include/ddk/fltkernel.h

   1 /*
   2  * Copyright (C) 2018 Alistair Leslie-Hughes
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  17  */
  18 #ifndef __FLTKERNEL__
  19 #define __FLTKERNEL__
  20
  21 #ifdef __cplusplus
  22 extern "C" {
  23 #endif
  24
  25 #include <ddk/ntifs.h>
  26
  27 typedef struct _FLT_FILTER   *PFLT_FILTER;
  28 typedef struct _FLT_INSTANCE *PFLT_INSTANCE;
  29 typedef ULONG  FLT_CALLBACK_DATA_FLAGS;
  30 typedef USHORT FLT_CONTEXT_REGISTRATION_FLAGS;
  31 typedef USHORT FLT_CONTEXT_TYPE;
  32 typedef ULONG  FLT_FILE_NAME_OPTIONS;
  33 typedef ULONG  FLT_FILTER_UNLOAD_FLAGS;
  34 typedef ULONG  FLT_INSTANCE_QUERY_TEARDOWN_FLAGS;
  35 typedef ULONG  FLT_INSTANCE_SETUP_FLAGS;
  36 typedef ULONG  FLT_INSTANCE_TEARDOWN_FLAGS;
  37 typedef ULONG  FLT_NORMALIZE_NAME_FLAGS;
  38 typedef ULONG  FLT_OPERATION_REGISTRATION_FLAGS;
  39 typedef ULONG  FLT_POST_OPERATION_FLAGS;
  40 typedef ULONG  FLT_REGISTRATION_FLAGS;
  41 typedef void*  PFLT_CONTEXT;
  42
  43
  44 #define FLT_VOLUME_CONTEXT       0x0001
  45 #define FLT_INSTANCE_CONTEXT     0x0002
  46 #define FLT_FILE_CONTEXT         0x0004
  47 #define FLT_STREAM_CONTEXT       0x0008
  48 #define FLT_STREAMHANDLE_CONTEXT 0x0010
  49 #define FLT_TRANSACTION_CONTEXT  0x0020
  50
  51 #define FLTFL_OPERATION_REGISTRATION_SKIP_PAGING_IO     0x00000001
  52 #define FLTFL_OPERATION_REGISTRATION_SKIP_CACHED_IO     0x00000002
  53 #define FLTFL_OPERATION_REGISTRATION_SKIP_NON_DASD_IO   0x00000004
  54
  55 #define FLTFL_INSTANCE_TEARDOWN_MANUAL                  0x00000001
  56 #define FLTFL_INSTANCE_TEARDOWN_FILTER_UNLOAD           0x00000002
  57 #define FLTFL_INSTANCE_TEARDOWN_MANDATORY_FILTER_UNLOAD 0x00000004
  58 #define FLTFL_INSTANCE_TEARDOWN_VOLUME_DISMOUNT         0x00000008
  59 #define FLTFL_INSTANCE_TEARDOWN_INTERNAL_ERROR          0x00000010
  60
  61 /* Belongs in fltuserstructures.h */
  62 typedef enum _FLT_FILESYSTEM_TYPE
  63 {
  64     FLT_FSTYPE_UNKNOWN,
  65     FLT_FSTYPE_RAW,
  66     FLT_FSTYPE_NTFS,
  67     FLT_FSTYPE_FAT,
  68     FLT_FSTYPE_CDFS,
  69     FLT_FSTYPE_UDFS,
  70     FLT_FSTYPE_LANMAN,
  71     FLT_FSTYPE_WEBDAV,
  72     FLT_FSTYPE_RDPDR,
  73     FLT_FSTYPE_NFS,
  74     FLT_FSTYPE_MS_NETWARE,
  75     FLT_FSTYPE_NETWARE,
  76     FLT_FSTYPE_BSUDF,
  77     FLT_FSTYPE_MUP,
  78     FLT_FSTYPE_RSFX,
  79     FLT_FSTYPE_ROXIO_UDF1,
  80     FLT_FSTYPE_ROXIO_UDF2,
  81     FLT_FSTYPE_ROXIO_UDF3,
  82     FLT_FSTYPE_TACIT,
  83     FLT_FSTYPE_FS_REC,
  84     FLT_FSTYPE_INCD,
  85     FLT_FSTYPE_INCD_FAT,
  86     FLT_FSTYPE_EXFAT,
  87     FLT_FSTYPE_PSFS,
  88     FLT_FSTYPE_GPFS,
  89     FLT_FSTYPE_NPFS,
  90     FLT_FSTYPE_MSFS,
  91     FLT_FSTYPE_CSVFS,
  92     FLT_FSTYPE_REFS,
  93     FLT_FSTYPE_OPENAFS
  94 } FLT_FILESYSTEM_TYPE, *PFLT_FILESYSTEM_TYPE;
  95
  96 typedef struct _FLT_NAME_CONTROL
  97 {
  98     UNICODE_STRING Name;
  99 } FLT_NAME_CONTROL, *PFLT_NAME_CONTROL;
 100
 101 typedef enum _FLT_PREOP_CALLBACK_STATUS
 102 {
 103     FLT_PREOP_SUCCESS_WITH_CALLBACK,
 104     FLT_PREOP_SUCCESS_NO_CALLBACK,
 105     FLT_PREOP_PENDING,
 106     FLT_PREOP_DISALLOW_FASTIO,
 107     FLT_PREOP_COMPLETE,
 108     FLT_PREOP_SYNCHRONIZE,
 109     FLT_PREOP_DISALLOW_FSFILTER_IO
 110 } FLT_PREOP_CALLBACK_STATUS, *PFLT_PREOP_CALLBACK_STATUS;
 111
 112 typedef enum _FLT_POSTOP_CALLBACK_STATUS
 113 {
 114     FLT_POSTOP_FINISHED_PROCESSING,
 115     FLT_POSTOP_MORE_PROCESSING_REQUIRED,
