WDK Mini Filter Example
nc.c
Go to the documentation of this file.
1 /*++
2 
3 Copyright (c) 1999 - 2002 Microsoft Corporation
4 
5 Module Name:
6 
7  nc.c
8 
9 Abstract:
10 
11  This is the main module of the NameChanger MiniFilter driver.
12  This filter grafts a directory from one part of a volume's namespace
13  to another part using a mapping. The filter then maintains the illusion
14  by acting as a name provider, injecting entries into directory enumerations
15  and forwarding directory change notifications.
16 
17 Environment:
18 
19  Kernel mode
20 
21 --*/
22 
23 #include <dontuse.h>
24 #include <suppress.h>
25 
26 #include "nc.h"
27 
28 
29 //
30 // Prototypes
31 //
32 
33 DRIVER_INITIALIZE DriverEntry;
34 NTSTATUS
36  _In_ PDRIVER_OBJECT DriverObject,
37  _In_ PUNICODE_STRING RegistryPath
38  );
39 
40 NTSTATUS
42  _In_ PCFLT_RELATED_OBJECTS FltObjects,
43  _In_ FLT_INSTANCE_SETUP_FLAGS Flags,
44  _In_ DEVICE_TYPE VolumeDeviceType,
45  _In_ FLT_FILESYSTEM_TYPE VolumeFilesystemType
46  );
47 
48 VOID
50  _In_ PCFLT_RELATED_OBJECTS FltObjects,
51  _In_ FLT_INSTANCE_TEARDOWN_FLAGS Flags
52  );
53 
54 NTSTATUS
55 NcUnload (
56  _In_ FLT_FILTER_UNLOAD_FLAGS Flags
57  );
58 
59 NTSTATUS
61  _In_ PCFLT_RELATED_OBJECTS FltObjects,
62  _In_ FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags
63  );
64 
65 
66 //
67 // Assign sections for each routine.
68 //
69 
70 #ifdef ALLOC_PRAGMA
71 #pragma alloc_text(INIT, DriverEntry)
72 #pragma alloc_text(PAGE, NcInstanceSetup)
73 #pragma alloc_text(PAGE, NcInstanceTeardownStart)
74 #pragma alloc_text(PAGE, NcUnload)
75 #pragma alloc_text(PAGE, NcInstanceQueryTeardown)
76 #endif
77 
78 //
79 // IRP Callback Prototypes
80 //
81 
82 FLT_PREOP_CALLBACK_STATUS
84  _Inout_ PFLT_CALLBACK_DATA Data,
85  _In_ PCFLT_RELATED_OBJECTS FltObjects,
86  _Flt_CompletionContext_Outptr_ PVOID *CompletionContext
87  );
88 
89 FLT_PREOP_CALLBACK_STATUS
91  _Unreferenced_parameter_ PFLT_CALLBACK_DATA Data,
92  _Unreferenced_parameter_ PCFLT_RELATED_OBJECTS FltObjects,
93  _Flt_CompletionContext_Outptr_ PVOID *CompletionContext
94  );
95 
96 FLT_POSTOP_CALLBACK_STATUS
98  _Inout_ PFLT_CALLBACK_DATA Data,
99  _In_ PCFLT_RELATED_OBJECTS FltObjects,
100  _In_opt_ PVOID CompletionContext,
101  _In_ FLT_POST_OPERATION_FLAGS Flags
102  );
103 
104 FLT_PREOP_CALLBACK_STATUS
106  _Inout_ PFLT_CALLBACK_DATA Data,
107  _In_ PCFLT_RELATED_OBJECTS FltObjects,
108  _Flt_CompletionContext_Outptr_ PVOID *CompletionContext
109  );
110 
111 FLT_POSTOP_CALLBACK_STATUS
113  _Inout_ PFLT_CALLBACK_DATA Data,
114  _In_ PCFLT_RELATED_OBJECTS FltObjects,
115  _When_(Data->Iopb->Parameters.FileSystemControl.Common.FsControlCode==FSCTL_FIND_FILES_BY_SID, _In_)
116  _When_(Data->Iopb->Parameters.FileSystemControl.Common.FsControlCode!=FSCTL_FIND_FILES_BY_SID, _In_opt_)
117  PVOID CompletionContext,
118  _In_ FLT_POST_OPERATION_FLAGS Flags
119  );
120 
121 FLT_PREOP_CALLBACK_STATUS
123  _Inout_ PFLT_CALLBACK_DATA Data,
124  _In_ PCFLT_RELATED_OBJECTS FltObjects,
125  _Flt_CompletionContext_Outptr_ PVOID *CompletionContext
126  );
127 
128 FLT_POSTOP_CALLBACK_STATUS
130  _Inout_ PFLT_CALLBACK_DATA Data,
131  _In_ PCFLT_RELATED_OBJECTS FltObjects,
132  _In_opt_ PVOID CompletionContext,
133  _In_ FLT_POST_OPERATION_FLAGS Flags
134  );
135 
136 FLT_PREOP_CALLBACK_STATUS
138  _Inout_ PFLT_CALLBACK_DATA Data,
139  _In_ PCFLT_RELATED_OBJECTS FltObjects,
140  _Flt_CompletionContext_Outptr_ PVOID *CompletionContext
141  );
142 
143 FLT_PREOP_CALLBACK_STATUS
145  _Inout_ PFLT_CALLBACK_DATA Data,
146  _In_ PCFLT_RELATED_OBJECTS FltObjects,
147  _Flt_CompletionContext_Outptr_ PVOID *CompletionContext
148  );
149 
150 FLT_POSTOP_CALLBACK_STATUS
152  _Inout_ PFLT_CALLBACK_DATA Data,
153  _In_ PCFLT_RELATED_OBJECTS FltObjects,
154  _In_ PVOID CompletionContext,
155  _In_ FLT_POST_OPERATION_FLAGS Flags
156  );
157 
158 FLT_PREOP_CALLBACK_STATUS
160  _Inout_ PFLT_CALLBACK_DATA Data,
161  _In_ PCFLT_RELATED_OBJECTS FltObjects,
162  _Flt_CompletionContext_Outptr_ PVOID *CompletionContext
163  );
164 
165 //
166 // Assign text sections for each routine.
167 //
168 
169 #ifdef ALLOC_PRAGMA
170 #pragma alloc_text(PAGE, NcPreCreateCallback)
171 #pragma alloc_text(PAGE, NcPreCleanupCallback)
172 #pragma alloc_text(PAGE, NcPostCleanupCallback)
173 #pragma alloc_text(PAGE, NcPreFsctlCallback)
174 #pragma alloc_text(PAGE, NcPreQueryInformationCallback)
175 #pragma alloc_text(PAGE, NcPostQueryInformationCallback)
176 #pragma alloc_text(PAGE, NcPreSetInformationCallback)
177 #pragma alloc_text(PAGE, NcPreDirectoryControlCallback)
178 #pragma alloc_text(PAGE, NcPreNetworkQueryCallback)
179 #endif
180 
181 //
182 // Name Callback Prototypes
183 //
184 
185 NTSTATUS
187  _In_ PFLT_INSTANCE Instance,
188  _In_ PFILE_OBJECT FileObject,
189  _In_opt_ PFLT_CALLBACK_DATA Data,
190  _In_ FLT_FILE_NAME_OPTIONS NameOptions,
191  _Out_ PBOOLEAN CacheFileNameInformation,
192  _Inout_ PFLT_NAME_CONTROL FileName
193  );
194 
195 NTSTATUS
197  _In_ PFLT_INSTANCE Instance,
198  _In_opt_ PFILE_OBJECT FileObject,
199  _In_ PCUNICODE_STRING ParentDirectory,
200  _In_ USHORT DeviceNameLength,
201  _In_ PCUNICODE_STRING Component,
202  _Out_writes_bytes_(ExpandComponentNameLength) PFILE_NAMES_INFORMATION ExpandComponentName,
203  _In_ ULONG ExpandComponentNameLength,
204  _In_ FLT_NORMALIZE_NAME_FLAGS Flags,
205  _Inout_ PVOID *NormalizationContext
206  );
207 
208 NTSTATUS
210  _In_ PFLT_INSTANCE Instance,
211  _In_ PCUNICODE_STRING ParentDirectory,
212  _In_ USHORT DeviceNameLength,
213  _In_ PCUNICODE_STRING Component,
214  _Out_writes_bytes_(ExpandComponentNameLength) PFILE_NAMES_INFORMATION ExpandComponentName,
215  _In_ ULONG ExpandComponentNameLength,
216  _In_ FLT_NORMALIZE_NAME_FLAGS Flags,
217  _Inout_ PVOID *NormalizationContext
218  );
219 
220 //
221 // Assign text sections for each routine.
