Something went wrong. Try again.
Reactos
Something went wrong. Try again.
1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984198519861987198819891990199119921993199419951996199719981999200020012002200320042005200620072008200920102011201220132014201520162017201820192020202120222023202420252026202720282029203020312032203320342035203620372038203920402041204220432044204520462047204820492050205120522053205420552056205720582059206020612062206320642065206620672068206920702071207220732074207520762077207820792080208120822083208420852086208720882089209020912092209320942095209620972098209921002101210221032104210521062107210821092110211121122113211421152116211721182119212021212122212321242125212621272128212921302131213221332134213521362137213821392140214121422143214421452146214721482149215021512152215321542155215621572158215921602161216221632164216521662167216821692170217121722173217421752176217721782179218021812182218321842185218621872188218921902191219221932194219521962197219821992200220122022203220422052206220722082209221022112212221322142215221622172218221922202221222222232224222522262227222822292230223122322233223422352236223722382239224022412242224322442245224622472248224922502251225222532254225522562257225822592260226122622263226422652266226722682269227022712272227322742275227622772278227922802281228222832284228522862287228822892290229122922293229422952296229722982299230023012302230323042305230623072308230923102311231223132314231523162317231823192320232123222323232423252326232723282329233023312332233323342335233623372338233923402341234223432344234523462347234823492350235123522353235423552356235723582359236023612362236323642365236623672368236923702371237223732374237523762377237823792380238123822383238423852386238723882389239023912392239323942395239623972398239924002401240224032404240524062407240824092410241124122413241424152416241724182419242024212422242324242425242624272428242924302431243224332434243524362437243824392440244124422443244424452446244724482449245024512452245324542455245624572458245924602461246224632464246524662467246824692470247124722473247424752476247724782479248024812482248324842485248624872488248924902491249224932494249524962497249824992500250125022503250425052506250725082509251025112512251325142515251625172518251925202521252225232524252525262527252825292530253125322533253425352536253725382539254025412542254325442545254625472548254925502551255225532554255525562557255825592560256125622563256425652566256725682569257025712572257325742575257625772578257925802581258225832584258525862587258825892590259125922593259425952596259725982599260026012602260326042605260626072608260926102611261226132614261526162617261826192620262126222623262426252626262726282629263026312632263326342635263626372638263926402641264226432644264526462647264826492650265126522653265426552656265726582659266026612662266326642665266626672668266926702671267226732674267526762677267826792680268126822683268426852686268726882689269026912692269326942695269626972698269927002701270227032704270527062707270827092710271127122713271427152716271727182719272027212722272327242725272627272728272927302731273227332734273527362737273827392740274127422743274427452746274727482749275027512752275327542755275627572758275927602761276227632764276527662767276827692770277127722773277427752776277727782779278027812782278327842785278627872788278927902791279227932794279527962797279827992800280128022803280428052806280728082809281028112812281328142815281628172818281928202821282228232824282528262827282828292830283128322833283428352836283728382839284028412842284328442845284628472848284928502851/* * fltkernel.h * * This file is part of the ReactOS DDK package. * * Contributors: * Amine Khaldi (amine.khaldi@reactos.org) * * THIS SOFTWARE IS NOT COPYRIGHTED * * This source code is offered for use in the public domain. You may * use, modify or distribute it freely. * * This code is distributed in the hope that it will be useful but * WITHOUT ANY WARRANTY. ALL WARRANTIES, EXPRESS OR IMPLIED ARE HEREBY * DISCLAIMED. This includes but is not limited to warranties of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. * */#pragma once
#ifndef __FLTKERNEL__#define __FLTKERNEL__
#ifdef __cplusplusextern "C" {#endif
#define FLT_MGR_BASELINE (((OSVER(NTDDI_VERSION) == NTDDI_WIN2K) && (SPVER(NTDDI_VERSION) >= SPVER(NTDDI_WIN2KSP4))) || \ ((OSVER(NTDDI_VERSION) == NTDDI_WINXP) && (SPVER(NTDDI_VERSION) >= SPVER(NTDDI_WINXPSP2))) || \ ((OSVER(NTDDI_VERSION) == NTDDI_WS03) && (SPVER(NTDDI_VERSION) >= SPVER(NTDDI_WS03SP1))) || \ (NTDDI_VERSION >= NTDDI_VISTA))
#define FLT_MGR_AFTER_XPSP2 (((OSVER(NTDDI_VERSION) == NTDDI_WIN2K) && (SPVER(NTDDI_VERSION) >= SPVER(NTDDI_WIN2KSP4))) || \ ((OSVER(NTDDI_VERSION) == NTDDI_WINXP) && (SPVER(NTDDI_VERSION) > SPVER(NTDDI_WINXPSP2))) || \ ((OSVER(NTDDI_VERSION) == NTDDI_WS03) && (SPVER(NTDDI_VERSION) >= SPVER(NTDDI_WS03SP1))) || \ (NTDDI_VERSION >= NTDDI_VISTA))
#define FLT_MGR_LONGHORN (NTDDI_VERSION >= NTDDI_VISTA)#define FLT_MGR_WIN7 (NTDDI_VERSION >= NTDDI_WIN7)
#include <ntifs.h>#include <fltuserstructures.h>#include <initguid.h>
#if FLT_MGR_BASELINE
#if FLT_MGR_LONGHORN#define FLT_ASSERT(_e) NT_ASSERT(_e)#define FLT_ASSERTMSG(_m, _e) NT_ASSERTMSG(_m, _e)#else#define FLT_ASSERT(_e) ASSERT(_e)#define FLT_ASSERTMSG(_m, _e) ASSERTMSG(_m, _e)#endif /* FLT_MGR_LONGHORN */
#define Add2Ptr(P,I) ((PVOID)((PUCHAR)(P) + (I)))#define PtrOffset(B,O) ((ULONG)((ULONG_PTR)(O) - (ULONG_PTR)(B)))
#define ROUND_TO_SIZE(_length, _alignment) \ ((((ULONG_PTR)(_length)) + ((_alignment)-1)) & ~(ULONG_PTR) ((_alignment) - 1))
#define IS_ALIGNED(_pointer, _alignment) \ ((((ULONG_PTR) (_pointer)) & ((_alignment) - 1)) == 0)
#define IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION ((UCHAR)-1)#define IRP_MJ_RELEASE_FOR_SECTION_SYNCHRONIZATION ((UCHAR)-2)#define IRP_MJ_ACQUIRE_FOR_MOD_WRITE ((UCHAR)-3)#define IRP_MJ_RELEASE_FOR_MOD_WRITE ((UCHAR)-4)#define IRP_MJ_ACQUIRE_FOR_CC_FLUSH ((UCHAR)-5)#define IRP_MJ_RELEASE_FOR_CC_FLUSH ((UCHAR)-6)#define IRP_MJ_FAST_IO_CHECK_IF_POSSIBLE ((UCHAR)-13)#define IRP_MJ_NETWORK_QUERY_OPEN ((UCHAR)-14)#define IRP_MJ_MDL_READ ((UCHAR)-15)#define IRP_MJ_MDL_READ_COMPLETE ((UCHAR)-16)#define IRP_MJ_PREPARE_MDL_WRITE ((UCHAR)-17)#define IRP_MJ_MDL_WRITE_COMPLETE ((UCHAR)-18)#define IRP_MJ_VOLUME_MOUNT ((UCHAR)-19)#define IRP_MJ_VOLUME_DISMOUNT ((UCHAR)-20)#define IRP_MJ_OPERATION_END ((UCHAR)0x80)#define FLT_INTERNAL_OPERATION_COUNT 22
#define NULL_CONTEXT ((PFLT_CONTEXT)NULL)
typedef struct _FLT_FILTER *PFLT_FILTER;typedef struct _FLT_VOLUME *PFLT_VOLUME;typedef struct _FLT_INSTANCE *PFLT_INSTANCE;typedef struct _FLT_PORT *PFLT_PORT;
typedef PVOID PFLT_CONTEXT;
#if !FLT_MGR_LONGHORNtypedef struct _KTRANSACTION *PKTRANSACTION;#endif
#if !defined(_AMD64_) && !defined(_IA64_) && !defined(_ARM_)#include "pshpack4.h"#endif
typedef union _FLT_PARAMETERS { struct { PIO_SECURITY_CONTEXT SecurityContext; ULONG Options; USHORT POINTER_ALIGNMENT FileAttributes; USHORT ShareAccess; ULONG POINTER_ALIGNMENT EaLength; PVOID EaBuffer; LARGE_INTEGER AllocationSize; } Create; struct { PIO_SECURITY_CONTEXT SecurityContext; ULONG Options; USHORT POINTER_ALIGNMENT Reserved; USHORT ShareAccess; PVOID Parameters; } CreatePipe; struct { PIO_SECURITY_CONTEXT SecurityContext; ULONG Options; USHORT POINTER_ALIGNMENT Reserved; USHORT ShareAccess; PVOID Parameters; } CreateMailslot; struct { ULONG Length; ULONG POINTER_ALIGNMENT Key; LARGE_INTEGER ByteOffset; PVOID ReadBuffer; PMDL MdlAddress; } Read; struct { ULONG Length; ULONG POINTER_ALIGNMENT Key; LARGE_INTEGER ByteOffset; PVOID WriteBuffer; PMDL MdlAddress; } Write; struct { ULONG Length; FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass; PVOID InfoBuffer; } QueryFileInformation; struct { ULONG Length; FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass; PFILE_OBJECT ParentOfTarget; _ANONYMOUS_UNION union { _ANONYMOUS_STRUCT struct { BOOLEAN ReplaceIfExists; BOOLEAN AdvanceOnly; } DUMMYSTRUCTNAME; ULONG ClusterCount; HANDLE DeleteHandle; } DUMMYUNIONNAME; PVOID InfoBuffer; } SetFileInformation; struct { ULONG Length; PVOID EaList; ULONG EaListLength; ULONG POINTER_ALIGNMENT EaIndex; PVOID EaBuffer; PMDL MdlAddress; } QueryEa; struct { ULONG Length; PVOID EaBuffer; PMDL MdlAddress; } SetEa; struct { ULONG Length; FS_INFORMATION_CLASS POINTER_ALIGNMENT FsInformationClass; PVOID VolumeBuffer; } QueryVolumeInformation; struct { ULONG Length; FS_INFORMATION_CLASS POINTER_ALIGNMENT FsInformationClass; PVOID VolumeBuffer; } SetVolumeInformation; union { struct { ULONG Length; PUNICODE_STRING FileName; FILE_INFORMATION_CLASS FileInformationClass; ULONG POINTER_ALIGNMENT FileIndex; PVOID DirectoryBuffer; PMDL MdlAddress; } QueryDirectory; struct { ULONG Length; ULONG POINTER_ALIGNMENT CompletionFilter; ULONG POINTER_ALIGNMENT Spare1; ULONG POINTER_ALIGNMENT Spare2; PVOID DirectoryBuffer; PMDL MdlAddress; } NotifyDirectory; } DirectoryControl; union { struct { PVPB Vpb; PDEVICE_OBJECT DeviceObject; } VerifyVolume; struct { ULONG OutputBufferLength; ULONG POINTER_ALIGNMENT InputBufferLength; ULONG POINTER_ALIGNMENT FsControlCode; } Common; struct { ULONG OutputBufferLength; ULONG POINTER_ALIGNMENT InputBufferLength; ULONG POINTER_ALIGNMENT FsControlCode; PVOID InputBuffer; PVOID OutputBuffer; PMDL OutputMdlAddress; } Neither; struct { ULONG OutputBufferLength; ULONG POINTER_ALIGNMENT InputBufferLength; ULONG POINTER_ALIGNMENT FsControlCode; PVOID SystemBuffer; } Buffered; struct { ULONG OutputBufferLength; ULONG POINTER_ALIGNMENT InputBufferLength; ULONG POINTER_ALIGNMENT FsControlCode; PVOID InputSystemBuffer; PVOID OutputBuffer; PMDL OutputMdlAddress; } Direct; } FileSystemControl; union { struct { ULONG OutputBufferLength; ULONG POINTER_ALIGNMENT InputBufferLength; ULONG POINTER_ALIGNMENT IoControlCode; } Common; struct { ULONG OutputBufferLength; ULONG POINTER_ALIGNMENT InputBufferLength; ULONG POINTER_ALIGNMENT IoControlCode; PVOID InputBuffer; PVOID OutputBuffer; PMDL OutputMdlAddress; } Neither; struct { ULONG OutputBufferLength; ULONG POINTER_ALIGNMENT InputBufferLength; ULONG POINTER_ALIGNMENT IoControlCode; PVOID SystemBuffer; } Buffered; struct { ULONG OutputBufferLength; ULONG POINTER_ALIGNMENT InputBufferLength; ULONG POINTER_ALIGNMENT IoControlCode; PVOID InputSystemBuffer; PVOID OutputBuffer; PMDL OutputMdlAddress; } Direct; struct { ULONG OutputBufferLength; ULONG POINTER_ALIGNMENT InputBufferLength; ULONG POINTER_ALIGNMENT IoControlCode; PVOID InputBuffer; PVOID OutputBuffer; } FastIo; } DeviceIoControl; struct { PLARGE_INTEGER Length; ULONG POINTER_ALIGNMENT Key; LARGE_INTEGER ByteOffset; PEPROCESS ProcessId; BOOLEAN FailImmediately; BOOLEAN ExclusiveLock; } LockControl; struct { SECURITY_INFORMATION SecurityInformation; ULONG POINTER_ALIGNMENT Length; PVOID SecurityBuffer; PMDL MdlAddress; } QuerySecurity; struct { SECURITY_INFORMATION SecurityInformation; PSECURITY_DESCRIPTOR SecurityDescriptor; } SetSecurity; struct { ULONG_PTR ProviderId; PVOID DataPath; ULONG BufferSize; PVOID Buffer; } WMI; struct { ULONG Length; PSID StartSid; PFILE_GET_QUOTA_INFORMATION SidList; ULONG SidListLength; PVOID QuotaBuffer; PMDL MdlAddress; } QueryQuota; struct { ULONG Length; PVOID QuotaBuffer; PMDL MdlAddress; } SetQuota; union { struct { PCM_RESOURCE_LIST AllocatedResources; PCM_RESOURCE_LIST AllocatedResourcesTranslated; } StartDevice; struct { DEVICE_RELATION_TYPE Type; } QueryDeviceRelations; struct { CONST GUID *InterfaceType; USHORT Size; USHORT Version; PINTERFACE Interface; PVOID InterfaceSpecificData; } QueryInterface; struct { PDEVICE_CAPABILITIES Capabilities; } DeviceCapabilities; struct { PIO_RESOURCE_REQUIREMENTS_LIST IoResourceRequirementList; } FilterResourceRequirements; struct { ULONG WhichSpace; PVOID Buffer; ULONG Offset; ULONG POINTER_ALIGNMENT Length; } ReadWriteConfig; struct { BOOLEAN Lock; } SetLock; struct { BUS_QUERY_ID_TYPE IdType; } QueryId; struct { DEVICE_TEXT_TYPE DeviceTextType; LCID POINTER_ALIGNMENT LocaleId; } QueryDeviceText; struct { BOOLEAN InPath; BOOLEAN Reserved[3]; DEVICE_USAGE_NOTIFICATION_TYPE POINTER_ALIGNMENT Type; } UsageNotification; } Pnp; struct { FS_FILTER_SECTION_SYNC_TYPE SyncType; ULONG PageProtection; } AcquireForSectionSynchronization; struct { PLARGE_INTEGER EndingOffset; PERESOURCE *ResourceToRelease; } AcquireForModifiedPageWriter; struct { PERESOURCE ResourceToRelease; } ReleaseForModifiedPageWriter; struct { LARGE_INTEGER FileOffset; ULONG Length; ULONG POINTER_ALIGNMENT LockKey; BOOLEAN POINTER_ALIGNMENT CheckForReadOperation; } FastIoCheckIfPossible; struct { PIRP Irp; PFILE_NETWORK_OPEN_INFORMATION NetworkInformation; } NetworkQueryOpen; struct { LARGE_INTEGER FileOffset; ULONG POINTER_ALIGNMENT Length; ULONG POINTER_ALIGNMENT Key; PMDL *MdlChain; } MdlRead; struct { PMDL MdlChain; } MdlReadComplete; struct { LARGE_INTEGER FileOffset; ULONG POINTER_ALIGNMENT Length; ULONG POINTER_ALIGNMENT Key; PMDL *MdlChain; } PrepareMdlWrite; struct { LARGE_INTEGER FileOffset; PMDL MdlChain; } MdlWriteComplete; struct { ULONG DeviceType; } MountVolume; struct { PVOID Argument1; PVOID Argument2; PVOID Argument3; PVOID Argument4; PVOID Argument5; LARGE_INTEGER Argument6; } Others;} FLT_PARAMETERS, *PFLT_PARAMETERS;
#if !defined(_AMD64_) && !defined(_IA64_) && !defined(_ARM_)#include "poppack.h"#endif
typedef struct _FLT_IO_PARAMETER_BLOCK { ULONG IrpFlags; UCHAR MajorFunction; UCHAR MinorFunction; UCHAR OperationFlags; UCHAR Reserved; PFILE_OBJECT TargetFileObject; PFLT_INSTANCE TargetInstance; FLT_PARAMETERS Parameters;} FLT_IO_PARAMETER_BLOCK, *PFLT_IO_PARAMETER_BLOCK;
#define FLTFL_CALLBACK_DATA_REISSUE_MASK 0x0000FFFF#define FLTFL_CALLBACK_DATA_IRP_OPERATION 0x00000001#define FLTFL_CALLBACK_DATA_FAST_IO_OPERATION 0x00000002#define FLTFL_CALLBACK_DATA_FS_FILTER_OPERATION 0x00000004#define FLTFL_CALLBACK_DATA_SYSTEM_BUFFER 0x00000008#define FLTFL_CALLBACK_DATA_GENERATED_IO 0x00010000#define FLTFL_CALLBACK_DATA_REISSUED_IO 0x00020000#define FLTFL_CALLBACK_DATA_DRAINING_IO 0x00040000#define FLTFL_CALLBACK_DATA_POST_OPERATION 0x00080000#define FLTFL_CALLBACK_DATA_NEW_SYSTEM_BUFFER 0x00100000#define FLTFL_CALLBACK_DATA_DIRTY 0x80000000
#define FLT_SET_CALLBACK_DATA_DIRTY(Data) FltSetCallbackDataDirty(Data)#define FLT_CLEAR_CALLBACK_DATA_DIRTY(Data) FltClearCallbackDataDirty(Data)#define FLT_IS_CALLBACK_DATA_DIRTY(Data) FltIsCallbackDataDirty(Data)
#define FLT_IS_IRP_OPERATION(Data) (FlagOn((Data)->Flags, FLTFL_CALLBACK_DATA_IRP_OPERATION))#define FLT_IS_FASTIO_OPERATION(Data) (FlagOn((Data)->Flags, FLTFL_CALLBACK_DATA_FAST_IO_OPERATION))#define FLT_IS_FS_FILTER_OPERATION(Data) (FlagOn((Data)->Flags, FLTFL_CALLBACK_DATA_FS_FILTER_OPERATION))#define FLT_IS_REISSUED_IO(Data) (FlagOn((Data)->Flags, FLTFL_CALLBACK_DATA_REISSUED_IO))#define FLT_IS_SYSTEM_BUFFER(Data) (FlagOn((Data)->Flags, FLTFL_CALLBACK_DATA_SYSTEM_BUFFER))
typedef USHORT FLT_CONTEXT_TYPE;
#define FLT_VOLUME_CONTEXT 0x0001#define FLT_INSTANCE_CONTEXT 0x0002#define FLT_FILE_CONTEXT 0x0004#define FLT_STREAM_CONTEXT 0x0008#define FLT_STREAMHANDLE_CONTEXT 0x0010#define FLT_TRANSACTION_CONTEXT 0x0020#define FLT_CONTEXT_END 0xffff
#define FLT_ALL_CONTEXTS (FLT_VOLUME_CONTEXT | FLT_INSTANCE_CONTEXT | \ FLT_FILE_CONTEXT | FLT_STREAM_CONTEXT | \ FLT_STREAMHANDLE_CONTEXT | FLT_TRANSACTION_CONTEXT)
typedef ULONG FLT_CALLBACK_DATA_FLAGS;
#if FLT_MGR_WIN7typedef ULONG FLT_ALLOCATE_CALLBACK_DATA_FLAGS;#define FLT_ALLOCATE_CALLBACK_DATA_PREALLOCATE_ALL_MEMORY 0x00000001#endif /* FLT_MGR_WIN7 */
typedef struct _FLT_CALLBACK_DATA { FLT_CALLBACK_DATA_FLAGS Flags; PETHREAD CONST Thread; PFLT_IO_PARAMETER_BLOCK CONST Iopb; IO_STATUS_BLOCK IoStatus; struct _FLT_TAG_DATA_BUFFER *TagData; _ANONYMOUS_UNION union { _ANONYMOUS_STRUCT struct { LIST_ENTRY QueueLinks; PVOID QueueContext[2]; } DUMMYSTRUCTNAME; PVOID FilterContext[4]; } DUMMYUNIONNAME; KPROCESSOR_MODE RequestorMode;} FLT_CALLBACK_DATA, *PFLT_CALLBACK_DATA;
typedef struct _FLT_RELATED_OBJECTS { USHORT CONST Size; USHORT CONST TransactionContext; PFLT_FILTER CONST Filter; PFLT_VOLUME CONST Volume; PFLT_INSTANCE CONST Instance; PFILE_OBJECT CONST FileObject; PKTRANSACTION CONST Transaction;} FLT_RELATED_OBJECTS, *PFLT_RELATED_OBJECTS;typedef const struct _FLT_RELATED_OBJECTS *PCFLT_RELATED_OBJECTS;
typedef struct _FLT_RELATED_CONTEXTS { PFLT_CONTEXT VolumeContext; PFLT_CONTEXT InstanceContext; PFLT_CONTEXT FileContext; PFLT_CONTEXT StreamContext; PFLT_CONTEXT StreamHandleContext; PFLT_CONTEXT TransactionContext;} FLT_RELATED_CONTEXTS, *PFLT_RELATED_CONTEXTS;
typedef VOID(FLTAPI *PFLT_CONTEXT_CLEANUP_CALLBACK)( _In_ PFLT_CONTEXT Context, _In_ FLT_CONTEXT_TYPE ContextType);
typedef PVOID(FLTAPI *PFLT_CONTEXT_ALLOCATE_CALLBACK)( _In_ POOL_TYPE PoolType, _In_ SIZE_T Size, _In_ FLT_CONTEXT_TYPE ContextType);
typedef VOID(FLTAPI *PFLT_CONTEXT_FREE_CALLBACK)( _In_ PVOID Pool, _In_ FLT_CONTEXT_TYPE ContextType);
typedef USHORT FLT_CONTEXT_REGISTRATION_FLAGS;
#define FLTFL_CONTEXT_REGISTRATION_NO_EXACT_SIZE_MATCH 0x0001
#define FLT_VARIABLE_SIZED_CONTEXTS ((SIZE_T)-1)
typedef struct _FLT_CONTEXT_REGISTRATION { FLT_CONTEXT_TYPE ContextType; FLT_CONTEXT_REGISTRATION_FLAGS Flags; PFLT_CONTEXT_CLEANUP_CALLBACK ContextCleanupCallback; SIZE_T Size; ULONG PoolTag; PFLT_CONTEXT_ALLOCATE_CALLBACK ContextAllocateCallback; PFLT_CONTEXT_FREE_CALLBACK ContextFreeCallback; PVOID Reserved1;} FLT_CONTEXT_REGISTRATION, *PFLT_CONTEXT_REGISTRATION;typedef const struct _FLT_CONTEXT_REGISTRATION *PCFLT_CONTEXT_REGISTRATION;
typedef ULONG FLT_INSTANCE_SETUP_FLAGS;
#define FLTFL_INSTANCE_SETUP_AUTOMATIC_ATTACHMENT 0x00000001#define FLTFL_INSTANCE_SETUP_MANUAL_ATTACHMENT 0x00000002#define FLTFL_INSTANCE_SETUP_NEWLY_MOUNTED_VOLUME 0x00000004
#if FLT_MGR_LONGHORN
#define FLTFL_INSTANCE_SETUP_DETACHED_VOLUME 0x00000008
#define FLT_MAX_TRANSACTION_NOTIFICATIONS (TRANSACTION_NOTIFY_PREPREPARE | \ TRANSACTION_NOTIFY_PREPARE | \ TRANSACTION_NOTIFY_COMMIT | \ TRANSACTION_NOTIFY_ROLLBACK | \ TRANSACTION_NOTIFY_COMMIT_FINALIZE)
#endif /* FLT_MGR_LONGHORN */
typedef NTSTATUS(FLTAPI *PFLT_INSTANCE_SETUP_CALLBACK)( _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_SETUP_FLAGS Flags, _In_ DEVICE_TYPE VolumeDeviceType, _In_ FLT_FILESYSTEM_TYPE VolumeFilesystemType);