 116     FLT_POSTOP_DISALLOW_FSFILTER_IO
 117 } FLT_POSTOP_CALLBACK_STATUS, *PFLT_POSTOP_CALLBACK_STATUS;
 118
 119 typedef struct _FLT_RELATED_CONTEXTS
 120 {
 121     PFLT_CONTEXT VolumeContext;
 122     PFLT_CONTEXT InstanceContext;
 123     PFLT_CONTEXT FileContext;
 124     PFLT_CONTEXT StreamContext;
 125     PFLT_CONTEXT StreamHandleContext;
 126     PFLT_CONTEXT TransactionContext;
 127 } FLT_RELATED_CONTEXTS, *PFLT_RELATED_CONTEXTS;
 128
 129 typedef const struct _FLT_RELATED_OBJECTS *PCFLT_RELATED_OBJECTS;
 130
 131 typedef union _FLT_PARAMETERS
 132 {
 133     struct
 134     {
 135         PIO_SECURITY_CONTEXT     SecurityContext;
 136         ULONG                    Options;
 137         USHORT POINTER_ALIGNMENT FileAttributes;
 138         USHORT                   ShareAccess;
 139         ULONG POINTER_ALIGNMENT  EaLength;
 140         void                    *EaBuffer;
 141         LARGE_INTEGER            AllocationSize;
 142     } Create;
 143
 144     struct
 145     {
 146         PIO_SECURITY_CONTEXT     SecurityContext;
 147         ULONG                    Options;
 148         USHORT POINTER_ALIGNMENT Reserved;
 149         USHORT                   ShareAccess;
 150         void                    *Parameters;
 151     } CreatePipe;
 152
 153 #undef CreateMailslot
 154     struct
 155     {
 156         PIO_SECURITY_CONTEXT     SecurityContext;
 157         ULONG                    Options;
 158         USHORT POINTER_ALIGNMENT Reserved;
 159         USHORT                   ShareAccess;
 160         void                    *Parameters;
 161     } CreateMailslot;
 162
 163     struct
 164     {
 165         ULONG                   Length;
 166         ULONG POINTER_ALIGNMENT Key;
 167         LARGE_INTEGER           ByteOffset;
 168         void                   *ReadBuffer;
 169         PMDL                    MdlAddress;
 170     } Read;
 171
 172     struct
 173     {
 174         ULONG                   Length;
 175         ULONG POINTER_ALIGNMENT Key;
 176         LARGE_INTEGER           ByteOffset;
 177         void                   *WriteBuffer;
 178         PMDL                    MdlAddress;
 179     } Write;
 180
 181     struct
 182     {
 183         ULONG                   Length;
 184         FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass;
 185         void                   *InfoBuffer;
 186     } QueryFileInformation;
 187
 188     struct
 189     {
 190         ULONG                   Length;
 191         FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass;
 192         PFILE_OBJECT            ParentOfTarget;
 193         union
 194         {
 195             struct
 196             {
 197                 BOOLEAN ReplaceIfExists;
 198                 BOOLEAN AdvanceOnly;
 199             } DUMMYSTRUCTNAME;
 200             ULONG ClusterCount;
 201             HANDLE DeleteHandle;
 202         } DUMMYUNIONNAME;
 203         void                    *InfoBuffer;
 204     } SetFileInformation;
 205
 206     struct
 207     {
 208         ULONG                   Length;
 209         void                   *EaList;
 210         ULONG                   EaListLength;
 211         ULONG                   POINTER_ALIGNMENT EaIndex;
 212         void                   *EaBuffer;
 213         PMDL                    MdlAddress;
 214     } QueryEa;
 215
 216     struct
 217     {
 218         ULONG                   Length;
 219         void                   *EaBuffer;
