include/ddk/ntifs.h

   1 /*
   2  * Copyright (C) 2014 Alistair Leslie-Hughes
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  17  */
  18
  19 #ifndef __NTIFS_H__
  20 #define __NTIFS_H__
  21
  22 #include "ntddk.h"
  23
  24 #define PHCM_ERROR_INVALID_PARAMETER    ((char)-1)
  25 #define PHCM_ERROR_NO_TEB               ((char)-2)
  26 #define PHCM_ERROR_NO_PEB               ((char)-3)
  27 #define PHCM_APPLICATION_DEFAULT        ((char)0)
  28 #define PHCM_DISGUISE_PLACEHOLDERS      ((char)1)
  29 #define PHCM_EXPOSE_PLACEHOLDERS        ((char)2)
  30 #define PHCM_DISGUISE_FULL_PLACEHOLDERS ((char)3)
  31 #define PHCM_MAX                        ((char)3)
  32
  33 typedef struct _EX_PUSH_LOCK EX_PUSH_LOCK, *PEX_PUSH_LOCK;
  34
  35 typedef enum _FS_FILTER_SECTION_SYNC_TYPE
  36 {
  37     SyncTypeOther = 0,
  38     SyncTypeCreateSection
  39 } FS_FILTER_SECTION_SYNC_TYPE, *PFS_FILTER_SECTION_SYNC_TYPE;
  40
  41 typedef struct _FS_FILTER_SECTION_SYNC_OUTPUT
  42 {
  43     ULONG StructureSize;
  44     ULONG SizeReturned;
  45     ULONG Flags;
  46     ULONG DesiredReadAlignment;
  47 } FS_FILTER_SECTION_SYNC_OUTPUT, *PFS_FILTER_SECTION_SYNC_OUTPUT;
  48
  49 typedef struct _KQUEUE
  50 {
  51   DISPATCHER_HEADER Header;
  52   LIST_ENTRY EntryListHead;
  53   volatile ULONG CurrentCount;
  54   ULONG MaximumCount;
  55   LIST_ENTRY ThreadListHead;
  56 } KQUEUE, *PKQUEUE, *RESTRICTED_POINTER PRKQUEUE;
  57
  58 typedef enum _FS_FILTER_STREAM_FO_NOTIFICATION_TYPE
  59 {
  60     NotifyTypeCreate  = 0,
  61     NotifyTypeRetired
  62 } FS_FILTER_STREAM_FO_NOTIFICATION_TYPE, *PFS_FILTER_STREAM_FO_NOTIFICATION_TYPE;
  63
  64 typedef union _FS_FILTER_PARAMETERS
  65 {
  66     struct
  67     {
  68         PLARGE_INTEGER EndingOffset;
  69         PERESOURCE    *ResourceToRelease;
  70     } AcquireForModifiedPageWriter;
  71
  72     struct
  73     {
  74         PERESOURCE ResourceToRelease;
  75     } ReleaseForModifiedPageWriter;
  76
  77     struct
  78     {
  79         FS_FILTER_SECTION_SYNC_TYPE    SyncType;
  80         ULONG                          PageProtection;
  81         PFS_FILTER_SECTION_SYNC_OUTPUT OutputInformation;
  82     } AcquireForSectionSynchronization;
  83
  84     struct
  85     {
  86         FS_FILTER_STREAM_FO_NOTIFICATION_TYPE NotificationType;
  87         BOOLEAN POINTER_ALIGNMENT             SafeToRecurse;
  88     } NotifyStreamFileObject;
  89
  90     struct
  91     {
  92         PIRP                   Irp;
  93         void                  *FileInformation;
  94         PULONG                 Length;
  95         FILE_INFORMATION_CLASS FileInformationClass;
  96         NTSTATUS               CompletionStatus;
  97     } QueryOpen;