typedef ULONG FLT_INSTANCE_QUERY_TEARDOWN_FLAGS;
typedef NTSTATUS(FLTAPI *PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK)( _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags);
typedef ULONG FLT_INSTANCE_TEARDOWN_FLAGS;
#define FLTFL_INSTANCE_TEARDOWN_MANUAL 0x00000001#define FLTFL_INSTANCE_TEARDOWN_FILTER_UNLOAD 0x00000002#define FLTFL_INSTANCE_TEARDOWN_MANDATORY_FILTER_UNLOAD 0x00000004#define FLTFL_INSTANCE_TEARDOWN_VOLUME_DISMOUNT 0x00000008#define FLTFL_INSTANCE_TEARDOWN_INTERNAL_ERROR 0x00000010
typedef VOID(FLTAPI *PFLT_INSTANCE_TEARDOWN_CALLBACK)( _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_TEARDOWN_FLAGS Reason);
typedef enum _FLT_PREOP_CALLBACK_STATUS { FLT_PREOP_SUCCESS_WITH_CALLBACK, FLT_PREOP_SUCCESS_NO_CALLBACK, FLT_PREOP_PENDING, FLT_PREOP_DISALLOW_FASTIO, FLT_PREOP_COMPLETE, FLT_PREOP_SYNCHRONIZE} FLT_PREOP_CALLBACK_STATUS, *PFLT_PREOP_CALLBACK_STATUS;
typedef FLT_PREOP_CALLBACK_STATUS(FLTAPI *PFLT_PRE_OPERATION_CALLBACK)( _Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Outptr_result_maybenull_ PVOID *CompletionContext);
typedef enum _FLT_POSTOP_CALLBACK_STATUS { FLT_POSTOP_FINISHED_PROCESSING, FLT_POSTOP_MORE_PROCESSING_REQUIRED} FLT_POSTOP_CALLBACK_STATUS, *PFLT_POSTOP_CALLBACK_STATUS;
typedef ULONG FLT_POST_OPERATION_FLAGS;
#define FLTFL_POST_OPERATION_DRAINING 0x00000001
typedef FLT_POSTOP_CALLBACK_STATUS(FLTAPI *PFLT_POST_OPERATION_CALLBACK)( _Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_opt_ PVOID CompletionContext, _In_ FLT_POST_OPERATION_FLAGS Flags);
typedef ULONG FLT_OPERATION_REGISTRATION_FLAGS;
#define FLTFL_OPERATION_REGISTRATION_SKIP_PAGING_IO 0x00000001#define FLTFL_OPERATION_REGISTRATION_SKIP_CACHED_IO 0x00000002#define FLTFL_OPERATION_REGISTRATION_SKIP_NON_DASD_IO 0x00000004
typedef struct _FLT_OPERATION_REGISTRATION { UCHAR MajorFunction; FLT_OPERATION_REGISTRATION_FLAGS Flags; PFLT_PRE_OPERATION_CALLBACK PreOperation; PFLT_POST_OPERATION_CALLBACK PostOperation; PVOID Reserved1;} FLT_OPERATION_REGISTRATION, *PFLT_OPERATION_REGISTRATION;
typedef struct _FLT_TAG_DATA_BUFFER { ULONG FileTag; USHORT TagDataLength; USHORT UnparsedNameLength; _ANONYMOUS_UNION union { struct { USHORT SubstituteNameOffset; USHORT SubstituteNameLength; USHORT PrintNameOffset; USHORT PrintNameLength; ULONG Flags; WCHAR PathBuffer[1]; } SymbolicLinkReparseBuffer; struct { USHORT SubstituteNameOffset; USHORT SubstituteNameLength; USHORT PrintNameOffset; USHORT PrintNameLength; WCHAR PathBuffer[1]; } MountPointReparseBuffer; struct { UCHAR DataBuffer[1]; } GenericReparseBuffer; struct { GUID TagGuid; UCHAR DataBuffer[1]; } GenericGUIDReparseBuffer; } DUMMYUNIONNAME;} FLT_TAG_DATA_BUFFER, *PFLT_TAG_DATA_BUFFER;
#define FLT_TAG_DATA_BUFFER_HEADER_SIZE FIELD_OFFSET(FLT_TAG_DATA_BUFFER, GenericReparseBuffer)
typedef ULONG FLT_FILTER_UNLOAD_FLAGS;
#define FLTFL_FILTER_UNLOAD_MANDATORY 0x00000001
typedef NTSTATUS(FLTAPI *PFLT_FILTER_UNLOAD_CALLBACK)( FLT_FILTER_UNLOAD_FLAGS Flags);
typedef struct _FLT_NAME_CONTROL { UNICODE_STRING Name;} FLT_NAME_CONTROL, *PFLT_NAME_CONTROL;
typedef ULONG FLT_FILE_NAME_OPTIONS;
typedef NTSTATUS(FLTAPI *PFLT_GENERATE_FILE_NAME)( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _In_opt_ PFLT_CALLBACK_DATA CallbackData, _In_ FLT_FILE_NAME_OPTIONS NameOptions, _Out_ PBOOLEAN CacheFileNameInformation, _Out_ PFLT_NAME_CONTROL FileName);
typedef ULONG FLT_NORMALIZE_NAME_FLAGS;
#define FLTFL_NORMALIZE_NAME_CASE_SENSITIVE 0x01#define FLTFL_NORMALIZE_NAME_DESTINATION_FILE_NAME 0x02
typedef NTSTATUS(FLTAPI *PFLT_NORMALIZE_NAME_COMPONENT)( _In_ PFLT_INSTANCE Instance, _In_ PCUNICODE_STRING ParentDirectory, _In_ USHORT VolumeNameLength, _In_ PCUNICODE_STRING Component, _Out_writes_bytes_(ExpandComponentNameLength) PFILE_NAMES_INFORMATION ExpandComponentName, _In_ ULONG ExpandComponentNameLength, _In_ FLT_NORMALIZE_NAME_FLAGS Flags, _Inout_ PVOID *NormalizationContext);
typedef NTSTATUS(FLTAPI *PFLT_NORMALIZE_NAME_COMPONENT_EX)( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _In_ PCUNICODE_STRING ParentDirectory, _In_ USHORT VolumeNameLength, _In_ PCUNICODE_STRING Component, _Out_writes_bytes_(ExpandComponentNameLength) PFILE_NAMES_INFORMATION ExpandComponentName, _In_ ULONG ExpandComponentNameLength, _In_ FLT_NORMALIZE_NAME_FLAGS Flags, _Inout_ PVOID *NormalizationContext);
typedef VOID(FLTAPI *PFLT_NORMALIZE_CONTEXT_CLEANUP)( _In_opt_ PVOID *NormalizationContext);
#if FLT_MGR_LONGHORNtypedef NTSTATUS(FLTAPI *PFLT_TRANSACTION_NOTIFICATION_CALLBACK)( _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ PFLT_CONTEXT TransactionContext, _In_ ULONG NotificationMask);#endif /* FLT_MGR_LONGHORN */
#define FLT_REGISTRATION_VERSION_0200 0x0200#define FLT_REGISTRATION_VERSION_0201 0x0201#define FLT_REGISTRATION_VERSION_0202 0x0202#define FLT_REGISTRATION_VERSION_0203 0x0203
#if FLT_MGR_LONGHORN#define FLT_REGISTRATION_VERSION FLT_REGISTRATION_VERSION_0202#else#define FLT_REGISTRATION_VERSION FLT_REGISTRATION_VERSION_0200#endif
typedef ULONG FLT_REGISTRATION_FLAGS;
#define FLTFL_REGISTRATION_DO_NOT_SUPPORT_SERVICE_STOP 0x00000001#define FLTFL_REGISTRATION_SUPPORT_NPFS_MSFS 0x00000002
typedef struct _FLT_REGISTRATION { USHORT Size; USHORT Version; FLT_REGISTRATION_FLAGS Flags; CONST FLT_CONTEXT_REGISTRATION *ContextRegistration; CONST FLT_OPERATION_REGISTRATION *OperationRegistration; PFLT_FILTER_UNLOAD_CALLBACK FilterUnloadCallback; PFLT_INSTANCE_SETUP_CALLBACK InstanceSetupCallback; PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK InstanceQueryTeardownCallback; PFLT_INSTANCE_TEARDOWN_CALLBACK InstanceTeardownStartCallback; PFLT_INSTANCE_TEARDOWN_CALLBACK InstanceTeardownCompleteCallback; PFLT_GENERATE_FILE_NAME GenerateFileNameCallback; PFLT_NORMALIZE_NAME_COMPONENT NormalizeNameComponentCallback; PFLT_NORMALIZE_CONTEXT_CLEANUP NormalizeContextCleanupCallback;#if FLT_MGR_LONGHORN PFLT_TRANSACTION_NOTIFICATION_CALLBACK TransactionNotificationCallback; PFLT_NORMALIZE_NAME_COMPONENT_EX NormalizeNameComponentExCallback;#endif /* FLT_MGR_LONGHORN */} FLT_REGISTRATION, *PFLT_REGISTRATION;
typedef VOID(FLTAPI *PFLT_COMPLETED_ASYNC_IO_CALLBACK)( _In_ PFLT_CALLBACK_DATA CallbackData, _In_ PFLT_CONTEXT Context);
typedef ULONG FLT_IO_OPERATION_FLAGS;
#define FLTFL_IO_OPERATION_NON_CACHED 0x00000001#define FLTFL_IO_OPERATION_PAGING 0x00000002#define FLTFL_IO_OPERATION_DO_NOT_UPDATE_BYTE_OFFSET 0x00000004
#if FLT_MGR_LONGHORN#define FLTFL_IO_OPERATION_SYNCHRONOUS_PAGING 0x00000008#endif
typedef VOID(FLTAPI *PFLT_GET_OPERATION_STATUS_CALLBACK)( _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ PFLT_IO_PARAMETER_BLOCK IopbSnapshot, _In_ NTSTATUS OperationStatus, _In_opt_ PVOID RequesterContext);
typedef ULONG FLT_FILE_NAME_OPTIONS;
#define FLT_VALID_FILE_NAME_FORMATS 0x000000ff
#define FLT_FILE_NAME_NORMALIZED 0x01#define FLT_FILE_NAME_OPENED 0x02#define FLT_FILE_NAME_SHORT 0x03
#define FltGetFileNameFormat( _NameOptions ) ((_NameOptions) & FLT_VALID_FILE_NAME_FORMATS)
#define FLT_VALID_FILE_NAME_QUERY_METHODS 0x0000ff00
#define FLT_FILE_NAME_QUERY_DEFAULT 0x0100#define FLT_FILE_NAME_QUERY_CACHE_ONLY 0x0200#define FLT_FILE_NAME_QUERY_FILESYSTEM_ONLY 0x0300#define FLT_FILE_NAME_QUERY_ALWAYS_ALLOW_CACHE_LOOKUP 0x0400
#define FltGetFileNameQueryMethod( _NameOptions ) ((_NameOptions) & FLT_VALID_FILE_NAME_QUERY_METHODS)
#define FLT_VALID_FILE_NAME_FLAGS 0xff000000
#define FLT_FILE_NAME_REQUEST_FROM_CURRENT_PROVIDER 0x01000000#define FLT_FILE_NAME_DO_NOT_CACHE 0x02000000
#if FLT_MGR_AFTER_XPSP2#define FLT_FILE_NAME_ALLOW_QUERY_ON_REPARSE 0x04000000#endif
typedef USHORT FLT_FILE_NAME_PARSED_FLAGS;
#define FLTFL_FILE_NAME_PARSED_FINAL_COMPONENT 0x0001#define FLTFL_FILE_NAME_PARSED_EXTENSION 0x0002#define FLTFL_FILE_NAME_PARSED_STREAM 0x0004#define FLTFL_FILE_NAME_PARSED_PARENT_DIR 0x0008
typedef struct _FLT_FILE_NAME_INFORMATION { USHORT Size; FLT_FILE_NAME_PARSED_FLAGS NamesParsed; FLT_FILE_NAME_OPTIONS Format; UNICODE_STRING Name; UNICODE_STRING Volume; UNICODE_STRING Share; UNICODE_STRING Extension; UNICODE_STRING Stream; UNICODE_STRING FinalComponent; UNICODE_STRING ParentDir;} FLT_FILE_NAME_INFORMATION, *PFLT_FILE_NAME_INFORMATION;
typedef enum _FLT_SET_CONTEXT_OPERATION { FLT_SET_CONTEXT_REPLACE_IF_EXISTS, FLT_SET_CONTEXT_KEEP_IF_EXISTS} FLT_SET_CONTEXT_OPERATION, *PFLT_SET_CONTEXT_OPERATION;
typedef struct _FLT_VOLUME_PROPERTIES { DEVICE_TYPE DeviceType; ULONG DeviceCharacteristics; ULONG DeviceObjectFlags; ULONG AlignmentRequirement; USHORT SectorSize; USHORT Reserved0; UNICODE_STRING FileSystemDriverName; UNICODE_STRING FileSystemDeviceName; UNICODE_STRING RealDeviceName;} FLT_VOLUME_PROPERTIES, *PFLT_VOLUME_PROPERTIES;
#define FLT_PORT_CONNECT 0x0001#define FLT_PORT_ALL_ACCESS (FLT_PORT_CONNECT | STANDARD_RIGHTS_ALL)
typedef NTSTATUS(FLTAPI *PFLT_MESSAGE_NOTIFY)( _In_opt_ PVOID PortCookie, _In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer, _In_ ULONG InputBufferLength, _Out_writes_bytes_to_opt_(OutputBufferLength,*ReturnOutputBufferLength) PVOID OutputBuffer, _In_ ULONG OutputBufferLength, _Out_ PULONG ReturnOutputBufferLength);
