#include <fltkernel.h>
#include <ntintsafe.h>

Data Structures
struct	__NC_CACHE_ENTRY

struct	_NC_MAPPING_PATH

struct	_NC_MAPPING_ENTRY

struct	_NC_MAPPING

union	NC_PATH_OVERLAP

struct	_NC_INSTANCE_CONTEXT

struct	_NC_DIR_QRY_CONTEXT

struct	_NC_DIR_NOT_IO_CACHE

struct	_NC_DIR_NOT_CONTEXT

struct	_NC_FIND_BY_SID_CONTEXT

struct	_NC_STREAM_HANDLE_CONTEXT

struct	_DIRECTORY_CONTROL_OFFSETS

struct	_NC_GLOBAL_DATA

Macros
#define	NC_TAG 'NC__'

#define	NC_MAPPING_TAG 'NCMP'

#define	NC_INSTANCE_CONTEXT_TAG 'NCin'

#define	NC_LOCK_TAG 'NClk'

#define	NC_GENERATE_NAME_TAG 'NCgn'

#define	NC_NORMALIZE_NAME_TAG 'NCnn'

#define	NC_FILE_NAME_TAG 'NCfn'

#define	NC_DIR_QRY_CACHE_TAG 'NCqc'

#define	NC_DIR_QRY_SEARCH_STRING 'NCqs'

#define	NC_SET_LINK_BUFFER_TAG 'NCsl'

#define	NC_RENAME_BUFFER_TAG 'NCrn'

#define	NC_STREAM_HANDLE__CONTEXT_TAG 'NCsh'

#define	NC_SEPARATOR ((WCHAR) L'\\')

#define	EMPTY_UNICODE_STRING {0, 0, NULL}

#define	AlignToSize(_length, _alignment) (((_length) + ((_alignment) - 1)) & ~((_alignment) - 1))

#define	Max(a, b) ((a) >= (b) ? (a) : (b))

#define	NcFreeUnicodeString(UCS)

#define	INVALID_HANDLE_VALUE ((HANDLE) -1)

#define	NcLockStreamHandleContext(C) FltAcquireResourceExclusive( (C)->Lock );

#define	NcUnlockStreamHandleContext(C) FltReleaseResource( (C)->Lock );

Typedefs
typedef NTSTATUS(*	NC_REPLACE_FILEOBJECT_NAME_TYPE) (_In_ PFILE_OBJECT FileObject, _In_reads_bytes_(FileNameLength) PWSTR NewFileName, _In_ USHORT FileNameLength)

typedef NTSTATUS(*	NC_QUERY_DIRECTORY_FILE_TYPE) (_In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _Out_writes_bytes_(Length) PVOID FileInformation, _In_ ULONG Length, _In_ FILE_INFORMATION_CLASS FileInformationClass, _In_ BOOLEAN ReturnSingleEntry, _In_opt_ PUNICODE_STRING FileName, _In_ BOOLEAN RestartScan, _Out_opt_ PULONG LengthReturned)

typedef NTSTATUS(*	NC_CREATE_FILE_EX_TYPE) (_In_ PFLT_FILTER Filter, _In_opt_ PFLT_INSTANCE Instance, _Out_ PHANDLE FileHandle, _Outptr_opt_ PFILE_OBJECT *FileObject, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _Out_ PIO_STATUS_BLOCK IoStatusBlock, _In_opt_ PLARGE_INTEGER AllocationSize, _In_ ULONG FileAttributes, _In_ ULONG ShareAccess, _In_ ULONG CreateDisposition, _In_ ULONG CreateOptions, _In_reads_bytes_opt_(EaLength) PVOID EaBuffer, _In_ ULONG EaLength, _In_ ULONG Flags)

typedef NTSTATUS(*	NC_CREATE_FILE_EX2_TYPE) (_In_ PFLT_FILTER Filter, _In_opt_ PFLT_INSTANCE Instance, _Out_ PHANDLE FileHandle, _Outptr_opt_ PFILE_OBJECT *FileObject, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _Out_ PIO_STATUS_BLOCK IoStatusBlock, _In_opt_ PLARGE_INTEGER AllocationSize, _In_ ULONG FileAttributes, _In_ ULONG ShareAccess, _In_ ULONG CreateDisposition, _In_ ULONG CreateOptions, _In_reads_bytes_opt_(EaLength) PVOID EaBuffer, _In_ ULONG EaLength, _In_ ULONG Flags, _In_opt_ PIO_DRIVER_CREATE_CONTEXT DriverContext)

typedef PVOID(*	NC_GET_NEW_SYSTEM_BUFFER_ADDRESS) (_In_ PFLT_CALLBACK_DATA Data)

typedef struct __NC_CACHE_ENTRY	NC_CACHE_ENTRY

typedef struct __NC_CACHE_ENTRY *	PNC_CACHE_ENTRY

typedef struct _NC_MAPPING_PATH	NC_MAPPING_PATH

typedef struct _NC_MAPPING_PATH *	PNC_MAPPING_PATH

typedef struct _NC_MAPPING_ENTRY	NC_MAPPING_ENTRY

typedef struct _NC_MAPPING_ENTRY *	PNC_MAPPING_ENTRY

typedef struct _NC_MAPPING	NC_MAPPING

typedef struct _NC_MAPPING *	PNC_MAPPING

typedef union NC_PATH_OVERLAP *	PNC_PATH_OVERLAP

typedef struct _NC_INSTANCE_CONTEXT	NC_INSTANCE_CONTEXT

typedef struct _NC_INSTANCE_CONTEXT *	PNC_INSTANCE_CONTEXT

typedef struct _NC_DIR_QRY_CONTEXT	NC_DIR_QRY_CONTEXT

typedef struct _NC_DIR_QRY_CONTEXT *	PNC_DIR_QRY_CONTEXT

typedef struct _NC_DIR_NOT_IO_CACHE	NC_DIR_NOT_IO_CACHE

typedef struct _NC_DIR_NOT_IO_CACHE *	PNC_DIR_NOT_IO_CACHE

typedef struct _NC_DIR_NOT_CONTEXT	NC_DIR_NOT_CONTEXT

typedef struct _NC_DIR_NOT_CONTEXT *	PNC_DIR_NOT_CONTEXT

typedef struct _NC_FIND_BY_SID_CONTEXT	NC_FIND_BY_SID_CONTEXT

typedef struct _NC_FIND_BY_SID_CONTEXT *	PNC_FIND_BY_SID_CONTEXT

typedef struct _NC_STREAM_HANDLE_CONTEXT	NC_STREAM_HANDLE_CONTEXT

typedef struct _NC_STREAM_HANDLE_CONTEXT *	PNC_STREAM_HANDLE_CONTEXT

typedef struct _DIRECTORY_CONTROL_OFFSETS	DIRECTORY_CONTROL_OFFSETS

typedef struct _DIRECTORY_CONTROL_OFFSETS *	PDIRECTORY_CONTROL_OFFSETS

typedef struct _NC_GLOBAL_DATA	NC_GLOBAL_DATA

typedef struct _NC_GLOBAL_DATA *	PNC_GLOBAL_DATA

Functions
	_When_ (Data==NULL, _Pre_satisfies_(FileObject !=NULL &&Instance !=NULL)) _When_(FileObject

	_Pre_satisfies_ (Data !=NULL)) NTSTATUS NcGetFileNameInformation(_In_opt_ PFLT_CALLBACK_DATA Data

