27 #pragma alloc_text(PAGE, CtxFindOrCreateFileContext) 28 #pragma alloc_text(PAGE, CtxCreateFileContext) 29 #pragma alloc_text(PAGE, CtxFindOrCreateStreamContext) 30 #pragma alloc_text(PAGE, CtxCreateStreamContext) 31 #pragma alloc_text(PAGE, CtxUpdateNameInStreamContext) 32 #pragma alloc_text(PAGE, CtxCreateOrReplaceStreamHandleContext) 33 #pragma alloc_text(PAGE, CtxCreateStreamHandleContext) 34 #pragma alloc_text(PAGE, CtxUpdateNameInStreamHandleContext) 42 _In_ PFLT_CALLBACK_DATA Cbd,
43 _In_ BOOLEAN CreateIfNotFound,
44 _When_( CreateIfNotFound != FALSE, _In_ )
_When_( CreateIfNotFound == FALSE, _In_opt_ ) PUNICODE_STRING FileName,
46 _Out_opt_ PBOOLEAN ContextCreated
78 if (ContextCreated !=
NULL) *ContextCreated = FALSE;
84 DebugTrace( DEBUG_TRACE_FILE_CONTEXT_OPERATIONS,
85 (
"[Ctx]: Trying to get file context (FileObject = %p, Instance = %p)\n",
86 Cbd->Iopb->TargetFileObject,
87 Cbd->Iopb->TargetInstance) );
89 status = FltGetFileContext( Cbd->Iopb->TargetInstance,
90 Cbd->Iopb->TargetFileObject,
99 if (!NT_SUCCESS( status ) &&
100 (status == STATUS_NOT_FOUND) &&
108 DebugTrace( DEBUG_TRACE_FILE_CONTEXT_OPERATIONS,
109 (
"[Ctx]: Creating file context (FileObject = %p, Instance = %p)\n",
110 Cbd->Iopb->TargetFileObject,
111 Cbd->Iopb->TargetInstance) );
115 if (!NT_SUCCESS( status )) {
117 DebugTrace( DEBUG_TRACE_ERROR | DEBUG_TRACE_FILE_CONTEXT_OPERATIONS,
118 (
"[Ctx]: Failed to create file context with status 0x%x. (FileObject = %p, Instance = %p)\n",
120 Cbd->Iopb->TargetFileObject,
121 Cbd->Iopb->TargetInstance) );
131 DebugTrace( DEBUG_TRACE_FILE_CONTEXT_OPERATIONS,
132 (
"[Ctx]: Setting file context %p (FileObject = %p, Instance = %p)\n",
134 Cbd->Iopb->TargetFileObject,
135 Cbd->Iopb->TargetInstance) );
137 status = FltSetFileContext( Cbd->Iopb->TargetInstance,
138 Cbd->Iopb->TargetFileObject,
139 FLT_SET_CONTEXT_KEEP_IF_EXISTS,
143 if (!NT_SUCCESS( status )) {
145 DebugTrace( DEBUG_TRACE_FILE_CONTEXT_OPERATIONS,
146 (
"[Ctx]: Failed to set file context with status 0x%x. (FileObject = %p, Instance = %p)\n",
148 Cbd->Iopb->TargetFileObject,
149 Cbd->Iopb->TargetInstance) );
158 DebugTrace( DEBUG_TRACE_FILE_CONTEXT_OPERATIONS,
159 (
"[Ctx]: Releasing file context %p (FileObject = %p, Instance = %p)\n",
161 Cbd->Iopb->TargetFileObject,
162 Cbd->Iopb->TargetInstance) );
164 FltReleaseContext( fileContext );
166 if (status != STATUS_FLT_CONTEXT_ALREADY_DEFINED) {
174 DebugTrace( DEBUG_TRACE_ERROR | DEBUG_TRACE_FILE_CONTEXT_OPERATIONS,
175 (
"[Ctx]: Failed to set file context with status 0x%x != STATUS_FLT_CONTEXT_ALREADY_DEFINED. (FileObject = %p, Instance = %p)\n",
177 Cbd->Iopb->TargetFileObject,
178 Cbd->Iopb->TargetInstance) );
188 DebugTrace( DEBUG_TRACE_FILE_CONTEXT_OPERATIONS,
189 (
"[Ctx]: File context already defined. Retaining old file context %p (FileObject = %p, Instance = %p)\n",
191 Cbd->Iopb->TargetFileObject,
192 Cbd->Iopb->TargetInstance) );
199 fileContext = oldFileContext;
200 status = STATUS_SUCCESS;
204 if (ContextCreated !=
NULL) *ContextCreated =
TRUE;
208 *FileContext = fileContext;
216 _In_ PUNICODE_STRING FileName,
