WDK Mini Filter Example
passThrough.c
Go to the documentation of this file.
1 /*++
2 
3 Copyright (c) 1999 - 2002 Microsoft Corporation
4 
5 Module Name:
6 
7  passThrough.c
8 
9 Abstract:
10 
11  This is the main module of the passThrough miniFilter driver.
12  This filter hooks all IO operations for both pre and post operation
13  callbacks. The filter passes through the operations.
14 
15 Environment:
16 
17  Kernel mode
18 
19 --*/
20 
21 #include <fltKernel.h>
22 #include <dontuse.h>
23 #include <suppress.h>
24 
25 #pragma prefast(disable:__WARNING_ENCODE_MEMBER_FUNCTION_POINTER, "Not valid for kernel mode drivers")
26 
27 
28 PFLT_FILTER gFilterHandle;
29 ULONG_PTR OperationStatusCtx = 1;
30 
31 #define PTDBG_TRACE_ROUTINES 0x00000001
32 #define PTDBG_TRACE_OPERATION_STATUS 0x00000002
33 
34 ULONG gTraceFlags = 0;
35 
36 
37 #define PT_DBG_PRINT( _dbgLevel, _string ) \
38  (FlagOn(gTraceFlags,(_dbgLevel)) ? \
39  DbgPrint _string : \
40  ((int)0))
41 
42 /*************************************************************************
43  Prototypes
44 *************************************************************************/
45 
46 DRIVER_INITIALIZE DriverEntry;
47 NTSTATUS
49  _In_ PDRIVER_OBJECT DriverObject,
50  _In_ PUNICODE_STRING RegistryPath
51  );
52 
53 NTSTATUS
55  _In_ PCFLT_RELATED_OBJECTS FltObjects,
56  _In_ FLT_INSTANCE_SETUP_FLAGS Flags,
57  _In_ DEVICE_TYPE VolumeDeviceType,
58  _In_ FLT_FILESYSTEM_TYPE VolumeFilesystemType
59  );
60 
61 VOID
63  _In_ PCFLT_RELATED_OBJECTS FltObjects,
64  _In_ FLT_INSTANCE_TEARDOWN_FLAGS Flags
65  );
66 
67 VOID
69  _In_ PCFLT_RELATED_OBJECTS FltObjects,
70  _In_ FLT_INSTANCE_TEARDOWN_FLAGS Flags
71  );
72 
73 NTSTATUS
74 PtUnload (
75  _In_ FLT_FILTER_UNLOAD_FLAGS Flags
76  );
77 
78 NTSTATUS
80  _In_ PCFLT_RELATED_OBJECTS FltObjects,
81  _In_ FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags
82  );
83 
84 FLT_PREOP_CALLBACK_STATUS
86  _Inout_ PFLT_CALLBACK_DATA Data,
87  _In_ PCFLT_RELATED_OBJECTS FltObjects,
88  _Flt_CompletionContext_Outptr_ PVOID *CompletionContext
89  );
90 
91 VOID
93  _In_ PCFLT_RELATED_OBJECTS FltObjects,
94  _In_ PFLT_IO_PARAMETER_BLOCK ParameterSnapshot,
95  _In_ NTSTATUS OperationStatus,
96  _In_ PVOID RequesterContext
97  );
98 
99 FLT_POSTOP_CALLBACK_STATUS
101  _Inout_ PFLT_CALLBACK_DATA Data,
102  _In_ PCFLT_RELATED_OBJECTS FltObjects,
103  _In_opt_ PVOID CompletionContext,
104  _In_ FLT_POST_OPERATION_FLAGS Flags
105  );
106 
107 FLT_PREOP_CALLBACK_STATUS
109  _Inout_ PFLT_CALLBACK_DATA Data,
110  _In_ PCFLT_RELATED_OBJECTS FltObjects,
111  _Flt_CompletionContext_Outptr_ PVOID *CompletionContext
112  );
113 
114 BOOLEAN
116  _In_ PFLT_CALLBACK_DATA Data
117  );
118 
119 //
120 // Assign text sections for each routine.