typedef NTSTATUS(FLTAPI *PFLT_CONNECT_NOTIFY)( _In_ PFLT_PORT ClientPort, _In_opt_ PVOID ServerPortCookie, _In_reads_bytes_opt_(SizeOfContext) PVOID ConnectionContext, _In_ ULONG SizeOfContext, _Outptr_result_maybenull_ PVOID *ConnectionPortCookie);
typedef VOID(FLTAPI *PFLT_DISCONNECT_NOTIFY)( _In_opt_ PVOID ConnectionCookie);
typedef VOID(FLTAPI *PFLT_COMPLETE_CANCELED_CALLBACK)( _In_ PFLT_CALLBACK_DATA CallbackData);
typedef struct _FLT_DEFERRED_IO_WORKITEM *PFLT_DEFERRED_IO_WORKITEM;typedef struct _FLT_GENERIC_WORKITEM *PFLT_GENERIC_WORKITEM;
typedef VOID(FLTAPI *PFLT_DEFERRED_IO_WORKITEM_ROUTINE)( _In_ PFLT_DEFERRED_IO_WORKITEM FltWorkItem, _In_ PFLT_CALLBACK_DATA CallbackData, _In_opt_ PVOID Context);
typedef VOID(FLTAPI *PFLT_GENERIC_WORKITEM_ROUTINE)( _In_ PFLT_GENERIC_WORKITEM FltWorkItem, _In_ PVOID FltObject, _In_opt_ PVOID Context);
typedef IO_CSQ_IRP_CONTEXT FLT_CALLBACK_DATA_QUEUE_IO_CONTEXT, *PFLT_CALLBACK_DATA_QUEUE_IO_CONTEXT;
typedef struct _FLT_CALLBACK_DATA_QUEUE FLT_CALLBACK_DATA_QUEUE, *PFLT_CALLBACK_DATA_QUEUE;
typedef NTSTATUS(FLTAPI *PFLT_CALLBACK_DATA_QUEUE_INSERT_IO)( _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _In_ PFLT_CALLBACK_DATA Cbd, _In_opt_ PVOID InsertContext);
typedef VOID(FLTAPI *PFLT_CALLBACK_DATA_QUEUE_REMOVE_IO)( _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _In_ PFLT_CALLBACK_DATA Cbd);
typedef PFLT_CALLBACK_DATA(FLTAPI *PFLT_CALLBACK_DATA_QUEUE_PEEK_NEXT_IO)( _In_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _In_opt_ PFLT_CALLBACK_DATA Cbd, _In_opt_ PVOID PeekContext);
typedef VOID(FLTAPI *PFLT_CALLBACK_DATA_QUEUE_ACQUIRE)( _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _Out_opt_ PKIRQL Irql);
typedef VOID(FLTAPI *PFLT_CALLBACK_DATA_QUEUE_RELEASE)( _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _In_opt_ KIRQL Irql);
typedef VOID(FLTAPI *PFLT_CALLBACK_DATA_QUEUE_COMPLETE_CANCELED_IO)( _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _Inout_ PFLT_CALLBACK_DATA Cbd);
typedef ULONG FLT_CALLBACK_DATA_QUEUE_FLAGS;
typedef struct _FLT_CALLBACK_DATA_QUEUE { IO_CSQ Csq; FLT_CALLBACK_DATA_QUEUE_FLAGS Flags; PFLT_INSTANCE Instance; PFLT_CALLBACK_DATA_QUEUE_INSERT_IO InsertIo; PFLT_CALLBACK_DATA_QUEUE_REMOVE_IO RemoveIo; PFLT_CALLBACK_DATA_QUEUE_PEEK_NEXT_IO PeekNextIo; PFLT_CALLBACK_DATA_QUEUE_ACQUIRE Acquire; PFLT_CALLBACK_DATA_QUEUE_RELEASE Release; PFLT_CALLBACK_DATA_QUEUE_COMPLETE_CANCELED_IO CompleteCanceledIo;} FLT_CALLBACK_DATA_QUEUE, *PFLT_CALLBACK_DATA_QUEUE;
typedef NTSTATUS(*PFLT_COMPLETE_LOCK_CALLBACK_DATA_ROUTINE)( _In_opt_ PVOID Context, _In_ PFLT_CALLBACK_DATA CallbackData);
typedef VOID(FLTAPI *PFLTOPLOCK_WAIT_COMPLETE_ROUTINE)( _In_ PFLT_CALLBACK_DATA CallbackData, _In_opt_ PVOID Context);
typedef VOID(FLTAPI *PFLTOPLOCK_PREPOST_CALLBACKDATA_ROUTINE)( _In_ PFLT_CALLBACK_DATA CallbackData, _In_opt_ PVOID Context);
VOIDFLTAPIFltSetCallbackDataDirty( _Inout_ PFLT_CALLBACK_DATA Data);
VOIDFLTAPIFltClearCallbackDataDirty( _Inout_ PFLT_CALLBACK_DATA Data);
BOOLEANFLTAPIFltIsCallbackDataDirty( _In_ PFLT_CALLBACK_DATA Data);
_Must_inspect_result_BOOLEANFLTAPIFltDoCompletionProcessingWhenSafe( _In_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_opt_ PVOID CompletionContext, _In_ FLT_POST_OPERATION_FLAGS Flags, _In_ PFLT_POST_OPERATION_CALLBACK SafePostCallback, _Out_ PFLT_POSTOP_CALLBACK_STATUS RetPostOperationStatus);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltCheckAndGrowNameControl( _Inout_ PFLT_NAME_CONTROL NameCtrl, _In_ USHORT NewSize);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltPurgeFileNameInformationCache( _In_ PFLT_INSTANCE Instance, _In_opt_ PFILE_OBJECT FileObject);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltRegisterFilter( _In_ PDRIVER_OBJECT Driver, _In_ CONST FLT_REGISTRATION *Registration, _Outptr_ PFLT_FILTER *RetFilter);
_IRQL_requires_max_(APC_LEVEL)VOIDFLTAPIFltUnregisterFilter( _In_ PFLT_FILTER Filter);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltStartFiltering( _In_ PFLT_FILTER Filter);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)PVOIDFLTAPIFltGetRoutineAddress( _In_ PCSTR FltMgrRoutineName);
_When_(CallbackStatus==FLT_PREOP_COMPLETE, _IRQL_requires_max_(DISPATCH_LEVEL))_When_(CallbackStatus!=FLT_PREOP_COMPLETE, _IRQL_requires_max_(APC_LEVEL))VOIDFLTAPIFltCompletePendedPreOperation( _In_ PFLT_CALLBACK_DATA CallbackData, _In_ FLT_PREOP_CALLBACK_STATUS CallbackStatus, _In_opt_ PVOID Context);
_IRQL_requires_max_(DISPATCH_LEVEL)VOIDFLTAPIFltCompletePendedPostOperation( _In_ PFLT_CALLBACK_DATA CallbackData);
_Must_inspect_result__IRQL_requires_max_(DISPATCH_LEVEL)NTSTATUSFLTAPIFltRequestOperationStatusCallback( _In_ PFLT_CALLBACK_DATA Data, _In_ PFLT_GET_OPERATION_STATUS_CALLBACK CallbackRoutine, _In_opt_ PVOID RequesterContext);
_When_((PoolType==NonPagedPoolNx), _IRQL_requires_max_(DISPATCH_LEVEL))_When_((PoolType!=NonPagedPoolNx), _IRQL_requires_max_(APC_LEVEL))PVOIDFLTAPIFltAllocatePoolAlignedWithTag( _In_ PFLT_INSTANCE Instance, _In_ POOL_TYPE PoolType, _In_ SIZE_T NumberOfBytes, _In_ ULONG Tag);
_IRQL_requires_max_(DISPATCH_LEVEL)VOIDFLTAPIFltFreePoolAlignedWithTag( _In_ PFLT_INSTANCE Instance, _In_ PVOID Buffer, _In_ ULONG Tag);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltGetFileNameInformation( _In_ PFLT_CALLBACK_DATA CallbackData, _In_ FLT_FILE_NAME_OPTIONS NameOptions, _Outptr_ PFLT_FILE_NAME_INFORMATION *FileNameInformation);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltGetFileNameInformationUnsafe( _In_ PFILE_OBJECT FileObject, _In_opt_ PFLT_INSTANCE Instance, _In_ FLT_FILE_NAME_OPTIONS NameOptions, _Outptr_ PFLT_FILE_NAME_INFORMATION *FileNameInformation);
_IRQL_requires_max_(APC_LEVEL)VOIDFLTAPIFltReleaseFileNameInformation( _In_ PFLT_FILE_NAME_INFORMATION FileNameInformation);
_IRQL_requires_max_(APC_LEVEL)VOIDFLTAPIFltReferenceFileNameInformation( _In_ PFLT_FILE_NAME_INFORMATION FileNameInformation);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltParseFileName( _In_ PCUNICODE_STRING FileName, _Inout_opt_ PUNICODE_STRING Extension, _Inout_opt_ PUNICODE_STRING Stream, _Inout_opt_ PUNICODE_STRING FinalComponent);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltParseFileNameInformation( _Inout_ PFLT_FILE_NAME_INFORMATION FileNameInformation);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltGetTunneledName( _In_ PFLT_CALLBACK_DATA CallbackData, _In_ PFLT_FILE_NAME_INFORMATION FileNameInformation, _Outptr_result_maybenull_ PFLT_FILE_NAME_INFORMATION *RetTunneledFileNameInformation);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltGetVolumeName( _In_ PFLT_VOLUME Volume, _Inout_opt_ PUNICODE_STRING VolumeName, _Out_opt_ PULONG BufferSizeNeeded);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltGetDestinationFileNameInformation( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _In_opt_ HANDLE RootDirectory, _In_reads_bytes_(FileNameLength) PWSTR FileName, _In_ ULONG FileNameLength, _In_ FLT_FILE_NAME_OPTIONS NameOptions, _Outptr_ PFLT_FILE_NAME_INFORMATION *RetFileNameInformation);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltIsDirectory( _In_ PFILE_OBJECT FileObject, _In_ PFLT_INSTANCE Instance, _Out_ PBOOLEAN IsDirectory);
_Must_inspect_result__IRQL_requires_max_(PASSIVE_LEVEL)NTSTATUSFLTAPIFltLoadFilter( _In_ PCUNICODE_STRING FilterName);
_Must_inspect_result__IRQL_requires_max_(PASSIVE_LEVEL)NTSTATUSFLTAPIFltUnloadFilter( _In_ PCUNICODE_STRING FilterName);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltAttachVolume( _Inout_ PFLT_FILTER Filter, _Inout_ PFLT_VOLUME Volume, _In_opt_ PCUNICODE_STRING InstanceName, _Outptr_opt_result_maybenull_ PFLT_INSTANCE *RetInstance);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltAttachVolumeAtAltitude( _Inout_ PFLT_FILTER Filter, _Inout_ PFLT_VOLUME Volume, _In_ PCUNICODE_STRING Altitude, _In_opt_ PCUNICODE_STRING InstanceName, _Outptr_opt_result_maybenull_ PFLT_INSTANCE *RetInstance);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltDetachVolume( _Inout_ PFLT_FILTER Filter, _Inout_ PFLT_VOLUME Volume, _In_opt_ PCUNICODE_STRING InstanceName);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltAllocateCallbackData( _In_ PFLT_INSTANCE Instance, _In_opt_ PFILE_OBJECT FileObject, _Outptr_ PFLT_CALLBACK_DATA *RetNewCallbackData);
_IRQL_requires_max_(DISPATCH_LEVEL)VOIDFLTAPIFltFreeCallbackData( _In_ PFLT_CALLBACK_DATA CallbackData);
_IRQL_requires_max_(APC_LEVEL)VOIDFLTAPIFltReuseCallbackData( _Inout_ PFLT_CALLBACK_DATA CallbackData);
_When_(FlagOn(CallbackData->Iopb->IrpFlags, IRP_PAGING_IO), _IRQL_requires_max_(APC_LEVEL))_When_(!FlagOn(CallbackData->Iopb->IrpFlags, IRP_PAGING_IO), _IRQL_requires_max_(PASSIVE_LEVEL))VOIDFLTAPIFltPerformSynchronousIo( _Inout_ PFLT_CALLBACK_DATA CallbackData);
_Must_inspect_result__When_( FlagOn(CallbackData->Iopb->IrpFlags, IRP_PAGING_IO), _IRQL_requires_max_(APC_LEVEL))_When_( !FlagOn(CallbackData->Iopb->IrpFlags, IRP_PAGING_IO), _IRQL_requires_max_(PASSIVE_LEVEL))NTSTATUSFLTAPIFltPerformAsynchronousIo( _Inout_ PFLT_CALLBACK_DATA CallbackData, _In_ PFLT_COMPLETED_ASYNC_IO_CALLBACK CallbackRoutine, _In_ PVOID CallbackContext);
