZE

#define DF_VOLUME_GUID_NAME_SIZE   48

Definition at line 34 of file delete.c.

◆ DFDBG_TRACE_ERRORS

#define DFDBG_TRACE_ERRORS   0x00000001

Definition at line 30 of file delete.c.

◆ DFDBG_TRACE_OPERATION_STATUS

#define DFDBG_TRACE_OPERATION_STATUS   0x00000004

Definition at line 32 of file delete.c.

◆ DFDBG_TRACE_ROUTINES

#define DFDBG_TRACE_ROUTINES   0x00000002

Definition at line 31 of file delete.c.

◆ DfSizeofFileId

#define DfSizeofFileId (   FID)
Value:
( \
((FID).FileId64.UpperZeroes == 0ll) ? \
sizeof((FID).FileId64.Value) : \
sizeof((FID).FileId128) \
)

Definition at line 92 of file delete.c.

◆ FlagOnAll

#define FlagOnAll (   F,
 
)    (FlagOn( F, T ) == T)

Definition at line 61 of file delete.c.

Typedef Documentation

◆ DF_DELETE_NOTIFY

◆ DF_FILE_REFERENCE

◆ DF_INSTANCE_CONTEXT

◆ DF_STREAM_CONTEXT

◆ DF_TRANSACTION_CONTEXT

◆ PDF_DELETE_NOTIFY

◆ PDF_FILE_REFERENCE

◆ PDF_INSTANCE_CONTEXT

◆ PDF_STREAM_CONTEXT

◆ PDF_TRANSACTION_CONTEXT

Function Documentation

◆ DfAddTransDeleteNotify()

NTSTATUS DfAddTransDeleteNotify ( _Inout_ PDF_STREAM_CONTEXT  StreamContext,
_Inout_ PDF_TRANSACTION_CONTEXT  TransactionContext,
_In_ BOOLEAN  FileDelete 
)

Definition at line 2278 of file delete.c.

◆ DfAllocateContext()

NTSTATUS DfAllocateContext ( _In_ FLT_CONTEXT_TYPE  ContextType,
_Outptr_ PFLT_CONTEXT *  Context 
)

Definition at line 902 of file delete.c.

◆ DfAllocateUnicodeString()

NTSTATUS DfAllocateUnicodeString ( _Inout_ PUNICODE_STRING  String)

Definition at line 1658 of file delete.c.

◆ DfBuildFileIdString()

NTSTATUS DfBuildFileIdString ( _In_ PFLT_CALLBACK_DATA  Data,
_In_ PCFLT_RELATED_OBJECTS  FltObjects,
_In_ PDF_STREAM_CONTEXT  StreamContext,
_Out_ PUNICODE_STRING  String 
)

Definition at line 1906 of file delete.c.

◆ DfDetectDeleteByFileId()

NTSTATUS DfDetectDeleteByFileId ( _In_ PFLT_CALLBACK_DATA  Data,
_In_ PCFLT_RELATED_OBJECTS  FltObjects,
_In_ PDF_STREAM_CONTEXT  StreamContext 
)

Definition at line 2019 of file delete.c.

◆ DfFreeUnicodeString()

VOID DfFreeUnicodeString ( _Inout_ PUNICODE_STRING  String)

Definition at line 1705 of file delete.c.

◆ DfGetContext()

NTSTATUS DfGetContext ( _In_ PCFLT_RELATED_OBJECTS  FltObjects,
_When_(ContextType==FLT_INSTANCE_CONTEXT, _In_opt_) _When_(ContextType!=FLT_INSTANCE_CONTEXT, _In_) PVOID  Target,
_In_ FLT_CONTEXT_TYPE  ContextType,
_Outptr_ PFLT_CONTEXT *  Context 
)

Definition at line 1072 of file delete.c.

◆ DfGetFileId()

NTSTATUS DfGetFileId ( _In_ PFLT_CALLBACK_DATA  Data,
_Inout_ PDF_STREAM_CONTEXT  StreamContext 
)

Definition at line 1544 of file delete.c.