NTSTATUS	NcAllocateEResource (_Out_ PERESOURCE *OutputLock)

VOID	NcFreeEResource (_In_ PERESOURCE Lock)

NTSTATUS	NcCreateFileHelper (_In_ PFLT_FILTER Filter, _In_opt_ PFLT_INSTANCE Instance, _Out_ PHANDLE FileHandle, _Outptr_opt_ PFILE_OBJECT *FileObject, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _Out_ PIO_STATUS_BLOCK IoStatusBlock, _In_opt_ PLARGE_INTEGER AllocationSize, _In_ ULONG FileAttributes, _In_ ULONG ShareAccess, _In_ ULONG CreateDisposition, _In_ ULONG CreateOptions, _In_reads_bytes_opt_(EaLength) PVOID EaBuffer, _In_ ULONG EaLength, _In_ ULONG Flags, _In_opt_ PFILE_OBJECT ParentFileObject)

NTSTATUS	NcSetCancelCompletion (_In_ PFLT_CALLBACK_DATA Data, _In_ PFLT_COMPLETE_CANCELED_CALLBACK CanceledCallback)

LONG	NcExceptionFilter (_In_ PEXCEPTION_POINTERS ExceptionPointer, _In_ BOOLEAN AccessingUserBuffer)

VOID	NcInitMappingPath (_Out_ PNC_MAPPING_PATH Path)

VOID	NcTeardownMappingPath (_Inout_ PNC_MAPPING_PATH Path)

NTSTATUS	NcBuildMappingPathFromVolume (_In_ PFLT_VOLUME CONST Volume, _In_ PUNICODE_STRING ParentPath, _In_ PUNICODE_STRING FinalComponentName, _Inout_ PNC_MAPPING_PATH Entry)

BOOLEAN	NcIsMappingZeroed (PNC_MAPPING Mapping)

VOID	NcInitMapping (PNC_MAPPING Mapping)

VOID	NcTeardownMapping (_Inout_ PNC_MAPPING Mapping)

NTSTATUS	NcBuildMapping (_In_ PFILE_OBJECT UserParent, _In_ PFILE_OBJECT RealParent, _In_ PUNICODE_STRING UserFinalComponentShortName, _In_ PUNICODE_STRING UserFinalComponentLongName, _In_ PUNICODE_STRING RealFinalComponentName, _In_ PFLT_INSTANCE Instance, _Out_ PNC_MAPPING Mapping)

NTSTATUS	NcInitializeMapping (_In_ PUNICODE_STRING RegistryPath)

BOOLEAN	NcComparePath (_In_ PCUNICODE_STRING Name, _In_ PNC_MAPPING_ENTRY Mapping, _Out_opt_ PUNICODE_STRING Remainder, _In_ BOOLEAN IgnoreCase, _In_ BOOLEAN ContainsDevice, _Out_ PNC_PATH_OVERLAP Overlap)

	_Post_satisfies_ (NewName->MaximumLength< MAXUSHORT) _Post_satisfies_(NewName -> Length<=NewName->MaximumLength) _Must_inspect_result_ NTSTATUS NcConstructPath(_In_ PNC_MAPPING_ENTRY RealPath, _In_ PUNICODE_STRING Remainder, _In_ BOOLEAN IncludeVolume, _Out_ _At_(NewName->Buffer, __drv_allocatesMem(Mem)) PUNICODE_STRING NewName)

NTSTATUS	NcParseFinalComponent (_In_ PUNICODE_STRING EntirePath, _Out_ PUNICODE_STRING ParentPath, _Out_ PUNICODE_STRING FinalComponent)

NTSTATUS	NcStreamHandleContextAllocAndAttach (_In_ PFLT_FILTER Filter, _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _Out_ PNC_STREAM_HANDLE_CONTEXT *Context)

VOID	NcInstanceContextClose (_In_ PFLT_CONTEXT Context, _In_ FLT_CONTEXT_TYPE ContextType)

VOID	NcStreamHandleContextClose (_In_ PFLT_CONTEXT Context, _In_ FLT_CONTEXT_TYPE ContextType)

FLT_PREOP_CALLBACK_STATUS	NcPreCreate (_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)

NTSTATUS	NcGenerateFileName (_In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _In_opt_ PFLT_CALLBACK_DATA Data, _In_ FLT_FILE_NAME_OPTIONS NameOptions, _Out_ PBOOLEAN CacheFileNameInformation, _Inout_ PFLT_NAME_CONTROL FileName)

NTSTATUS	NcNormalizeNameComponentEx (_In_ PFLT_INSTANCE Instance, _In_opt_ PFILE_OBJECT FileObject, _In_ PCUNICODE_STRING ParentDirectory, _In_ USHORT DeviceNameLength, _In_ PCUNICODE_STRING Component, _Out_writes_bytes_(ExpandComponentNameLength) PFILE_NAMES_INFORMATION ExpandComponentName, _In_ ULONG ExpandComponentNameLength, _In_ FLT_NORMALIZE_NAME_FLAGS Flags, _Inout_ PVOID *NormalizationContext)

BOOLEAN	NcDetermineStructureOffsets (_Out_ PDIRECTORY_CONTROL_OFFSETS Offsets, _In_ FILE_INFORMATION_CLASS Information)

VOID	NcCalculateDirectoryNotificationOffsets (PDIRECTORY_CONTROL_OFFSETS Offsets)

ULONG	NcGetNextEntryOffset (_In_ CONST PVOID Buffer, _In_ CONST PDIRECTORY_CONTROL_OFFSETS Offsets)

PVOID	NcGetNextEntry (_In_ CONST PVOID Buffer, _In_ CONST PDIRECTORY_CONTROL_OFFSETS Offsets)

ULONG	NcGetFileNameLength (_In_ CONST PVOID Buffer, _In_ CONST PDIRECTORY_CONTROL_OFFSETS Offsets)

ULONG	NcGetEntrySize (_In_ CONST PVOID Buffer, _In_ CONST PDIRECTORY_CONTROL_OFFSETS Offsets)

PWSTR	NcGetFileName (_In_ CONST PVOID Buffer, _In_ CONST PDIRECTORY_CONTROL_OFFSETS Offsets)

PWSTR	NcGetShortName (_In_ CONST PVOID Buffer, _In_ CONST PDIRECTORY_CONTROL_OFFSETS Offsets)

CCHAR	NcGetShortNameLength (_In_ CONST PVOID Buffer, _In_ CONST PDIRECTORY_CONTROL_OFFSETS Offsets)

VOID	NcSetNextEntryOffset (_Inout_ PVOID Buffer, _In_ CONST PDIRECTORY_CONTROL_OFFSETS Offsets, _In_ BOOLEAN ForceLast)

VOID	NcSetFileName (_In_ PVOID Entry, _In_ PWSTR NewName, _In_ ULONG Length, _In_ CONST PDIRECTORY_CONTROL_OFFSETS Offsets, _In_ BOOLEAN ForceLast)

VOID	NcSetShortName (_In_ PVOID Entry, _In_ PWSTR NewShortName, _In_ USHORT Length, _In_ CONST PDIRECTORY_CONTROL_OFFSETS Offsets)

FLT_PREOP_CALLBACK_STATUS	NcEnumerateDirectory (_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)