_Must_inspect_result__IRQL_requires_max_(PASSIVE_LEVEL)NTSTATUSFLTAPIFltCreateFile( _In_ PFLT_FILTER Filter, _In_opt_ PFLT_INSTANCE Instance, _Out_ PHANDLE FileHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _Out_ PIO_STATUS_BLOCK IoStatusBlock, _In_opt_ PLARGE_INTEGER AllocationSize, _In_ ULONG FileAttributes, _In_ ULONG ShareAccess, _In_ ULONG CreateDisposition, _In_ ULONG CreateOptions, _In_reads_bytes_opt_(EaLength)PVOID EaBuffer, _In_ ULONG EaLength, _In_ ULONG Flags);
_Must_inspect_result__IRQL_requires_max_(PASSIVE_LEVEL)_When_((Flags|FLTFL_IO_OPERATION_PAGING|FLTFL_IO_OPERATION_SYNCHRONOUS_PAGING),_IRQL_requires_max_(APC_LEVEL))NTSTATUSFLTAPIFltReadFile( _In_ PFLT_INSTANCE InitiatingInstance, _In_ PFILE_OBJECT FileObject, _In_opt_ PLARGE_INTEGER ByteOffset, _In_ ULONG Length, _Out_writes_bytes_to_(Length,*BytesRead) PVOID Buffer, _In_ FLT_IO_OPERATION_FLAGS Flags, _Out_opt_ PULONG BytesRead, _In_opt_ PFLT_COMPLETED_ASYNC_IO_CALLBACK CallbackRoutine, _In_opt_ PVOID CallbackContext);
_Must_inspect_result__IRQL_requires_max_(PASSIVE_LEVEL)NTSTATUSFLTAPIFltTagFile( _In_ PFLT_INSTANCE InitiatingInstance, _In_ PFILE_OBJECT FileObject, _In_ ULONG FileTag, _In_opt_ GUID *Guid, _In_reads_bytes_(DataBufferLength) PVOID DataBuffer, _In_ USHORT DataBufferLength);
_Must_inspect_result__IRQL_requires_max_(PASSIVE_LEVEL)NTSTATUSFLTAPIFltUntagFile( _In_ PFLT_INSTANCE InitiatingInstance, _In_ PFILE_OBJECT FileObject, _In_ ULONG FileTag, _In_opt_ GUID *Guid);
_Must_inspect_result__IRQL_requires_max_(PASSIVE_LEVEL)_When_((Flags|FLTFL_IO_OPERATION_PAGING|FLTFL_IO_OPERATION_SYNCHRONOUS_PAGING),_IRQL_requires_max_(APC_LEVEL))NTSTATUSFLTAPIFltWriteFile( _In_ PFLT_INSTANCE InitiatingInstance, _In_ PFILE_OBJECT FileObject, _In_opt_ PLARGE_INTEGER ByteOffset, _In_ ULONG Length, _In_reads_bytes_(Length) PVOID Buffer, _In_ FLT_IO_OPERATION_FLAGS Flags, _Out_opt_ PULONG BytesWritten, _In_opt_ PFLT_COMPLETED_ASYNC_IO_CALLBACK CallbackRoutine, _In_opt_ PVOID CallbackContext);
_Must_inspect_result__IRQL_requires_max_(PASSIVE_LEVEL)NTSTATUSFLTAPIFltQueryInformationFile( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _Out_writes_bytes_to_(Length,*LengthReturned) PVOID FileInformation, _In_ ULONG Length, _In_ FILE_INFORMATION_CLASS FileInformationClass, _Out_opt_ PULONG LengthReturned);
_Must_inspect_result__IRQL_requires_max_(PASSIVE_LEVEL)NTSTATUSFLTAPIFltSetInformationFile( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _In_reads_bytes_(Length) PVOID FileInformation, _In_ ULONG Length, _In_ FILE_INFORMATION_CLASS FileInformationClass);
_Must_inspect_result__IRQL_requires_max_(PASSIVE_LEVEL)NTSTATUSFLTAPIFltQueryVolumeInformationFile( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _Out_writes_bytes_to_(Length,*LengthReturned) PVOID FsInformation, _In_ ULONG Length, _In_ FS_INFORMATION_CLASS FsInformationClass, _Out_opt_ PULONG LengthReturned);
_Must_inspect_result__IRQL_requires_max_(PASSIVE_LEVEL)NTSTATUSFLTAPIFltQuerySecurityObject( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _In_ SECURITY_INFORMATION SecurityInformation, _Inout_updates_bytes_opt_(Length) PSECURITY_DESCRIPTOR SecurityDescriptor, _In_ ULONG Length, _Out_opt_ PULONG LengthNeeded);
_Must_inspect_result__IRQL_requires_max_(PASSIVE_LEVEL)NTSTATUSFLTAPIFltSetSecurityObject( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _In_ SECURITY_INFORMATION SecurityInformation, _In_ PSECURITY_DESCRIPTOR SecurityDescriptor);
_Must_inspect_result__IRQL_requires_max_(PASSIVE_LEVEL)NTSTATUSFLTAPIFltFlushBuffers( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject);
_Must_inspect_result__IRQL_requires_max_(PASSIVE_LEVEL)NTSTATUSFLTAPIFltFsControlFile( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _In_ ULONG FsControlCode, _In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer, _In_ ULONG InputBufferLength, _Out_writes_bytes_to_opt_(OutputBufferLength,*LengthReturned) PVOID OutputBuffer, _In_ ULONG OutputBufferLength, _Out_opt_ PULONG LengthReturned);
_Must_inspect_result__IRQL_requires_max_(PASSIVE_LEVEL)NTSTATUSFLTAPIFltDeviceIoControlFile( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _In_ ULONG IoControlCode, _In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer, _In_ ULONG InputBufferLength, _Out_writes_bytes_to_opt_(OutputBufferLength,*LengthReturned) PVOID OutputBuffer, _In_ ULONG OutputBufferLength, _Out_opt_ PULONG LengthReturned);
_When_(FlagOn(CallbackData->Iopb->IrpFlags, IRP_PAGING_IO), _IRQL_requires_max_(APC_LEVEL))_When_(!FlagOn(CallbackData->Iopb->IrpFlags, IRP_PAGING_IO), _IRQL_requires_max_(PASSIVE_LEVEL))VOIDFLTAPIFltReissueSynchronousIo( _In_ PFLT_INSTANCE InitiatingInstance, _In_ PFLT_CALLBACK_DATA CallbackData);
_IRQL_requires_max_(PASSIVE_LEVEL)NTSTATUSFLTAPIFltClose( _In_ HANDLE FileHandle);
_IRQL_requires_max_(PASSIVE_LEVEL)VOIDFLTAPIFltCancelFileOpen( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject);
_Must_inspect_result__IRQL_requires_max_(PASSIVE_LEVEL)NTSTATUSFLTAPIFltCreateSystemVolumeInformationFolder( _In_ PFLT_INSTANCE Instance);
_IRQL_requires_max_(APC_LEVEL)BOOLEANFLTAPIFltSupportsFileContexts( _In_ PFILE_OBJECT FileObject);
_IRQL_requires_max_(APC_LEVEL)BOOLEANFLTAPIFltSupportsStreamContexts( _In_ PFILE_OBJECT FileObject);
_IRQL_requires_max_(APC_LEVEL)BOOLEANFLTAPIFltSupportsStreamHandleContexts( _In_ PFILE_OBJECT FileObject);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltAllocateContext( _In_ PFLT_FILTER Filter, _In_ FLT_CONTEXT_TYPE ContextType, _In_ SIZE_T ContextSize, _In_ POOL_TYPE PoolType, _Outptr_result_bytebuffer_(ContextSize) PFLT_CONTEXT *ReturnedContext);
_IRQL_requires_max_(APC_LEVEL)VOIDFLTAPIFltGetContexts( _In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_CONTEXT_TYPE DesiredContexts, _Out_ PFLT_RELATED_CONTEXTS Contexts);
_IRQL_requires_max_(APC_LEVEL)VOIDFLTAPIFltReleaseContexts( _In_ PFLT_RELATED_CONTEXTS Contexts);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltSetVolumeContext( _In_ PFLT_VOLUME Volume, _In_ FLT_SET_CONTEXT_OPERATION Operation, _In_ PFLT_CONTEXT NewContext, _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltSetInstanceContext( _In_ PFLT_INSTANCE Instance, _In_ FLT_SET_CONTEXT_OPERATION Operation, _In_ PFLT_CONTEXT NewContext, _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltSetFileContext( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _In_ FLT_SET_CONTEXT_OPERATION Operation, _In_ PFLT_CONTEXT NewContext, _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltSetStreamContext( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _In_ FLT_SET_CONTEXT_OPERATION Operation, _In_ PFLT_CONTEXT NewContext, _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltSetStreamHandleContext( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _In_ FLT_SET_CONTEXT_OPERATION Operation, _In_ PFLT_CONTEXT NewContext, _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext);
_IRQL_requires_max_(APC_LEVEL)VOIDFLTAPIFltDeleteContext( _In_ PFLT_CONTEXT Context);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltDeleteVolumeContext( _In_ PFLT_FILTER Filter, _In_ PFLT_VOLUME Volume, _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltDeleteInstanceContext( _In_ PFLT_INSTANCE Instance, _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltDeleteFileContext( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltDeleteStreamContext( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltDeleteStreamHandleContext( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _Outptr_opt_result_maybenull_ PFLT_CONTEXT *OldContext);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltGetVolumeContext( _In_ PFLT_FILTER Filter, _In_ PFLT_VOLUME Volume, _Outptr_ PFLT_CONTEXT *Context);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltGetInstanceContext( _In_ PFLT_INSTANCE Instance, _Outptr_ PFLT_CONTEXT *Context);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltGetFileContext( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _Outptr_ PFLT_CONTEXT *Context);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltGetStreamContext( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _Outptr_ PFLT_CONTEXT *Context);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltGetStreamHandleContext( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _Outptr_ PFLT_CONTEXT *Context);
_IRQL_requires_max_(DISPATCH_LEVEL)VOIDFLTAPIFltReferenceContext( _In_ PFLT_CONTEXT Context);
_IRQL_requires_max_(DISPATCH_LEVEL)VOIDFLTAPIFltReleaseContext( _In_ PFLT_CONTEXT Context);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltGetFilterFromName( _In_ PCUNICODE_STRING FilterName, _Outptr_ PFLT_FILTER *RetFilter);
_IRQL_requires_max_(PASSIVE_LEVEL)NTSTATUSFLTAPIFltGetVolumeFromName( _In_ PFLT_FILTER Filter, _In_ PCUNICODE_STRING VolumeName, _Outptr_ PFLT_VOLUME *RetVolume);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltGetVolumeInstanceFromName( _In_opt_ PFLT_FILTER Filter, _In_ PFLT_VOLUME Volume, _In_opt_ PCUNICODE_STRING InstanceName, _Outptr_ PFLT_INSTANCE *RetInstance);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltGetVolumeFromInstance( _In_ PFLT_INSTANCE Instance, _Outptr_ PFLT_VOLUME *RetVolume);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltGetFilterFromInstance( _In_ PFLT_INSTANCE Instance, _Outptr_ PFLT_FILTER *RetFilter);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltGetVolumeFromFileObject( _In_ PFLT_FILTER Filter, _In_ PFILE_OBJECT FileObject, _Outptr_ PFLT_VOLUME *RetVolume);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltGetVolumeFromDeviceObject( _In_ PFLT_FILTER Filter, _In_ PDEVICE_OBJECT DeviceObject, _Outptr_ PFLT_VOLUME *RetVolume);