◆ DfGetFileNameInformation()

NTSTATUS DfGetFileNameInformation ( _In_ PFLT_CALLBACK_DATA  Data,
_Inout_ PDF_STREAM_CONTEXT  StreamContext 
)

Definition at line 1471 of file delete.c.

◆ DfGetOrSetContext()

NTSTATUS DfGetOrSetContext ( _In_ PCFLT_RELATED_OBJECTS  FltObjects,
_When_(ContextType==FLT_INSTANCE_CONTEXT, _In_opt_) _When_(ContextType!=FLT_INSTANCE_CONTEXT, _In_) PVOID  Target,
_Outptr_ _Pre_valid_ PFLT_CONTEXT *  Context,
_In_ FLT_CONTEXT_TYPE  ContextType 
)

Definition at line 1136 of file delete.c.

◆ DfGetVolumeGuidName()

NTSTATUS DfGetVolumeGuidName ( _In_ PCFLT_RELATED_OBJECTS  FltObjects,
_Inout_ PUNICODE_STRING  VolumeGuidName 
)

Definition at line 1738 of file delete.c.

◆ DfInstanceContextCleanupCallback()

VOID DfInstanceContextCleanupCallback ( _In_ PDF_INSTANCE_CONTEXT  InstanceContext,
_In_ FLT_CONTEXT_TYPE  ContextType 
)

Definition at line 1437 of file delete.c.

◆ DfInstanceQueryTeardown()

NTSTATUS DfInstanceQueryTeardown ( _In_ PCFLT_RELATED_OBJECTS  FltObjects,
_In_ FLT_INSTANCE_QUERY_TEARDOWN_FLAGS  Flags 
)

Definition at line 792 of file delete.c.

◆ DfInstanceSetup()

NTSTATUS DfInstanceSetup ( _In_ PCFLT_RELATED_OBJECTS  FltObjects,
_In_ FLT_INSTANCE_SETUP_FLAGS  Flags,
_In_ DEVICE_TYPE  VolumeDeviceType,
_In_ FLT_FILESYSTEM_TYPE  VolumeFilesystemType 
)

Definition at line 710 of file delete.c.

◆ DfInstanceTeardownComplete()

VOID DfInstanceTeardownComplete ( _In_ PCFLT_RELATED_OBJECTS  FltObjects,
_In_ FLT_INSTANCE_TEARDOWN_FLAGS  Flags 
)

Definition at line 864 of file delete.c.

◆ DfInstanceTeardownStart()

VOID DfInstanceTeardownStart ( _In_ PCFLT_RELATED_OBJECTS  FltObjects,
_In_ FLT_INSTANCE_TEARDOWN_FLAGS  Flags 
)

Definition at line 830 of file delete.c.

◆ DfIsFileDeleted()

NTSTATUS DfIsFileDeleted ( _In_ PFLT_CALLBACK_DATA  Data,
_In_ PCFLT_RELATED_OBJECTS  FltObjects,
_In_ PDF_STREAM_CONTEXT  StreamContext,
_In_ BOOLEAN  IsTransaction 
)

Definition at line 2135 of file delete.c.

◆ DfNotifyDelete()

VOID DfNotifyDelete ( _In_ PDF_STREAM_CONTEXT  StreamContext,
_In_ BOOLEAN  IsFile,
_Inout_opt_ PDF_TRANSACTION_CONTEXT  TransactionContext 
)

Definition at line 2341 of file delete.c.

◆ DfNotifyDeleteOnTransactionEnd()

VOID DfNotifyDeleteOnTransactionEnd ( _In_ PDF_DELETE_NOTIFY  DeleteNotify,
_In_ BOOLEAN  Commit 
)

Definition at line 2410 of file delete.c.

◆ DfPostCleanupCallback()

FLT_POSTOP_CALLBACK_STATUS DfPostCleanupCallback ( _Inout_ PFLT_CALLBACK_DATA  Data,
_In_ PCFLT_RELATED_OBJECTS  FltObjects,
_In_ PVOID  CompletionContext,
_In_ FLT_POST_OPERATION_FLAGS  Flags 
)

Definition at line 3073 of file delete.c.