245 DebugTrace( DEBUG_TRACE_FILE_CONTEXT_OPERATIONS,
246 (
"[Ctx]: Allocating file context \n") );
254 if (!NT_SUCCESS( status )) {
256 DebugTrace( DEBUG_TRACE_FILE_CONTEXT_OPERATIONS | DEBUG_TRACE_ERROR,
257 (
"[Ctx]: Failed to allocate file context with status 0x%x \n",
270 fileContext->
FileName.MaximumLength = FileName->Length;
271 status = CtxAllocateUnicodeString( &fileContext->
FileName );
272 if (NT_SUCCESS( status )) {
274 RtlCopyUnicodeString( &fileContext->
FileName, FileName );
277 *FileContext = fileContext;
279 return STATUS_SUCCESS;
285 _In_ PFLT_CALLBACK_DATA Cbd,
286 _In_ BOOLEAN CreateIfNotFound,
288 _Out_opt_ PBOOLEAN ContextCreated
318 *StreamContext =
NULL;
319 if (ContextCreated !=
NULL) *ContextCreated = FALSE;
325 DebugTrace( DEBUG_TRACE_STREAM_CONTEXT_OPERATIONS,
326 (
"[Ctx]: Trying to get stream context (FileObject = %p, Instance = %p)\n",
327 Cbd->Iopb->TargetFileObject,
328 Cbd->Iopb->TargetInstance) );
330 status = FltGetStreamContext( Cbd->Iopb->TargetInstance,
331 Cbd->Iopb->TargetFileObject,
340 if (!NT_SUCCESS( status ) &&
341 (status == STATUS_NOT_FOUND) &&
349 DebugTrace( DEBUG_TRACE_STREAM_CONTEXT_OPERATIONS,
350 (
"[Ctx]: Creating stream context (FileObject = %p, Instance = %p)\n",
351 Cbd->Iopb->TargetFileObject,
352 Cbd->Iopb->TargetInstance) );
356 if (!NT_SUCCESS( status )) {
358 DebugTrace( DEBUG_TRACE_ERROR | DEBUG_TRACE_STREAM_CONTEXT_OPERATIONS,
359 (
"[Ctx]: Failed to create stream context with status 0x%x. (FileObject = %p, Instance = %p)\n",
361 Cbd->Iopb->TargetFileObject,
362 Cbd->Iopb->TargetInstance) );
372 DebugTrace( DEBUG_TRACE_STREAM_CONTEXT_OPERATIONS,
373 (
"[Ctx]: Setting stream context %p (FileObject = %p, Instance = %p)\n",
375 Cbd->Iopb->TargetFileObject,
376 Cbd->Iopb->TargetInstance) );
378 status = FltSetStreamContext( Cbd->Iopb->TargetInstance,
379 Cbd->Iopb->TargetFileObject,
380 FLT_SET_CONTEXT_KEEP_IF_EXISTS,
384 if (!NT_SUCCESS( status )) {
386 DebugTrace( DEBUG_TRACE_STREAM_CONTEXT_OPERATIONS,
387 (
"[Ctx]: Failed to set stream context with status 0x%x. (FileObject = %p, Instance = %p)\n",
389 Cbd->Iopb->TargetFileObject,
390 Cbd->Iopb->TargetInstance) );
399 DebugTrace( DEBUG_TRACE_STREAM_CONTEXT_OPERATIONS,
400 (
"[Ctx]: Releasing stream context %p (FileObject = %p, Instance = %p)\n",
402 Cbd->Iopb->TargetFileObject,
403 Cbd->Iopb->TargetInstance) );
405 FltReleaseContext( streamContext );
407 if (status != STATUS_FLT_CONTEXT_ALREADY_DEFINED) {
415 DebugTrace( DEBUG_TRACE_ERROR | DEBUG_TRACE_STREAM_CONTEXT_OPERATIONS,
416 (
"[Ctx]: Failed to set stream context with status 0x%x != STATUS_FLT_CONTEXT_ALREADY_DEFINED. (FileObject = %p, Instance = %p)\n",
418 Cbd->Iopb->TargetFileObject,
419 Cbd->Iopb->TargetInstance) );
429 DebugTrace( DEBUG_TRACE_STREAM_CONTEXT_OPERATIONS,
430 (
"[Ctx]: Stream context already defined. Retaining old stream context %p (FileObject = %p, Instance = %p)\n",
432 Cbd->Iopb->TargetFileObject,
433 Cbd->Iopb->TargetInstance) );
440 streamContext = oldStreamContext;
441 status = STATUS_SUCCESS;
445 if (ContextCreated !=
NULL) *ContextCreated =
TRUE;
449 *StreamContext = streamContext;