 220         PMDL                    MdlAddress;
 221     } SetEa;
 222
 223     struct
 224     {
 225         ULONG                   Length;
 226         FS_INFORMATION_CLASS POINTER_ALIGNMENT FsInformationClass;
 227         void                   *VolumeBuffer;
 228     } QueryVolumeInformation;
 229
 230     struct
 231     {
 232         ULONG                  Length;
 233         FS_INFORMATION_CLASS POINTER_ALIGNMENT FsInformationClass;
 234         void                  *VolumeBuffer;
 235     } SetVolumeInformation;
 236
 237     union
 238     {
 239         struct
 240         {
 241             ULONG                   Length;
 242             PUNICODE_STRING         FileName;
 243             FILE_INFORMATION_CLASS  FileInformationClass;
 244             ULONG POINTER_ALIGNMENT FileIndex;
 245             void                   *DirectoryBuffer;
 246             PMDL                    MdlAddress;
 247         } QueryDirectory;
 248
 249         struct
 250         {
 251             ULONG                   Length;
 252             ULONG POINTER_ALIGNMENT CompletionFilter;
 253             ULONG POINTER_ALIGNMENT Spare1;
 254             ULONG POINTER_ALIGNMENT Spare2;
 255             void                   *DirectoryBuffer;
 256             PMDL                    MdlAddress;
 257         } NotifyDirectory;
 258
 259         struct
 260         {
 261             ULONG                    Length;
 262             ULONG POINTER_ALIGNMENT  CompletionFilter;
 263             DIRECTORY_NOTIFY_INFORMATION_CLASS POINTER_ALIGNMENT DirectoryNotifyInformationClass;
 264             ULONG POINTER_ALIGNMENT  Spare2;
 265             void                    *DirectoryBuffer;
 266             PMDL                     MdlAddress;
 267         } NotifyDirectoryEx;
 268     } DirectoryControl;
 269
 270     union
 271     {
 272         struct
 273         {
 274             PVPB           Vpb;
 275             PDEVICE_OBJECT DeviceObject;
 276         } VerifyVolume;
 277
 278         struct
 279         {
 280             ULONG                   OutputBufferLength;
 281             ULONG POINTER_ALIGNMENT InputBufferLength;
 282             ULONG POINTER_ALIGNMENT FsControlCode;
 283         } Common;
 284
 285         struct
 286         {
 287             ULONG                   OutputBufferLength;
 288             ULONG POINTER_ALIGNMENT InputBufferLength;
 289             ULONG POINTER_ALIGNMENT FsControlCode;
 290             void                   *InputBuffer;
 291             void                   *OutputBuffer;
 292             PMDL                    OutputMdlAddress;
 293         } Neither;
 294
 295         struct
 296         {
 297             ULONG                   OutputBufferLength;
 298             ULONG POINTER_ALIGNMENT InputBufferLength;
 299             ULONG POINTER_ALIGNMENT FsControlCode;
 300             void                   *SystemBuffer;
 301         } Buffered;
 302
 303         struct
 304         {
 305             ULONG                   OutputBufferLength;
 306             ULONG POINTER_ALIGNMENT InputBufferLength;
 307             ULONG POINTER_ALIGNMENT FsControlCode;
 308             void                   *InputSystemBuffer;
 309             void                   *OutputBuffer;
 310             PMDL                    OutputMdlAddress;
 311         } Direct;
 312     } FileSystemControl;
 313
 314     union
 315     {
 316         struct