_IRQL_requires_max_(DISPATCH_LEVEL)NTSTATUSFLTAPIFltGetDeviceObject( _In_ PFLT_VOLUME Volume, _Outptr_ PDEVICE_OBJECT *DeviceObject);
_IRQL_requires_max_(DISPATCH_LEVEL)NTSTATUSFLTAPIFltGetDiskDeviceObject( _In_ PFLT_VOLUME Volume, _Outptr_ PDEVICE_OBJECT *DiskDeviceObject);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltGetLowerInstance( _In_ PFLT_INSTANCE CurrentInstance, _Outptr_ PFLT_INSTANCE *LowerInstance);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltGetUpperInstance( _In_ PFLT_INSTANCE CurrentInstance, _Outptr_ PFLT_INSTANCE *UpperInstance);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltGetTopInstance( _In_ PFLT_VOLUME Volume, _Outptr_ PFLT_INSTANCE *Instance);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltGetBottomInstance( _In_ PFLT_VOLUME Volume, _Outptr_ PFLT_INSTANCE *Instance);
LONGFLTAPIFltCompareInstanceAltitudes( _In_ PFLT_INSTANCE Instance1, _In_ PFLT_INSTANCE Instance2);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltGetFilterInformation( _In_ PFLT_FILTER Filter, _In_ FILTER_INFORMATION_CLASS InformationClass, _Out_writes_bytes_to_opt_(BufferSize, *BytesReturned) PVOID Buffer, _In_ ULONG BufferSize, _Out_ PULONG BytesReturned);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltGetInstanceInformation( _In_ PFLT_INSTANCE Instance, _In_ INSTANCE_INFORMATION_CLASS InformationClass, _Out_writes_bytes_to_opt_(BufferSize,*BytesReturned) PVOID Buffer, _In_ ULONG BufferSize, _Out_ PULONG BytesReturned);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltGetVolumeProperties( _In_ PFLT_VOLUME Volume, _Out_writes_bytes_to_opt_(VolumePropertiesLength,*LengthReturned) PFLT_VOLUME_PROPERTIES VolumeProperties, _In_ ULONG VolumePropertiesLength, _Out_ PULONG LengthReturned);
_Must_inspect_result__IRQL_requires_max_(PASSIVE_LEVEL)NTSTATUSFLTAPIFltIsVolumeWritable( _In_ PVOID FltObject, _Out_ PBOOLEAN IsWritable);
_Must_inspect_result__IRQL_requires_max_(PASSIVE_LEVEL)NTSTATUSFLTAPIFltGetVolumeGuidName( _In_ PFLT_VOLUME Volume, _Out_ PUNICODE_STRING VolumeGuidName, _Out_opt_ PULONG BufferSizeNeeded);
_Must_inspect_result__IRQL_requires_max_(PASSIVE_LEVEL)NTSTATUSFLTAPIFltQueryVolumeInformation( _In_ PFLT_INSTANCE Instance, _Out_ PIO_STATUS_BLOCK Iosb, _Out_writes_bytes_(Length) PVOID FsInformation, _In_ ULONG Length, _In_ FS_INFORMATION_CLASS FsInformationClass);
_Must_inspect_result__IRQL_requires_max_(PASSIVE_LEVEL)NTSTATUSFLTAPIFltSetVolumeInformation( _In_ PFLT_INSTANCE Instance, _Out_ PIO_STATUS_BLOCK Iosb, _Out_writes_bytes_(Length) PVOID FsInformation, _In_ ULONG Length, _In_ FS_INFORMATION_CLASS FsInformationClass);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltEnumerateFilters( _Out_writes_to_opt_(FilterListSize,*NumberFiltersReturned) PFLT_FILTER *FilterList, _In_ ULONG FilterListSize, _Out_ PULONG NumberFiltersReturned);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltEnumerateVolumes( _In_ PFLT_FILTER Filter, _Out_writes_to_opt_(VolumeListSize,*NumberVolumesReturned) PFLT_VOLUME *VolumeList, _In_ ULONG VolumeListSize, _Out_ PULONG NumberVolumesReturned);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltEnumerateInstances( _In_opt_ PFLT_VOLUME Volume, _In_opt_ PFLT_FILTER Filter, _Out_writes_to_opt_(InstanceListSize,*NumberInstancesReturned) PFLT_INSTANCE *InstanceList, _In_ ULONG InstanceListSize, _Out_ PULONG NumberInstancesReturned);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltEnumerateFilterInformation( _In_ ULONG Index, _In_ FILTER_INFORMATION_CLASS InformationClass, _Out_writes_bytes_to_opt_(BufferSize,*BytesReturned) PVOID Buffer, _In_ ULONG BufferSize, _Out_ PULONG BytesReturned);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltEnumerateInstanceInformationByFilter( _In_ PFLT_FILTER Filter, _In_ ULONG Index, _In_ INSTANCE_INFORMATION_CLASS InformationClass, _Out_writes_bytes_to_opt_(BufferSize,*BytesReturned) PVOID Buffer, _In_ ULONG BufferSize, _Out_ PULONG BytesReturned);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltEnumerateInstanceInformationByVolume( _In_ PFLT_VOLUME Volume, _In_ ULONG Index, _In_ INSTANCE_INFORMATION_CLASS InformationClass, _Out_writes_bytes_to_opt_(BufferSize,*BytesReturned) PVOID Buffer, _In_ ULONG BufferSize, _Out_ PULONG BytesReturned);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltEnumerateVolumeInformation( _In_ PFLT_FILTER Filter, _In_ ULONG Index, _In_ FILTER_VOLUME_INFORMATION_CLASS InformationClass, _Out_writes_bytes_to_opt_(BufferSize,*BytesReturned) PVOID Buffer, _In_ ULONG BufferSize, _Out_ PULONG BytesReturned);
_Must_inspect_result__IRQL_requires_max_(DISPATCH_LEVEL)NTSTATUSFLTAPIFltObjectReference( _Inout_ PVOID FltObject);
_IRQL_requires_max_(DISPATCH_LEVEL)VOIDFLTAPIFltObjectDereference( _Inout_ PVOID FltObject);
_Must_inspect_result__IRQL_requires_max_(PASSIVE_LEVEL)NTSTATUSFLTAPIFltCreateCommunicationPort( _In_ PFLT_FILTER Filter, _Outptr_ PFLT_PORT *ServerPort, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _In_opt_ PVOID ServerPortCookie, _In_ PFLT_CONNECT_NOTIFY ConnectNotifyCallback, _In_ PFLT_DISCONNECT_NOTIFY DisconnectNotifyCallback, _In_opt_ PFLT_MESSAGE_NOTIFY MessageNotifyCallback, _In_ LONG MaxConnections);
_IRQL_requires_max_(PASSIVE_LEVEL)VOIDFLTAPIFltCloseCommunicationPort( _In_ PFLT_PORT ServerPort);
_IRQL_requires_max_(PASSIVE_LEVEL)VOIDFLTAPIFltCloseClientPort( _In_ PFLT_FILTER Filter, _Outptr_ PFLT_PORT *ClientPort);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltSendMessage( _In_ PFLT_FILTER Filter, _In_ PFLT_PORT *ClientPort, _In_reads_bytes_(SenderBufferLength) PVOID SenderBuffer, _In_ ULONG SenderBufferLength, _Out_writes_bytes_opt_(*ReplyLength) PVOID ReplyBuffer, _Inout_opt_ PULONG ReplyLength, _In_opt_ PLARGE_INTEGER Timeout);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltBuildDefaultSecurityDescriptor( _Outptr_ PSECURITY_DESCRIPTOR *SecurityDescriptor, _In_ ACCESS_MASK DesiredAccess);
_IRQL_requires_max_(APC_LEVEL)VOIDFLTAPIFltFreeSecurityDescriptor( _In_ PSECURITY_DESCRIPTOR SecurityDescriptor);
_Must_inspect_result__IRQL_requires_max_(DISPATCH_LEVEL)BOOLEANFLTAPIFltCancelIo( _In_ PFLT_CALLBACK_DATA CallbackData);
_IRQL_requires_max_(DISPATCH_LEVEL)NTSTATUSFLTAPIFltSetCancelCompletion( _In_ PFLT_CALLBACK_DATA CallbackData, _In_ PFLT_COMPLETE_CANCELED_CALLBACK CanceledCallback);
_Must_inspect_result__IRQL_requires_max_(DISPATCH_LEVEL)NTSTATUSFLTAPIFltClearCancelCompletion( _In_ PFLT_CALLBACK_DATA CallbackData);
BOOLEANFLTAPIFltIsIoCanceled( _In_ PFLT_CALLBACK_DATA CallbackData);
_Must_inspect_result__IRQL_requires_max_(DISPATCH_LEVEL)PFLT_DEFERRED_IO_WORKITEMFLTAPIFltAllocateDeferredIoWorkItem(VOID);
_IRQL_requires_max_(DISPATCH_LEVEL)VOIDFLTAPIFltFreeDeferredIoWorkItem( _In_ PFLT_DEFERRED_IO_WORKITEM FltWorkItem);
_Must_inspect_result__IRQL_requires_max_(DISPATCH_LEVEL)PFLT_GENERIC_WORKITEMFLTAPIFltAllocateGenericWorkItem(VOID);
_IRQL_requires_max_(DISPATCH_LEVEL)VOIDFLTAPIFltFreeGenericWorkItem( _In_ PFLT_GENERIC_WORKITEM FltWorkItem);
_Must_inspect_result__IRQL_requires_max_(DISPATCH_LEVEL)NTSTATUSFLTAPIFltQueueDeferredIoWorkItem( _In_ PFLT_DEFERRED_IO_WORKITEM FltWorkItem, _In_ PFLT_CALLBACK_DATA Data, _In_ PFLT_DEFERRED_IO_WORKITEM_ROUTINE WorkerRoutine, _In_ WORK_QUEUE_TYPE QueueType, _In_ PVOID Context);
_Must_inspect_result__IRQL_requires_max_(DISPATCH_LEVEL)NTSTATUSFLTAPIFltQueueGenericWorkItem( _In_ PFLT_GENERIC_WORKITEM FltWorkItem, _In_ PVOID FltObject, _In_ PFLT_GENERIC_WORKITEM_ROUTINE WorkerRoutine, _In_ WORK_QUEUE_TYPE QueueType, _In_opt_ PVOID Context);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltLockUserBuffer( _In_ PFLT_CALLBACK_DATA CallbackData);
NTSTATUSFLTAPIFltDecodeParameters( _In_ PFLT_CALLBACK_DATA CallbackData, _Outptr_opt_ PMDL **MdlAddressPointer, _Outptr_opt_result_bytebuffer_(**Length) PVOID **Buffer, _Outptr_opt_ PULONG *Length, _Out_opt_ LOCK_OPERATION *DesiredAccess);
PMDLFASTCALLFltGetSwappedBufferMdlAddress( _In_ PFLT_CALLBACK_DATA CallbackData);
VOIDFASTCALLFltRetainSwappedBufferMdlAddress( _In_ PFLT_CALLBACK_DATA CallbackData);
NTSTATUSFLTAPIFltCbdqInitialize( _In_ PFLT_INSTANCE Instance, _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _In_ PFLT_CALLBACK_DATA_QUEUE_INSERT_IO CbdqInsertIo, _In_ PFLT_CALLBACK_DATA_QUEUE_REMOVE_IO CbdqRemoveIo, _In_ PFLT_CALLBACK_DATA_QUEUE_PEEK_NEXT_IO CbdqPeekNextIo, _In_ PFLT_CALLBACK_DATA_QUEUE_ACQUIRE CbdqAcquire, _In_ PFLT_CALLBACK_DATA_QUEUE_RELEASE CbdqRelease, _In_ PFLT_CALLBACK_DATA_QUEUE_COMPLETE_CANCELED_IO CbdqCompleteCanceledIo);
VOIDFLTAPIFltCbdqEnable( _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq);
VOIDFLTAPIFltCbdqDisable( _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq);