NTSTATUS	NcEnumerateDirectorySetupInjection (_Inout_ PNC_DIR_QRY_CONTEXT DirQryCtx, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ PNC_INSTANCE_CONTEXT InstanceContext, _In_ PDIRECTORY_CONTROL_OFFSETS Offsets, _In_ FILE_INFORMATION_CLASS InformationClass)

VOID	NcEnumerateDirectoryReset (_Inout_ PNC_DIR_QRY_CONTEXT dirCtx)

NTSTATUS	NcPerformEnumeration ()

NTSTATUS	NcPopulateCacheEntry (_In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _In_ ULONG BufferLength, _In_ FILE_INFORMATION_CLASS FileInfoClass, _In_ PUNICODE_STRING SearchString, _In_ BOOLEAN RestartScan, _Out_ PNC_CACHE_ENTRY Cache)

PNC_CACHE_ENTRY	NcDirEnumSelectNextEntry (_Inout_ PNC_DIR_QRY_CONTEXT Context, _In_ PDIRECTORY_CONTROL_OFFSETS Offsets, _In_ BOOLEAN IgnoreCase)

BOOLEAN	NcSkipName (_In_ PDIRECTORY_CONTROL_OFFSETS Offsets, _In_ PNC_DIR_QRY_CONTEXT Context, _In_ NC_PATH_OVERLAP RealOverlap, _In_ PNC_MAPPING Mapping, _In_ BOOLEAN IgnoreCase)

_Success_ Copied ULONG	NcCopyDirEnumEntry (_Out_ PVOID UserBuffer, _In_ ULONG UserOffset, _In_ ULONG UserSize, _Inout_ PNC_CACHE_ENTRY Entry, _In_ PDIRECTORY_CONTROL_OFFSETS Offsets, _Out_ PBOOLEAN Copied)

NTSTATUS	NcStreamHandleContextDirEnumCreate (_Out_ PNC_DIR_QRY_CONTEXT Context)

NTSTATUS	NcStreamHandleContextEnumSetup (_Inout_ PNC_DIR_QRY_CONTEXT DirContext, _In_ PNC_INSTANCE_CONTEXT InstanceContext, _In_ PDIRECTORY_CONTROL_OFFSETS Offsets, _In_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ NC_PATH_OVERLAP UserMappingOverlap, _Out_ PBOOLEAN FirstUsage)

VOID	NcStreamHandleContextEnumClose (_In_ PNC_DIR_QRY_CONTEXT DirContext)

FLT_PREOP_CALLBACK_STATUS	NcPreNotifyDirectory (_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)

FLT_POSTOP_CALLBACK_STATUS	NcPostNotifyDirectory (_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ PVOID CompletionContext, _In_ FLT_POST_OPERATION_FLAGS Flags)

NTSTATUS	NcStreamHandleContextNotCreate (_Out_ PNC_DIR_NOT_CONTEXT Context)

VOID	NcStreamHandleContextNotCleanup (_In_ PNC_STREAM_HANDLE_CONTEXT HandleContext)

VOID	NcStreamHandleContextNotClose (_In_ PNC_DIR_NOT_CONTEXT DirContext)

FLT_PREOP_CALLBACK_STATUS	NcPreQueryAlternateName (_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)

FLT_POSTOP_CALLBACK_STATUS	NcPostQueryHardLinks (_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_opt_ PVOID CompletionContext, _In_ FLT_POST_OPERATION_FLAGS Flags)

FLT_POSTOP_CALLBACK_STATUS	NcPostQueryName (_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_opt_ PVOID CompletionContext, _In_ FLT_POST_OPERATION_FLAGS Flags)

FLT_PREOP_CALLBACK_STATUS	NcPreRename (_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)

FLT_PREOP_CALLBACK_STATUS	NcPreSetDisposition (_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)

FLT_PREOP_CALLBACK_STATUS	NcPreSetLinkInformation (_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)

FLT_PREOP_CALLBACK_STATUS	NcPreSetShortName (_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)

FLT_POSTOP_CALLBACK_STATUS	NcPostEnumUsnData (_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_opt_ PVOID CompletionContext, _In_ FLT_POST_OPERATION_FLAGS Flags)

NTSTATUS	NcStreamHandleContextFindBySidCreate (_Out_ PNC_FIND_BY_SID_CONTEXT Context)

VOID	NcStreamHandleContextFindBySidClose (_In_ PNC_FIND_BY_SID_CONTEXT Context)

FLT_PREOP_CALLBACK_STATUS	NcPreFindFilesBySid (_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)

FLT_POSTOP_CALLBACK_STATUS	NcPostFindFilesBySid (_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ PVOID CompletionContext, _In_ FLT_POST_OPERATION_FLAGS Flags)

FLT_POSTOP_CALLBACK_STATUS	NcPostReadFileUsnData (_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_opt_ PVOID CompletionContext, _In_ FLT_POST_OPERATION_FLAGS Flags)

FLT_POSTOP_CALLBACK_STATUS	NcPostReadUsnJournal (_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_opt_ PVOID CompletionContext, _In_ FLT_POST_OPERATION_FLAGS Flags)

VOID	NcCompatInit ()

Variables
NC_GLOBAL_DATA	NcGlobalData

_In_opt_ PFILE_OBJECT	FileObject

_In_opt_ PFILE_OBJECT _In_opt_ PFLT_INSTANCE	Instance

_In_opt_ PFILE_OBJECT _In_opt_ PFLT_INSTANCE _In_ FLT_FILE_NAME_OPTIONS	NameOptions

_In_opt_ PFILE_OBJECT _In_opt_ PFLT_INSTANCE _In_ FLT_FILE_NAME_OPTIONS _Outptr_ PFLT_FILE_NAME_INFORMATION *	FileNameInformation

PFLT_FILTER	gFilterHandle

NC_REPLACE_FILEOBJECT_NAME_TYPE	NcReplaceFileObjectName

NC_QUERY_DIRECTORY_FILE_TYPE	NcQueryDirectoryFile

NC_CREATE_FILE_EX2_TYPE	NcCreateFileEx2

NC_GET_NEW_SYSTEM_BUFFER_ADDRESS	NcGetNewSystemBufferAddress

Macro Definition Documentation

◆ AlignToSize

#define AlignToSize	(	_length,
		_alignment
	)	(((_length) + ((_alignment) - 1)) & ~((_alignment) - 1))

Definition at line 35 of file nc.h.

◆ EMPTY_UNICODE_STRING

#define EMPTY_UNICODE_STRING {0, 0, NULL}

Definition at line 33 of file nc.h.

◆ INVALID_HANDLE_VALUE

#define INVALID_HANDLE_VALUE ((HANDLE) -1)

Definition at line 58 of file nc.h.

◆ Max

#define Max	(	a,
		b
	)	((a) >= (b) ? (a) : (b))

Definition at line 38 of file nc.h.

◆ NC_DIR_QRY_CACHE_TAG

#define NC_DIR_QRY_CACHE_TAG 'NCqc'

Definition at line 20 of file nc.h.

◆ NC_DIR_QRY_SEARCH_STRING

#define NC_DIR_QRY_SEARCH_STRING 'NCqs'

Definition at line 21 of file nc.h.

◆ NC_FILE_NAME_TAG

#define NC_FILE_NAME_TAG 'NCfn'

Definition at line 19 of file nc.h.