222 //
223 
224 #ifdef ALLOC_PRAGMA
225 #pragma alloc_text(PAGE, NcGenerateFileNameCallback)
226 #pragma alloc_text(PAGE, NcNormalizeNameComponentCallback)
227 #pragma alloc_text(PAGE, NcNormalizeNameComponentExCallback)
228 #endif
229 
230 //
231 // operation registration
232 //
233 
234 CONST FLT_OPERATION_REGISTRATION Callbacks[] = {
235  { IRP_MJ_CREATE,
236  0,
238  NULL },
239 
240  { IRP_MJ_CLEANUP,
241  0,
244 
246  0,
249 
251  0,
253  NULL },
254 
256  0,
259 
261  0,
263  NULL },
264 
266  0,
269 
270  { IRP_MJ_OPERATION_END }
271 };
272 
273 //
274 // Context Registration
275 //
276 
277 const FLT_CONTEXT_REGISTRATION contextRegistration[] = {
278 
279  { FLT_INSTANCE_CONTEXT,
280  0,
282  sizeof(NC_INSTANCE_CONTEXT),
284  NULL,
285  NULL,
286  NULL },
287 
288  { FLT_STREAMHANDLE_CONTEXT,
289  0,
291  sizeof(NC_STREAM_HANDLE_CONTEXT),
293  NULL,
294  NULL,
295  NULL },
296 
297  { FLT_CONTEXT_END }
298 };
299 
300 //
301 // This defines what we want to filter with FltMgr
302 //
303 
304 CONST FLT_REGISTRATION FilterRegistration = {
305 
306  sizeof( FLT_REGISTRATION ), // Size
307  FLT_REGISTRATION_VERSION, // Version
308  0, // Flags
309 
310  contextRegistration, // Context
311  Callbacks, // Operation callbacks
312 
313  NcUnload, // MiniFilterUnload
314 
315  NcInstanceSetup, // InstanceSetup
316  NcInstanceQueryTeardown, // InstanceQueryTeardown
317  NcInstanceTeardownStart, // InstanceTeardownStart
318  NULL, // InstanceTeardownComplete
319 
320  NcGenerateFileNameCallback, // GenerateFileName
321  NcNormalizeNameComponentCallback, // Normalize Component
322  NULL, // NormalizeContextCleanupCallback
323 
324 #if FLT_MGR_LONGHORN
325  NULL, // Transaction Notification Callback.
326  NcNormalizeNameComponentExCallback // Normalize Name Component with transaction handle.
327 #endif
328 
329 };
330 
331 //
332 // Constants
333 //
334 
336 
337 //
338 // Function Definitions
339 //
340 
341 
342 NTSTATUS
344  _In_ PCFLT_RELATED_OBJECTS FltObjects,
345  _In_ FLT_INSTANCE_SETUP_FLAGS Flags,
346  _In_ DEVICE_TYPE VolumeDeviceType,
347  _In_ FLT_FILESYSTEM_TYPE VolumeFilesystemType
348  )
349 /*++
350 
351 Routine Description:
352 
353  This routine is called whenever a new instance is created on a volume. This
354  gives us a chance to decide if we need to attach to this volume or not.
355 
356  We attach to the volume if:
357  The User mapping parent exists.
358  The User mapping does not exist
359  The Real mapping parent exists
360 
361 Arguments:
362 
363  FltObjects - Pointer to the FLT_RELATED_OBJECTS data structure containing
364  opaque handles to this filter, instance and its associated volume.
365 
366  Flags - Flags describing the reason for this attach request.
367 
368 Return Value:
369 
370  STATUS_SUCCESS - attach
371  STATUS_FLT_DO_NOT_ATTACH - do not attach
372  Other Errorcode - Percolate errors up. (do not attach).
373 
374 Logic:
375  A) Validate that we should attach.
376  1) Construct UserMappingPath
377  2) Open User Parent (validate it exists)
378  3) Query Final component (validate it does not exist)
379  4) Construct RealMappingPath
380  5) Open Real Parent (validate it exists)
381  B) Now we know that we should attach. We need to get
382  short and normalized names for the paths and then
383  construct our mapping and instance context.
384 --*/
385 {
386 
387  //
388  // Status Tracking Vars.
389  //
390 
391  NTSTATUS Status;
392  NTSTATUS ReturnValue = STATUS_SUCCESS;
393 
394  //
395  // User mapping vars
396  //
397 
398  NC_MAPPING_PATH UserPath;
399  HANDLE UserParentHandle = 0;
400  PFILE_OBJECT UserParentFileObj = NULL;
401  OBJECT_ATTRIBUTES UserParentAttributes;
402  IO_STATUS_BLOCK UserParentStatusBlock;
403  PFILE_NAMES_INFORMATION FinalComponentQueryBuffer = NULL;
404  ULONG FinalComponentQueryLength;
405 
406  //
407  // Real Mapping vars
408  //
409 
410  NC_MAPPING_PATH RealPath;
411  HANDLE RealParentHandle = 0;
412  PFILE_OBJECT RealParentFileObj = NULL;
413  OBJECT_ATTRIBUTES RealParentAttributes;
414  IO_STATUS_BLOCK RealParentStatusBlock;
415 
416  //
417  // Context Vars
418  //
419 
420  PNC_INSTANCE_CONTEXT InstanceContext = NULL;
421 
422  //
423  // Temp vars
424  //
425 
426  ULONG DataRead;
427  NC_PATH_OVERLAP Overlap;
428 
429 
430  PAGED_CODE();
431 
432  UNREFERENCED_PARAMETER( VolumeDeviceType );
433 
434  //
435  // Although this filter goes to great lengths to be filesystem-agnostic,
436  // it is not yet able to handle the V3 USN records supported by ReFS.
437  //
438 
439  if (VolumeFilesystemType == FLT_FSTYPE_REFS) {
440 
441  return STATUS_FLT_DO_NOT_ATTACH;
442  }
443 
444  //
445  // Prevent the filter from auto attaching.
446  //
447 
448  if (FlagOn( Flags, FLTFL_INSTANCE_SETUP_AUTOMATIC_ATTACHMENT )) {
449 
450  //
451  // We actually return here, rather than goto cleanup, because
452  // we have not yet zeroed out the buffers in the mappings.
453  //
454 
455  return STATUS_FLT_DO_NOT_ATTACH;
456  }
457 
458  //
459  // We should not be attaching before our driver initialization
460  // has completed, which should load and sanity check these
461  // values. If this hasn't happened, fail attachment.
462  //
463 
464  if (NcGlobalData.UserMappingPath.Length == 0 ||
465  NcGlobalData.UserMappingFinalComponentShort.Length == 0 ||
466  NcGlobalData.UserMappingFinalComponentLong.Length == 0 ||
467  NcGlobalData.RealMappingPath.Length == 0 ||
468  NcGlobalData.RealMappingFinalComponent.Length == 0) {
469 
470  FLT_ASSERT( FALSE );
471  return STATUS_FLT_DO_NOT_ATTACH;
472  }
473 
474  //
475  // Zero Out structures. (Now we can cleanup)
476  //
477 
478  NcInitMappingPath( &UserPath );
479  NcInitMappingPath( &RealPath );
480 
481  //
482  // Build the mapping strings for this instance from our global
483  // registry state.
484  //
485 
486  Status = NcBuildMappingPathFromVolume( FltObjects->Volume,
487  &NcGlobalData.UserMappingPath,
488  &NcGlobalData.UserMappingFinalComponentShort,
489  &UserPath );
490 
491  if (!NT_SUCCESS( Status )) {
492 
493  ReturnValue = Status;
494  goto NcInstanceSetupCleanup;
495  }
496 
497  Status = NcBuildMappingPathFromVolume( FltObjects->Volume,
498  &NcGlobalData.RealMappingPath,
499  &NcGlobalData.RealMappingFinalComponent,
500  &RealPath );
501 
502  if (!NT_SUCCESS( Status )) {
503 
504  ReturnValue = Status;
505  goto NcInstanceSetupCleanup;
506  }
507 
508  //
509  // Allocate the buffer to store the directory lookup. We
510  // reuse the buffer for long and short names, so it must
511  // be large enough to handle either.
512  //
513 
514  FinalComponentQueryLength = sizeof(FILE_NAMES_INFORMATION) +
515  AlignToSize( max( NcGlobalData.UserMappingFinalComponentLong.Length, NcGlobalData.UserMappingFinalComponentShort.Length ), 8 );
516  FinalComponentQueryBuffer = ExAllocatePoolWithTag( PagedPool,
517  FinalComponentQueryLength,
519 
520  if (FinalComponentQueryBuffer == NULL) {
521 
522  ReturnValue = STATUS_INSUFFICIENT_RESOURCES;
523  goto NcInstanceSetupCleanup;
524  }
525 
526 
527  //
528  // Open Parent of user mapping, and validate that it exists.
529  // Note that we do have a race here; a user may have this object
530  // opened with FILE_DELETE_ON_CLOSE. Under these semantics, our
531  // create will succeed, but when their handle is closed our
532  // mapping parent will go away, which this filter cannot deal
533  // with.
534  //
535 
536  InitializeObjectAttributes( &UserParentAttributes,
537  &UserPath.ParentPath,
538  OBJ_KERNEL_HANDLE,
539  NULL,
540  NULL );
541 
542  Status = NcCreateFileEx2( NcGlobalData.FilterHandle, // Filter
543  FltObjects->Instance, // Instance
544  &UserParentHandle, // Returned Handle
545  &UserParentFileObj, // Returned FileObject
546  FILE_LIST_DIRECTORY|FILE_TRAVERSE, // Desired Access
547  &UserParentAttributes, // object attributes
548  &UserParentStatusBlock, // Returned IOStatusBlock
549  0, // Allocation Size
550  FILE_ATTRIBUTE_NORMAL, // File Attributes
551  0, // Share Access
552  FILE_OPEN, // Create Disposition
553  FILE_DIRECTORY_FILE, // Create Options
554  NULL, // Ea Buffer
555  0, // EA Length
556  IO_IGNORE_SHARE_ACCESS_CHECK, // Flags
557  NULL ); // Transaction/ECP
558 
559  if (!NT_SUCCESS( Status )) {
560 
561  //
562  // We could not open the parent path, fail attachment.
563  //
564 
565  ReturnValue = STATUS_FLT_DO_NOT_ATTACH;
566  goto NcInstanceSetupCleanup;
567  }
568 
569  //
570  // Make sure that the User mapping's short final component does not exist.
571  //
572 
573  Status = NcQueryDirectoryFile( FltObjects->Instance,
574  UserParentFileObj,
575  FinalComponentQueryBuffer,
576  FinalComponentQueryLength,
577  FileNamesInformation,
578  TRUE,//Return single entry
579  &NcGlobalData.UserMappingFinalComponentShort,
580  TRUE,//restart scan
581  &DataRead);
582 
583  if (Status != STATUS_NO_SUCH_FILE) {
584 
585  if (!NT_SUCCESS( Status )) {
586 
587  //
588  // An unexpected error occurred, return code.
