include/ddk/ntifs.h

   1 /*
   2  * Copyright (C) 2014 Alistair Leslie-Hughes
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  17  */
  18
  19 #ifndef __NTIFS_H__
  20 #define __NTIFS_H__
  21
  22 #include "ntddk.h"
  23
  24 typedef struct _EX_PUSH_LOCK EX_PUSH_LOCK, *PEX_PUSH_LOCK;
  25
  26 typedef enum _FS_FILTER_SECTION_SYNC_TYPE
  27 {
  28     SyncTypeOther = 0,
  29     SyncTypeCreateSection
  30 } FS_FILTER_SECTION_SYNC_TYPE, *PFS_FILTER_SECTION_SYNC_TYPE;
  31
  32 typedef struct _FS_FILTER_SECTION_SYNC_OUTPUT
  33 {
  34     ULONG StructureSize;
  35     ULONG SizeReturned;
  36     ULONG Flags;
  37     ULONG DesiredReadAlignment;
  38 } FS_FILTER_SECTION_SYNC_OUTPUT, *PFS_FILTER_SECTION_SYNC_OUTPUT;
  39
  40 typedef struct _KQUEUE
  41 {
  42   DISPATCHER_HEADER Header;
  43   LIST_ENTRY EntryListHead;
  44   volatile ULONG CurrentCount;
  45   ULONG MaximumCount;
  46   LIST_ENTRY ThreadListHead;
  47 } KQUEUE, *PKQUEUE, *RESTRICTED_POINTER PRKQUEUE;
  48
  49 typedef enum _FS_FILTER_STREAM_FO_NOTIFICATION_TYPE
  50 {
  51     NotifyTypeCreate  = 0,
  52     NotifyTypeRetired
  53 } FS_FILTER_STREAM_FO_NOTIFICATION_TYPE, *PFS_FILTER_STREAM_FO_NOTIFICATION_TYPE;
  54
  55 typedef union _FS_FILTER_PARAMETERS
  56 {
  57     struct
  58     {
  59         PLARGE_INTEGER EndingOffset;
  60         PERESOURCE    *ResourceToRelease;
  61     } AcquireForModifiedPageWriter;
  62
  63     struct
  64     {
  65         PERESOURCE ResourceToRelease;
  66     } ReleaseForModifiedPageWriter;
  67
  68     struct
  69     {
  70         FS_FILTER_SECTION_SYNC_TYPE    SyncType;
  71         ULONG                          PageProtection;
  72         PFS_FILTER_SECTION_SYNC_OUTPUT OutputInformation;
  73     } AcquireForSectionSynchronization;
  74
  75     struct
  76     {
  77         FS_FILTER_STREAM_FO_NOTIFICATION_TYPE NotificationType;
  78         BOOLEAN POINTER_ALIGNMENT             SafeToRecurse;
  79     } NotifyStreamFileObject;
  80
  81     struct
  82     {
  83         PIRP                   Irp;
  84         void                  *FileInformation;
  85         PULONG                 Length;
  86         FILE_INFORMATION_CLASS FileInformationClass;
  87         NTSTATUS               CompletionStatus;
  88     } QueryOpen;
  89
  90     struct
  91     {
  92         void *Argument1;
  93         void *Argument2;
  94         void *Argument3;
  95         void *Argument4;
  96         void *Argument5;
  97     } Others;
  98
  99 } FS_FILTER_PARAMETERS, *PFS_FILTER_PARAMETERS;
 100
 101 typedef struct _FS_FILTER_CALLBACK_DATA
 102 {
 103     ULONG                  SizeOfFsFilterCallbackData;
 104     UCHAR                  Operation;
 105     UCHAR                  Reserved;
 106     struct _DEVICE_OBJECT *DeviceObject;
 107     struct _FILE_OBJECT   *FileObject;
 108     FS_FILTER_PARAMETERS   Parameters;
 109 } FS_FILTER_CALLBACK_DATA, *PFS_FILTER_CALLBACK_DATA;
 110
 111 typedef NTSTATUS (WINAPI *PFS_FILTER_CALLBACK)(PFS_FILTER_CALLBACK_DATA, void **);
 112 typedef void     (WINAPI *PFS_FILTER_COMPLETION_CALLBACK)(PFS_FILTER_CALLBACK_DATA, NTSTATUS, void *context);
 113
 114 typedef struct _FS_FILTER_CALLBACKS
 115 {
 116     ULONG SizeOfFsFilterCallbacks;
 117     ULONG Reserved;
 118     PFS_FILTER_CALLBACK            PreAcquireForSectionSynchronization;
 119     PFS_FILTER_COMPLETION_CALLBACK PostAcquireForSectionSynchronization;
 120     PFS_FILTER_CALLBACK            PreReleaseForSectionSynchronization;
 121     PFS_FILTER_COMPLETION_CALLBACK PostReleaseForSectionSynchronization;
 122     PFS_FILTER_CALLBACK            PreAcquireForCcFlush;
 123     PFS_FILTER_COMPLETION_CALLBACK PostAcquireForCcFlush;
 124     PFS_FILTER_CALLBACK            PreReleaseForCcFlush;
 125     PFS_FILTER_COMPLETION_CALLBACK PostReleaseForCcFlush;
 126     PFS_FILTER_CALLBACK            PreAcquireForModifiedPageWriter;
 127     PFS_FILTER_COMPLETION_CALLBACK PostAcquireForModifiedPageWriter;
 128     PFS_FILTER_CALLBACK            PreReleaseForModifiedPageWriter;
 129     PFS_FILTER_COMPLETION_CALLBACK PostReleaseForModifiedPageWriter;
 130 } FS_FILTER_CALLBACKS, *PFS_FILTER_CALLBACKS;
 131
 132 BOOLEAN WINAPI FsRtlIsNameInExpression(PUNICODE_STRING, PUNICODE_STRING, BOOLEAN, PWCH);
 133 DEVICE_OBJECT * WINAPI IoGetAttachedDevice(DEVICE_OBJECT*);
 134 PEPROCESS WINAPI IoGetRequestorProcess(IRP*);
 135 void WINAPI KeStackAttachProcess(KPROCESS*,KAPC_STATE*);
 136 void WINAPI KeUnstackDetachProcess(KAPC_STATE*);
 137 NTSTATUS WINAPI ObOpenObjectByPointer(void*,ULONG,PACCESS_STATE,ACCESS_MASK,POBJECT_TYPE,KPROCESSOR_MODE,HANDLE*);
 138 NTSTATUS WINAPI ObQueryNameString(PVOID,POBJECT_NAME_INFORMATION,ULONG,PULONG);
 139 BOOLEAN WINAPI PsIsSystemThread(PETHREAD);
 140 NTSTATUS WINAPI PsLookupProcessByProcessId(HANDLE,PEPROCESS*);
 141 NTSTATUS WINAPI PsLookupThreadByThreadId(HANDLE,PETHREAD*);
 142 void WINAPI PsRevertToSelf(void);
 143
 144 #endif