WDK Mini Filter Example
Functions | Variables
change.c File Reference
#include "change.h"

Go to the source code of this file.

Functions

NTSTATUS DriverEntry (_In_ PDRIVER_OBJECT DriverObject, _In_ PUNICODE_STRING RegistryPath)
 
NTSTATUS CgInstanceSetup (_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_SETUP_FLAGS Flags, _In_ DEVICE_TYPE VolumeDeviceType, _In_ FLT_FILESYSTEM_TYPE VolumeFilesystemType)
 
VOID CgInstanceTeardownStart (_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_TEARDOWN_FLAGS Flags)
 
VOID CgInstanceTeardownComplete (_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_TEARDOWN_FLAGS Flags)
 
NTSTATUS CgUnload (_In_ FLT_FILTER_UNLOAD_FLAGS Flags)
 
NTSTATUS CgInstanceQueryTeardown (_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags)
 
FLT_PREOP_CALLBACK_STATUS CgPreOperationCallback (_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)
 
FLT_PREOP_CALLBACK_STATUS CgPreCreate (_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)
 
FLT_POSTOP_CALLBACK_STATUS CgPostCreate (_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_opt_ PVOID CompletionContext, _In_ FLT_POST_OPERATION_FLAGS Flags)
 
FLT_PREOP_CALLBACK_STATUS CgPreClose (_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)
 
FLT_PREOP_CALLBACK_STATUS CgPreFsControl (_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)
 
NTSTATUS CgKtmNotificationCallback (_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ PFLT_CONTEXT TransactionContext, _In_ ULONG TransactionNotification)
 
BOOLEAN CgOperationsNeedDirty (_In_ PFLT_CALLBACK_DATA Data)
 
NTSTATUS CgQueryTransactionOutcome (_In_ PKTRANSACTION Transaction, _Out_ PULONG TxOutcome)
 
NTSTATUS CgProcessPreviousTransaction (_In_ PCFLT_RELATED_OBJECTS FltObjects, _Inout_ PCG_FILE_CONTEXT FileContext)
 
NTSTATUS CgProcessTransactionOutcome (_Inout_ PCG_TRANSACTION_CONTEXT TransactionContext, _In_ ULONG TransactionOutcome)
 
FORCEINLINE VOID CgPropagateDirty (_Inout_ PCG_FILE_CONTEXT FileContext, _In_ ULONG TransactionOutcome)
 

Variables

DRIVER_INITIALIZE DriverEntry
 
CONST FLT_OPERATION_REGISTRATION Callbacks []
 
const FLT_CONTEXT_REGISTRATION ContextRegistration []
 
CONST FLT_REGISTRATION FilterRegistration
 

Function Documentation

◆ CgInstanceQueryTeardown()

NTSTATUS CgInstanceQueryTeardown ( _In_ PCFLT_RELATED_OBJECTS  FltObjects,
_In_ FLT_INSTANCE_QUERY_TEARDOWN_FLAGS  Flags 
)

Definition at line 299 of file change.c.

◆ CgInstanceSetup()

NTSTATUS CgInstanceSetup ( _In_ PCFLT_RELATED_OBJECTS  FltObjects,
_In_ FLT_INSTANCE_SETUP_FLAGS  Flags,
_In_ DEVICE_TYPE  VolumeDeviceType,
_In_ FLT_FILESYSTEM_TYPE  VolumeFilesystemType 
)

Definition at line 254 of file change.c.

◆ CgInstanceTeardownComplete()

VOID CgInstanceTeardownComplete ( _In_ PCFLT_RELATED_OBJECTS  FltObjects,
_In_ FLT_INSTANCE_TEARDOWN_FLAGS  Flags 
)

Definition at line 375 of file change.c.

◆ CgInstanceTeardownStart()

VOID CgInstanceTeardownStart ( _In_ PCFLT_RELATED_OBJECTS  FltObjects,
_In_ FLT_INSTANCE_TEARDOWN_FLAGS  Flags 
)

Definition at line 341 of file change.c.

◆ CgKtmNotificationCallback()

NTSTATUS CgKtmNotificationCallback ( _In_ PCFLT_RELATED_OBJECTS  FltObjects,
_In_ PFLT_CONTEXT  TransactionContext,
_In_ ULONG  TransactionNotification 
)

Definition at line 1337 of file change.c.