◆ NC_GENERATE_NAME_TAG

#define NC_GENERATE_NAME_TAG 'NCgn'

Definition at line 17 of file nc.h.

◆ NC_INSTANCE_CONTEXT_TAG

#define NC_INSTANCE_CONTEXT_TAG 'NCin'

Definition at line 15 of file nc.h.

◆ NC_LOCK_TAG

#define NC_LOCK_TAG 'NClk'

Definition at line 16 of file nc.h.

◆ NC_MAPPING_TAG

#define NC_MAPPING_TAG 'NCMP'

Definition at line 14 of file nc.h.

◆ NC_NORMALIZE_NAME_TAG

#define NC_NORMALIZE_NAME_TAG 'NCnn'

Definition at line 18 of file nc.h.

◆ NC_RENAME_BUFFER_TAG

#define NC_RENAME_BUFFER_TAG 'NCrn'

Definition at line 23 of file nc.h.

◆ NC_SEPARATOR

#define NC_SEPARATOR ((WCHAR) L'\\')

Definition at line 32 of file nc.h.

◆ NC_SET_LINK_BUFFER_TAG

#define NC_SET_LINK_BUFFER_TAG 'NCsl'

Definition at line 22 of file nc.h.

◆ NC_STREAM_HANDLE__CONTEXT_TAG

#define NC_STREAM_HANDLE__CONTEXT_TAG 'NCsh'

Definition at line 26 of file nc.h.

◆ NC_TAG

#define NC_TAG 'NC__'

Definition at line 13 of file nc.h.

◆ NcFreeUnicodeString

#define NcFreeUnicodeString ( UCS )

Value:

ExFreePoolWithTag( (UCS)->Buffer, NC_TAG );  \
    (UCS)->Buffer = NULL;                        \
    (UCS)->MaximumLength =                       \
    (UCS)->Length = 0;

Definition at line 40 of file nc.h.

◆ NcLockStreamHandleContext

#define NcLockStreamHandleContext ( C ) FltAcquireResourceExclusive( (C)->Lock );

Definition at line 444 of file nc.h.

◆ NcUnlockStreamHandleContext

#define NcUnlockStreamHandleContext ( C ) FltReleaseResource( (C)->Lock );

Definition at line 447 of file nc.h.

Typedef Documentation

◆ DIRECTORY_CONTROL_OFFSETS

typedef struct _DIRECTORY_CONTROL_OFFSETS DIRECTORY_CONTROL_OFFSETS

◆ NC_CACHE_ENTRY

typedef struct __NC_CACHE_ENTRY NC_CACHE_ENTRY

◆ NC_CREATE_FILE_EX2_TYPE

typedef NTSTATUS( * NC_CREATE_FILE_EX2_TYPE) (_In_ PFLT_FILTER Filter, _In_opt_ PFLT_INSTANCE Instance, _Out_ PHANDLE FileHandle, _Outptr_opt_ PFILE_OBJECT *FileObject, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _Out_ PIO_STATUS_BLOCK IoStatusBlock, _In_opt_ PLARGE_INTEGER AllocationSize, _In_ ULONG FileAttributes, _In_ ULONG ShareAccess, _In_ ULONG CreateDisposition, _In_ ULONG CreateOptions, _In_reads_bytes_opt_(EaLength) PVOID EaBuffer, _In_ ULONG EaLength, _In_ ULONG Flags, _In_opt_ PIO_DRIVER_CREATE_CONTEXT DriverContext)

Definition at line 108 of file nc.h.

◆ NC_CREATE_FILE_EX_TYPE

typedef NTSTATUS( * NC_CREATE_FILE_EX_TYPE) (_In_ PFLT_FILTER Filter, _In_opt_ PFLT_INSTANCE Instance, _Out_ PHANDLE FileHandle, _Outptr_opt_ PFILE_OBJECT *FileObject, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _Out_ PIO_STATUS_BLOCK IoStatusBlock, _In_opt_ PLARGE_INTEGER AllocationSize, _In_ ULONG FileAttributes, _In_ ULONG ShareAccess, _In_ ULONG CreateDisposition, _In_ ULONG CreateOptions, _In_reads_bytes_opt_(EaLength) PVOID EaBuffer, _In_ ULONG EaLength, _In_ ULONG Flags)

Definition at line 88 of file nc.h.

◆ NC_DIR_NOT_CONTEXT

typedef struct _NC_DIR_NOT_CONTEXT NC_DIR_NOT_CONTEXT

◆ NC_DIR_NOT_IO_CACHE

typedef struct _NC_DIR_NOT_IO_CACHE NC_DIR_NOT_IO_CACHE

◆ NC_DIR_QRY_CONTEXT

typedef struct _NC_DIR_QRY_CONTEXT NC_DIR_QRY_CONTEXT

◆ NC_FIND_BY_SID_CONTEXT

typedef struct _NC_FIND_BY_SID_CONTEXT NC_FIND_BY_SID_CONTEXT

◆ NC_GET_NEW_SYSTEM_BUFFER_ADDRESS

typedef PVOID( * NC_GET_NEW_SYSTEM_BUFFER_ADDRESS) (_In_ PFLT_CALLBACK_DATA Data)

Definition at line 129 of file nc.h.

◆ NC_GLOBAL_DATA

typedef struct _NC_GLOBAL_DATA NC_GLOBAL_DATA

◆ NC_INSTANCE_CONTEXT

typedef struct _NC_INSTANCE_CONTEXT NC_INSTANCE_CONTEXT

◆ NC_MAPPING

typedef struct _NC_MAPPING NC_MAPPING

◆ NC_MAPPING_ENTRY

typedef struct _NC_MAPPING_ENTRY NC_MAPPING_ENTRY

◆ NC_MAPPING_PATH

typedef struct _NC_MAPPING_PATH NC_MAPPING_PATH

◆ NC_QUERY_DIRECTORY_FILE_TYPE

typedef NTSTATUS( * NC_QUERY_DIRECTORY_FILE_TYPE) (_In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _Out_writes_bytes_(Length) PVOID FileInformation, _In_ ULONG Length, _In_ FILE_INFORMATION_CLASS FileInformationClass, _In_ BOOLEAN ReturnSingleEntry, _In_opt_ PUNICODE_STRING FileName, _In_ BOOLEAN RestartScan, _Out_opt_ PULONG LengthReturned)

Definition at line 74 of file nc.h.

◆ NC_REPLACE_FILEOBJECT_NAME_TYPE

typedef NTSTATUS(* NC_REPLACE_FILEOBJECT_NAME_TYPE) (_In_ PFILE_OBJECT FileObject, _In_reads_bytes_(FileNameLength) PWSTR NewFileName, _In_ USHORT FileNameLength)

Definition at line 66 of file nc.h.