589  //
590 
591  ReturnValue = Status;
592  goto NcInstanceSetupCleanup;
593 
594  } else {
595 
596  //
597  // The query worked, but the file exists.
598  // The volume does not meet our constraints,
599  // so abort attachment.
600  //
601 
602  ReturnValue = STATUS_FLT_DO_NOT_ATTACH;
603  goto NcInstanceSetupCleanup;
604  }
605  }
606 
607  //
608  // Now we have established that the short name does not exist,
609  // we must search again for the long name. Since the search
610  // string for a directory enumeration is cached by the filesystem
611  // and cannot be changed, we have to close and re-open the file
612  // in order to do the second enumeration.
613  //
614 
615  FltClose( UserParentHandle );
616  UserParentHandle = NULL;
617 
618  ObDereferenceObject( UserParentFileObj );
619  UserParentFileObj = NULL;
620 
621  Status = NcCreateFileEx2( NcGlobalData.FilterHandle, // Filter
622  FltObjects->Instance, // Instance
623  &UserParentHandle, // Returned Handle
624  &UserParentFileObj, // Returned FileObject
625  FILE_LIST_DIRECTORY|FILE_TRAVERSE, // Desired Access
626  &UserParentAttributes, // object attributes
627  &UserParentStatusBlock, // Returned IOStatusBlock
628  0, // Allocation Size
629  FILE_ATTRIBUTE_NORMAL, // File Attributes
630  0, // Share Access
631  FILE_OPEN, // Create Disposition
632  FILE_DIRECTORY_FILE, // Create Options
633  NULL, // Ea Buffer
634  0, // EA Length
635  IO_IGNORE_SHARE_ACCESS_CHECK, // Flags
636  NULL ); // Transaction/ECP
637 
638  if (!NT_SUCCESS( Status )) {
639 
640  ReturnValue = Status;
641  goto NcInstanceSetupCleanup;
642  }
643 
644  //
645  // Make sure that the User mapping's long final component does not exist.
646  //
647 
648  Status = NcQueryDirectoryFile( FltObjects->Instance,
649  UserParentFileObj,
650  FinalComponentQueryBuffer,
651  FinalComponentQueryLength,
652  FileNamesInformation,
653  TRUE,//Return single entry
654  &NcGlobalData.UserMappingFinalComponentLong,
655  TRUE,//restart scan
656  &DataRead );
657 
658  if (Status != STATUS_NO_SUCH_FILE) {
659 
660  if (!NT_SUCCESS( Status )) {
661 
662  //
663  // An unexpected error occurred, return code.
664  //
665 
666  ReturnValue = Status;
667  goto NcInstanceSetupCleanup;
668 
669  } else {
670 
671  //
672  // The query worked, but the file exists.
673  // The volume does not meet our constraints,
674  // so abort attachment.
675  //
676 
677  ReturnValue = STATUS_FLT_DO_NOT_ATTACH;
678  goto NcInstanceSetupCleanup;
679  }
680  }
681 
682  //
683  // Open parent of real mapping.
684  // Note that we do have a race here; a user may have this object
685  // opened with FILE_DELETE_ON_CLOSE. Under these semantics, our
686  // create will succeed, but when their handle is closed our
687  // mapping parent will go away, which this filter cannot deal
688  // with.
689  //
690 
691  InitializeObjectAttributes( &RealParentAttributes,
692  &RealPath.ParentPath,
693  OBJ_KERNEL_HANDLE,
694  NULL,
695  NULL );
696 
697  Status = NcCreateFileEx2( NcGlobalData.FilterHandle, // Filter
698  FltObjects->Instance, // Instance
699  &RealParentHandle, // Returned Handle
700  &RealParentFileObj, // Returned FileObject
701  FILE_LIST_DIRECTORY|FILE_TRAVERSE, // Desired Access
702  &RealParentAttributes, // object attributes
703  &RealParentStatusBlock, // Returned IOStatusBlock
704  0, // Allocation Size
705  FILE_ATTRIBUTE_NORMAL, // File Attributes
706  0, // Share Access
707  FILE_OPEN, // Create Disposition
708  FILE_DIRECTORY_FILE, // Create Options
709  NULL, // Ea Buffer
710  0, // EA Length
711  IO_IGNORE_SHARE_ACCESS_CHECK, // Flags
712  NULL ); // Transaction/ECP
713 
714  FLT_ASSERT( Status != STATUS_INVALID_PARAMETER );
715 
716  if (!NT_SUCCESS( Status )) {
717 
718  //
719  // We could not open the parent path, fail attachment.
720  //
721 
722  ReturnValue = STATUS_FLT_DO_NOT_ATTACH;
723  goto NcInstanceSetupCleanup;
724  }
725 
726  //
727  // We have validated that we should attach.
728  //
729 
730 
731  //
732  // Allocate context
733  //
734 
735  Status = FltAllocateContext( FltObjects->Filter,
736  FLT_INSTANCE_CONTEXT,
737  sizeof(NC_INSTANCE_CONTEXT),
738  NonPagedPool,
739  &InstanceContext );
740 
741  if (!NT_SUCCESS( Status )) {
742 
743  ReturnValue = Status;
744  goto NcInstanceSetupCleanup;
745  }
746 
747  //
748  // We have allocated an instance context. Now initialize it.
749  //
750 
751  //
752  // Now that we have a context,
753  // we need to generate the mapping
754  //
755 
756  NcInitMapping( &InstanceContext->Mapping );
757 
758 
759  Status = NcBuildMapping( UserParentFileObj,
760  RealParentFileObj,
761  &NcGlobalData.UserMappingFinalComponentShort,
762  &NcGlobalData.UserMappingFinalComponentLong,
763  &NcGlobalData.RealMappingFinalComponent,
764  FltObjects->Instance,
765  &InstanceContext->Mapping );
766 
767  if (!NT_SUCCESS( Status )) {
768 
769  ReturnValue = Status;
770  goto NcInstanceSetupCleanup;
771  }
772 
773  //
774  // Sanity check the relation between the mappings. Force case insensitive
775  // to TRUE here, since we may be evaluating this relationship in response
776  // to case insensitive user requests in the future.
777  //
778 
779  NcComparePath( &RealPath.FullPath,
780  &InstanceContext->Mapping.UserMapping,
781  NULL,
782  TRUE,
783  TRUE,
784  &Overlap );
785 
786  if (Overlap.InMapping || Overlap.Ancestor) {
787 
788  ReturnValue = STATUS_FLT_DO_NOT_ATTACH;
789  goto NcInstanceSetupCleanup;
790  }
791 
792  NcComparePath( &UserPath.FullPath,
793  &InstanceContext->Mapping.RealMapping,
794  NULL,
795  TRUE,
796  TRUE,
797  &Overlap );
798 
799  if (Overlap.InMapping || Overlap.Ancestor) {
800 
801  ReturnValue = STATUS_FLT_DO_NOT_ATTACH;
802  goto NcInstanceSetupCleanup;
803  }
804 
805  //
806  // Remember what file system we're attached to.
807  //
808 
809  InstanceContext->VolumeFilesystemType = VolumeFilesystemType;
810 
811  //
812  // Register the instance context.
813  //
814 
815  Status = FltSetInstanceContext( FltObjects->Instance,
816  FLT_SET_CONTEXT_REPLACE_IF_EXISTS,
817  InstanceContext,
818  NULL);
819 
820  if (!NT_SUCCESS( Status )) {
821 
822  ReturnValue = Status;
823  goto NcInstanceSetupCleanup;
824  }
825 
826 
827 NcInstanceSetupCleanup:
828 
829  if (InstanceContext != NULL ) {
830 
831  FltReleaseContext( InstanceContext );
832  }
833 
834  NcTeardownMappingPath( &UserPath );
835 
836  if (UserParentHandle != 0) {
837 
838  FltClose( UserParentHandle );
839  }
840 
841  if (UserParentFileObj != NULL) {
842 
843  ObDereferenceObject( UserParentFileObj );
844  }
845 
846  NcTeardownMappingPath( &RealPath );
847 
848  if (RealParentHandle != 0) {
849 
850  FltClose( RealParentHandle );
851  }
852 
853  if (RealParentFileObj != NULL) {
854 
855  ObDereferenceObject( RealParentFileObj );
856  }
857 
858  if (FinalComponentQueryBuffer != NULL) {
859 
860  ExFreePool( FinalComponentQueryBuffer );
861  }
862 
863  return ReturnValue;
864 }
865 
866 
867 NTSTATUS
869  _In_ PCFLT_RELATED_OBJECTS FltObjects,
870  _In_ FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags
871  )
872 /*++
873 
874 Routine Description:
875 
876  This is called when an instance is being manually deleted by a
877  call to FltDetachVolume or FilterDetach thereby giving us a
878  chance to fail that detach request.
879 
880  If this routine is not defined in the registration structure, explicit
881  detach requests via FltDetachVolume or FilterDetach will always be
882  failed.
883 
884 Arguments:
885 
886  FltObjects - Pointer to the FLT_RELATED_OBJECTS data structure containing
887  opaque handles to this filter, instance and its associated volume.
888 
889  Flags - Indicating where this detach request came from.
890 
891 Return Value:
892 
893  Returns the Status of this operation.
894 
895 --*/
896 {
897  UNREFERENCED_PARAMETER( FltObjects );
898  UNREFERENCED_PARAMETER( Flags );
899 
900  PAGED_CODE();
901 
902  return STATUS_SUCCESS;
903 }
904 
905 
906 VOID
908  _In_ PCFLT_RELATED_OBJECTS FltObjects,
909  _In_ FLT_INSTANCE_TEARDOWN_FLAGS Flags
910  )
911 /*++
912 
913 Routine Description:
914 
915  This routine is called at the start of instance teardown.
916 
917 Arguments:
918 
919  FltObjects - Pointer to the FLT_RELATED_OBJECTS data structure containing
920  opaque handles to this filter, instance and its associated volume.