486 DebugTrace( DEBUG_TRACE_STREAM_CONTEXT_OPERATIONS,
487 (
"[Ctx]: Allocating stream context \n") );
495 if (!NT_SUCCESS( status )) {
497 DebugTrace( DEBUG_TRACE_STREAM_CONTEXT_OPERATIONS | DEBUG_TRACE_ERROR,
498 (
"[Ctx]: Failed to allocate stream context with status 0x%x \n",
512 FltReleaseContext( streamContext );
513 return STATUS_INSUFFICIENT_RESOURCES;
515 ExInitializeResourceLite( streamContext->
Resource );
517 *StreamContext = streamContext;
519 return STATUS_SUCCESS;
525 _In_ PUNICODE_STRING DirectoryName,
558 if (StreamContext->FileName.Buffer !=
NULL) {
560 CtxFreeUnicodeString(&StreamContext->FileName);
568 StreamContext->FileName.MaximumLength = DirectoryName->Length;
569 status = CtxAllocateUnicodeString(&StreamContext->FileName);
570 if (NT_SUCCESS(status)) {
572 RtlCopyUnicodeString(&StreamContext->FileName, DirectoryName);
583 _In_ PFLT_CALLBACK_DATA Cbd,
584 _In_ BOOLEAN ReplaceIfExists,
586 _Out_opt_ PBOOLEAN ContextReplaced
617 *StreamHandleContext =
NULL;
618 if (ContextReplaced !=
NULL) *ContextReplaced = FALSE;
624 DebugTrace( DEBUG_TRACE_STREAMHANDLE_CONTEXT_OPERATIONS,
625 (
"[Ctx]: Creating stream handle context (FileObject = %p, Instance = %p)\n",
626 Cbd->Iopb->TargetFileObject,
627 Cbd->Iopb->TargetInstance) );
631 if (!NT_SUCCESS( status )) {
633 DebugTrace( DEBUG_TRACE_ERROR | DEBUG_TRACE_STREAMHANDLE_CONTEXT_OPERATIONS,
634 (
"[Ctx]: Failed to create stream context with status 0x%x. (FileObject = %p, Instance = %p)\n",
636 Cbd->Iopb->TargetFileObject,
637 Cbd->Iopb->TargetInstance) );
646 DebugTrace( DEBUG_TRACE_STREAMHANDLE_CONTEXT_OPERATIONS,
647 (
"[Ctx]: Setting stream context %p (FileObject = %p, Instance = %p, ReplaceIfExists = %x)\n",
649 Cbd->Iopb->TargetFileObject,
650 Cbd->Iopb->TargetInstance,
653 status = FltSetStreamHandleContext( Cbd->Iopb->TargetInstance,
654 Cbd->Iopb->TargetFileObject,
655 ReplaceIfExists ? FLT_SET_CONTEXT_REPLACE_IF_EXISTS : FLT_SET_CONTEXT_KEEP_IF_EXISTS,
657 &oldStreamHandleContext );
659 if (!NT_SUCCESS( status )) {
661 DebugTrace( DEBUG_TRACE_STREAMHANDLE_CONTEXT_OPERATIONS,
662 (
"[Ctx]: Failed to set stream handle context with status 0x%x. (FileObject = %p, Instance = %p)\n",
664 Cbd->Iopb->TargetFileObject,
665 Cbd->Iopb->TargetInstance) );
675 DebugTrace( DEBUG_TRACE_STREAMHANDLE_CONTEXT_OPERATIONS,
676 (
"[Ctx]: Releasing stream handle context %p (FileObject = %p, Instance = %p)\n",
678 Cbd->Iopb->TargetFileObject,
679 Cbd->Iopb->TargetInstance) );
681 FltReleaseContext( streamHandleContext );
683 if (status != STATUS_FLT_CONTEXT_ALREADY_DEFINED) {
691 DebugTrace( DEBUG_TRACE_ERROR | DEBUG_TRACE_STREAMHANDLE_CONTEXT_OPERATIONS,
692 (
"[Ctx]: Failed to set stream context with status 0x%x != STATUS_FLT_CONTEXT_ALREADY_DEFINED. (FileObject = %p, Instance = %p)\n",
694 Cbd->Iopb->TargetFileObject,
695 Cbd->Iopb->TargetInstance) );
712 DebugTrace( DEBUG_TRACE_STREAMHANDLE_CONTEXT_OPERATIONS,
713 (
"[Ctx]: Stream context already defined. Retaining old stream context %p (FileObject = %p, Instance = %p)\n",
714 oldStreamHandleContext,
715 Cbd->Iopb->TargetFileObject,
716 Cbd->Iopb->TargetInstance) );