121 //
122 
123 #ifdef ALLOC_PRAGMA
124 #pragma alloc_text(INIT, DriverEntry)
125 #pragma alloc_text(PAGE, PtUnload)
126 #pragma alloc_text(PAGE, PtInstanceQueryTeardown)
127 #pragma alloc_text(PAGE, PtInstanceSetup)
128 #pragma alloc_text(PAGE, PtInstanceTeardownStart)
129 #pragma alloc_text(PAGE, PtInstanceTeardownComplete)
130 #endif
131 
132 //
133 // operation registration
134 //
135 
136 CONST FLT_OPERATION_REGISTRATION Callbacks[] = {
137  { IRP_MJ_CREATE,
138  0,
141 
143  0,
145  PtPostOperationPassThrough },
146 
147  { IRP_MJ_CLOSE,
148  0,
150  PtPostOperationPassThrough },
151 
152  { IRP_MJ_READ,
153  0,
155  PtPostOperationPassThrough },
156 
157  { IRP_MJ_WRITE,
158  0,
160  PtPostOperationPassThrough },
161 
163  0,
165  PtPostOperationPassThrough },
166 
168  0,
170  PtPostOperationPassThrough },
171 
172  { IRP_MJ_QUERY_EA,
173  0,
175  PtPostOperationPassThrough },
176 
177  { IRP_MJ_SET_EA,
178  0,
180  PtPostOperationPassThrough },
181 
183  0,
185  PtPostOperationPassThrough },
186 
188  0,
190  PtPostOperationPassThrough },
191 
193  0,
195  PtPostOperationPassThrough },
196 
198  0,
200  PtPostOperationPassThrough },
201 
203  0,
205  PtPostOperationPassThrough },
206 
208  0,
210  PtPostOperationPassThrough },
211 
213  0,
215  PtPostOperationPassThrough },
216 
217  { IRP_MJ_SHUTDOWN,
218  0,
220  NULL }, //post operations not supported
221 
223  0,
225  PtPostOperationPassThrough },
226 
227  { IRP_MJ_CLEANUP,
228  0,
230  PtPostOperationPassThrough },
231 
233  0,
235  PtPostOperationPassThrough },
236 
238  0,
240  PtPostOperationPassThrough },
241 
243  0,
245  PtPostOperationPassThrough },
246 
248  0,
250  PtPostOperationPassThrough },
251 
253  0,
255  PtPostOperationPassThrough },
256 
257  { IRP_MJ_PNP,
258  0,
260  PtPostOperationPassThrough },
261 
263  0,
265  PtPostOperationPassThrough },
266 
268  0,
270  PtPostOperationPassThrough },
271 
273  0,
275  PtPostOperationPassThrough },
276 
278  0,
280  PtPostOperationPassThrough },
281 
283  0,
285  PtPostOperationPassThrough },
286 
288  0,
290  PtPostOperationPassThrough },
291 
293  0,
295  PtPostOperationPassThrough },
296 
298  0,
300  PtPostOperationPassThrough },
301 
302  { IRP_MJ_MDL_READ,
303  0,
305  PtPostOperationPassThrough },
306 
308  0,
310  PtPostOperationPassThrough },
311 
313  0,
315  PtPostOperationPassThrough },
316 
318  0,
320  PtPostOperationPassThrough },
321 
323  0,
325  PtPostOperationPassThrough },
326 
328  0,
330  PtPostOperationPassThrough },
331 
332  { IRP_MJ_OPERATION_END }
333 };
334 
335 //
336 // This defines what we want to filter with FltMgr
337 //
338 
339 CONST FLT_REGISTRATION FilterRegistration = {
340 
341  sizeof( FLT_REGISTRATION ), // Size
342  FLT_REGISTRATION_VERSION, // Version
343  0, // Flags
344 
345  NULL, // Context
346  Callbacks, // Operation callbacks
347 
348  PtUnload, // MiniFilterUnload
349 
350  PtInstanceSetup, // InstanceSetup
351  PtInstanceQueryTeardown, // InstanceQueryTeardown
352  PtInstanceTeardownStart, // InstanceTeardownStart
353  PtInstanceTeardownComplete, // InstanceTeardownComplete
354 
355  NULL, // GenerateFileName
356  NULL, // GenerateDestinationFileName
357  NULL // NormalizeNameComponent
358 
359 };
360 
361 
362 
363 NTSTATUS
365  _In_ PCFLT_RELATED_OBJECTS FltObjects,
366  _In_ FLT_INSTANCE_SETUP_FLAGS Flags,
367  _In_ DEVICE_TYPE VolumeDeviceType,
368  _In_ FLT_FILESYSTEM_TYPE VolumeFilesystemType
369  )
370 /*++
371 
372 Routine Description:
373 
374  This routine is called whenever a new instance is created on a volume. This
375  gives us a chance to decide if we need to attach to this volume or not.