_Must_inspect_result_NTSTATUSFLTAPIFltCbdqInsertIo( _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _In_ PFLT_CALLBACK_DATA Cbd, _In_opt_ PFLT_CALLBACK_DATA_QUEUE_IO_CONTEXT Context, _In_opt_ PVOID InsertContext);
_Must_inspect_result_PFLT_CALLBACK_DATAFLTAPIFltCbdqRemoveIo( _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _In_ PFLT_CALLBACK_DATA_QUEUE_IO_CONTEXT Context);
_Must_inspect_result_PFLT_CALLBACK_DATAFLTAPIFltCbdqRemoveNextIo( _Inout_ PFLT_CALLBACK_DATA_QUEUE Cbdq, _In_opt_ PVOID PeekContext);
_IRQL_requires_max_(APC_LEVEL)VOIDFLTAPIFltInitializeOplock( _Out_ POPLOCK Oplock);
_IRQL_requires_max_(APC_LEVEL)VOIDFLTAPIFltUninitializeOplock( _In_ POPLOCK Oplock);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)FLT_PREOP_CALLBACK_STATUSFLTAPIFltOplockFsctrl( _In_ POPLOCK Oplock, _In_ PFLT_CALLBACK_DATA CallbackData, _In_ ULONG OpenCount);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)FLT_PREOP_CALLBACK_STATUSFLTAPIFltCheckOplock( _In_ POPLOCK Oplock, _In_ PFLT_CALLBACK_DATA CallbackData, _In_opt_ PVOID Context, _In_opt_ PFLTOPLOCK_WAIT_COMPLETE_ROUTINE WaitCompletionRoutine, _In_opt_ PFLTOPLOCK_PREPOST_CALLBACKDATA_ROUTINE PrePostCallbackDataRoutine);
_IRQL_requires_max_(APC_LEVEL)BOOLEANFLTAPIFltOplockIsFastIoPossible( _In_ POPLOCK Oplock);
_IRQL_requires_max_(APC_LEVEL)BOOLEANFLTAPIFltCurrentBatchOplock( _In_ POPLOCK Oplock);
VOIDFLTAPIFltInitializeFileLock( _Out_ PFILE_LOCK FileLock);
VOIDFLTAPIFltUninitializeFileLock( _In_ PFILE_LOCK FileLock);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)PFILE_LOCKFLTAPIFltAllocateFileLock( _In_opt_ PFLT_COMPLETE_LOCK_CALLBACK_DATA_ROUTINE CompleteLockCallbackDataRoutine, _In_opt_ PUNLOCK_ROUTINE UnlockRoutine);
_IRQL_requires_max_(APC_LEVEL)VOIDFLTAPIFltFreeFileLock( _In_ PFILE_LOCK FileLock);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)FLT_PREOP_CALLBACK_STATUSFLTAPIFltProcessFileLock( _In_ PFILE_LOCK FileLock, _In_ PFLT_CALLBACK_DATA CallbackData, _In_opt_ PVOID Context);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)BOOLEANFLTAPIFltCheckLockForReadAccess( _In_ PFILE_LOCK FileLock, _In_ PFLT_CALLBACK_DATA CallbackData);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)BOOLEANFLTAPIFltCheckLockForWriteAccess( _In_ PFILE_LOCK FileLock, _In_ PFLT_CALLBACK_DATA CallbackData);
_Acquires_lock_(_Global_critical_region_)_IRQL_requires_max_(APC_LEVEL)VOIDFLTAPIFltAcquireResourceExclusive( _Inout_ _Requires_lock_not_held_(*_Curr_) _Acquires_lock_(*_Curr_) PERESOURCE Resource);
_Acquires_lock_(_Global_critical_region_)_IRQL_requires_max_(APC_LEVEL)VOIDFLTAPIFltAcquireResourceShared( _Inout_ _Requires_lock_not_held_(*_Curr_) _Acquires_lock_(*_Curr_) PERESOURCE Resource);
_Releases_lock_(_Global_critical_region_)_IRQL_requires_max_(DISPATCH_LEVEL)VOIDFLTAPIFltReleaseResource( _Inout_ _Requires_lock_held_(*_Curr_) _Releases_lock_(*_Curr_) PERESOURCE Resource);
_IRQL_requires_max_(APC_LEVEL)VOIDFLTAPIFltInitializePushLock( _Out_ PEX_PUSH_LOCK PushLock);
_IRQL_requires_max_(APC_LEVEL)VOIDFLTAPIFltDeletePushLock( _In_ PEX_PUSH_LOCK PushLock);
_Acquires_lock_(_Global_critical_region_)_IRQL_requires_max_(APC_LEVEL)VOIDFLTAPIFltAcquirePushLockExclusive( _Inout_ _Requires_lock_not_held_(*_Curr_) _Acquires_lock_(*_Curr_) PEX_PUSH_LOCK PushLock);
_Acquires_lock_(_Global_critical_region_)_IRQL_requires_max_(APC_LEVEL)VOIDFLTAPIFltAcquirePushLockShared( _Inout_ _Requires_lock_not_held_(*_Curr_) _Acquires_lock_(*_Curr_) PEX_PUSH_LOCK PushLock);
_Releases_lock_(_Global_critical_region_)_IRQL_requires_max_(APC_LEVEL)VOIDFLTAPIFltReleasePushLock( _Inout_ _Requires_lock_held_(*_Curr_) _Releases_lock_(*_Curr_) PEX_PUSH_LOCK PushLock);
BOOLEANFLTAPIFltIsOperationSynchronous( _In_ PFLT_CALLBACK_DATA CallbackData);
_IRQL_requires_max_(DISPATCH_LEVEL)BOOLEANFLTAPIFltIs32bitProcess( _In_opt_ PFLT_CALLBACK_DATA CallbackData);
_IRQL_requires_max_(DISPATCH_LEVEL)PEPROCESSFLTAPIFltGetRequestorProcess( _In_ PFLT_CALLBACK_DATA CallbackData);
_IRQL_requires_max_(DISPATCH_LEVEL)ULONGFLTAPIFltGetRequestorProcessId( _In_ PFLT_CALLBACK_DATA CallbackData);
_IRQL_requires_max_(APC_LEVEL)VOIDFLTAPIFltNotifyFilterChangeDirectory( _Inout_ PNOTIFY_SYNC NotifySync, _Inout_ PLIST_ENTRY NotifyList, _In_ PVOID FsContext, _In_ PSTRING FullDirectoryName, _In_ BOOLEAN WatchTree, _In_ BOOLEAN IgnoreBuffer, _In_ ULONG CompletionFilter, _In_ PFLT_CALLBACK_DATA NotifyCallbackData, _In_opt_ PCHECK_FOR_TRAVERSE_ACCESS TraverseCallback, _In_opt_ PSECURITY_SUBJECT_CONTEXT SubjectContext, _In_opt_ PFILTER_REPORT_CHANGE FilterCallback);
PCHARFLTAPIFltGetIrpName( _In_ UCHAR IrpMajorCode);
#if FLT_MGR_AFTER_XPSP2
_Must_inspect_result__IRQL_requires_max_(PASSIVE_LEVEL)NTSTATUSFLTAPIFltCreateFileEx( _In_ PFLT_FILTER Filter, _In_opt_ PFLT_INSTANCE Instance, _Out_ PHANDLE FileHandle, _Outptr_opt_ PFILE_OBJECT *FileObject, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _Out_ PIO_STATUS_BLOCK IoStatusBlock, _In_opt_ PLARGE_INTEGER AllocationSize, _In_ ULONG FileAttributes, _In_ ULONG ShareAccess, _In_ ULONG CreateDisposition, _In_ ULONG CreateOptions, _In_reads_bytes_opt_(EaLength) PVOID EaBuffer, _In_ ULONG EaLength, _In_ ULONG Flags);
_Must_inspect_result__IRQL_requires_max_(PASSIVE_LEVEL)NTSTATUSFLTAPIFltOpenVolume( _In_ PFLT_INSTANCE Instance, _Out_ PHANDLE VolumeHandle, _Outptr_opt_ PFILE_OBJECT *VolumeFileObject);
_Must_inspect_result__IRQL_requires_max_(PASSIVE_LEVEL)NTSTATUSFLTAPIFltQueryEaFile( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _Out_writes_bytes_to_(Length,*LengthReturned) PVOID ReturnedEaData, _In_ ULONG Length, _In_ BOOLEAN ReturnSingleEntry, _In_reads_bytes_opt_(EaListLength) PVOID EaList, _In_ ULONG EaListLength, _In_opt_ PULONG EaIndex, _In_ BOOLEAN RestartScan, _Out_opt_ PULONG LengthReturned);
_Must_inspect_result__IRQL_requires_max_(PASSIVE_LEVEL)NTSTATUSFLTAPIFltSetEaFile( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _In_reads_bytes_(Length) PVOID EaBuffer, _In_ ULONG Length);
#endif /* FLT_MGR_AFTER_XPSP2 */
#if FLT_MGR_LONGHORN
_Must_inspect_result__IRQL_requires_max_(PASSIVE_LEVEL)NTSTATUSFLTAPIFltCreateFileEx2( _In_ PFLT_FILTER Filter, _In_opt_ PFLT_INSTANCE Instance, _Out_ PHANDLE FileHandle, _Outptr_opt_ PFILE_OBJECT *FileObject, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _Out_ PIO_STATUS_BLOCK IoStatusBlock, _In_opt_ PLARGE_INTEGER AllocationSize, _In_ ULONG FileAttributes, _In_ ULONG ShareAccess, _In_ ULONG CreateDisposition, _In_ ULONG CreateOptions, _In_reads_bytes_opt_(EaLength) PVOID EaBuffer, _In_ ULONG EaLength, _In_ ULONG Flags, _In_opt_ PIO_DRIVER_CREATE_CONTEXT DriverContext);
_Must_inspect_result__IRQL_requires_max_(PASSIVE_LEVEL)NTSTATUSFLTAPIFltQueryDirectoryFile( _In_ PFLT_INSTANCE Instance, _In_ PFILE_OBJECT FileObject, _Out_writes_bytes_(Length) PVOID FileInformation, _In_ ULONG Length, _In_ FILE_INFORMATION_CLASS FileInformationClass, _In_ BOOLEAN ReturnSingleEntry, _In_opt_ PUNICODE_STRING FileName, _In_ BOOLEAN RestartScan, _Out_opt_ PULONG LengthReturned);
_IRQL_requires_max_(APC_LEVEL)BOOLEANFLTAPIFltSupportsFileContextsEx( _In_ PFILE_OBJECT FileObject, _In_opt_ PFLT_INSTANCE Instance);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltSetTransactionContext( _In_ PFLT_INSTANCE Instance, _In_ PKTRANSACTION Transaction, _In_ FLT_SET_CONTEXT_OPERATION Operation, _In_ PFLT_CONTEXT NewContext, _Outptr_opt_ PFLT_CONTEXT *OldContext);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltDeleteTransactionContext( _In_ PFLT_INSTANCE Instance, _In_ PKTRANSACTION Transaction, _Outptr_opt_ PFLT_CONTEXT *OldContext);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltGetTransactionContext( _In_ PFLT_INSTANCE Instance, _In_ PKTRANSACTION Transaction, _Outptr_ PFLT_CONTEXT *Context);
_IRQL_requires_max_(APC_LEVEL)BOOLEANFLTAPIFltIsFltMgrVolumeDeviceObject( _In_ PDEVICE_OBJECT DeviceObject);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltGetVolumeInformation( _In_ PFLT_VOLUME Volume, _In_ FILTER_VOLUME_INFORMATION_CLASS InformationClass, _Out_writes_bytes_to_opt_(BufferSize,*BytesReturned) PVOID Buffer, _In_ ULONG BufferSize, _Out_ PULONG BytesReturned);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltGetFileSystemType( _In_ PVOID FltObject, _Out_ PFLT_FILESYSTEM_TYPE FileSystemType);
_Must_inspect_result__IRQL_requires_max_(PASSIVE_LEVEL)NTSTATUSFLTAPIFltIsVolumeSnapshot( _In_ PVOID FltObject, _Out_ PBOOLEAN IsSnapshotVolume);
_Must_inspect_result__When_(((CallbackData!=NULL) && FLT_IS_IRP_OPERATION(CallbackData)), _IRQL_requires_max_(PASSIVE_LEVEL))_When_((!((CallbackData!=NULL) && FLT_IS_IRP_OPERATION(CallbackData))), _IRQL_requires_max_(APC_LEVEL))NTSTATUSFLTAPIFltCancellableWaitForSingleObject( _In_ PVOID Object, _In_opt_ PLARGE_INTEGER Timeout, _In_opt_ PFLT_CALLBACK_DATA CallbackData);
_Must_inspect_result__When_(((CallbackData!=NULL) && FLT_IS_IRP_OPERATION(CallbackData)), _IRQL_requires_max_(PASSIVE_LEVEL))_When_((!((CallbackData!=NULL) && FLT_IS_IRP_OPERATION(CallbackData))), _IRQL_requires_max_(APC_LEVEL))NTSTATUSFLTAPIFltCancellableWaitForMultipleObjects( _In_ ULONG Count, _In_reads_(Count) PVOID ObjectArray[], _In_ WAIT_TYPE WaitType, _In_opt_ PLARGE_INTEGER Timeout, _In_opt_ PKWAIT_BLOCK WaitBlockArray, _In_ PFLT_CALLBACK_DATA CallbackData);