921 
922  Flags - Reason why this instance is been deleted.
923 
924 Return Value:
925 
926  None.
927 
928 --*/
929 {
930  NTSTATUS Status;
931  PNC_INSTANCE_CONTEXT InstanceContext = NULL;
932 
933  PAGED_CODE();
934  UNREFERENCED_PARAMETER( Flags );
935 
936  Status = FltGetInstanceContext( FltObjects->Instance,
937  &InstanceContext );
938 
939  if (!NT_SUCCESS( Status )) {
940 
941  goto NcInstanceTeardownStartCleanup;
942  }
943 
944 NcInstanceTeardownStartCleanup:
945 
946  if (InstanceContext) {
947 
948  FltReleaseContext( InstanceContext );
949  }
950 
951 }
952 
953 //
954 // MiniFilter initialization and unload routines.
955 //
956 
957 NTSTATUS
959  _In_ PDRIVER_OBJECT DriverObject,
960  _In_ PUNICODE_STRING RegistryPath
961  )
962 /*++
963 
964 Routine Description:
965 
966  This is the initialization routine for this miniFilter driver. This
967  registers with FltMgr and initializes all global data structures.
968 
969 Arguments:
970 
971  DriverObject - Pointer to driver object created by the system to
972  represent this driver.
973 
974  RegistryPath - Unicode string identifying where the parameters for this
975  driver are located in the registry.
976 
977 Return Value:
978 
979  Returns STATUS_SUCCESS.
980 
981 --*/
982 {
983  NTSTATUS Status;
984 
985  //
986  // Import routines
987  //
988 
989  NcCompatInit( );
990 
991  Status = NcInitializeMapping( RegistryPath );
992  if (!NT_SUCCESS( Status )) {
993  return Status;
994  }
995 
996  //
997  // Register with FltMgr to tell it our callback routines
998  //
999 
1000  Status = FltRegisterFilter( DriverObject,
1001  &FilterRegistration,
1002  &NcGlobalData.FilterHandle );
1003 
1004  FLT_ASSERT( NT_SUCCESS( Status ) );
1005 
1006  if (NT_SUCCESS( Status )) {
1007 
1008  //
1009  // Start filtering i/o
1010  //
1011 
1012  Status = FltStartFiltering( NcGlobalData.FilterHandle );
1013 
1014  if (!NT_SUCCESS( Status )) {
1015 
1016  FltUnregisterFilter( NcGlobalData.FilterHandle );
1017  }
1018  }
1019 
1020  return Status;
1021 }
1022 
1023 NTSTATUS
1025  _In_ FLT_FILTER_UNLOAD_FLAGS Flags
1026  )
1027 /*++
1028 
1029 Routine Description:
1030 
1031  This is the unload routine for this miniFilter driver. This is called
1032  when the minifilter is about to be unloaded. We can fail this unload
1033  request if this is not a mandatory unloaded indicated by the Flags
1034  parameter.
1035 
1036 Arguments:
1037 
1038  Flags - Indicating if this is a mandatory unload.
1039 
1040 Return Value:
1041 
1042  Returns the final Status of this operation.
1043 
1044 --*/
1045 {
1046  UNREFERENCED_PARAMETER( Flags );
1047 
1048  PAGED_CODE();
1049 
1050  FltUnregisterFilter( NcGlobalData.FilterHandle );
1051 
1052  if (NcGlobalData.UserMappingPath.Buffer != NULL) {
1053  NcFreeUnicodeString( &NcGlobalData.UserMappingPath );
1054  }
1055 
1056  if (NcGlobalData.UserMappingFinalComponentShort.Buffer != NULL) {
1058  }
1059 
1060  if (NcGlobalData.UserMappingFinalComponentLong.Buffer != NULL) {
1062  }
1063 
1064  if (NcGlobalData.RealMappingPath.Buffer != NULL) {
1065  NcFreeUnicodeString( &NcGlobalData.RealMappingPath );
1066  }
1067 
1068  if (NcGlobalData.RealMappingFinalComponent.Buffer != NULL) {
1070  }
1071 
1072  return STATUS_SUCCESS;
1073 }
1074 
1075 //
1076 // MiniFilter callback routines.
1077 //
1078 
1079 FLT_PREOP_CALLBACK_STATUS
1081  _Inout_ PFLT_CALLBACK_DATA Data,
1082  _In_ PCFLT_RELATED_OBJECTS FltObjects,
1083  _Flt_CompletionContext_Outptr_ PVOID *CompletionContext
1084  )
1085 /*++
1086 
1087 Routine Description:
1088 
1089  Routine is invoked when a create is issued by a user.
1090 
1091 
1092 Arguments:
1093 
1094  Data - Pointer to the filter CallbackData that is passed to us.
1095 
1096  FltObjects - Pointer to the FLT_RELATED_OBJECTS data structure containing
1097  opaque handles to this filter, instance, its associated volume and
1098  file object.
1099 
1100  CompletionContext - The context for the completion routine for this
1101  operation.
1102 
1103 Return Value:
1104 
1105  The return value is the Status of the operation.
1106 
1107 Logic:
1108 
1109  1) If file is opened by ID or is a Paging File, etc.
1110  A) return PASSTHROUGH_NO_CALLBACK
1111  2) Get the opened name and calculate overlap
1112  3) If File is Delete On close
1113  A) If the file is an ancestor of either mapping
1114  a) Fail Open
1115  4) If the path is in the real mapping
1116  A) Fail the Open
1117  5) If the path is in user mapping
1118  A) Recalculate the full name (without SL_TARGET_PARENT_DIRECTORY)
1119  B) Munge Name to Real Mapping
1120  C) Switch name
1121  D) Passthrough with callback.
1122  6) Else
1123  A) Return Passthrough No callback
1124 --*/
1125 {
1126  PAGED_CODE();
1127 
1128  return NcPreCreate( Data,
1129  FltObjects,
1130  CompletionContext );
1131 }
1132 
1133 FLT_PREOP_CALLBACK_STATUS
1135  _Unreferenced_parameter_ PFLT_CALLBACK_DATA Data,
1136  _Unreferenced_parameter_ PCFLT_RELATED_OBJECTS FltObjects,
1137  _Flt_CompletionContext_Outptr_ PVOID *CompletionContext
1138  )
1139 /*++
1140 
1141 Routine Description:
1142 
1143  This is the pre cleanup callback. It is called for every handle cleanup
1144  operation. The role of this callback is merely to ensure that we
1145  also receive every post handle cleanup operation, and that it is safe
1146  to issue filesystem calls when we do. We do this via
1147  FLT_PREOP_SYNCHRONIZE for simplicity.
1148  parameter.
1149 
1150 Arguments:
1151 
1152  Data - Pointer to the filter CallbackData that is passed to us.
1153 
1154  FltObjects - Pointer to the FLT_RELATED_OBJECTS data structure containing
1155  opaque handles to this filter, instance, its associated volume and
1156  file object.
1157 
1158  CompletionContext - The context for the completion routine for this
1159  operation. Not used in this function.
1160 
1161 Return Value:
1162 
1163  Returns the final status of this operation. Always FLT_PREOP_SYNCHRONIZE
1164  in this routine.
1165 
1166 --*/
1167 {
1168  PAGED_CODE();
1169 
1170  UNREFERENCED_PARAMETER( Data );
1171  UNREFERENCED_PARAMETER( FltObjects );
1172  UNREFERENCED_PARAMETER( CompletionContext );
1173 
1174  //
1175  // Synchronize all cleanup requests. This enables us to ensure
1176  // that any state is torn down correctly even if a request is
1177  // issued between pre cleanup and post cleanup.
1178  //
1179 
1180  return FLT_PREOP_SYNCHRONIZE;
1181 }
1182 
1183 FLT_POSTOP_CALLBACK_STATUS
1185  _Inout_ PFLT_CALLBACK_DATA Data,
1186  _In_ PCFLT_RELATED_OBJECTS FltObjects,
1187  _In_opt_ PVOID CompletionContext,
1188  _In_ FLT_POST_OPERATION_FLAGS Flags
1189  )
1190 /*++
1191 
1192 Routine Description:
1193 
1194  This is the post cleanup callback. It is called for every handle cleanup
1195  operation. The role of this callback is to tear down any pending
1196  directory change notification state attached to this handle.
1197 
1198 Arguments:
1199 
1200  Data - Pointer to the filter CallbackData that is passed to us.
1201 
1202  FltObjects - Pointer to the FLT_RELATED_OBJECTS data structure containing
1203  opaque handles to this filter, instance, its associated volume and
1204  file object.
1205 
1206  CompletionContext - The context for the completion routine for this
1207  operation. Not used in this function.
1208 
1209  Flags - The flags for this operation.
1210 
1211 Return Value:
1212 
1213  Returns the final status of this operation. Always
1214  FLT_POSTOP_FINISHED_PROCESSING in this routine. Note that cleanup
1215  operations should never fail.
1216 
1217 --*/
1218 {
1219  NTSTATUS Status;
1220  PNC_STREAM_HANDLE_CONTEXT HandleContext = NULL;
1221 
1222  UNREFERENCED_PARAMETER( Data );
1223  UNREFERENCED_PARAMETER( CompletionContext );
1224 
1225  PAGED_CODE();
1226 
1227  if (!FlagOn( Flags, FLTFL_POST_OPERATION_DRAINING )) {
1228 
1229  //
1230  // Obtain our handle context. We should only be called here
1231  // if we really have one.
1232  //
1233 
1234  Status = FltGetStreamHandleContext( FltObjects->Instance,
1235  FltObjects->FileObject,
1236  &HandleContext );
1237 
1238  if (!NT_SUCCESS( Status )) {
1239 
1240  goto NcPostCleanupCallbackCleanup;
1241 
1242  }
1243 
1244  FLT_ASSERT( HandleContext != NULL );
1245 
1246  NcStreamHandleContextNotCleanup( HandleContext );
1247  }
1248 
1249 
1250 NcPostCleanupCallbackCleanup:
1251 
1252  if (HandleContext != NULL) {
1253 
1254  FltReleaseContext( HandleContext );
1255 
1256  }
1257 
1258  //
1259  // We don't want to fail cleanup no matter what goes wrong.