◆ DfPostCreateCallback()

FLT_POSTOP_CALLBACK_STATUS DfPostCreateCallback ( _Inout_ PFLT_CALLBACK_DATA  Data,
_In_ PCFLT_RELATED_OBJECTS  FltObjects,
_In_ PVOID  CompletionContext,
_In_ FLT_POST_OPERATION_FLAGS  Flags 
)

Definition at line 2652 of file delete.c.

◆ DfPostSetInfoCallback()

FLT_POSTOP_CALLBACK_STATUS DfPostSetInfoCallback ( _Inout_ PFLT_CALLBACK_DATA  Data,
_In_ PCFLT_RELATED_OBJECTS  FltObjects,
_In_ PVOID  CompletionContext,
_In_ FLT_POST_OPERATION_FLAGS  Flags 
)

Definition at line 2867 of file delete.c.

◆ DfPreCleanupCallback()

FLT_PREOP_CALLBACK_STATUS DfPreCleanupCallback ( _Inout_ PFLT_CALLBACK_DATA  Data,
_In_ PCFLT_RELATED_OBJECTS  FltObjects,
_Flt_CompletionContext_Outptr_ PVOID *  CompletionContext 
)

Definition at line 2985 of file delete.c.

◆ DfPreCreateCallback()

FLT_PREOP_CALLBACK_STATUS DfPreCreateCallback ( _Inout_ PFLT_CALLBACK_DATA  Data,
_In_ PCFLT_RELATED_OBJECTS  FltObjects,
_Outptr_result_maybenull_ PVOID *  CompletionContext 
)

Definition at line 2568 of file delete.c.

◆ DfPreSetInfoCallback()

FLT_PREOP_CALLBACK_STATUS DfPreSetInfoCallback ( _Inout_ PFLT_CALLBACK_DATA  Data,
_In_ PCFLT_RELATED_OBJECTS  FltObjects,
_Flt_CompletionContext_Outptr_ PVOID *  CompletionContext 
)

Definition at line 2754 of file delete.c.

◆ DfProcessDelete()

NTSTATUS DfProcessDelete ( _Inout_ PFLT_CALLBACK_DATA  Data,
_In_ PCFLT_RELATED_OBJECTS  FltObjects,
_In_ PDF_STREAM_CONTEXT  StreamContext 
)

Definition at line 2467 of file delete.c.

◆ DfSetContext()

NTSTATUS DfSetContext ( _In_ PCFLT_RELATED_OBJECTS  FltObjects,
_When_(ContextType==FLT_INSTANCE_CONTEXT, _In_opt_) _When_(ContextType!=FLT_INSTANCE_CONTEXT, _In_) PVOID  Target,
_In_ FLT_CONTEXT_TYPE  ContextType,
_In_ PFLT_CONTEXT  NewContext,
_Outptr_opt_result_maybenull_ PFLT_CONTEXT *  OldContext 
)

Definition at line 996 of file delete.c.

◆ DfSetupInstanceContext()

NTSTATUS DfSetupInstanceContext ( _In_ PCFLT_RELATED_OBJECTS  FltObjects)

◆ DfStreamContextCleanupCallback()

VOID DfStreamContextCleanupCallback ( _In_ PDF_STREAM_CONTEXT  StreamContext,
_In_ FLT_CONTEXT_TYPE  ContextType 
)

Definition at line 1336 of file delete.c.

◆ DfTransactionContextCleanupCallback()

VOID DfTransactionContextCleanupCallback ( _In_ PDF_TRANSACTION_CONTEXT  TransactionContext,
_In_ FLT_CONTEXT_TYPE  ContextType 
)

Definition at line 1374 of file delete.c.

◆ DfTransactionNotificationCallback()

NTSTATUS DfTransactionNotificationCallback ( _In_ PCFLT_RELATED_OBJECTS  FltObjects,
_In_ PDF_TRANSACTION_CONTEXT  TransactionContext,
_In_ ULONG  NotificationMask 
)

Definition at line 3194 of file delete.c.

◆ DfUnload()

NTSTATUS DfUnload ( _In_ FLT_FILTER_UNLOAD_FLAGS  Flags)

Definition at line 672 of file delete.c.