_IRQL_requires_max_(DISPATCH_LEVEL)HANDLEFLTAPIFltGetRequestorProcessIdEx( _In_ PFLT_CALLBACK_DATA CallbackData);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltEnlistInTransaction( _In_ PFLT_INSTANCE Instance, _In_ PKTRANSACTION Transaction, _In_ PFLT_CONTEXT TransactionContext, _In_ NOTIFICATION_MASK NotificationMask);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltRollbackEnlistment( _In_ PFLT_INSTANCE Instance, _In_ PKTRANSACTION Transaction, _In_opt_ PFLT_CONTEXT TransactionContext);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltPrePrepareComplete( _In_ PFLT_INSTANCE Instance, _In_ PKTRANSACTION Transaction, _In_opt_ PFLT_CONTEXT TransactionContext);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltPrepareComplete( _In_ PFLT_INSTANCE Instance, _In_ PKTRANSACTION Transaction, _In_opt_ PFLT_CONTEXT TransactionContext);
_IRQL_requires_max_(PASSIVE_LEVEL)NTSTATUSFLTAPIFltCommitComplete( _In_ PFLT_INSTANCE Instance, _In_ PKTRANSACTION Transaction, _In_opt_ PFLT_CONTEXT TransactionContext);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltCommitFinalizeComplete( _In_ PFLT_INSTANCE Instance, _In_ PKTRANSACTION Transaction, _In_opt_ PFLT_CONTEXT TransactionContext);
_IRQL_requires_max_(PASSIVE_LEVEL)NTSTATUSFLTAPIFltRollbackComplete( _In_ PFLT_INSTANCE Instance, _In_ PKTRANSACTION Transaction, _In_opt_ PFLT_CONTEXT TransactionContext);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltAllocateExtraCreateParameterList( _In_ PFLT_FILTER Filter, _In_ FSRTL_ALLOCATE_ECPLIST_FLAGS Flags, _Outptr_ PECP_LIST *EcpList);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltAllocateExtraCreateParameter( _In_ PFLT_FILTER Filter, _In_ LPCGUID EcpType, ULONG SizeOfContext, _In_ FSRTL_ALLOCATE_ECP_FLAGS Flags, _In_opt_ PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK CleanupCallback, _In_ ULONG PoolTag, _Outptr_ PVOID *EcpContext);
_IRQL_requires_max_(APC_LEVEL)VOIDFLTAPIFltInitExtraCreateParameterLookasideList( _In_ PFLT_FILTER Filter, _Inout_ PVOID Lookaside, _In_ FSRTL_ECP_LOOKASIDE_FLAGS Flags, _In_ SIZE_T Size, _In_ ULONG Tag);
_IRQL_requires_max_(APC_LEVEL)VOIDFLTAPIFltDeleteExtraCreateParameterLookasideList( _In_ PFLT_FILTER Filter, _Inout_ PVOID Lookaside, _In_ FSRTL_ECP_LOOKASIDE_FLAGS Flags);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltAllocateExtraCreateParameterFromLookasideList( _In_ PFLT_FILTER Filter, _In_ LPCGUID EcpType, _In_ ULONG SizeOfContext, _In_ FSRTL_ALLOCATE_ECP_FLAGS Flags, _In_opt_ PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK CleanupCallback, _Inout_ PVOID LookasideList, _Outptr_ PVOID *EcpContext);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltInsertExtraCreateParameter( _In_ PFLT_FILTER Filter, _Inout_ PECP_LIST EcpList, _Inout_ PVOID EcpContext);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltFindExtraCreateParameter( _In_ PFLT_FILTER Filter, _In_ PECP_LIST EcpList, _In_ LPCGUID EcpType, _Outptr_opt_ PVOID *EcpContext, _Out_opt_ ULONG *EcpContextSize);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltRemoveExtraCreateParameter( _In_ PFLT_FILTER Filter, _Inout_ PECP_LIST EcpList, _In_ LPCGUID EcpType, _Outptr_ PVOID *EcpContext, _Out_opt_ ULONG *EcpContextSize);
_IRQL_requires_max_(APC_LEVEL)VOIDFLTAPIFltFreeExtraCreateParameterList( _In_ PFLT_FILTER Filter, _In_ PECP_LIST EcpList);
_IRQL_requires_max_(APC_LEVEL)VOIDFLTAPIFltFreeExtraCreateParameter( _In_ PFLT_FILTER Filter, _In_ PVOID EcpContext);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltGetEcpListFromCallbackData( _In_ PFLT_FILTER Filter, _In_ PFLT_CALLBACK_DATA CallbackData, _Outptr_result_maybenull_ PECP_LIST *EcpList);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltSetEcpListIntoCallbackData( _In_ PFLT_FILTER Filter, _In_ PFLT_CALLBACK_DATA CallbackData, _In_ PECP_LIST EcpList);
_IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltGetNextExtraCreateParameter( _In_ PFLT_FILTER Filter, _In_ PECP_LIST EcpList, _In_opt_ PVOID CurrentEcpContext, _Out_opt_ LPGUID NextEcpType, _Outptr_opt_ PVOID *NextEcpContext, _Out_opt_ ULONG *NextEcpContextSize);
_IRQL_requires_max_(APC_LEVEL)VOIDFLTAPIFltAcknowledgeEcp( _In_ PFLT_FILTER Filter, _In_ PVOID EcpContext);
_IRQL_requires_max_(APC_LEVEL)BOOLEANFLTAPIFltIsEcpAcknowledged( _In_ PFLT_FILTER Filter, _In_ PVOID EcpContext);
_IRQL_requires_max_(APC_LEVEL)BOOLEANFLTAPIFltIsEcpFromUserMode( _In_ PFLT_FILTER Filter, _In_ PVOID EcpContext);
_IRQL_requires_max_(DISPATCH_LEVEL)NTSTATUSFLTAPIFltRetrieveIoPriorityInfo( _In_opt_ PFLT_CALLBACK_DATA Data, _In_opt_ PFILE_OBJECT FileObject, _In_opt_ PETHREAD Thread, _Inout_ PIO_PRIORITY_INFO PriorityInfo);
_IRQL_requires_max_(DISPATCH_LEVEL)NTSTATUSFLTAPIFltApplyPriorityInfoThread( _In_ PIO_PRIORITY_INFO InputPriorityInfo, _Out_opt_ PIO_PRIORITY_INFO OutputPriorityInfo, _In_ PETHREAD Thread);
_IRQL_requires_max_(DISPATCH_LEVEL)IO_PRIORITY_HINTFLTAPIFltGetIoPriorityHint( _In_ PFLT_CALLBACK_DATA Data);
_IRQL_requires_max_(DISPATCH_LEVEL)IO_PRIORITY_HINTFLTAPIFltGetIoPriorityHintFromCallbackData( _In_ PFLT_CALLBACK_DATA Data);
_IRQL_requires_max_(DISPATCH_LEVEL)NTSTATUSFLTAPIFltSetIoPriorityHintIntoCallbackData( _In_ PFLT_CALLBACK_DATA Data, _In_ IO_PRIORITY_HINT PriorityHint);
_IRQL_requires_max_(DISPATCH_LEVEL)IO_PRIORITY_HINTFLTAPIFltGetIoPriorityHintFromFileObject( _In_ PFILE_OBJECT FileObject);
_Must_inspect_result__IRQL_requires_max_(DISPATCH_LEVEL)NTSTATUSFLTAPIFltSetIoPriorityHintIntoFileObject( _In_ PFILE_OBJECT FileObject, _In_ IO_PRIORITY_HINT PriorityHint);
_IRQL_requires_max_(DISPATCH_LEVEL)IO_PRIORITY_HINTFLTAPIFltGetIoPriorityHintFromThread( _In_ PETHREAD Thread);
_IRQL_requires_max_(DISPATCH_LEVEL)NTSTATUSFLTAPIFltSetIoPriorityHintIntoThread( _In_ PETHREAD Thread, _In_ IO_PRIORITY_HINT PriorityHint);
#endif /* FLT_MGR_LONGHORN */
#if FLT_MGR_WIN7
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltAllocateCallbackDataEx( _In_ PFLT_INSTANCE Instance, _In_opt_ PFILE_OBJECT FileObject, _In_ FLT_ALLOCATE_CALLBACK_DATA_FLAGS Flags, _Outptr_ PFLT_CALLBACK_DATA *RetNewCallbackData);
_Must_inspect_result__IRQL_requires_max_(DPC_LEVEL)PVOIDFLTAPIFltGetNewSystemBufferAddress( _In_ PFLT_CALLBACK_DATA CallbackData);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)FLT_PREOP_CALLBACK_STATUSFLTAPIFltCheckOplockEx( _In_ POPLOCK Oplock, _In_ PFLT_CALLBACK_DATA CallbackData, _In_ ULONG Flags, _In_opt_ PVOID Context, _In_opt_ PFLTOPLOCK_WAIT_COMPLETE_ROUTINE WaitCompletionRoutine, _In_opt_ PFLTOPLOCK_PREPOST_CALLBACKDATA_ROUTINE PrePostCallbackDataRoutine);
_IRQL_requires_max_(APC_LEVEL)BOOLEANFLTAPIFltCurrentOplock( _In_ POPLOCK Oplock);
_IRQL_requires_max_(APC_LEVEL)BOOLEANFLTAPIFltCurrentOplockH( _In_ POPLOCK Oplock);
_IRQL_requires_max_(APC_LEVEL)FLT_PREOP_CALLBACK_STATUSFLTAPIFltOplockBreakH( _In_ POPLOCK Oplock, _In_ PFLT_CALLBACK_DATA CallbackData, _In_ ULONG Flags, _In_opt_ PVOID Context, _In_opt_ PFLTOPLOCK_WAIT_COMPLETE_ROUTINE WaitCompletionRoutine, _In_opt_ PFLTOPLOCK_PREPOST_CALLBACKDATA_ROUTINE PrePostCallbackDataRoutine);
_IRQL_requires_max_(APC_LEVEL)FLT_PREOP_CALLBACK_STATUSFLTAPIFltOplockBreakToNone( _In_ POPLOCK Oplock, _In_ PFLT_CALLBACK_DATA CallbackData, _In_opt_ PVOID Context, _In_opt_ PFLTOPLOCK_WAIT_COMPLETE_ROUTINE WaitCompletionRoutine, _In_opt_ PFLTOPLOCK_PREPOST_CALLBACKDATA_ROUTINE PrePostCallbackDataRoutine);
_IRQL_requires_max_(APC_LEVEL)FLT_PREOP_CALLBACK_STATUSFLTAPIFltOplockBreakToNoneEx( _In_ POPLOCK Oplock, _In_ PFLT_CALLBACK_DATA CallbackData, _In_ ULONG Flags, _In_opt_ PVOID Context, _In_opt_ PFLTOPLOCK_WAIT_COMPLETE_ROUTINE WaitCompletionRoutine, _In_opt_ PFLTOPLOCK_PREPOST_CALLBACKDATA_ROUTINE PrePostCallbackDataRoutine);
_IRQL_requires_max_(APC_LEVEL)BOOLEANFLTAPIFltOplockIsSharedRequest( _In_ PFLT_CALLBACK_DATA CallbackData);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)FLT_PREOP_CALLBACK_STATUSFLTAPIFltOplockFsctrlEx( _In_ POPLOCK Oplock, _In_ PFLT_CALLBACK_DATA CallbackData, _In_ ULONG OpenCount, _In_ ULONG Flags);
BOOLEANFLTAPIFltOplockKeysEqual( _In_opt_ PFILE_OBJECT Fo1, _In_opt_ PFILE_OBJECT Fo2);
_Must_inspect_result__IRQL_requires_max_(APC_LEVEL)NTSTATUSFLTAPIFltGetRequestorSessionId( _In_ PFLT_CALLBACK_DATA CallbackData, _Out_ PULONG SessionId);
_IRQL_requires_max_(DISPATCH_LEVEL)NTSTATUSFLTAPIFltAdjustDeviceStackSizeForIoRedirection( _In_ PFLT_INSTANCE SourceInstance, _In_ PFLT_INSTANCE TargetInstance, _Out_opt_ PBOOLEAN SourceDeviceStackSizeModified);
_IRQL_requires_max_(DISPATCH_LEVEL)NTSTATUSFLTAPIFltIsIoRedirectionAllowed( _In_ PFLT_INSTANCE SourceInstance, _In_ PFLT_INSTANCE TargetInstance, _Out_ PBOOLEAN RedirectionAllowed);
_IRQL_requires_max_(DISPATCH_LEVEL)NTSTATUSFLTAPIFltIsIoRedirectionAllowedForOperation( _In_ PFLT_CALLBACK_DATA Data, _In_ PFLT_INSTANCE TargetInstance, _Out_ PBOOLEAN RedirectionAllowedThisIo, _Out_opt_ PBOOLEAN RedirectionAllowedAllIo);
#endif /* FLT_MGR_WIN7 */
#endif /* FLT_MGR_BASELINE */
#ifdef __cplusplus} /* extern "C" */#endif
#endif /* __FLTKERNEL__ */