1260  //
1261 
1262  return FLT_POSTOP_FINISHED_PROCESSING;
1263 }
1264 
1265 
1266 FLT_PREOP_CALLBACK_STATUS
1268  _Inout_ PFLT_CALLBACK_DATA Data,
1269  _In_ PCFLT_RELATED_OBJECTS FltObjects,
1270  _Flt_CompletionContext_Outptr_ PVOID *CompletionContext
1271  )
1272 /*++
1273 
1274 Routine Description:
1275 
1276  This is the pre FSCTL callback. It is called for every FSCTL
1277  operation. This allows us to intercept and process FSCTLs which
1278  either consume or return names which may be affected by the namespace
1279  redirection performed by this filter.
1280 
1281  Currently we munge:
1282  FSCTL_ENUM_USN_DATA
1283  FSCTL_FIND_FILES_BY_SID
1284  FSCTL_LOOKUP_STREAM_FROM_CLUSTER
1285  FSCTL_READ_FILE_USN_DATA
1286  FSCTL_READ_USN_JOURNAL
1287 
1288  We also need to munge:
1289  FSCTL_TXFS_LIST_TRANSACTION_LOCKED_FILES
1290 
1291 Arguments:
1292 
1293  Data - Pointer to the filter CallbackData that is passed to us.
1294 
1295  FltObjects - Pointer to the FLT_RELATED_OBJECTS data structure containing
1296  opaque handles to this filter, instance, its associated volume and
1297  file object.
1298 
1299  CompletionContext - The context for the completion routine for this
1300  operation. Not used in this function.
1301 
1302 Return Value:
1303 
1304  Returns the final status of this operation.
1305 
1306 --*/
1307 {
1308  PAGED_CODE();
1309 
1310  //
1311  // TODO:
1312  // FSCTL_TXFS_LIST_TRANSACTION_LOCKED_FILES
1313  //
1314  // The following take paths and work without any explicit change.
1315  // Since Txf sends its creates to the top of the filter stack, we
1316  // munge these paths on create (both for the RM and the logs.) Thus
1317  // Txf believes its logs are in the user mapping, when they are not;
1318  // subsequent queries return the user mapping correctly.
1319  //
1320  // FSCTL_TXFS_QUERY_RM_INFORMATION
1321  // FSCTL_TXFS_START_RM
1322  //
1323 
1324  switch (Data->Iopb->Parameters.FileSystemControl.Common.FsControlCode) {
1325  case FSCTL_ENUM_USN_DATA:
1326  return FLT_PREOP_SYNCHRONIZE;
1327  break;
1328  case FSCTL_FIND_FILES_BY_SID:
1329  return NcPreFindFilesBySid( Data,
1330  FltObjects,
1331  CompletionContext );
1332  break;
1333 #if FLT_MGR_WIN7
1334  case FSCTL_LOOKUP_STREAM_FROM_CLUSTER:
1335  return FLT_PREOP_SYNCHRONIZE;
1336  break;
1337 #endif
1338  case FSCTL_READ_FILE_USN_DATA:
1339  return FLT_PREOP_SYNCHRONIZE;
1340  break;
1341  case FSCTL_READ_USN_JOURNAL:
1342  return FLT_PREOP_SUCCESS_WITH_CALLBACK;
1343  break;
1344  default:
1345 
1346  //
1347  // We're not processing this. Let the filesystem handle it
1348  // normally.
1349  //
1350 
1351  return FLT_PREOP_SUCCESS_NO_CALLBACK;
1352  break;
1353 
1354  }
1355 }
1356 
1357 FLT_POSTOP_CALLBACK_STATUS
1359  _Inout_ PFLT_CALLBACK_DATA Data,
1360  _In_ PCFLT_RELATED_OBJECTS FltObjects,
1361  _When_(Data->Iopb->Parameters.FileSystemControl.Common.FsControlCode==FSCTL_FIND_FILES_BY_SID, _In_)
1362  _When_(Data->Iopb->Parameters.FileSystemControl.Common.FsControlCode!=FSCTL_FIND_FILES_BY_SID, _In_opt_)
1363  PVOID CompletionContext,
1364  _In_ FLT_POST_OPERATION_FLAGS Flags
1365  )
1366 /*++
1367 
1368 Routine Description:
1369 
1370  This is the post FSCTL callback. It is called for every FSCTL
1371  which we need to munge, including USN, find files by SID, and lookup
1372  stream from cluster. This allows us to process these FSCTLs which
1373  either consume or return names which may be affected by the namespace
1374  redirection performed by this filter.
1375 
1376 Arguments:
1377 
1378  Data - Pointer to the filter CallbackData that is passed to us.
1379 
1380  FltObjects - Pointer to the FLT_RELATED_OBJECTS data structure containing
1381  opaque handles to this filter, instance, its associated volume and
1382  file object.
1383 
1384  CompletionContext - The context for the completion routine for this
1385  operation. Not used in this function.
1386 
1387  Flags - The flags for this operation.
1388 
1389 Return Value:
1390 
1391  Returns the final status of this operation.
1392 
1393 --*/
1394 {
1395  FLT_POSTOP_CALLBACK_STATUS Status = FLT_POSTOP_FINISHED_PROCESSING;
1396 
1397  if (!FlagOn( Flags, FLTFL_POST_OPERATION_DRAINING )) {
1398 
1399  switch (Data->Iopb->Parameters.FileSystemControl.Common.FsControlCode) {
1400 
1401  case FSCTL_ENUM_USN_DATA:
1402 
1403  Status = NcPostEnumUsnData( Data,
1404  FltObjects,
1405  CompletionContext,
1406  Flags );
1407  break;
1408 
1409  case FSCTL_FIND_FILES_BY_SID:
1410 
1411  Status = NcPostFindFilesBySid( Data,
1412  FltObjects,
1413  CompletionContext,
1414  Flags );
1415 
1416  break;
1417 #if FLT_MGR_WIN7
1418  case FSCTL_LOOKUP_STREAM_FROM_CLUSTER:
1419 
1420  Status = NcPostLookupStreamFromCluster( Data,
1421  FltObjects,
1422  CompletionContext,
1423  Flags );
1424 
1425  break;
1426 #endif
1427 
1428  case FSCTL_READ_FILE_USN_DATA:
1429 
1430  Status = NcPostReadFileUsnData( Data,
1431  FltObjects,
1432  CompletionContext,
1433  Flags );
1434  break;
1435 
1436  case FSCTL_READ_USN_JOURNAL:
1437 
1438  Status = NcPostReadUsnJournal( Data,
1439  FltObjects,
1440  CompletionContext,
1441  Flags );
1442  break;
1443 
1444  default:
1445  break;
1446  }
1447  }
1448 
1449  return Status;
1450 }
1451 
1452 FLT_PREOP_CALLBACK_STATUS
1454  _Inout_ PFLT_CALLBACK_DATA Data,
1455  _In_ PCFLT_RELATED_OBJECTS FltObjects,
1456  _Flt_CompletionContext_Outptr_ PVOID *CompletionContext
1457  )
1458 /*++
1459 
1460 Routine Description:
1461 
1462  This callback is invoked when the user queries a file's information.
1463 
1464 Arguments:
1465 
1466  Data - Pointer to the filter CallbackData that is passed to us.
1467  Currently we munge:
1468  FileAllInformation
1469  FileAlternateNameInformation
1470  FileHardLinkInformation
1471  FileNameInformation
1472  FileNormalizedNameInformation
1473 
1474  FltObjects - Pointer to the FLT_RELATED_OBJECTS data structure containing
1475  opaque handles to this filter, instance, its associated volume and
1476  file object.
1477 
1478  CompletionContext - The context for the completion routine for this
1479  operation.
1480 
1481 Return Value:
1482 
1483  The return value is the Status of the operation.
1484 
1485 --*/
1486 {
1487  FLT_PREOP_CALLBACK_STATUS result;
1488 
1489  PAGED_CODE();
1490 
1491  //
1492  // We only have to munge for name sensitive operations.
1493  //
1494 
1495  switch( Data->Iopb->Parameters.QueryFileInformation.FileInformationClass ) {
1496 
1497  case FileAllInformation:
1498  case FileNameInformation:
1499  case FileNormalizedNameInformation:
1500 
1501  result = FLT_PREOP_SYNCHRONIZE;
1502  break;
1503 
1504  case FileAlternateNameInformation:
1505  result = NcPreQueryAlternateName( Data,
1506  FltObjects,
1507  CompletionContext );
1508  break;
1509 
1510  case FileHardLinkInformation:
1511 
1512  result = FLT_PREOP_SYNCHRONIZE;
1513  break;
1514 
1515  default:
1516  result = FLT_PREOP_SUCCESS_NO_CALLBACK;
1517  break;
1518  }
1519 
1520  return result;
1521 }
1522 
1523 FLT_POSTOP_CALLBACK_STATUS
1525  _Inout_ PFLT_CALLBACK_DATA Data,
1526  _In_ PCFLT_RELATED_OBJECTS FltObjects,
1527  _In_opt_ PVOID CompletionContext,
1528  _In_ FLT_POST_OPERATION_FLAGS Flags
1529  )
1530 /*++
1531 
1532 Routine Description:
1533 
1534  This is the post query file information callback. It is called for
1535  every information class we need to process. This allows us to fixup
1536  names returned that would otherwise contain real mapping paths.
1537 
1538 Arguments:
1539 
1540  Data - Pointer to the filter CallbackData that is passed to us.
1541 
1542  FltObjects - Pointer to the FLT_RELATED_OBJECTS data structure containing
1543  opaque handles to this filter, instance, its associated volume and
1544  file object.