◆ NC_STREAM_HANDLE_CONTEXT

typedef struct _NC_STREAM_HANDLE_CONTEXT NC_STREAM_HANDLE_CONTEXT

◆ PDIRECTORY_CONTROL_OFFSETS

typedef struct _DIRECTORY_CONTROL_OFFSETS * PDIRECTORY_CONTROL_OFFSETS

◆ PNC_CACHE_ENTRY

typedef struct __NC_CACHE_ENTRY * PNC_CACHE_ENTRY

◆ PNC_DIR_NOT_CONTEXT

typedef struct _NC_DIR_NOT_CONTEXT * PNC_DIR_NOT_CONTEXT

◆ PNC_DIR_NOT_IO_CACHE

typedef struct _NC_DIR_NOT_IO_CACHE * PNC_DIR_NOT_IO_CACHE

◆ PNC_DIR_QRY_CONTEXT

typedef struct _NC_DIR_QRY_CONTEXT * PNC_DIR_QRY_CONTEXT

◆ PNC_FIND_BY_SID_CONTEXT

typedef struct _NC_FIND_BY_SID_CONTEXT * PNC_FIND_BY_SID_CONTEXT

◆ PNC_GLOBAL_DATA

typedef struct _NC_GLOBAL_DATA * PNC_GLOBAL_DATA

◆ PNC_INSTANCE_CONTEXT

typedef struct _NC_INSTANCE_CONTEXT * PNC_INSTANCE_CONTEXT

◆ PNC_MAPPING

typedef struct _NC_MAPPING * PNC_MAPPING

◆ PNC_MAPPING_ENTRY

typedef struct _NC_MAPPING_ENTRY * PNC_MAPPING_ENTRY

◆ PNC_MAPPING_PATH

typedef struct _NC_MAPPING_PATH * PNC_MAPPING_PATH

◆ PNC_PATH_OVERLAP

typedef union NC_PATH_OVERLAP * PNC_PATH_OVERLAP

◆ PNC_STREAM_HANDLE_CONTEXT

typedef struct _NC_STREAM_HANDLE_CONTEXT * PNC_STREAM_HANDLE_CONTEXT

Function Documentation

◆ _Post_satisfies_()

_Post_satisfies_ ( NewName->MaximumLength< MAXUSHORT) _Post_satisfies_(NewName -> Length<=NewName-> MaximumLength ) -> Buffer, __drv_allocatesMem(Mem)) PUNICODE_STRING NewName)

Definition at line 439 of file ncpath.c.

◆ _Pre_satisfies_()

_Pre_satisfies_ ( Data ! = NULL )

◆ _When_()

_When_	(	Data	= `= NULL`,
		_Pre_satisfies_(FileObject !=NULL &&Instance !=NULL)
	)

◆ NcAllocateEResource()

NTSTATUS NcAllocateEResource ( _Out_ PERESOURCE * OutputLock )

Definition at line 104 of file nchelper.c.

◆ NcBuildMapping()

NTSTATUS NcBuildMapping	(	_In_ PFILE_OBJECT	UserParent,
		_In_ PFILE_OBJECT	RealParent,
		_In_ PUNICODE_STRING	UserFinalComponentShortName,
		_In_ PUNICODE_STRING	UserFinalComponentLongName,
		_In_ PUNICODE_STRING	RealFinalComponentName,
		_In_ PFLT_INSTANCE	Instance,
		_Out_ PNC_MAPPING	Mapping
	)

Definition at line 698 of file ncmapping.c.

◆ NcBuildMappingPathFromVolume()

NTSTATUS NcBuildMappingPathFromVolume	(	_In_ PFLT_VOLUME CONST	Volume,
		_In_ PUNICODE_STRING	ParentPath,
		_In_ PUNICODE_STRING	FinalComponentName,
		_Inout_ PNC_MAPPING_PATH	Entry
	)

Definition at line 376 of file ncmapping.c.

◆ NcCalculateDirectoryNotificationOffsets()

VOID NcCalculateDirectoryNotificationOffsets ( PDIRECTORY_CONTROL_OFFSETS Offsets )

Definition at line 201 of file ncoffsets.c.

◆ NcComparePath()

BOOLEAN NcComparePath	(	_In_ PCUNICODE_STRING	Name,
		_In_ PNC_MAPPING_ENTRY	Mapping,
		_Out_opt_ PUNICODE_STRING	Remainder,
		_In_ BOOLEAN	IgnoreCase,
		_In_ BOOLEAN	ContainsDevice,
		_Out_ PNC_PATH_OVERLAP	Overlap
	)

Definition at line 13 of file ncpath.c.

◆ NcCompatInit()

VOID NcCompatInit ( )

Definition at line 414 of file nccompat.c.

◆ NcCopyDirEnumEntry()

_Success_ Copied ULONG NcCopyDirEnumEntry	(	_Out_ PVOID	UserBuffer,
		_In_ ULONG	UserOffset,
		_In_ ULONG	UserSize,
		_Inout_ PNC_CACHE_ENTRY	Entry,
		_In_ PDIRECTORY_CONTROL_OFFSETS	Offsets,
		_Out_ PBOOLEAN	Copied
	)

Definition at line 1034 of file ncdirenum.c.

◆ NcCreateFileHelper()

NTSTATUS NcCreateFileHelper	(	_In_ PFLT_FILTER	Filter,
		_In_opt_ PFLT_INSTANCE	Instance,
		_Out_ PHANDLE	FileHandle,
		_Outptr_opt_ PFILE_OBJECT *	FileObject,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes,
		_Out_ PIO_STATUS_BLOCK	IoStatusBlock,
		_In_opt_ PLARGE_INTEGER	AllocationSize,
		_In_ ULONG	FileAttributes,
		_In_ ULONG	ShareAccess,
		_In_ ULONG	CreateDisposition,
		_In_ ULONG	CreateOptions,
		_In_reads_bytes_opt_(EaLength) PVOID	EaBuffer,
		_In_ ULONG	EaLength,
		_In_ ULONG	Flags,
		_In_opt_ PFILE_OBJECT	ParentFileObject
	)

Definition at line 195 of file nchelper.c.

◆ NcDetermineStructureOffsets()

BOOLEAN NcDetermineStructureOffsets	(	_Out_ PDIRECTORY_CONTROL_OFFSETS	Offsets,
		_In_ FILE_INFORMATION_CLASS	Information
	)

Definition at line 52 of file ncoffsets.c.

◆ NcDirEnumSelectNextEntry()

PNC_CACHE_ENTRY NcDirEnumSelectNextEntry	(	_Inout_ PNC_DIR_QRY_CONTEXT	Context,
		_In_ PDIRECTORY_CONTROL_OFFSETS	Offsets,
		_In_ BOOLEAN	IgnoreCase
	)

Definition at line 920 of file ncdirenum.c.

◆ NcEnumerateDirectory()

FLT_PREOP_CALLBACK_STATUS NcEnumerateDirectory	(	_Inout_ PFLT_CALLBACK_DATA	Data,
		_In_ PCFLT_RELATED_OBJECTS	FltObjects,
		_Flt_CompletionContext_Outptr_ PVOID *	CompletionContext
	)

Definition at line 39 of file ncdirenum.c.

◆ NcEnumerateDirectoryReset()

VOID NcEnumerateDirectoryReset ( _Inout_ PNC_DIR_QRY_CONTEXT dirCtx )

Definition at line 682 of file ncdirenum.c.

◆ NcEnumerateDirectorySetupInjection()

NTSTATUS NcEnumerateDirectorySetupInjection	(	_Inout_ PNC_DIR_QRY_CONTEXT	DirQryCtx,
		_In_ PCFLT_RELATED_OBJECTS	FltObjects,
		_In_ PNC_INSTANCE_CONTEXT	InstanceContext,
		_In_ PDIRECTORY_CONTROL_OFFSETS	Offsets,
		_In_ FILE_INFORMATION_CLASS	InformationClass
	)

Definition at line 463 of file ncdirenum.c.