◆ CgOperationsNeedDirty()

BOOLEAN CgOperationsNeedDirty ( _In_ PFLT_CALLBACK_DATA  Data)

Definition at line 513 of file change.c.

◆ CgPostCreate()

FLT_POSTOP_CALLBACK_STATUS CgPostCreate ( _Inout_ PFLT_CALLBACK_DATA  Data,
_In_ PCFLT_RELATED_OBJECTS  FltObjects,
_In_opt_ PVOID  CompletionContext,
_In_ FLT_POST_OPERATION_FLAGS  Flags 
)

Definition at line 1157 of file change.c.

◆ CgPreClose()

FLT_PREOP_CALLBACK_STATUS CgPreClose ( _Inout_ PFLT_CALLBACK_DATA  Data,
_In_ PCFLT_RELATED_OBJECTS  FltObjects,
_Flt_CompletionContext_Outptr_ PVOID *  CompletionContext 
)

Definition at line 1265 of file change.c.

◆ CgPreCreate()

FLT_PREOP_CALLBACK_STATUS CgPreCreate ( _Inout_ PFLT_CALLBACK_DATA  Data,
_In_ PCFLT_RELATED_OBJECTS  FltObjects,
_Flt_CompletionContext_Outptr_ PVOID *  CompletionContext 
)

Definition at line 1105 of file change.c.

◆ CgPreFsControl()

FLT_PREOP_CALLBACK_STATUS CgPreFsControl ( _Inout_ PFLT_CALLBACK_DATA  Data,
_In_ PCFLT_RELATED_OBJECTS  FltObjects,
_Flt_CompletionContext_Outptr_ PVOID *  CompletionContext 
)

Definition at line 1059 of file change.c.

◆ CgPreOperationCallback()

FLT_PREOP_CALLBACK_STATUS CgPreOperationCallback ( _Inout_ PFLT_CALLBACK_DATA  Data,
_In_ PCFLT_RELATED_OBJECTS  FltObjects,
_Flt_CompletionContext_Outptr_ PVOID *  CompletionContext 
)

Definition at line 956 of file change.c.

◆ CgProcessPreviousTransaction()

NTSTATUS CgProcessPreviousTransaction ( _In_ PCFLT_RELATED_OBJECTS  FltObjects,
_Inout_ PCG_FILE_CONTEXT  FileContext 
)

Definition at line 669 of file change.c.

◆ CgProcessTransactionOutcome()

NTSTATUS CgProcessTransactionOutcome ( _Inout_ PCG_TRANSACTION_CONTEXT  TransactionContext,
_In_ ULONG  TransactionOutcome 
)

Definition at line 870 of file change.c.

◆ CgPropagateDirty()

FORCEINLINE VOID CgPropagateDirty ( _Inout_ PCG_FILE_CONTEXT  FileContext,
_In_ ULONG  TransactionOutcome 
)

Definition at line 638 of file change.c.

◆ CgQueryTransactionOutcome()

NTSTATUS CgQueryTransactionOutcome ( _In_ PKTRANSACTION  Transaction,
_Out_ PULONG  TxOutcome 
)

Definition at line 573 of file change.c.

◆ CgUnload()

NTSTATUS CgUnload ( _In_ FLT_FILTER_UNLOAD_FLAGS  Flags)

Definition at line 471 of file change.c.

◆ DriverEntry()

NTSTATUS DriverEntry ( _In_ PDRIVER_OBJECT  DriverObject,
_In_ PUNICODE_STRING  RegistryPath 
)

Definition at line 413 of file change.c.