1545 
1546  CompletionContext - The context for the completion routine for this
1547  operation. Not used in this function.
1548 
1549  Flags - The flags for this operation.
1550 
1551 Return Value:
1552 
1553  Returns the final status of this operation.
1554 
1555 --*/
1556 {
1557  FLT_POSTOP_CALLBACK_STATUS Status = FLT_POSTOP_FINISHED_PROCESSING;
1558 
1559  PAGED_CODE();
1560 
1561  if (!FlagOn( Flags, FLTFL_POST_OPERATION_DRAINING )) {
1562 
1563  switch( Data->Iopb->Parameters.SetFileInformation.FileInformationClass ) {
1564 
1565  case FileNameInformation:
1566  case FileNormalizedNameInformation:
1567  case FileAllInformation:
1568 
1569  Status = NcPostQueryName( Data,
1570  FltObjects,
1571  CompletionContext,
1572  Flags );
1573  break;
1574 
1575  case FileHardLinkInformation:
1576  Status = NcPostQueryHardLinks( Data,
1577  FltObjects,
1578  CompletionContext,
1579  Flags );
1580  break;
1581  }
1582  }
1583  return Status;
1584 }
1585 
1586 FLT_PREOP_CALLBACK_STATUS
1588  _Inout_ PFLT_CALLBACK_DATA Data,
1589  _In_ PCFLT_RELATED_OBJECTS FltObjects,
1590  _Flt_CompletionContext_Outptr_ PVOID *CompletionContext
1591  )
1592 /*++
1593 
1594 Routine Description:
1595 
1596  This is the pre set file information callback. It is called for every
1597  set file information operation. This allows us to intercept and process
1598  those which either consume or return names, as well as those which would
1599  violate the constraints imposed by this filter.
1600 
1601  Currently we munge:
1602  FileDispositionInformation
1603  FileDispositionInformationEx
1604  FileLinkInformation
1605  FileRenameInformation
1606  FileRenameInformationEx
1607  FileShortNameInformation
1608 
1609 Arguments:
1610 
1611  Data - Pointer to the filter CallbackData that is passed to us.
1612 
1613  FltObjects - Pointer to the FLT_RELATED_OBJECTS data structure containing
1614  opaque handles to this filter, instance, its associated volume and
1615  file object.
1616 
1617  CompletionContext - The context for the completion routine for this
1618  operation.
1619 
1620 Return Value:
1621 
1622  The return value is the Status of the operation.
1623 
1624 --*/
1625 {
1626 
1627  FLT_PREOP_CALLBACK_STATUS result;
1628 
1629  PAGED_CODE();
1630 
1631  switch( Data->Iopb->Parameters.SetFileInformation.FileInformationClass ) {
1632 
1633  case FileDispositionInformation:
1634  case FileDispositionInformationEx:
1635 
1636  result = NcPreSetDisposition( Data,
1637  FltObjects,
1638  CompletionContext );
1639 
1640  break;
1641 
1642  case FileLinkInformation:
1643 
1644  result = NcPreSetLinkInformation( Data,
1645  FltObjects,
1646  CompletionContext );
1647 
1648  break;
1649 
1650  case FileRenameInformation:
1651  case FileRenameInformationEx:
1652 
1653  result = NcPreRename( Data,
1654  FltObjects,
1655  CompletionContext );
1656 
1657  break;
1658 
1659  case FileShortNameInformation:
1660 
1661  result = NcPreSetShortName( Data,
1662  FltObjects,
1663  CompletionContext );
1664 
1665  break;
1666 
1667  default:
1668  result = FLT_PREOP_SUCCESS_NO_CALLBACK;
1669  break;
1670  }
1671 
1672  return result;
1673 }
1674 
1675 FLT_PREOP_CALLBACK_STATUS
1677  _Inout_ PFLT_CALLBACK_DATA Data,
1678  _In_ PCFLT_RELATED_OBJECTS FltObjects,
1679  _Flt_CompletionContext_Outptr_ PVOID *CompletionContext
1680  )
1681 /*++
1682 
1683 Routine Description:
1684 
1685  This callback is invoked when the user tries to enumerate a directory
1686  or get change notifications.
1687 
1688 Arguments:
1689 
1690  Data - Pointer to the filter CallbackData that is passed to us.
1691 
1692  FltObjects - Pointer to the FLT_RELATED_OBJECTS data structure containing
1693  opaque handles to this filter, instance, its associated volume and
1694  file object.
1695 
1696  CompletionContext - The context for the completion routine for this
1697  operation.
1698 
1699 Return Value:
1700 
1701  The return value is the Status of the operation.
1702 
1703 --*/
1704 {
1705  FLT_PREOP_CALLBACK_STATUS Status;
1706 
1707  PAGED_CODE();
1708 
1709  switch( Data->Iopb->MinorFunction ) {
1710 
1712  Status = NcEnumerateDirectory( Data, FltObjects, CompletionContext );
1713  break;
1714 
1716  Status = NcPreNotifyDirectory( Data, FltObjects, CompletionContext );
1717  break;
1718 
1719  default:
1720  FLT_ASSERT( FALSE );
1721  Status = FLT_PREOP_SUCCESS_NO_CALLBACK;
1722 
1723  }
1724 
1725  return Status;
1726 }
1727 
1728 FLT_POSTOP_CALLBACK_STATUS
1730  _Inout_ PFLT_CALLBACK_DATA Data,
1731  _In_ PCFLT_RELATED_OBJECTS FltObjects,
1732  _In_ PVOID CompletionContext,
1733  _In_ FLT_POST_OPERATION_FLAGS Flags
1734  )
1735 /*++
1736 
1737 Routine Description:
1738 
1739  This callback is invoked after the user tries to enumerate a directory
1740  or get change notifications.
1741 
1742 Arguments:
1743 
1744  Data - Pointer to the filter CallbackData that is passed to us.
1745 
1746  FltObjects - Pointer to the FLT_RELATED_OBJECTS data structure containing
1747  opaque handles to this filter, instance, its associated volume and
1748  file object.
1749 
1750  CompletionContext - The context for the completion routine for this
1751  operation.
1752 
1753 Return Value:
1754 
1755  The return value is the Status of the operation.
1756 
1757 --*/
1758 {
1759  FLT_POSTOP_CALLBACK_STATUS Status;
1760 
1761  //
1762  // Note this routine must be nonpaged. It is called within completion
1763  // routines.
1764  //
1765 
1766  switch( Data->Iopb->MinorFunction ) {
1767 
1769 
1770  //
1771  // Currently we don't process post directory enumeration
1772  // requests. We really should.
1773  //
1774 
1775  Status = FLT_POSTOP_FINISHED_PROCESSING;
1776  break;
1777 
1779 
1780  Status = NcPostNotifyDirectory( Data, FltObjects, CompletionContext, Flags );
1781  break;
1782 
1783  default:
1784  FLT_ASSERT( FALSE );
1785  Status = FLT_POSTOP_FINISHED_PROCESSING;
1786 
1787  }
1788 
1789  return Status;
1790 }
1791 
1792 FLT_PREOP_CALLBACK_STATUS
1794  _Inout_ PFLT_CALLBACK_DATA Data,
1795  _In_ PCFLT_RELATED_OBJECTS FltObjects,
1796  _Flt_CompletionContext_Outptr_ PVOID *CompletionContext
1797  )
1798 /*++
1799 
1800 Routine Description:
1801 
1802  This callback is invoked when the user tries to do a network query open.
1803 
1804 Arguments:
1805 
1806  Data - Pointer to the filter CallbackData that is passed to us.
1807 
1808  FltObjects - Pointer to the FLT_RELATED_OBJECTS data structure containing
1809  opaque handles to this filter, instance, its associated volume and
1810  file object.
1811 
1812  CompletionContext - The context for the completion routine for this
1813  operation.
1814 
1815 Return Value:
1816 
1817  The return value is the Status of the operation.
1818 
1819 --*/
1820 {
1821  UNREFERENCED_PARAMETER( Data );
1822  UNREFERENCED_PARAMETER( FltObjects );
1823  UNREFERENCED_PARAMETER( CompletionContext );
1824 
1825  PAGED_CODE();
1826 
1827  //
1828  // TODO We need to pipe these through the existing create path if
1829  // possible.
1830  //
1831 
1832  return FLT_PREOP_DISALLOW_FASTIO;
1833 }
1834 
1835 NTSTATUS
1837  _In_ PFLT_INSTANCE Instance,
1838  _In_ PFILE_OBJECT FileObject,
1839  _In_opt_ PFLT_CALLBACK_DATA Data,
1840  _In_ FLT_FILE_NAME_OPTIONS NameOptions,
1841  _Out_ PBOOLEAN CacheFileNameInformation,
1842  _Inout_ PFLT_NAME_CONTROL OutputNameControl
1843  )
1844 /*++
1845 
1846 Routine Description:
1847 
1848  This callback is invoked to maintain FltMgr's name cache coherency
1849  when this filter munges names.
1850 
1851 Arguments:
1852 
1853  Instance - Instance pointer for the minifilter instance that this
1854  callback routine is registered for.
1855 
1856  FileObject - Pointer to a file object for the file whose name is being
1857  requested.
1858 
1859  Data - Pointer to the callback data structure for the operation during
1860  which this name is being requested.
1861 
1862  NameOptions - FLT_FILE_NAME_OPTIONS value that specifies the name format,
1863  query method, and flags for this file name information query.
1864 
1865  CacheFileNameInformation - Pointer to a Boolean value specifying whether
1866  this name can be cached. Set to TRUE on output if the name can be
1867  cached; set to FALSE otherwise.
1868 
1869  OutputNameControl - Pointer to a Filter Manager-allocated FLT_NAME_CONTROL
1870  structure to receive the file name on output.