 317         {
 318             ULONG                   OutputBufferLength;
 319             ULONG POINTER_ALIGNMENT InputBufferLength;
 320             ULONG POINTER_ALIGNMENT IoControlCode;
 321         } Common;
 322
 323         struct
 324         {
 325             ULONG                   OutputBufferLength;
 326             ULONG POINTER_ALIGNMENT InputBufferLength;
 327             ULONG POINTER_ALIGNMENT IoControlCode;
 328             void                   *InputBuffer;
 329             void                   *OutputBuffer;
 330             PMDL                    OutputMdlAddress;
 331         } Neither;
 332
 333         struct
 334         {
 335             ULONG                   OutputBufferLength;
 336             ULONG POINTER_ALIGNMENT InputBufferLength;
 337             ULONG POINTER_ALIGNMENT IoControlCode;
 338             void                   *SystemBuffer;
 339         } Buffered;
 340
 341         struct
 342         {
 343             ULONG                   OutputBufferLength;
 344             ULONG POINTER_ALIGNMENT InputBufferLength;
 345             ULONG POINTER_ALIGNMENT IoControlCode;
 346             void                   *InputSystemBuffer;
 347             void                   *OutputBuffer;
 348             PMDL                    OutputMdlAddress;
 349         } Direct;
 350
 351         struct
 352         {
 353             ULONG                   OutputBufferLength;
 354             ULONG POINTER_ALIGNMENT InputBufferLength;
 355             ULONG POINTER_ALIGNMENT IoControlCode;
 356             void                   *InputBuffer;
 357             void                   *OutputBuffer;
 358         } FastIo;
 359     } DeviceIoControl;
 360
 361     struct
 362     {
 363         PLARGE_INTEGER              Length;
 364         ULONG POINTER_ALIGNMENT     Key;
 365         LARGE_INTEGER               ByteOffset;
 366         PEPROCESS                   ProcessId;
 367         BOOLEAN                     FailImmediately;
 368         BOOLEAN                     ExclusiveLock;
 369     } LockControl;
 370
 371     struct
 372     {
 373         SECURITY_INFORMATION        SecurityInformation;
 374         ULONG POINTER_ALIGNMENT     Length;
 375         void                       *SecurityBuffer;
 376         PMDL                        MdlAddress;
 377     } QuerySecurity;
 378
 379     struct
 380     {
 381         SECURITY_INFORMATION        SecurityInformation;
 382         PSECURITY_DESCRIPTOR        SecurityDescriptor;
 383     } SetSecurity;
 384
 385     struct
 386     {
 387         ULONG_PTR                   ProviderId;
 388         void                       *DataPath;
 389         ULONG                       BufferSize;
 390         void                       *Buffer;
 391     } WMI;
 392
 393     struct
 394     {
 395         ULONG                       Length;
 396         PSID                        StartSid;
 397         PFILE_GET_QUOTA_INFORMATION SidList;
 398         ULONG                       SidListLength;
 399         void                       *QuotaBuffer;
 400         PMDL                        MdlAddress;
 401     } QueryQuota;
 402
 403     struct
 404     {
 405         ULONG                       Length;
 406         void                       *QuotaBuffer;
 407         PMDL                        MdlAddress;
 408     } SetQuota;
 409
 410     union
 411     {
 412         struct
 413         {