  98
  99     struct
 100     {
 101         void *Argument1;
 102         void *Argument2;
 103         void *Argument3;
 104         void *Argument4;
 105         void *Argument5;
 106     } Others;
 107
 108 } FS_FILTER_PARAMETERS, *PFS_FILTER_PARAMETERS;
 109
 110 typedef struct _FS_FILTER_CALLBACK_DATA
 111 {
 112     ULONG                  SizeOfFsFilterCallbackData;
 113     UCHAR                  Operation;
 114     UCHAR                  Reserved;
 115     struct _DEVICE_OBJECT *DeviceObject;
 116     struct _FILE_OBJECT   *FileObject;
 117     FS_FILTER_PARAMETERS   Parameters;
 118 } FS_FILTER_CALLBACK_DATA, *PFS_FILTER_CALLBACK_DATA;
 119
 120 typedef NTSTATUS (WINAPI *PFS_FILTER_CALLBACK)(PFS_FILTER_CALLBACK_DATA, void **);
 121 typedef void     (WINAPI *PFS_FILTER_COMPLETION_CALLBACK)(PFS_FILTER_CALLBACK_DATA, NTSTATUS, void *context);
 122
 123 typedef struct _FS_FILTER_CALLBACKS
 124 {
 125     ULONG SizeOfFsFilterCallbacks;
 126     ULONG Reserved;
 127     PFS_FILTER_CALLBACK            PreAcquireForSectionSynchronization;
 128     PFS_FILTER_COMPLETION_CALLBACK PostAcquireForSectionSynchronization;
 129     PFS_FILTER_CALLBACK            PreReleaseForSectionSynchronization;
 130     PFS_FILTER_COMPLETION_CALLBACK PostReleaseForSectionSynchronization;
 131     PFS_FILTER_CALLBACK            PreAcquireForCcFlush;
 132     PFS_FILTER_COMPLETION_CALLBACK PostAcquireForCcFlush;
 133     PFS_FILTER_CALLBACK            PreReleaseForCcFlush;
 134     PFS_FILTER_COMPLETION_CALLBACK PostReleaseForCcFlush;
 135     PFS_FILTER_CALLBACK            PreAcquireForModifiedPageWriter;
 136     PFS_FILTER_COMPLETION_CALLBACK PostAcquireForModifiedPageWriter;
 137     PFS_FILTER_CALLBACK            PreReleaseForModifiedPageWriter;
 138     PFS_FILTER_COMPLETION_CALLBACK PostReleaseForModifiedPageWriter;
 139 } FS_FILTER_CALLBACKS, *PFS_FILTER_CALLBACKS;
 140
 141 BOOLEAN WINAPI FsRtlIsNameInExpression(PUNICODE_STRING, PUNICODE_STRING, BOOLEAN, PWCH);
 142 DEVICE_OBJECT * WINAPI IoGetAttachedDevice(DEVICE_OBJECT*);
 143 PEPROCESS WINAPI IoGetRequestorProcess(IRP*);
 144 void WINAPI KeStackAttachProcess(KPROCESS*,KAPC_STATE*);
 145 void WINAPI KeUnstackDetachProcess(KAPC_STATE*);
 146 NTSTATUS WINAPI ObOpenObjectByPointer(void*,ULONG,PACCESS_STATE,ACCESS_MASK,POBJECT_TYPE,KPROCESSOR_MODE,HANDLE*);
 147 NTSTATUS WINAPI ObQueryNameString(PVOID,POBJECT_NAME_INFORMATION,ULONG,PULONG);
 148 BOOLEAN WINAPI PsIsSystemThread(PETHREAD);
 149 NTSTATUS WINAPI PsLookupProcessByProcessId(HANDLE,PEPROCESS*);
 150 NTSTATUS WINAPI PsLookupThreadByThreadId(HANDLE,PETHREAD*);
 151 void WINAPI PsRevertToSelf(void);
 152 char WINAPI RtlQueryProcessPlaceholderCompatibilityMode(void);
 153
 154 #endif