1871 
1872 Return Value:
1873 
1874  The return value is the Status of the operation.
1875 
1876 --*/
1877 {
1878 
1879  PAGED_CODE();
1880 
1881  return NcGenerateFileName( Instance,
1882  FileObject,
1883  Data,
1884  NameOptions,
1885  CacheFileNameInformation,
1886  OutputNameControl );
1887 }
1888 
1889 NTSTATUS
1891  _In_ PFLT_INSTANCE Instance,
1892  _In_opt_ PFILE_OBJECT FileObject,
1893  _In_ PCUNICODE_STRING ParentDirectory,
1894  _In_ USHORT DeviceNameLength,
1895  _In_ PCUNICODE_STRING Component,
1896  _Out_writes_bytes_(ExpandComponentNameLength) PFILE_NAMES_INFORMATION ExpandComponentName,
1897  _In_ ULONG ExpandComponentNameLength,
1898  _In_ FLT_NORMALIZE_NAME_FLAGS Flags,
1899  _Inout_ PVOID *NormalizationContext
1900  )
1901 /*++
1902 
1903 Routine Description:
1904 
1905  This callback is invoked to maintain FltMgr's name cache coherency
1906  when this filter munges names.
1907 
1908 Arguments:
1909 
1910  Instance - Instance pointer for the minifilter instance that this callback
1911  routine is registered for.
1912 
1913  FileObject - Optionally points to a file object that the name query is
1914  taking place on. We can use this to flow transaction information
1915  to any recursive requests.
1916 
1917  ParentDirectory - Pointer to a UNICODE_STRING structure that contains the
1918  name of the parent directory for this name component.
1919 
1920  DeviceNameLength - Length, in bytes, of the parent directory name stored
1921  in the structure that the ParentDirectory parameter points to.
1922 
1923  Component - Pointer to a UNICODE_STRING structure that contains the name
1924  component to be expanded.
1925 
1926  ExpandComponentName - Pointer to a FILE_NAMES_INFORMATION structure that
1927  receives the expanded (normalized) file name information for the name
1928  component.
1929 
1930  ExpandComponentNameLength - Length, in bytes, of the buffer that the
1931  ExpandComponentName parameter points to.
1932 
1933  NormalizationContext - Pointer to minifilter-provided context information
1934  to be passed in any subsequent calls to this callback routine that are
1935  made to normalize the remaining components in the same file name path.
1936 
1937 Return Value:
1938 
1939  The return value is the Status of the operation.
1940 
1941 --*/
1942 {
1943  PAGED_CODE();
1944 
1945  return NcNormalizeNameComponentEx( Instance,
1946  FileObject,
1947  ParentDirectory,
1948  DeviceNameLength,
1949  Component,
1950  ExpandComponentName,
1951  ExpandComponentNameLength,
1952  Flags,
1953  NormalizationContext );
1954 
1955 }
1956 
1957 NTSTATUS
1959  _In_ PFLT_INSTANCE Instance,
1960  _In_ PCUNICODE_STRING ParentDirectory,
1961  _In_ USHORT DeviceNameLength,
1962  _In_ PCUNICODE_STRING Component,
1963  _Out_writes_bytes_(ExpandComponentNameLength) PFILE_NAMES_INFORMATION ExpandComponentName,
1964  _In_ ULONG ExpandComponentNameLength,
1965  _In_ FLT_NORMALIZE_NAME_FLAGS Flags,
1966  _Inout_ PVOID *NormalizationContext
1967  )
1968 /*++
1969 
1970 Routine Description:
1971 
1972  This callback is invoked to maintain FltMgr's name cache coherency
1973  when this filter munges names.
1974 
1975 Arguments:
1976 
1977  Instance - Instance pointer for the minifilter instance that this callback
1978  routine is registered for.
1979 
1980  ParentDirectory - Pointer to a UNICODE_STRING structure that contains the
1981  name of the parent directory for this name component.
1982 
1983  DeviceNameLength - Length, in bytes, of the parent directory name stored
1984  in the structure that the ParentDirectory parameter points to.
1985 
1986  Component - Pointer to a UNICODE_STRING structure that contains the name
1987  component to be expanded.
1988 
1989  ExpandComponentName - Pointer to a FILE_NAMES_INFORMATION structure that
1990  receives the expanded (normalized) file name information for the name
1991  component.
1992 
1993  ExpandComponentNameLength - Length, in bytes, of the buffer that the
1994  ExpandComponentName parameter points to.
1995 
1996  NormalizationContext - Pointer to minifilter-provided context information
1997  to be passed in any subsequent calls to this callback routine that are
1998  made to normalize the remaining components in the same file name path.
1999 
2000 Return Value:
2001 
2002  The return value is the Status of the operation.
2003 
2004 --*/
2005 {
2006 
2007  PAGED_CODE();
2008 
2009  return NcNormalizeNameComponentEx( Instance,
2010  NULL,
2011  ParentDirectory,
2012  DeviceNameLength,
2013  Component,
2014  ExpandComponentName,
2015  ExpandComponentNameLength,
2016  Flags,
2017  NormalizationContext );
2018 }
2019 
2020 
2021 
VOID NcInstanceTeardownStart(_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_TEARDOWN_FLAGS Flags)
Definition: nc.c:907
UNICODE_STRING UserMappingFinalComponentLong
Definition: nc.h:470
UNICODE_STRING UserMappingFinalComponentShort
Definition: nc.h:469
#define NC_INSTANCE_CONTEXT_TAG
Definition: nc.h:15
NTSTATUS NcUnload(_In_ FLT_FILTER_UNLOAD_FLAGS Flags)
Definition: nc.c:1024
NTSTATUS NcInitializeMapping(_In_ PUNICODE_STRING RegistryPath)
Definition: ncinit.c:282
FLT_PREOP_CALLBACK_STATUS NcEnumerateDirectory(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)
Definition: ncdirenum.c:39
UNICODE_STRING FullPath
Definition: nc.h:156
#define IRP_MJ_CLEANUP
Definition: mspyLog.h:302
NTSTATUS NcNormalizeNameComponentEx(_In_ PFLT_INSTANCE Instance, _In_opt_ PFILE_OBJECT FileObject, _In_ PCUNICODE_STRING ParentDirectory, _In_ USHORT DeviceNameLength, _In_ PCUNICODE_STRING Component, _Out_writes_bytes_(ExpandComponentNameLength) PFILE_NAMES_INFORMATION ExpandComponentName, _In_ ULONG ExpandComponentNameLength, _In_ FLT_NORMALIZE_NAME_FLAGS Flags, _Inout_ PVOID *NormalizationContext)
Definition: ncnameprov.c:342
CONST FLT_REGISTRATION FilterRegistration
Definition: nc.c:304
FLT_POSTOP_CALLBACK_STATUS NcPostQueryName(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_opt_ PVOID CompletionContext, _In_ FLT_POST_OPERATION_FLAGS Flags)
Definition: ncfileinfo.c:33
VOID NcInitMappingPath(_Out_ PNC_MAPPING_PATH Path)
Definition: ncmapping.c:131
#define NC_STREAM_HANDLE__CONTEXT_TAG
Definition: nc.h:26
NC_MAPPING_ENTRY RealMapping
Definition: nc.h:186
VOID NcCompatInit()
Definition: nccompat.c:414
FLT_POSTOP_CALLBACK_STATUS NcPostReadFileUsnData(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_opt_ PVOID CompletionContext, _In_ FLT_POST_OPERATION_FLAGS Flags)
Definition: ncfsctrl.c:2520
FLT_PREOP_CALLBACK_STATUS NcPreSetDisposition(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)
Definition: ncfileinfo.c:1189
FLT_POSTOP_CALLBACK_STATUS NcPostNotifyDirectory(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ PVOID CompletionContext, _In_ FLT_POST_OPERATION_FLAGS Flags)
Definition: ncdirnotify.c:2824
NTSTATUS NcNormalizeNameComponentExCallback(_In_ PFLT_INSTANCE Instance, _In_opt_ PFILE_OBJECT FileObject, _In_ PCUNICODE_STRING ParentDirectory, _In_ USHORT DeviceNameLength, _In_ PCUNICODE_STRING Component, _Out_writes_bytes_(ExpandComponentNameLength) PFILE_NAMES_INFORMATION ExpandComponentName, _In_ ULONG ExpandComponentNameLength, _In_ FLT_NORMALIZE_NAME_FLAGS Flags, _Inout_ PVOID *NormalizationContext)
Definition: nc.c:1890
UNICODE_STRING UserMappingPath
Definition: nc.h:468
FLT_POSTOP_CALLBACK_STATUS NcPostReadUsnJournal(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_opt_ PVOID CompletionContext, _In_ FLT_POST_OPERATION_FLAGS Flags)
Definition: ncfsctrl.c:3576
#define IRP_MJ_NETWORK_QUERY_OPEN
Definition: minispy.h:37
FLT_PREOP_CALLBACK_STATUS NcPreQueryInformationCallback(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)
Definition: nc.c:1453
_In_opt_ PFILE_OBJECT _In_opt_ PFLT_INSTANCE Instance
Definition: nc.h:493
#define IRP_MN_NOTIFY_CHANGE_DIRECTORY
Definition: mspyLog.h:319
#define IRP_MJ_QUERY_INFORMATION
Definition: mspyLog.h:289
NTSTATUS NcBuildMappingPathFromVolume(_In_ PFLT_VOLUME CONST Volume, _In_ PUNICODE_STRING ParentPath, _In_ PUNICODE_STRING FinalComponentName, _Inout_ PNC_MAPPING_PATH Entry)