◆ NcExceptionFilter()

LONG NcExceptionFilter	(	_In_ PEXCEPTION_POINTERS	ExceptionPointer,
		_In_ BOOLEAN	AccessingUserBuffer
	)

Definition at line 322 of file nchelper.c.

◆ NcFreeEResource()

VOID NcFreeEResource ( _In_ PERESOURCE Lock )

Definition at line 170 of file nchelper.c.

◆ NcGenerateFileName()

NTSTATUS NcGenerateFileName	(	_In_ PFLT_INSTANCE	Instance,
		_In_ PFILE_OBJECT	FileObject,
		_In_opt_ PFLT_CALLBACK_DATA	Data,
		_In_ FLT_FILE_NAME_OPTIONS	NameOptions,
		_Out_ PBOOLEAN	CacheFileNameInformation,
		_Inout_ PFLT_NAME_CONTROL	FileName
	)

Definition at line 10 of file ncnameprov.c.

◆ NcGetEntrySize()

ULONG NcGetEntrySize	(	_In_ CONST PVOID	Buffer,
		_In_ CONST PDIRECTORY_CONTROL_OFFSETS	Offsets
	)

Definition at line 328 of file ncoffsets.c.

◆ NcGetFileName()

PWSTR NcGetFileName	(	_In_ CONST PVOID	Buffer,
		_In_ CONST PDIRECTORY_CONTROL_OFFSETS	Offsets
	)

Definition at line 368 of file ncoffsets.c.

◆ NcGetFileNameLength()

ULONG NcGetFileNameLength	(	_In_ CONST PVOID	Buffer,
		_In_ CONST PDIRECTORY_CONTROL_OFFSETS	Offsets
	)

Definition at line 299 of file ncoffsets.c.

◆ NcGetNextEntry()

PVOID NcGetNextEntry	(	_In_ CONST PVOID	Buffer,
		_In_ CONST PDIRECTORY_CONTROL_OFFSETS	Offsets
	)

Definition at line 269 of file ncoffsets.c.

◆ NcGetNextEntryOffset()

ULONG NcGetNextEntryOffset	(	_In_ CONST PVOID	Buffer,
		_In_ CONST PDIRECTORY_CONTROL_OFFSETS	Offsets
	)

Definition at line 240 of file ncoffsets.c.

◆ NcGetShortName()

PWSTR NcGetShortName	(	_In_ CONST PVOID	Buffer,
		_In_ CONST PDIRECTORY_CONTROL_OFFSETS	Offsets
	)

Definition at line 396 of file ncoffsets.c.

◆ NcGetShortNameLength()

CCHAR NcGetShortNameLength	(	_In_ CONST PVOID	Buffer,
		_In_ CONST PDIRECTORY_CONTROL_OFFSETS	Offsets
	)

Definition at line 432 of file ncoffsets.c.

◆ NcInitializeMapping()

NTSTATUS NcInitializeMapping ( _In_ PUNICODE_STRING RegistryPath )

Definition at line 282 of file ncinit.c.

◆ NcInitMapping()

VOID NcInitMapping ( PNC_MAPPING Mapping )

Definition at line 678 of file ncmapping.c.

◆ NcInitMappingPath()

VOID NcInitMappingPath ( _Out_ PNC_MAPPING_PATH Path )

Definition at line 131 of file ncmapping.c.

◆ NcInstanceContextClose()

VOID NcInstanceContextClose	(	_In_ PFLT_CONTEXT	Context,
		_In_ FLT_CONTEXT_TYPE	ContextType
	)

Definition at line 31 of file nccontext.c.

◆ NcIsMappingZeroed()

BOOLEAN NcIsMappingZeroed ( PNC_MAPPING Mapping )

Definition at line 659 of file ncmapping.c.

◆ NcNormalizeNameComponentEx()

NTSTATUS NcNormalizeNameComponentEx	(	_In_ PFLT_INSTANCE	Instance,
		_In_opt_ PFILE_OBJECT	FileObject,
		_In_ PCUNICODE_STRING	ParentDirectory,
		_In_ USHORT	DeviceNameLength,
		_In_ PCUNICODE_STRING	Component,
		_Out_writes_bytes_(ExpandComponentNameLength) PFILE_NAMES_INFORMATION	ExpandComponentName,
		_In_ ULONG	ExpandComponentNameLength,
		_In_ FLT_NORMALIZE_NAME_FLAGS	Flags,
		_Inout_ PVOID *	NormalizationContext
	)

Definition at line 342 of file ncnameprov.c.

◆ NcParseFinalComponent()

NTSTATUS NcParseFinalComponent	(	_In_ PUNICODE_STRING	EntirePath,
		_Out_ PUNICODE_STRING	ParentPath,
		_Out_ PUNICODE_STRING	FinalComponent
	)

Definition at line 572 of file ncpath.c.

◆ NcPerformEnumeration()

NTSTATUS NcPerformEnumeration ( )

◆ NcPopulateCacheEntry()

NTSTATUS NcPopulateCacheEntry	(	_In_ PFLT_INSTANCE	Instance,
		_In_ PFILE_OBJECT	FileObject,
		_In_ ULONG	BufferLength,
		_In_ FILE_INFORMATION_CLASS	FileInfoClass,
		_In_ PUNICODE_STRING	SearchString,
		_In_ BOOLEAN	RestartScan,
		_Out_ PNC_CACHE_ENTRY	Cache
	)

Definition at line 809 of file ncdirenum.c.

◆ NcPostEnumUsnData()

FLT_POSTOP_CALLBACK_STATUS NcPostEnumUsnData	(	_Inout_ PFLT_CALLBACK_DATA	Data,
		_In_ PCFLT_RELATED_OBJECTS	FltObjects,
		_In_opt_ PVOID	CompletionContext,
		_In_ FLT_POST_OPERATION_FLAGS	Flags
	)

Definition at line 2906 of file ncfsctrl.c.

◆ NcPostFindFilesBySid()

FLT_POSTOP_CALLBACK_STATUS NcPostFindFilesBySid	(	_Inout_ PFLT_CALLBACK_DATA	Data,
		_In_ PCFLT_RELATED_OBJECTS	FltObjects,
		_In_ PVOID	CompletionContext,
		_In_ FLT_POST_OPERATION_FLAGS	Flags
	)

Definition at line 1092 of file ncfsctrl.c.

◆ NcPostNotifyDirectory()

FLT_POSTOP_CALLBACK_STATUS NcPostNotifyDirectory	(	_Inout_ PFLT_CALLBACK_DATA	Data,
		_In_ PCFLT_RELATED_OBJECTS	FltObjects,
		_In_ PVOID	CompletionContext,
		_In_ FLT_POST_OPERATION_FLAGS	Flags
	)

Definition at line 2824 of file ncdirnotify.c.

◆ NcPostQueryHardLinks()

FLT_POSTOP_CALLBACK_STATUS NcPostQueryHardLinks	(	_Inout_ PFLT_CALLBACK_DATA	Data,
		_In_ PCFLT_RELATED_OBJECTS	FltObjects,
		_In_opt_ PVOID	CompletionContext,
		_In_ FLT_POST_OPERATION_FLAGS	Flags
	)

Definition at line 581 of file ncfileinfo.c.