376 
377  If this routine is not defined in the registration structure, automatic
378  instances are alwasys created.
379 
380 Arguments:
381 
382  FltObjects - Pointer to the FLT_RELATED_OBJECTS data structure containing
383  opaque handles to this filter, instance and its associated volume.
384 
385  Flags - Flags describing the reason for this attach request.
386 
387 Return Value:
388 
389  STATUS_SUCCESS - attach
390  STATUS_FLT_DO_NOT_ATTACH - do not attach
391 
392 --*/
393 {
394  UNREFERENCED_PARAMETER( FltObjects );
395  UNREFERENCED_PARAMETER( Flags );
396  UNREFERENCED_PARAMETER( VolumeDeviceType );
397  UNREFERENCED_PARAMETER( VolumeFilesystemType );
398 
399  PAGED_CODE();
400 
402  ("PassThrough!PtInstanceSetup: Entered\n") );
403 
404  return STATUS_SUCCESS;
405 }
406 
407 
408 NTSTATUS
410  _In_ PCFLT_RELATED_OBJECTS FltObjects,
411  _In_ FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags
412  )
413 /*++
414 
415 Routine Description:
416 
417  This is called when an instance is being manually deleted by a
418  call to FltDetachVolume or FilterDetach thereby giving us a
419  chance to fail that detach request.
420 
421  If this routine is not defined in the registration structure, explicit
422  detach requests via FltDetachVolume or FilterDetach will always be
423  failed.
424 
425 Arguments:
426 
427  FltObjects - Pointer to the FLT_RELATED_OBJECTS data structure containing
428  opaque handles to this filter, instance and its associated volume.
429 
430  Flags - Indicating where this detach request came from.
431 
432 Return Value:
433 
434  Returns the status of this operation.
435 
436 --*/
437 {
438  UNREFERENCED_PARAMETER( FltObjects );
439  UNREFERENCED_PARAMETER( Flags );
440 
441  PAGED_CODE();
442 
444  ("PassThrough!PtInstanceQueryTeardown: Entered\n") );
445 
446  return STATUS_SUCCESS;
447 }
448 
449 
450 VOID
452  _In_ PCFLT_RELATED_OBJECTS FltObjects,
453  _In_ FLT_INSTANCE_TEARDOWN_FLAGS Flags
454  )
455 /*++
456 
457 Routine Description:
458 
459  This routine is called at the start of instance teardown.
460 
461 Arguments:
462 
463  FltObjects - Pointer to the FLT_RELATED_OBJECTS data structure containing
464  opaque handles to this filter, instance and its associated volume.
465 
466  Flags - Reason why this instance is been deleted.
467 
468 Return Value:
469 
470  None.
471 
472 --*/
473 {
474  UNREFERENCED_PARAMETER( FltObjects );
475  UNREFERENCED_PARAMETER( Flags );
476 
477  PAGED_CODE();
478 
480  ("PassThrough!PtInstanceTeardownStart: Entered\n") );
481 }
482 
483 
484 VOID
486  _In_ PCFLT_RELATED_OBJECTS FltObjects,
487  _In_ FLT_INSTANCE_TEARDOWN_FLAGS Flags
488  )
489 /*++
490 
491 Routine Description:
492 
493  This routine is called at the end of instance teardown.
494 
495 Arguments:
496 
497  FltObjects - Pointer to the FLT_RELATED_OBJECTS data structure containing
498  opaque handles to this filter, instance and its associated volume.
499 
500  Flags - Reason why this instance is been deleted.
501 
502 Return Value:
503 
504  None.
505 
506 --*/
507 {
508  UNREFERENCED_PARAMETER( FltObjects );
509  UNREFERENCED_PARAMETER( Flags );
510 
511  PAGED_CODE();
512 
514  ("PassThrough!PtInstanceTeardownComplete: Entered\n") );
515 }
516 
517 
518 /*************************************************************************
519  MiniFilter initialization and unload routines.
520 *************************************************************************/
521 
522 NTSTATUS
524  _In_ PDRIVER_OBJECT DriverObject,
525  _In_ PUNICODE_STRING RegistryPath
526  )
527 /*++
528 
529 Routine Description:
530 
531  This is the initialization routine for this miniFilter driver. This
532  registers with FltMgr and initializes all global data structures.