Definition: ncmapping.c:376
NTSTATUS NcGenerateFileName(_In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _In_opt_ PFLT_CALLBACK_DATA Data, _In_ FLT_FILE_NAME_OPTIONS NameOptions, _Out_ PBOOLEAN CacheFileNameInformation, _Inout_ PFLT_NAME_CONTROL FileName)
Definition: ncnameprov.c:10
FLT_PREOP_CALLBACK_STATUS NcPreRename(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)
Definition: ncfileinfo.c:1621
FLT_POSTOP_CALLBACK_STATUS NcPostEnumUsnData(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_opt_ PVOID CompletionContext, _In_ FLT_POST_OPERATION_FLAGS Flags)
Definition: ncfsctrl.c:2906
_When_(Data==NULL, _Pre_satisfies_(FileObject !=NULL &&Instance !=NULL)) _When_(FileObject
FLT_ASSERT(IS_MY_CONTROL_DEVICE_OBJECT(DeviceObject))
#define NcFreeUnicodeString(UCS)
Definition: nc.h:40
#define NC_NORMALIZE_NAME_TAG
Definition: nc.h:18
FLT_POSTOP_CALLBACK_STATUS NcPostFindFilesBySid(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ PVOID CompletionContext, _In_ FLT_POST_OPERATION_FLAGS Flags)
Definition: ncfsctrl.c:1092
FLT_PREOP_CALLBACK_STATUS NcPreSetLinkInformation(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)
Definition: ncfileinfo.c:1377
return TRUE
struct _NC_INSTANCE_CONTEXT NC_INSTANCE_CONTEXT
VOID NcStreamHandleContextNotCleanup(_In_ PNC_STREAM_HANDLE_CONTEXT HandleContext)
Definition: ncdirnotify.c:3325
VOID NcStreamHandleContextClose(_In_ PFLT_CONTEXT Context, _In_ FLT_CONTEXT_TYPE ContextType)
Definition: nccontext.c:65
NC_MAPPING Mapping
Definition: nc.h:233
_In_opt_ PFILE_OBJECT _In_opt_ PFLT_INSTANCE _In_ FLT_FILE_NAME_OPTIONS NameOptions
Definition: nc.h:493
FLT_FILESYSTEM_TYPE VolumeFilesystemType
Definition: nc.h:236
NC_CREATE_FILE_EX2_TYPE NcCreateFileEx2
Definition: nccompat.c:80
FLT_POSTOP_CALLBACK_STATUS NcPostFsctlCallback(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _When_(Data->Iopb->Parameters.FileSystemControl.Common.FsControlCode==FSCTL_FIND_FILES_BY_SID, _In_) _When_(Data->Iopb->Parameters.FileSystemControl.Common.FsControlCode!=FSCTL_FIND_FILES_BY_SID, _In_opt_) PVOID CompletionContext, _In_ FLT_POST_OPERATION_FLAGS Flags)
Definition: nc.c:1358
NTSTATUS NcNormalizeNameComponentCallback(_In_ PFLT_INSTANCE Instance, _In_ PCUNICODE_STRING ParentDirectory, _In_ USHORT DeviceNameLength, _In_ PCUNICODE_STRING Component, _Out_writes_bytes_(ExpandComponentNameLength) PFILE_NAMES_INFORMATION ExpandComponentName, _In_ ULONG ExpandComponentNameLength, _In_ FLT_NORMALIZE_NAME_FLAGS Flags, _Inout_ PVOID *NormalizationContext)
Definition: nc.c:1958
VOID NcInitMapping(PNC_MAPPING Mapping)
Definition: ncmapping.c:678
FLT_POSTOP_CALLBACK_STATUS NcPostQueryHardLinks(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_opt_ PVOID CompletionContext, _In_ FLT_POST_OPERATION_FLAGS Flags)
Definition: ncfileinfo.c:581
struct _NC_STREAM_HANDLE_CONTEXT NC_STREAM_HANDLE_CONTEXT
NC_MAPPING_ENTRY UserMapping
Definition: nc.h:187
_In_opt_ PFILE_OBJECT _In_opt_ PFLT_INSTANCE _In_ FLT_FILE_NAME_OPTIONS _Outptr_ PFLT_FILE_NAME_INFORMATION * FileNameInformation
Definition: nc.h:493
_In_ PLARGE_INTEGER _In_ ULONG _In_ ULONG _Out_writes_bytes_(Length)
FLT_PREOP_CALLBACK_STATUS NcPreNotifyDirectory(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)
Definition: ncdirnotify.c:1067
#define IRP_MJ_SET_INFORMATION
Definition: mspyLog.h:290
#define FlagOn(_F, _SF)
Definition: minispy.h:247
CONST FLT_OPERATION_REGISTRATION Callbacks[]
Definition: nc.c:234
NTSTATUS NcInstanceSetup(_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_SETUP_FLAGS Flags, _In_ DEVICE_TYPE VolumeDeviceType, _In_ FLT_FILESYSTEM_TYPE VolumeFilesystemType)
Definition: nc.c:343
int Ancestor
Definition: nc.h:217
NC_QUERY_DIRECTORY_FILE_TYPE NcQueryDirectoryFile
Definition: nccompat.c:79
UNREFERENCED_PARAMETER(FileObject)
VOID NcInstanceContextClose(_In_ PFLT_CONTEXT Context, _In_ FLT_CONTEXT_TYPE ContextType)
Definition: nccontext.c:31
FLT_PREOP_CALLBACK_STATUS NcPreSetInformationCallback(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)
Definition: nc.c:1587
FLT_PREOP_CALLBACK_STATUS NcPreNetworkQueryCallback(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)
Definition: nc.c:1793
NcLoadRegistryStringRetry NULL
Definition: ncinit.c:53
int InMapping
Definition: nc.h:220
FLT_PREOP_CALLBACK_STATUS NcPreCreateCallback(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)
Definition: nc.c:1080
FLT_PREOP_CALLBACK_STATUS NcPreCreate(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)
Definition: nccreate.c:29
FLT_POSTOP_CALLBACK_STATUS NcPostCleanupCallback(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_opt_ PVOID CompletionContext, _In_ FLT_POST_OPERATION_FLAGS Flags)
Definition: nc.c:1184
UNICODE_STRING ParentPath
Definition: nc.h:158
const FLT_CONTEXT_REGISTRATION contextRegistration[]
Definition: nc.c:277
NTSTATUS NcBuildMapping(_In_ PFILE_OBJECT UserParent, _In_ PFILE_OBJECT RealParent, _In_ PUNICODE_STRING UserFinalComponentShortName, _In_ PUNICODE_STRING UserFinalComponentLongName, _In_ PUNICODE_STRING RealFinalComponentName, _In_ PFLT_INSTANCE Instance, _Out_ PNC_MAPPING Mapping)
Definition: ncmapping.c:698
FLT_PREOP_CALLBACK_STATUS NcPreCleanupCallback(_Unreferenced_parameter_ PFLT_CALLBACK_DATA Data, _Unreferenced_parameter_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)
Definition: nc.c:1134
FLT_POSTOP_CALLBACK_STATUS NcPostQueryInformationCallback(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_opt_ PVOID CompletionContext, _In_ FLT_POST_OPERATION_FLAGS Flags)
Definition: nc.c:1524
DRIVER_INITIALIZE DriverEntry
Definition: nc.c:33
BOOLEAN NcComparePath(_In_ PCUNICODE_STRING Name, _In_ PNC_MAPPING_ENTRY Mapping, _Out_opt_ PUNICODE_STRING Remainder, _In_ BOOLEAN IgnoreCase, _In_ BOOLEAN ContainsDevice, _Out_ PNC_PATH_OVERLAP Overlap)
Definition: ncpath.c:13
FLT_POSTOP_CALLBACK_STATUS NcPostDirectoryControlCallback(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ PVOID CompletionContext, _In_ FLT_POST_OPERATION_FLAGS Flags)
Definition: nc.c:1729
PAGED_CODE()
#define IRP_MJ_FILE_SYSTEM_CONTROL
Definition: mspyLog.h:297
#define IRP_MN_QUERY_DIRECTORY
Definition: mspyLog.h:318
#define IRP_MJ_DIRECTORY_CONTROL
Definition: mspyLog.h:296
IoStatus Status
NC_GLOBAL_DATA NcGlobalData
Definition: nc.c:335
#define AlignToSize(_length, _alignment)
Definition: nc.h:35
FLT_PREOP_CALLBACK_STATUS NcPreQueryAlternateName(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)
Definition: ncfileinfo.c:367
FLT_PREOP_CALLBACK_STATUS NcPreFsctlCallback(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)
Definition: nc.c:1267
UNICODE_STRING RealMappingFinalComponent
Definition: nc.h:473
FLT_PREOP_CALLBACK_STATUS NcPreSetShortName(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)
Definition: ncfileinfo.c:999
PFLT_FILTER FilterHandle
Definition: nc.h:475
NTSTATUS NcGenerateFileNameCallback(_In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _In_opt_ PFLT_CALLBACK_DATA Data, _In_ FLT_FILE_NAME_OPTIONS NameOptions, _Out_ PBOOLEAN CacheFileNameInformation, _Inout_ PFLT_NAME_CONTROL FileName)
Definition: nc.c:1836
NTSTATUS NcInstanceQueryTeardown(_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags)
Definition: nc.c:868
FLT_PREOP_CALLBACK_STATUS NcPreFindFilesBySid(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)
Definition: ncfsctrl.c:587
_In_opt_ PFILE_OBJECT FileObject
Definition: nc.h:493
FLT_PREOP_CALLBACK_STATUS NcPreDirectoryControlCallback(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)
Definition: nc.c:1676
UNICODE_STRING RealMappingPath
Definition: nc.h:472
#define IRP_MJ_CREATE
Definition: mspyLog.h:284
VOID NcTeardownMappingPath(_Inout_ PNC_MAPPING_PATH Path)
Definition: ncmapping.c:155

Social Network


Services Overview

Architect, implement and test file system filter drivers for a wide range of functionality. We can offer several levels of assistance to meet your specific.

Contact Us

You are welcome to contact us for salse or partnership.

Sales: sales@easefilter.com
Support: support@easefilter.com
Info: info@easefilter.com