 414             PCM_RESOURCE_LIST       AllocatedResources;
 415             PCM_RESOURCE_LIST       AllocatedResourcesTranslated;
 416         } StartDevice;
 417
 418         struct
 419         {
 420             DEVICE_RELATION_TYPE    Type;
 421         } QueryDeviceRelations;
 422
 423         struct
 424         {
 425             const GUID             *InterfaceType;
 426             USHORT                  Size;
 427             USHORT                  Version;
 428             PINTERFACE              Interface;
 429             void                   *InterfaceSpecificData;
 430         } QueryInterface;
 431
 432         struct
 433         {
 434             PDEVICE_CAPABILITIES    Capabilities;
 435         } DeviceCapabilities;
 436
 437         struct
 438         {
 439             PIO_RESOURCE_REQUIREMENTS_LIST IoResourceRequirementList;
 440         } FilterResourceRequirements;
 441
 442         struct
 443         {
 444             ULONG                   WhichSpace;
 445             void                   *Buffer;
 446             ULONG                   Offset;
 447             ULONG POINTER_ALIGNMENT Length;
 448         } ReadWriteConfig;
 449
 450         struct
 451         {
 452             BOOLEAN                 Lock;
 453         } SetLock;
 454
 455         struct {
 456             BUS_QUERY_ID_TYPE       IdType;
 457         } QueryId;
 458
 459         struct
 460         {
 461             DEVICE_TEXT_TYPE       DeviceTextType;
 462             LCID POINTER_ALIGNMENT LocaleId;
 463         } QueryDeviceText;
 464
 465         struct
 466         {
 467             BOOLEAN                InPath;
 468             BOOLEAN                Reserved[3];
 469             DEVICE_USAGE_NOTIFICATION_TYPE POINTER_ALIGNMENT Type;
 470         } UsageNotification;
 471     } Pnp;
 472
 473     struct
 474     {
 475         FS_FILTER_SECTION_SYNC_TYPE    SyncType;
 476         ULONG                          PageProtection;
 477         PFS_FILTER_SECTION_SYNC_OUTPUT OutputInformation;
 478     } AcquireForSectionSynchronization;
 479
 480     struct
 481     {
 482         PLARGE_INTEGER                 EndingOffset;
 483         PERESOURCE                    *ResourceToRelease;
 484     } AcquireForModifiedPageWriter;
 485
 486     struct
 487     {
 488         PERESOURCE                     ResourceToRelease;
 489     } ReleaseForModifiedPageWriter;
 490
 491     struct
 492     {
 493         PIRP                           Irp;
 494         void                          *FileInformation;
 495         PULONG                         Length;
 496         FILE_INFORMATION_CLASS         FileInformationClass;
 497     } QueryOpen;
 498
 499     struct
 500     {
 501         LARGE_INTEGER                  FileOffset;
 502         ULONG                          Length;
 503         ULONG POINTER_ALIGNMENT        LockKey;
 504         BOOLEAN POINTER_ALIGNMENT      CheckForReadOperation;
 505     } FastIoCheckIfPossible;
 506
 507     struct
 508     {
 509         PIRP                           Irp;
 510         PFILE_NETWORK_OPEN_INFORMATION NetworkInformation;
 511     } NetworkQueryOpen;
 512
 513     struct
 514     {
 515         LARGE_INTEGER                  FileOffset;
 516         ULONG POINTER_ALIGNMENT        Length;
 517         ULONG POINTER_ALIGNMENT        Key;
 518         PMDL                          *MdlChain;
 519     } MdlRead;
 520
 521     struct
 522     {
 523         PMDL                           MdlChain;