533 
534 Arguments:
535 
536  DriverObject - Pointer to driver object created by the system to
537  represent this driver.
538 
539  RegistryPath - Unicode string identifying where the parameters for this
540  driver are located in the registry.
541 
542 Return Value:
543 
544  Returns STATUS_SUCCESS.
545 
546 --*/
547 {
548  NTSTATUS status;
549 
550  UNREFERENCED_PARAMETER( RegistryPath );
551 
553  ("PassThrough!DriverEntry: Entered\n") );
554 
555  //
556  // Register with FltMgr to tell it our callback routines
557  //
558 
559  status = FltRegisterFilter( DriverObject,
561  &gFilterHandle );
562 
563  FLT_ASSERT( NT_SUCCESS( status ) );
564 
565  if (NT_SUCCESS( status )) {
566 
567  //
568  // Start filtering i/o
569  //
570 
571  status = FltStartFiltering( gFilterHandle );
572 
573  if (!NT_SUCCESS( status )) {
574 
575  FltUnregisterFilter( gFilterHandle );
576  }
577  }
578 
579  return status;
580 }
581 
582 NTSTATUS
584  _In_ FLT_FILTER_UNLOAD_FLAGS Flags
585  )
586 /*++
587 
588 Routine Description:
589 
590  This is the unload routine for this miniFilter driver. This is called
591  when the minifilter is about to be unloaded. We can fail this unload
592  request if this is not a mandatory unloaded indicated by the Flags
593  parameter.
594 
595 Arguments:
596 
597  Flags - Indicating if this is a mandatory unload.
598 
599 Return Value:
600 
601  Returns the final status of this operation.
602 
603 --*/
604 {
605  UNREFERENCED_PARAMETER( Flags );
606 
607  PAGED_CODE();
608 
610  ("PassThrough!PtUnload: Entered\n") );
611 
612  FltUnregisterFilter( gFilterHandle );
613 
614  return STATUS_SUCCESS;
615 }
616 
617 
618 /*************************************************************************
619  MiniFilter callback routines.
620 *************************************************************************/
621 FLT_PREOP_CALLBACK_STATUS
623  _Inout_ PFLT_CALLBACK_DATA Data,
624  _In_ PCFLT_RELATED_OBJECTS FltObjects,
625  _Flt_CompletionContext_Outptr_ PVOID *CompletionContext
626  )
627 /*++
628 
629 Routine Description:
630 
631  This routine is the main pre-operation dispatch routine for this
632  miniFilter. Since this is just a simple passThrough miniFilter it
633  does not do anything with the callbackData but rather return
634  FLT_PREOP_SUCCESS_WITH_CALLBACK thereby passing it down to the next
635  miniFilter in the chain.
636 
637  This is non-pageable because it could be called on the paging path
638 
639 Arguments:
640 
641  Data - Pointer to the filter callbackData that is passed to us.
642 
643  FltObjects - Pointer to the FLT_RELATED_OBJECTS data structure containing
644  opaque handles to this filter, instance, its associated volume and
645  file object.
646 
647  CompletionContext - The context for the completion routine for this
648  operation.
649 
650 Return Value:
651 
652  The return value is the status of the operation.
653 
654 --*/
655 {
656  NTSTATUS status;
657 
658  UNREFERENCED_PARAMETER( FltObjects );
659  UNREFERENCED_PARAMETER( CompletionContext );
660 
662  ("PassThrough!PtPreOperationPassThrough: Entered\n") );
663 
664  //
665  // See if this is an operation we would like the operation status
666  // for. If so request it.
667  //
668  // NOTE: most filters do NOT need to do this. You only need to make
669  // this call if, for example, you need to know if the oplock was
670  // actually granted.
671  //
672 
673  if (PtDoRequestOperationStatus( Data )) {
674 
675  status = FltRequestOperationStatusCallback( Data,
677  (PVOID)(++OperationStatusCtx) );
678  if (!NT_SUCCESS(status)) {
679 
681  ("PassThrough!PtPreOperationPassThrough: FltRequestOperationStatusCallback Failed, status=%08x\n",
682  status) );
683  }
684  }
685 
686  return FLT_PREOP_SUCCESS_WITH_CALLBACK;
687 }
688 
689 
690 
691 VOID
693  _In_ PCFLT_RELATED_OBJECTS FltObjects,
694  _In_ PFLT_IO_PARAMETER_BLOCK ParameterSnapshot,
695  _In_ NTSTATUS OperationStatus,
696  _In_ PVOID RequesterContext
697  )
698 /*++
699 
700 Routine Description:
701 
702  This routine is called when the given operation returns from the call
703  to IoCallDriver. This is useful for operations where STATUS_PENDING
704  means the operation was successfully queued. This is useful for OpLocks
705  and directory change notification operations.
