WDK Mini Filter Example
RegistrationData.c
Go to the documentation of this file.
1 /*++
2 
3 Copyright (c) 1989-2002 Microsoft Corporation
4 
5 Module Name:
6 
7  RegistrationData.c
8 
9 Abstract:
10 
11  This filters registration information. Note that this is in a unique file
12  so it could be set into the INIT section.
13 
14 Environment:
15 
16  Kernel mode
17 
18 --*/
19 
20 #include "mspyKern.h"
21 
22 //---------------------------------------------------------------------------
23 // Registration information for FLTMGR.
24 //---------------------------------------------------------------------------
25 
26 //
27 // Tells the compiler to define all following DATA and CONSTANT DATA to
28 // be placed in the INIT segment.
29 //
30 
31 #ifdef ALLOC_DATA_PRAGMA
32  #pragma data_seg("INIT")
33  #pragma const_seg("INIT")
34 #endif
35 
36 CONST FLT_OPERATION_REGISTRATION Callbacks[] = {
37  { IRP_MJ_CREATE,
38  0,
41 
43  0,
45  SpyPostOperationCallback },
46 
47  { IRP_MJ_CLOSE,
48  0,
50  SpyPostOperationCallback },
51 
52  { IRP_MJ_READ,
53  0,
55  SpyPostOperationCallback },
56 
57  { IRP_MJ_WRITE,
58  0,
60  SpyPostOperationCallback },
61 
63  0,
65  SpyPostOperationCallback },
66 
68  0,
70  SpyPostOperationCallback },
71 
73  0,
75  SpyPostOperationCallback },
76 
77  { IRP_MJ_SET_EA,
78  0,
80  SpyPostOperationCallback },
81 
83  0,
85  SpyPostOperationCallback },
86 
88  0,
90  SpyPostOperationCallback },
91 
93  0,
95  SpyPostOperationCallback },
96 
98  0,
100  SpyPostOperationCallback },
101 
103  0,
105  SpyPostOperationCallback },
106 
108  0,
110  SpyPostOperationCallback },
111 
113  0,
115  SpyPostOperationCallback },
116 
117  { IRP_MJ_SHUTDOWN,
118  0,
120  NULL }, //post operation callback not supported
121 
123  0,
125  SpyPostOperationCallback },
126 
127  { IRP_MJ_CLEANUP,
128  0,
130  SpyPostOperationCallback },
131 
133  0,
135  SpyPostOperationCallback },
136 
138  0,
140  SpyPostOperationCallback },
141 
143  0,
145  SpyPostOperationCallback },
146 
148  0,
150  SpyPostOperationCallback },
151 
153  0,
155  SpyPostOperationCallback },
156 
157  { IRP_MJ_PNP,
158  0,
160  SpyPostOperationCallback },
161 
163  0,
165  SpyPostOperationCallback },
166 
168  0,
170  SpyPostOperationCallback },
171 
173  0,
175  SpyPostOperationCallback },
176 
178  0,
180  SpyPostOperationCallback },
181 
183  0,
185  SpyPostOperationCallback },
186 
188  0,
190  SpyPostOperationCallback },
191 
192 /* { IRP_MJ_NOTIFY_STREAM_FILE_OBJECT,
193  0,
194  SpyPreOperationCallback,
195  SpyPostOperationCallback },*/
196 
198  0,
200  SpyPostOperationCallback },
201 
203  0,
205  SpyPostOperationCallback },
206 
207  { IRP_MJ_MDL_READ,
208  0,
210  SpyPostOperationCallback },
211 
213  0,
215  SpyPostOperationCallback },
216 
218  0,
220  SpyPostOperationCallback },
221 
223  0,
225  SpyPostOperationCallback },
226 
228  0,
230  SpyPostOperationCallback },
231 
233  0,
235  SpyPostOperationCallback },
236 
237  { IRP_MJ_OPERATION_END }
238 };
239 
240 const FLT_CONTEXT_REGISTRATION Contexts[] = {
241 
242 #if MINISPY_VISTA
243 
244  { FLT_TRANSACTION_CONTEXT,
245  0,
248  'ypsM' },
249 
250 #endif // MINISPY_VISTA
251 
252  { FLT_CONTEXT_END }
253 };
254 
255 //
256 // This defines what we want to filter with FltMgr
257 //
258 
259 CONST FLT_REGISTRATION FilterRegistration = {
260 
261  sizeof(FLT_REGISTRATION), // Size
262  FLT_REGISTRATION_VERSION, // Version
263 #if MINISPY_WIN8
264  FLTFL_REGISTRATION_SUPPORT_NPFS_MSFS, // Flags
265 #else
266  0, // Flags
267 #endif // MINISPY_WIN8
268 
269  Contexts, // Context
270  Callbacks, // Operation callbacks
271 
272  SpyFilterUnload, // FilterUnload
273 
274  NULL, // InstanceSetup
275  SpyQueryTeardown, // InstanceQueryTeardown
276  NULL, // InstanceTeardownStart
277  NULL, // InstanceTeardownComplete
278 
279  NULL, // GenerateFileName
280  NULL, // GenerateDestinationFileName
281  NULL // NormalizeNameComponent
282 
283 #if MINISPY_VISTA
284 
285  ,
286  SpyKtmNotificationCallback // KTM notification callback
287 