 524     } MdlReadComplete;
 525
 526     struct
 527     {
 528         LARGE_INTEGER                  FileOffset;
 529         ULONG POINTER_ALIGNMENT        Length;
 530         ULONG POINTER_ALIGNMENT        Key;
 531         PMDL                          *MdlChain;
 532     } PrepareMdlWrite;
 533
 534     struct
 535     {
 536         LARGE_INTEGER                  FileOffset;
 537         PMDL                           MdlChain;
 538     } MdlWriteComplete;
 539
 540     struct
 541     {
 542         ULONG                          DeviceType;
 543     } MountVolume;
 544
 545     struct
 546     {
 547         void                          *Argument1;
 548         void                          *Argument2;
 549         void                          *Argument3;
 550         void                          *Argument4;
 551         void                          *Argument5;
 552         LARGE_INTEGER                  Argument6;
 553     } Others;
 554 } FLT_PARAMETERS, *PFLT_PARAMETERS;
 555
 556 typedef struct _FLT_IO_PARAMETER_BLOCK
 557 {
 558     ULONG          IrpFlags;
 559     UCHAR          MajorFunction;
 560     UCHAR          MinorFunction;
 561     UCHAR          OperationFlags;
 562     UCHAR          Reserved;
 563     PFILE_OBJECT   TargetFileObject;
 564     PFLT_INSTANCE  TargetInstance;
 565     FLT_PARAMETERS Parameters;
 566 } FLT_IO_PARAMETER_BLOCK, *PFLT_IO_PARAMETER_BLOCK;
 567
 568 typedef struct _FLT_CALLBACK_DATA
 569 {
 570     FLT_CALLBACK_DATA_FLAGS       Flags;
 571     PETHREAD const                Thread;
 572     PFLT_IO_PARAMETER_BLOCK const Iopb;
 573     IO_STATUS_BLOCK               IoStatus;
 574     struct _FLT_TAG_DATA_BUFFER  *TagData;
 575
 576     union
 577     {
 578         struct
 579         {
 580             LIST_ENTRY QueueLinks;
 581             void      *QueueContext[2];
 582         } DUMMYSTRUCTNAME;
 583         void *FilterContext[4];
 584     } DUMMYUNIONNAME;
 585     KPROCESSOR_MODE RequestorMode;
 586 } FLT_CALLBACK_DATA, *PFLT_CALLBACK_DATA;
 587
 588 typedef void*    (WINAPI *PFLT_CONTEXT_ALLOCATE_CALLBACK)(POOL_TYPE,SIZE_T,FLT_CONTEXT_TYPE);
 589 typedef void     (WINAPI *PFLT_CONTEXT_CLEANUP_CALLBACK)(PFLT_CONTEXT, FLT_CONTEXT_TYPE);
 590 typedef void     (WINAPI *PFLT_CONTEXT_FREE_CALLBACK)(void *, FLT_CONTEXT_TYPE);
 591 typedef NTSTATUS (WINAPI *PFLT_FILTER_UNLOAD_CALLBACK)(FLT_FILTER_UNLOAD_FLAGS);
 592 typedef NTSTATUS (WINAPI *PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK)(PCFLT_RELATED_OBJECTS,
 593                 FLT_INSTANCE_QUERY_TEARDOWN_FLAGS);
 594 typedef NTSTATUS (WINAPI *PFLT_GENERATE_FILE_NAME)(PFLT_INSTANCE, PFILE_OBJECT,PFLT_CALLBACK_DATA,
 595                 FLT_FILE_NAME_OPTIONS,PBOOLEAN, PFLT_NAME_CONTROL);
 596 typedef NTSTATUS (WINAPI *PFLT_INSTANCE_SETUP_CALLBACK)(PCFLT_RELATED_OBJECTS,FLT_INSTANCE_SETUP_FLAGS,
 597                 DEVICE_TYPE,FLT_FILESYSTEM_TYPE);
 598 typedef void     (WINAPI *PFLT_INSTANCE_TEARDOWN_CALLBACK)(PCFLT_RELATED_OBJECTS, FLT_INSTANCE_TEARDOWN_FLAGS);
 599 typedef void     (WINAPI *PFLT_NORMALIZE_CONTEXT_CLEANUP)(void**);
 600 typedef NTSTATUS (WINAPI *PFLT_NORMALIZE_NAME_COMPONENT)(PFLT_INSTANCE, PCUNICODE_STRING, USHORT,
 601                 PCUNICODE_STRING,PFILE_NAMES_INFORMATION,ULONG,FLT_NORMALIZE_NAME_FLAGS, void **);
 602 typedef NTSTATUS (WINAPI *PFLT_NORMALIZE_NAME_COMPONENT_EX)(PFLT_INSTANCE, PFILE_OBJECT, PCUNICODE_STRING,