706 
707  This callback is called in the context of the originating thread and will
708  never be called at DPC level. The file object has been correctly
709  referenced so that you can access it. It will be automatically
710  dereferenced upon return.
711 
712  This is non-pageable because it could be called on the paging path
713 
714 Arguments:
715 
716  FltObjects - Pointer to the FLT_RELATED_OBJECTS data structure containing
717  opaque handles to this filter, instance, its associated volume and
718  file object.
719 
720  RequesterContext - The context for the completion routine for this
721  operation.
722 
723  OperationStatus -
724 
725 Return Value:
726 
727  The return value is the status of the operation.
728 
729 --*/
730 {
731  UNREFERENCED_PARAMETER( FltObjects );
732 
734  ("PassThrough!PtOperationStatusCallback: Entered\n") );
735 
737  ("PassThrough!PtOperationStatusCallback: Status=%08x ctx=%p IrpMj=%02x.%02x \"%s\"\n",
738  OperationStatus,
739  RequesterContext,
740  ParameterSnapshot->MajorFunction,
741  ParameterSnapshot->MinorFunction,
742  FltGetIrpName(ParameterSnapshot->MajorFunction)) );
743 }
744 
745 
746 FLT_POSTOP_CALLBACK_STATUS
748  _Inout_ PFLT_CALLBACK_DATA Data,
749  _In_ PCFLT_RELATED_OBJECTS FltObjects,
750  _In_opt_ PVOID CompletionContext,
751  _In_ FLT_POST_OPERATION_FLAGS Flags
752  )
753 /*++
754 
755 Routine Description:
756 
757  This routine is the post-operation completion routine for this
758  miniFilter.
759 
760  This is non-pageable because it may be called at DPC level.
761 
762 Arguments:
763 
764  Data - Pointer to the filter callbackData that is passed to us.
765 
766  FltObjects - Pointer to the FLT_RELATED_OBJECTS data structure containing
767  opaque handles to this filter, instance, its associated volume and
768  file object.
769 
770  CompletionContext - The completion context set in the pre-operation routine.
771 
772  Flags - Denotes whether the completion is successful or is being drained.
773 
774 Return Value:
775 
776  The return value is the status of the operation.
777 
778 --*/
779 {
780  UNREFERENCED_PARAMETER( Data );
781  UNREFERENCED_PARAMETER( FltObjects );
782  UNREFERENCED_PARAMETER( CompletionContext );
783  UNREFERENCED_PARAMETER( Flags );
784 
786  ("PassThrough!PtPostOperationPassThrough: Entered\n") );
787 
788  return FLT_POSTOP_FINISHED_PROCESSING;
789 }
790 
791 
792 FLT_PREOP_CALLBACK_STATUS
794  _Inout_ PFLT_CALLBACK_DATA Data,
795  _In_ PCFLT_RELATED_OBJECTS FltObjects,
796  _Flt_CompletionContext_Outptr_ PVOID *CompletionContext
797  )
798 /*++
799 
800 Routine Description:
801 
802  This routine is the main pre-operation dispatch routine for this
803  miniFilter. Since this is just a simple passThrough miniFilter it
804  does not do anything with the callbackData but rather return
805  FLT_PREOP_SUCCESS_WITH_CALLBACK thereby passing it down to the next
806  miniFilter in the chain.
807 
808  This is non-pageable because it could be called on the paging path
809 
810 Arguments:
811 
812  Data - Pointer to the filter callbackData that is passed to us.
813 
814  FltObjects - Pointer to the FLT_RELATED_OBJECTS data structure containing
815  opaque handles to this filter, instance, its associated volume and
816  file object.
817 
818  CompletionContext - The context for the completion routine for this
819  operation.