723 streamHandleContext = oldStreamHandleContext;
724 status = STATUS_SUCCESS;
740 if ( ReplaceIfExists &&
741 oldStreamHandleContext !=
NULL) {
743 DebugTrace( DEBUG_TRACE_STREAMHANDLE_CONTEXT_OPERATIONS,
744 (
"[Ctx]: Releasing old stream handle context %p (FileObject = %p, Instance = %p)\n",
745 oldStreamHandleContext,
746 Cbd->Iopb->TargetFileObject,
747 Cbd->Iopb->TargetInstance) );
749 FltReleaseContext( oldStreamHandleContext );
750 if (ContextReplaced !=
NULL) *ContextReplaced =
TRUE;
754 *StreamHandleContext = streamHandleContext;
792 DebugTrace( DEBUG_TRACE_STREAMHANDLE_CONTEXT_OPERATIONS,
793 (
"[Ctx]: Allocating stream handle context \n") );
796 FLT_STREAMHANDLE_CONTEXT,
799 &streamHandleContext );
801 if (!NT_SUCCESS( status )) {
803 DebugTrace( DEBUG_TRACE_STREAMHANDLE_CONTEXT_OPERATIONS | DEBUG_TRACE_ERROR,
804 (
"[Ctx]: Failed to allocate stream handle context with status 0x%x \n",
819 FltReleaseContext( streamHandleContext );
820 return STATUS_INSUFFICIENT_RESOURCES;
822 ExInitializeResourceLite( streamHandleContext->
Resource );
824 *StreamHandleContext = streamHandleContext;
826 return STATUS_SUCCESS;
833 _In_ PUNICODE_STRING DirectoryName,
866 if (StreamHandleContext->FileName.Buffer !=
NULL) {
868 CtxFreeUnicodeString(&StreamHandleContext->FileName);
876 StreamHandleContext->FileName.MaximumLength = DirectoryName->Length;
877 status = CtxAllocateUnicodeString(&StreamHandleContext->FileName);
878 if (NT_SUCCESS(status)) {
880 RtlCopyUnicodeString(&StreamHandleContext->FileName, DirectoryName);
NTSTATUS CtxFindOrCreateFileContext(_In_ PFLT_CALLBACK_DATA Cbd, _In_ BOOLEAN CreateIfNotFound, _When_(CreateIfNotFound !=FALSE, _In_) _When_(CreateIfNotFound==FALSE, _In_opt_) PUNICODE_STRING FileName, _Outptr_ PCTX_FILE_CONTEXT *FileContext, _Out_opt_ PBOOLEAN ContextCreated)
#define CTX_STREAMHANDLE_CONTEXT_SIZE
#define DebugTrace(Level, Data)
_When_(Data==NULL, _Pre_satisfies_(FileObject !=NULL &&Instance !=NULL)) _When_(FileObject
FLT_ASSERT(IS_MY_CONTROL_DEVICE_OBJECT(DeviceObject))
AV_SCANNER_GLOBAL_DATA Globals
NTSTATUS CtxCreateStreamContext(_Outptr_ PCTX_STREAM_CONTEXT *StreamContext)
NTSTATUS CtxCreateStreamHandleContext(_Outptr_ PCTX_STREAMHANDLE_CONTEXT *StreamHandleContext)
NTSTATUS CtxCreateFileContext(_In_ PUNICODE_STRING FileName, _Outptr_ PCTX_FILE_CONTEXT *FileContext)
NTSTATUS CtxUpdateNameInStreamHandleContext(_In_ PUNICODE_STRING DirectoryName, _Inout_ PCTX_STREAMHANDLE_CONTEXT StreamHandleContext)
NcLoadRegistryStringRetry NULL
FORCEINLINE PERESOURCE CtxAllocateResource(VOID)
#define CTX_STREAM_CONTEXT_SIZE
NTSTATUS CtxFindOrCreateStreamContext(_In_ PFLT_CALLBACK_DATA Cbd, _In_ BOOLEAN CreateIfNotFound, _Outptr_ PCTX_STREAM_CONTEXT *StreamContext, _Out_opt_ PBOOLEAN ContextCreated)
#define CTX_FILE_CONTEXT_SIZE
NTSTATUS CtxCreateOrReplaceStreamHandleContext(_In_ PFLT_CALLBACK_DATA Cbd, _In_ BOOLEAN ReplaceIfExists, _Outptr_ PCTX_STREAMHANDLE_CONTEXT *StreamHandleContext, _Out_opt_ PBOOLEAN ContextReplaced)
NTSTATUS CtxUpdateNameInStreamContext(_In_ PUNICODE_STRING DirectoryName, _Inout_ PCTX_STREAM_CONTEXT StreamContext)