◆ NcPostQueryName()

FLT_POSTOP_CALLBACK_STATUS NcPostQueryName	(	_Inout_ PFLT_CALLBACK_DATA	Data,
		_In_ PCFLT_RELATED_OBJECTS	FltObjects,
		_In_opt_ PVOID	CompletionContext,
		_In_ FLT_POST_OPERATION_FLAGS	Flags
	)

Definition at line 33 of file ncfileinfo.c.

◆ NcPostReadFileUsnData()

FLT_POSTOP_CALLBACK_STATUS NcPostReadFileUsnData	(	_Inout_ PFLT_CALLBACK_DATA	Data,
		_In_ PCFLT_RELATED_OBJECTS	FltObjects,
		_In_opt_ PVOID	CompletionContext,
		_In_ FLT_POST_OPERATION_FLAGS	Flags
	)

Definition at line 2520 of file ncfsctrl.c.

◆ NcPostReadUsnJournal()

FLT_POSTOP_CALLBACK_STATUS NcPostReadUsnJournal	(	_Inout_ PFLT_CALLBACK_DATA	Data,
		_In_ PCFLT_RELATED_OBJECTS	FltObjects,
		_In_opt_ PVOID	CompletionContext,
		_In_ FLT_POST_OPERATION_FLAGS	Flags
	)

Definition at line 3576 of file ncfsctrl.c.

◆ NcPreCreate()

FLT_PREOP_CALLBACK_STATUS NcPreCreate	(	_Inout_ PFLT_CALLBACK_DATA	Data,
		_In_ PCFLT_RELATED_OBJECTS	FltObjects,
		_Flt_CompletionContext_Outptr_ PVOID *	CompletionContext
	)

Definition at line 29 of file nccreate.c.

◆ NcPreFindFilesBySid()

FLT_PREOP_CALLBACK_STATUS NcPreFindFilesBySid	(	_Inout_ PFLT_CALLBACK_DATA	Data,
		_In_ PCFLT_RELATED_OBJECTS	FltObjects,
		_Flt_CompletionContext_Outptr_ PVOID *	CompletionContext
	)

Definition at line 587 of file ncfsctrl.c.

◆ NcPreNotifyDirectory()

FLT_PREOP_CALLBACK_STATUS NcPreNotifyDirectory	(	_Inout_ PFLT_CALLBACK_DATA	Data,
		_In_ PCFLT_RELATED_OBJECTS	FltObjects,
		_Flt_CompletionContext_Outptr_ PVOID *	CompletionContext
	)

Definition at line 1067 of file ncdirnotify.c.

◆ NcPreQueryAlternateName()

FLT_PREOP_CALLBACK_STATUS NcPreQueryAlternateName	(	_Inout_ PFLT_CALLBACK_DATA	Data,
		_In_ PCFLT_RELATED_OBJECTS	FltObjects,
		_Flt_CompletionContext_Outptr_ PVOID *	CompletionContext
	)

Definition at line 367 of file ncfileinfo.c.

◆ NcPreRename()

FLT_PREOP_CALLBACK_STATUS NcPreRename	(	_Inout_ PFLT_CALLBACK_DATA	Data,
		_In_ PCFLT_RELATED_OBJECTS	FltObjects,
		_Flt_CompletionContext_Outptr_ PVOID *	CompletionContext
	)

Definition at line 1621 of file ncfileinfo.c.

◆ NcPreSetDisposition()

FLT_PREOP_CALLBACK_STATUS NcPreSetDisposition	(	_Inout_ PFLT_CALLBACK_DATA	Data,
		_In_ PCFLT_RELATED_OBJECTS	FltObjects,
		_Flt_CompletionContext_Outptr_ PVOID *	CompletionContext
	)

Definition at line 1189 of file ncfileinfo.c.

◆ NcPreSetLinkInformation()

FLT_PREOP_CALLBACK_STATUS NcPreSetLinkInformation	(	_Inout_ PFLT_CALLBACK_DATA	Data,
		_In_ PCFLT_RELATED_OBJECTS	FltObjects,
		_Flt_CompletionContext_Outptr_ PVOID *	CompletionContext
	)

Definition at line 1377 of file ncfileinfo.c.

◆ NcPreSetShortName()

FLT_PREOP_CALLBACK_STATUS NcPreSetShortName	(	_Inout_ PFLT_CALLBACK_DATA	Data,
		_In_ PCFLT_RELATED_OBJECTS	FltObjects,
		_Flt_CompletionContext_Outptr_ PVOID *	CompletionContext
	)

Definition at line 999 of file ncfileinfo.c.

◆ NcSetCancelCompletion()

NTSTATUS NcSetCancelCompletion	(	_In_ PFLT_CALLBACK_DATA	Data,
		_In_ PFLT_COMPLETE_CANCELED_CALLBACK	CanceledCallback
	)

Definition at line 270 of file nchelper.c.

◆ NcSetFileName()

VOID NcSetFileName	(	_In_ PVOID	Entry,
		_In_ PWSTR	NewName,
		_In_ ULONG	Length,
		_In_ CONST PDIRECTORY_CONTROL_OFFSETS	Offsets,
		_In_ BOOLEAN	ForceLast
	)

Definition at line 527 of file ncoffsets.c.

◆ NcSetNextEntryOffset()

VOID NcSetNextEntryOffset	(	_Inout_ PVOID	Buffer,
		_In_ CONST PDIRECTORY_CONTROL_OFFSETS	Offsets,
		_In_ BOOLEAN	ForceLast
	)

Definition at line 470 of file ncoffsets.c.

◆ NcSetShortName()

VOID NcSetShortName	(	_In_ PVOID	Entry,
		_In_ PWSTR	NewShortName,
		_In_ USHORT	Length,
		_In_ CONST PDIRECTORY_CONTROL_OFFSETS	Offsets
	)

Definition at line 587 of file ncoffsets.c.

◆ NcSkipName()

BOOLEAN NcSkipName	(	_In_ PDIRECTORY_CONTROL_OFFSETS	Offsets,
		_In_ PNC_DIR_QRY_CONTEXT	Context,
		_In_ NC_PATH_OVERLAP	RealOverlap,
		_In_ PNC_MAPPING	Mapping,
		_In_ BOOLEAN	IgnoreCase
	)

Definition at line 714 of file ncdirenum.c.

◆ NcStreamHandleContextAllocAndAttach()

NTSTATUS NcStreamHandleContextAllocAndAttach	(	_In_ PFLT_FILTER	Filter,
		_In_ PFLT_INSTANCE	Instance,
		_In_ PFILE_OBJECT	FileObject,
		_Out_ PNC_STREAM_HANDLE_CONTEXT *	Context
	)

Definition at line 126 of file nccontext.c.

◆ NcStreamHandleContextClose()

VOID NcStreamHandleContextClose	(	_In_ PFLT_CONTEXT	Context,
		_In_ FLT_CONTEXT_TYPE	ContextType
	)

Definition at line 65 of file nccontext.c.

◆ NcStreamHandleContextDirEnumCreate()

NTSTATUS NcStreamHandleContextDirEnumCreate ( _Out_ PNC_DIR_QRY_CONTEXT Context )

Definition at line 1132 of file ncdirenum.c.

◆ NcStreamHandleContextEnumClose()

VOID NcStreamHandleContextEnumClose ( _In_ PNC_DIR_QRY_CONTEXT DirContext )

Definition at line 1374 of file ncdirenum.c.