820 
821 Return Value:
822 
823  The return value is the status of the operation.
824 
825 --*/
826 {
827  UNREFERENCED_PARAMETER( Data );
828  UNREFERENCED_PARAMETER( FltObjects );
829  UNREFERENCED_PARAMETER( CompletionContext );
830 
832  ("PassThrough!PtPreOperationNoPostOperationPassThrough: Entered\n") );
833 
834  return FLT_PREOP_SUCCESS_NO_CALLBACK;
835 }
836 
837 
838 BOOLEAN
840  _In_ PFLT_CALLBACK_DATA Data
841  )
842 /*++
843 
844 Routine Description:
845 
846  This identifies those operations we want the operation status for. These
847  are typically operations that return STATUS_PENDING as a normal completion
848  status.
849 
850 Arguments:
851 
852 Return Value:
853 
854  TRUE - If we want the operation status
855  FALSE - If we don't
856 
857 --*/
858 {
859  PFLT_IO_PARAMETER_BLOCK iopb = Data->Iopb;
860 
861  //
862  // return boolean state based on which operations we are interested in
863  //
864 
865  return (BOOLEAN)
866 
867  //
868  // Check for oplock operations
869  //
870 
871  (((iopb->MajorFunction == IRP_MJ_FILE_SYSTEM_CONTROL) &&
872  ((iopb->Parameters.FileSystemControl.Common.FsControlCode == FSCTL_REQUEST_FILTER_OPLOCK) ||
873  (iopb->Parameters.FileSystemControl.Common.FsControlCode == FSCTL_REQUEST_BATCH_OPLOCK) ||
874  (iopb->Parameters.FileSystemControl.Common.FsControlCode == FSCTL_REQUEST_OPLOCK_LEVEL_1) ||
875  (iopb->Parameters.FileSystemControl.Common.FsControlCode == FSCTL_REQUEST_OPLOCK_LEVEL_2)))
876 
877  ||
878 
879  //
880  // Check for directy change notification
881  //
882 
883  ((iopb->MajorFunction == IRP_MJ_DIRECTORY_CONTROL) &&
884  (iopb->MinorFunction == IRP_MN_NOTIFY_CHANGE_DIRECTORY))
885  );
886 }
887 
NTSTATUS PtInstanceQueryTeardown(_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags)
Definition: passThrough.c:409
#define IRP_MJ_WRITE
Definition: mspyLog.h:288
#define PTDBG_TRACE_ROUTINES
Definition: passThrough.c:31
PFLT_FILTER gFilterHandle
Definition: passThrough.c:28
DRIVER_INITIALIZE DriverEntry
Definition: passThrough.c:46
#define IRP_MJ_READ
Definition: mspyLog.h:287
#define IRP_MJ_MDL_WRITE_COMPLETE
Definition: minispy.h:41
CONST FLT_OPERATION_REGISTRATION Callbacks[]
Definition: passThrough.c:136
#define IRP_MJ_CLEANUP
Definition: mspyLog.h:302
#define IRP_MJ_SET_EA
Definition: mspyLog.h:292
#define IRP_MJ_ACQUIRE_FOR_CC_FLUSH
Definition: minispy.h:32
#define IRP_MJ_RELEASE_FOR_SECTION_SYNCHRONIZATION
Definition: minispy.h:29
VOID PtInstanceTeardownStart(_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_TEARDOWN_FLAGS Flags)
Definition: passThrough.c:451
NTSTATUS PtUnload(_In_ FLT_FILTER_UNLOAD_FLAGS Flags)
Definition: passThrough.c:583
#define IRP_MJ_DEVICE_CONTROL
Definition: mspyLog.h:298
#define IRP_MJ_QUERY_QUOTA
Definition: mspyLog.h:309
#define IRP_MJ_NETWORK_QUERY_OPEN
Definition: minispy.h:37
#define IRP_MJ_SET_VOLUME_INFORMATION
Definition: mspyLog.h:295
NTSTATUS PtInstanceSetup(_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_SETUP_FLAGS Flags, _In_ DEVICE_TYPE VolumeDeviceType, _In_ FLT_FILESYSTEM_TYPE VolumeFilesystemType)
Definition: passThrough.c:364
#define IRP_MN_NOTIFY_CHANGE_DIRECTORY
Definition: mspyLog.h:319
#define IRP_MJ_QUERY_INFORMATION
Definition: mspyLog.h:289
CONST FLT_REGISTRATION FilterRegistration
Definition: passThrough.c:339