 603                 USHORT, PCUNICODE_STRING,PFILE_NAMES_INFORMATION, ULONG, FLT_NORMALIZE_NAME_FLAGS Flags,
 604                 void **NormalizationContext);
 605 typedef FLT_PREOP_CALLBACK_STATUS (WINAPI *PFLT_PRE_OPERATION_CALLBACK)(PFLT_CALLBACK_DATA,
 606                 PCFLT_RELATED_OBJECTS, void**);
 607 typedef FLT_POSTOP_CALLBACK_STATUS (WINAPI *PFLT_POST_OPERATION_CALLBACK)(PFLT_CALLBACK_DATA,
 608                 PCFLT_RELATED_OBJECTS, void*, FLT_POST_OPERATION_FLAGS);
 609 typedef NTSTATUS (WINAPI *PFLT_SECTION_CONFLICT_NOTIFICATION_CALLBACK)(PFLT_INSTANCE, PFLT_CONTEXT,
 610                 PFLT_CALLBACK_DATA);
 611 typedef NTSTATUS (WINAPI *PFLT_TRANSACTION_NOTIFICATION_CALLBACK)(PCFLT_RELATED_OBJECTS, PFLT_CONTEXT, ULONG);
 612
 613 typedef struct _FLT_CONTEXT_REGISTRATION
 614 {
 615     FLT_CONTEXT_TYPE               ContextType;
 616     FLT_CONTEXT_REGISTRATION_FLAGS Flags;
 617     PFLT_CONTEXT_CLEANUP_CALLBACK  ContextCleanupCallback;
 618     SIZE_T                         Size;
 619     ULONG                          PoolTag;
 620     PFLT_CONTEXT_ALLOCATE_CALLBACK ContextAllocateCallback;
 621     PFLT_CONTEXT_FREE_CALLBACK     ContextFreeCallback;
 622     void                          *Reserved1;
 623 } FLT_CONTEXT_REGISTRATION, *PFLT_CONTEXT_REGISTRATION;
 624
 625 typedef const FLT_CONTEXT_REGISTRATION *PCFLT_CONTEXT_REGISTRATION;
 626
 627 typedef struct _FLT_OPERATION_REGISTRATION
 628 {
 629     UCHAR                            MajorFunction;
 630     FLT_OPERATION_REGISTRATION_FLAGS Flags;
 631     PFLT_PRE_OPERATION_CALLBACK      PreOperation;
 632     PFLT_POST_OPERATION_CALLBACK     PostOperation;
 633     void                            *Reserved1;
 634 } FLT_OPERATION_REGISTRATION, *PFLT_OPERATION_REGISTRATION;
 635
 636 typedef struct _FLT_REGISTRATION
 637 {
 638     USHORT                                      Size;
 639     USHORT                                      Version;
 640     FLT_REGISTRATION_FLAGS                      Flags;
 641     const FLT_CONTEXT_REGISTRATION             *ContextRegistration;
 642     const FLT_OPERATION_REGISTRATION           *OperationRegistration;
 643     PFLT_FILTER_UNLOAD_CALLBACK                 FilterUnloadCallback;
 644     PFLT_INSTANCE_SETUP_CALLBACK                InstanceSetupCallback;
 645     PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK       InstanceQueryTeardownCallback;
 646     PFLT_INSTANCE_TEARDOWN_CALLBACK             InstanceTeardownStartCallback;
 647     PFLT_INSTANCE_TEARDOWN_CALLBACK             InstanceTeardownCompleteCallback;
 648     PFLT_GENERATE_FILE_NAME                     GenerateFileNameCallback;
 649     PFLT_NORMALIZE_NAME_COMPONENT               NormalizeNameComponentCallback;
 650     PFLT_NORMALIZE_CONTEXT_CLEANUP              NormalizeContextCleanupCallback;
 651     PFLT_TRANSACTION_NOTIFICATION_CALLBACK      TransactionNotificationCallback;
 652     PFLT_NORMALIZE_NAME_COMPONENT_EX            NormalizeNameComponentExCallback;
 653     PFLT_SECTION_CONFLICT_NOTIFICATION_CALLBACK SectionNotificationCallback;
 654 } FLT_REGISTRATION, *PFLT_REGISTRATION;
 655
 656
 657 void*    WINAPI FltGetRoutineAddress(LPCSTR name);
 658 NTSTATUS WINAPI FltRegisterFilter(PDRIVER_OBJECT, const FLT_REGISTRATION *, PFLT_FILTER *);
 659 NTSTATUS WINAPI FltStartFiltering(PFLT_FILTER);
 660 void     WINAPI FltUnregisterFilter(PFLT_FILTER);
 661
 662 #ifdef __cplusplus
 663 }
 664 #endif
 665
 666 #endif