◆ DriverEntry()

NTSTATUS DriverEntry ( _In_ PDRIVER_OBJECT  DriverObject,
_In_ PUNICODE_STRING  RegistryPath 
)

Definition at line 605 of file delete.c.

Variable Documentation

◆ Callbacks

CONST FLT_OPERATION_REGISTRATION Callbacks[]
Initial value:
= {
0,
FLTFL_OPERATION_REGISTRATION_SKIP_PAGING_IO,
0,
{ IRP_MJ_OPERATION_END }
}
FLT_POSTOP_CALLBACK_STATUS DfPostCleanupCallback(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ PVOID CompletionContext, _In_ FLT_POST_OPERATION_FLAGS Flags)
Definition: delete.c:3073
FLT_POSTOP_CALLBACK_STATUS DfPostSetInfoCallback(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ PVOID CompletionContext, _In_ FLT_POST_OPERATION_FLAGS Flags)
Definition: delete.c:2867
#define IRP_MJ_CLEANUP
Definition: mspyLog.h:302
FLT_PREOP_CALLBACK_STATUS DfPreCleanupCallback(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)
Definition: delete.c:2985
FLT_PREOP_CALLBACK_STATUS DfPreCreateCallback(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Outptr_result_maybenull_ PVOID *CompletionContext)
Definition: delete.c:2568
#define IRP_MJ_SET_INFORMATION
Definition: mspyLog.h:290
FLT_PREOP_CALLBACK_STATUS DfPreSetInfoCallback(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)
Definition: delete.c:2754
FLT_POSTOP_CALLBACK_STATUS DfPostCreateCallback(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ PVOID CompletionContext, _In_ FLT_POST_OPERATION_FLAGS Flags)
Definition: delete.c:2652
#define IRP_MJ_CREATE
Definition: mspyLog.h:284

Definition at line 550 of file delete.c.

◆ Contexts

CONST FLT_CONTEXT_REGISTRATION Contexts[]

Definition at line 512 of file delete.c.

◆ DriverEntry

DRIVER_INITIALIZE DriverEntry

Definition at line 244 of file delete.c.

◆ FilterRegistration

CONST FLT_REGISTRATION FilterRegistration
Initial value:
= {
sizeof( FLT_REGISTRATION ),
FLT_REGISTRATION_VERSION,
0,
NULL,
NULL,
NULL,
}
CONST FLT_OPERATION_REGISTRATION Callbacks[]
Definition: delete.c:550
NTSTATUS DfTransactionNotificationCallback(_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ PDF_TRANSACTION_CONTEXT TransactionContext, _In_ ULONG NotificationMask)
Definition: delete.c:3194
NTSTATUS DfInstanceSetup(_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_SETUP_FLAGS Flags, _In_ DEVICE_TYPE VolumeDeviceType, _In_ FLT_FILESYSTEM_TYPE VolumeFilesystemType)
Definition: delete.c:710
VOID DfInstanceTeardownStart(_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_TEARDOWN_FLAGS Flags)
Definition: delete.c:830
NcLoadRegistryStringRetry NULL
Definition: ncinit.c:53
NTSTATUS DfUnload(_In_ FLT_FILTER_UNLOAD_FLAGS Flags)
Definition: delete.c:672
VOID DfInstanceTeardownComplete(_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_TEARDOWN_FLAGS Flags)
Definition: delete.c:864
NTSTATUS DfInstanceQueryTeardown(_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags)
Definition: delete.c:792
CONST FLT_CONTEXT_REGISTRATION Contexts[]
Definition: delete.c:512

Definition at line 576 of file delete.c.

◆ gFilterHandle

PFLT_FILTER gFilterHandle

Definition at line 69 of file delete.c.

◆ gTraceFlags

ULONG gTraceFlags = DFDBG_TRACE_ERRORS

Definition at line 70 of file delete.c.

Social Network


Services Overview

Architect, implement and test file system filter drivers for a wide range of functionality. We can offer several levels of assistance to meet your specific.

Contact Us

You are welcome to contact us for salse or partnership.

Sales: sales@easefilter.com
Support: support@easefilter.com
Info: info@easefilter.com