288 #endif // MINISPY_VISTA
289 
290 };
291 
292 
293 //
294 // Tells the compiler to restore the given section types back to their previous
295 // section definition.
296 //
297 
298 #ifdef ALLOC_DATA_PRAGMA
299  #pragma data_seg()
300  #pragma const_seg()
301 #endif
302 
NTSTATUS SpyQueryTeardown(_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags)
Definition: minispy.c:354
CONST FLT_REGISTRATION FilterRegistration
NTSTATUS SpyFilterUnload(_In_ FLT_FILTER_UNLOAD_FLAGS Flags)
Definition: minispy.c:309
CONST FLT_OPERATION_REGISTRATION Callbacks[]
#define IRP_MJ_WRITE
Definition: mspyLog.h:288
NTSTATUS SpyKtmNotificationCallback(_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ PFLT_CONTEXT TransactionContext, _In_ ULONG TransactionNotification)
Definition: minispy.c:1289
#define IRP_MJ_READ
Definition: mspyLog.h:287
#define IRP_MJ_MDL_WRITE_COMPLETE
Definition: minispy.h:41
#define IRP_MJ_CLEANUP
Definition: mspyLog.h:302
#define IRP_MJ_SET_EA
Definition: mspyLog.h:292
#define IRP_MJ_ACQUIRE_FOR_CC_FLUSH
Definition: minispy.h:32
#define IRP_MJ_RELEASE_FOR_SECTION_SYNCHRONIZATION
Definition: minispy.h:29
#define MINISPY_WIN8
Definition: mspyKern.h:42
#define IRP_MJ_DEVICE_CONTROL
Definition: mspyLog.h:298
#define IRP_MJ_QUERY_QUOTA
Definition: mspyLog.h:309
#define IRP_MJ_NETWORK_QUERY_OPEN
Definition: minispy.h:37
#define IRP_MJ_SET_VOLUME_INFORMATION
Definition: mspyLog.h:295
#define IRP_MJ_QUERY_INFORMATION
Definition: mspyLog.h:289
#define IRP_MJ_INTERNAL_DEVICE_CONTROL
Definition: mspyLog.h:299
#define IRP_MJ_SET_SECURITY
Definition: mspyLog.h:305
#define IRP_MJ_RELEASE_FOR_CC_FLUSH
Definition: minispy.h:33
#define IRP_MJ_CREATE_MAILSLOT
Definition: mspyLog.h:303
FLT_POSTOP_CALLBACK_STATUS SpyPostOperationCallback(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ PVOID CompletionContext, _In_ FLT_POST_OPERATION_FLAGS Flags)
Definition: minispy.c:911
#define IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION
Definition: minispy.h:28
#define IRP_MJ_LOCK_CONTROL
Definition: mspyLog.h:301
struct _MINISPY_TRANSACTION_CONTEXT MINISPY_TRANSACTION_CONTEXT
#define MINISPY_VISTA
Definition: mspyKern.h:44
#define IRP_MJ_SET_INFORMATION
Definition: mspyLog.h:290
#define IRP_MJ_MDL_READ
Definition: minispy.h:38
FLT_PREOP_CALLBACK_STATUS SpyPreOperationCallback(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)
Definition: minispy.c:593
NcLoadRegistryStringRetry NULL
Definition: ncinit.c:53
#define IRP_MJ_SET_QUOTA
Definition: mspyLog.h:310
#define IRP_MJ_ACQUIRE_FOR_MOD_WRITE
Definition: minispy.h:30
#define IRP_MJ_RELEASE_FOR_MOD_WRITE
Definition: minispy.h:31
#define IRP_MJ_VOLUME_DISMOUNT
Definition: minispy.h:43
#define IRP_MJ_CLOSE
Definition: mspyLog.h:286
#define IRP_MJ_FILE_SYSTEM_CONTROL
Definition: mspyLog.h:297
#define IRP_MJ_DIRECTORY_CONTROL
Definition: mspyLog.h:296
#define IRP_MJ_FAST_IO_CHECK_IF_POSSIBLE
Definition: minispy.h:36
#define IRP_MJ_PREPARE_MDL_WRITE
Definition: minispy.h:40
const FLT_CONTEXT_REGISTRATION Contexts[]
VOID SpyDeleteTxfContext(_Inout_ PMINISPY_TRANSACTION_CONTEXT Context, _In_ FLT_CONTEXT_TYPE ContextType)
Definition: minispy.c:1322
#define IRP_MJ_QUERY_SECURITY
Definition: mspyLog.h:304
#define IRP_MJ_PNP
Definition: mspyLog.h:311
#define IRP_MJ_VOLUME_MOUNT
Definition: minispy.h:42
#define IRP_MJ_QUERY_EA
Definition: mspyLog.h:291
#define IRP_MJ_FLUSH_BUFFERS
Definition: mspyLog.h:293
#define IRP_MJ_MDL_READ_COMPLETE
Definition: minispy.h:39
#define IRP_MJ_SHUTDOWN
Definition: mspyLog.h:300
#define IRP_MJ_QUERY_VOLUME_INFORMATION
Definition: mspyLog.h:294
#define IRP_MJ_CREATE_NAMED_PIPE
Definition: mspyLog.h:285
#define IRP_MJ_CREATE
Definition: mspyLog.h:284

Social Network


Services Overview

Architect, implement and test file system filter drivers for a wide range of functionality. We can offer several levels of assistance to meet your specific.

Contact Us

You are welcome to contact us for salse or partnership.

Sales: sales@easefilter.com
Support: support@easefilter.com
Info: info@easefilter.com