FLT_ASSERT(IS_MY_CONTROL_DEVICE_OBJECT(DeviceObject))
#define IRP_MJ_INTERNAL_DEVICE_CONTROL
Definition: mspyLog.h:299
#define IRP_MJ_SET_SECURITY
Definition: mspyLog.h:305
#define IRP_MJ_RELEASE_FOR_CC_FLUSH
Definition: minispy.h:33
#define IRP_MJ_CREATE_MAILSLOT
Definition: mspyLog.h:303
#define IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION
Definition: minispy.h:28
#define IRP_MJ_LOCK_CONTROL
Definition: mspyLog.h:301
VOID PtInstanceTeardownComplete(_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_TEARDOWN_FLAGS Flags)
Definition: passThrough.c:485
#define IRP_MJ_SET_INFORMATION
Definition: mspyLog.h:290
#define IRP_MJ_MDL_READ
Definition: minispy.h:38
FLT_PREOP_CALLBACK_STATUS PtPreOperationNoPostOperationPassThrough(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)
Definition: passThrough.c:793
FLT_POSTOP_CALLBACK_STATUS PtPostOperationPassThrough(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_opt_ PVOID CompletionContext, _In_ FLT_POST_OPERATION_FLAGS Flags)
Definition: passThrough.c:747
UNREFERENCED_PARAMETER(FileObject)
ULONG gTraceFlags
Definition: passThrough.c:34
NcLoadRegistryStringRetry NULL
Definition: ncinit.c:53
#define IRP_MJ_SET_QUOTA
Definition: mspyLog.h:310
#define IRP_MJ_ACQUIRE_FOR_MOD_WRITE
Definition: minispy.h:30
#define IRP_MJ_RELEASE_FOR_MOD_WRITE
Definition: minispy.h:31
#define IRP_MJ_VOLUME_DISMOUNT
Definition: minispy.h:43
#define IRP_MJ_CLOSE
Definition: mspyLog.h:286
PAGED_CODE()
VOID PtOperationStatusCallback(_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ PFLT_IO_PARAMETER_BLOCK ParameterSnapshot, _In_ NTSTATUS OperationStatus, _In_ PVOID RequesterContext)
Definition: passThrough.c:692
#define IRP_MJ_FILE_SYSTEM_CONTROL
Definition: mspyLog.h:297
#define IRP_MJ_DIRECTORY_CONTROL
Definition: mspyLog.h:296
#define IRP_MJ_FAST_IO_CHECK_IF_POSSIBLE
Definition: minispy.h:36
#define IRP_MJ_PREPARE_MDL_WRITE
Definition: minispy.h:40
BOOLEAN PtDoRequestOperationStatus(_In_ PFLT_CALLBACK_DATA Data)
Definition: passThrough.c:839
#define IRP_MJ_QUERY_SECURITY
Definition: mspyLog.h:304
#define IRP_MJ_PNP
Definition: mspyLog.h:311
#define IRP_MJ_VOLUME_MOUNT
Definition: minispy.h:42
#define IRP_MJ_QUERY_EA
Definition: mspyLog.h:291
#define IRP_MJ_FLUSH_BUFFERS
Definition: mspyLog.h:293
#define IRP_MJ_MDL_READ_COMPLETE
Definition: minispy.h:39
#define IRP_MJ_SHUTDOWN
Definition: mspyLog.h:300
#define PTDBG_TRACE_OPERATION_STATUS
Definition: passThrough.c:32
ULONG_PTR OperationStatusCtx
Definition: passThrough.c:29
#define IRP_MJ_QUERY_VOLUME_INFORMATION
Definition: mspyLog.h:294
FLT_PREOP_CALLBACK_STATUS PtPreOperationPassThrough(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Flt_CompletionContext_Outptr_ PVOID *CompletionContext)
Definition: passThrough.c:622
#define PT_DBG_PRINT(_dbgLevel, _string)
Definition: passThrough.c:37
#define IRP_MJ_CREATE_NAMED_PIPE
Definition: mspyLog.h:285
#define IRP_MJ_CREATE
Definition: mspyLog.h:284

Social Network


Services Overview

Architect, implement and test file system filter drivers for a wide range of functionality. We can offer several levels of assistance to meet your specific.

Contact Us

You are welcome to contact us for salse or partnership.

Sales: sales@easefilter.com
Support: support@easefilter.com
Info: info@easefilter.com