Variable Documentation

◆ Callbacks

CONST FLT_OPERATION_REGISTRATION Callbacks[]
Initial value:
= {
{ IRP_MJ_CREATE,
0,
CgPreCreate,
CgPostCreate },
{ IRP_MJ_CLOSE,
0,
CgPreClose,
NULL },
{ IRP_MJ_WRITE,
0,
CgPreOperationCallback,
NULL },
{ IRP_MJ_SET_INFORMATION,
0,
CgPreOperationCallback,
NULL },
{ IRP_MJ_FILE_SYSTEM_CONTROL,
0,
CgPreFsControl,
NULL },
{ IRP_MJ_OPERATION_END }
}
IRP_MJ_WRITE
#define IRP_MJ_WRITE
Definition: mspyLog.h:288
CgPreOperationCallback
FLT_PREOP_CALLBACK_STATUS CgPreOperationCallback(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)
Definition: change.c:956
CgPreClose
FLT_PREOP_CALLBACK_STATUS CgPreClose(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)
Definition: change.c:1265
CgPostCreate
FLT_POSTOP_CALLBACK_STATUS CgPostCreate(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_opt_ PVOID CompletionContext, _In_ FLT_POST_OPERATION_FLAGS Flags)
Definition: change.c:1157
CgPreCreate
FLT_PREOP_CALLBACK_STATUS CgPreCreate(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)
Definition: change.c:1105
IRP_MJ_SET_INFORMATION
#define IRP_MJ_SET_INFORMATION
Definition: mspyLog.h:290
NULL
NcLoadRegistryStringRetry NULL
Definition: ncinit.c:53
IRP_MJ_CLOSE
#define IRP_MJ_CLOSE
Definition: mspyLog.h:286
IRP_MJ_FILE_SYSTEM_CONTROL
#define IRP_MJ_FILE_SYSTEM_CONTROL
Definition: mspyLog.h:297
CgPreFsControl
FLT_PREOP_CALLBACK_STATUS CgPreFsControl(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)
Definition: change.c:1059
IRP_MJ_CREATE
#define IRP_MJ_CREATE
Definition: mspyLog.h:284

Definition at line 189 of file change.c.

◆ ContextRegistration

const FLT_CONTEXT_REGISTRATION ContextRegistration[]

Definition at line 68 of file avscan/filter/context.c.

◆ DriverEntry

DRIVER_INITIALIZE DriverEntry

Definition at line 53 of file change.c.

◆ FilterRegistration

CONST FLT_REGISTRATION FilterRegistration
Initial value:
= {
sizeof( FLT_REGISTRATION ),
FLT_REGISTRATION_VERSION,
0,
ContextRegistration,
Callbacks,
CgUnload,
CgInstanceSetup,
CgInstanceQueryTeardown,
CgInstanceTeardownStart,
CgInstanceTeardownComplete,
NULL,
NULL,
NULL,
CgKtmNotificationCallback
}
CgUnload
NTSTATUS CgUnload(_In_ FLT_FILTER_UNLOAD_FLAGS Flags)
Definition: change.c:471
CgKtmNotificationCallback
NTSTATUS CgKtmNotificationCallback(_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ PFLT_CONTEXT TransactionContext, _In_ ULONG TransactionNotification)
Definition: change.c:1337
Callbacks
CONST FLT_OPERATION_REGISTRATION Callbacks[]
Definition: change.c:189
CgInstanceQueryTeardown
NTSTATUS CgInstanceQueryTeardown(_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags)
Definition: change.c:299
CgInstanceTeardownStart
VOID CgInstanceTeardownStart(_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_TEARDOWN_FLAGS Flags)
Definition: change.c:341
NULL
NcLoadRegistryStringRetry NULL
Definition: ncinit.c:53
CgInstanceSetup
NTSTATUS CgInstanceSetup(_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_SETUP_FLAGS Flags, _In_ DEVICE_TYPE VolumeDeviceType, _In_ FLT_FILESYSTEM_TYPE VolumeFilesystemType)
Definition: change.c:254
ContextRegistration
const FLT_CONTEXT_REGISTRATION ContextRegistration[]
Definition: avscan/filter/context.c:68
CgInstanceTeardownComplete
VOID CgInstanceTeardownComplete(_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_TEARDOWN_FLAGS Flags)
Definition: change.c:375

Definition at line 228 of file change.c.

Social Network


Services Overview

Architect, implement and test file system filter drivers for a wide range of functionality. We can offer several levels of assistance to meet your specific.

Contact Us

You are welcome to contact us for salse or partnership.

Sales: sales@easefilter.com
Support: support@easefilter.com
Info: info@easefilter.com

© Copyright EaseFilter Inc..