◆ NcStreamHandleContextEnumSetup()

NTSTATUS NcStreamHandleContextEnumSetup	(	_Inout_ PNC_DIR_QRY_CONTEXT	DirContext,
		_In_ PNC_INSTANCE_CONTEXT	InstanceContext,
		_In_ PDIRECTORY_CONTROL_OFFSETS	Offsets,
		_In_ PFLT_CALLBACK_DATA	Data,
		_In_ PCFLT_RELATED_OBJECTS	FltObjects,
		_In_ NC_PATH_OVERLAP	UserMappingOverlap,
		_Out_ PBOOLEAN	FirstUsage
	)

Definition at line 1172 of file ncdirenum.c.

◆ NcStreamHandleContextFindBySidClose()

VOID NcStreamHandleContextFindBySidClose ( _In_ PNC_FIND_BY_SID_CONTEXT Context )

Definition at line 113 of file ncfsctrl.c.

◆ NcStreamHandleContextFindBySidCreate()

NTSTATUS NcStreamHandleContextFindBySidCreate ( _Out_ PNC_FIND_BY_SID_CONTEXT Context )

Definition at line 75 of file ncfsctrl.c.

◆ NcStreamHandleContextNotCleanup()

VOID NcStreamHandleContextNotCleanup ( _In_ PNC_STREAM_HANDLE_CONTEXT HandleContext )

Definition at line 3325 of file ncdirnotify.c.

◆ NcStreamHandleContextNotClose()

VOID NcStreamHandleContextNotClose ( _In_ PNC_DIR_NOT_CONTEXT DirContext )

Definition at line 3423 of file ncdirnotify.c.

◆ NcStreamHandleContextNotCreate()

NTSTATUS NcStreamHandleContextNotCreate ( _Out_ PNC_DIR_NOT_CONTEXT Context )

Definition at line 3276 of file ncdirnotify.c.

◆ NcTeardownMapping()

VOID NcTeardownMapping ( _Inout_ PNC_MAPPING Mapping )

Definition at line 688 of file ncmapping.c.

◆ NcTeardownMappingPath()

VOID NcTeardownMappingPath ( _Inout_ PNC_MAPPING_PATH Path )

Definition at line 155 of file ncmapping.c.

Variable Documentation

◆ FileNameInformation

_In_opt_ PFILE_OBJECT _In_opt_ PFLT_INSTANCE _In_ FLT_FILE_NAME_OPTIONS _Outptr_ PFLT_FILE_NAME_INFORMATION* FileNameInformation

Definition at line 493 of file nc.h.

◆ FileObject

_In_opt_ PFILE_OBJECT FileObject

Definition at line 493 of file nc.h.

◆ gFilterHandle

PFLT_FILTER gFilterHandle

Definition at line 69 of file delete.c.

◆ Instance

_In_opt_ PFILE_OBJECT _In_opt_ PFLT_INSTANCE Instance

Definition at line 493 of file nc.h.

◆ NameOptions

_In_opt_ PFILE_OBJECT _In_opt_ PFLT_INSTANCE _In_ FLT_FILE_NAME_OPTIONS NameOptions

Definition at line 493 of file nc.h.

◆ NcCreateFileEx2

NC_CREATE_FILE_EX2_TYPE NcCreateFileEx2

Definition at line 80 of file nccompat.c.

◆ NcGetNewSystemBufferAddress

NC_GET_NEW_SYSTEM_BUFFER_ADDRESS NcGetNewSystemBufferAddress

Definition at line 81 of file nccompat.c.

◆ NcGlobalData

NC_GLOBAL_DATA NcGlobalData

Definition at line 335 of file nc.c.

◆ NcQueryDirectoryFile

NC_QUERY_DIRECTORY_FILE_TYPE NcQueryDirectoryFile

Definition at line 79 of file nccompat.c.

◆ NcReplaceFileObjectName

NC_REPLACE_FILEOBJECT_NAME_TYPE NcReplaceFileObjectName

Definition at line 78 of file nccompat.c.

EaseFilterYour Filter Driver Solution

Data Structures

Macros

Typedefs

Functions

Variables

Macro Definition Documentation

◆ AlignToSize

◆ EMPTY_UNICODE_STRING

◆ INVALID_HANDLE_VALUE

◆ Max

◆ NC_DIR_QRY_CACHE_TAG

◆ NC_DIR_QRY_SEARCH_STRING

◆ NC_FILE_NAME_TAG

◆ NC_GENERATE_NAME_TAG

◆ NC_INSTANCE_CONTEXT_TAG

◆ NC_LOCK_TAG

◆ NC_MAPPING_TAG

◆ NC_NORMALIZE_NAME_TAG

◆ NC_RENAME_BUFFER_TAG

◆ NC_SEPARATOR

◆ NC_SET_LINK_BUFFER_TAG

◆ NC_STREAM_HANDLE__CONTEXT_TAG

◆ NC_TAG

◆ NcFreeUnicodeString

◆ NcLockStreamHandleContext

◆ NcUnlockStreamHandleContext

Typedef Documentation

◆ DIRECTORY_CONTROL_OFFSETS

◆ NC_CACHE_ENTRY

◆ NC_CREATE_FILE_EX2_TYPE

◆ NC_CREATE_FILE_EX_TYPE

◆ NC_DIR_NOT_CONTEXT

◆ NC_DIR_NOT_IO_CACHE

◆ NC_DIR_QRY_CONTEXT

◆ NC_FIND_BY_SID_CONTEXT

◆ NC_GET_NEW_SYSTEM_BUFFER_ADDRESS

◆ NC_GLOBAL_DATA

◆ NC_INSTANCE_CONTEXT

◆ NC_MAPPING

◆ NC_MAPPING_ENTRY

◆ NC_MAPPING_PATH

◆ NC_QUERY_DIRECTORY_FILE_TYPE

◆ NC_REPLACE_FILEOBJECT_NAME_TYPE

◆ NC_STREAM_HANDLE_CONTEXT

◆ PDIRECTORY_CONTROL_OFFSETS

◆ PNC_CACHE_ENTRY

◆ PNC_DIR_NOT_CONTEXT

◆ PNC_DIR_NOT_IO_CACHE

◆ PNC_DIR_QRY_CONTEXT

◆ PNC_FIND_BY_SID_CONTEXT

◆ PNC_GLOBAL_DATA

◆ PNC_INSTANCE_CONTEXT

◆ PNC_MAPPING

◆ PNC_MAPPING_ENTRY

◆ PNC_MAPPING_PATH

◆ PNC_PATH_OVERLAP

◆ PNC_STREAM_HANDLE_CONTEXT

Function Documentation

◆ _Post_satisfies_()

◆ _Pre_satisfies_()

◆ _When_()

◆ NcAllocateEResource()

◆ NcBuildMapping()

◆ NcBuildMappingPathFromVolume()

◆ NcCalculateDirectoryNotificationOffsets()

◆ NcComparePath()

◆ NcCompatInit()

◆ NcCopyDirEnumEntry()

◆ NcCreateFileHelper()

◆ NcDetermineStructureOffsets()

◆ NcDirEnumSelectNextEntry()

◆ NcEnumerateDirectory()

◆ NcEnumerateDirectoryReset()

◆ NcEnumerateDirectorySetupInjection()

◆ NcExceptionFilter()

◆ NcFreeEResource()

◆ NcGenerateFileName()

◆ NcGetEntrySize()

◆ NcGetFileName()