Re: [ros-dev] [ros-diffs] [gedmurphy] 74590: [FLTMGR] - Add a rather messy header that I've been slowly building as I'm starting to understand the internals. - Mostly taken from the MS PDBs and info gained from OSR and Alex...

[Alex Ionescu]

Hey Ged,

The full internal internal filter manager header was published by microsoft
in the "minwin" folder of the TH1 and TH2 WDK+SDK. Same place where Timo
and Thomas have been using "ntosp.h" from.

Best regards,
Alex Ionescu

On Fri, May 19, 2017 at 2:42 AM, <gedmurphy(a)svn.reactos.org> wrote:

>   Author: gedmurphy
>  Date: Fri May 19 09:42:00 2017
>  New Revision: 74590
>
>  URL: http://svn.reactos.org/svn/reactos?rev=74590&view=rev
>  Log:
>  [FLTMGR]
>  - Add a rather messy header that I've been slowly building as I'm starting
>  to understand the internals.
>  - Mostly taken from the MS PDBs and info gained from OSR and Alex Carp's
>  blog. (https://fsfilters.blogspot.co.uk)
>
>  Added:
>      trunk/reactos/drivers/filters/fltmgr/fltmgrint.h   (with props)
>
>  Added: trunk/reactos/drivers/filters/fltmgr/fltmgrint.h
>  URL: http://svn.reactos.org/svn/reactos/trunk/reactos/drivers/
>  filters/fltmgr/fltmgrint.h?rev=74590
>  ============================================================
>  ==================
>  --- trunk/reactos/drivers/filters/fltmgr/fltmgrint.h    (added)
>  +++ trunk/reactos/drivers/filters/fltmgr/fltmgrint.h    [iso-8859-1] Fri
>  May 19 09:42:00 2017
>  @@ -0,0 +1,284 @@
>  +#ifndef _FLTMGR_INTERNAL_H
>  +#define _FLTMGR_INTERNAL_H
>  +
>  +
>  +#define MAX_CONTEXT_TYPES   6
>  +
>  +
>  +typedef enum _FLT_OBJECT_FLAGS
>  +{
>  +    FLT_OBFL_DRAINING = 1,
>  +    FLT_OBFL_ZOMBIED = 2,
>  +    FLT_OBFL_TYPE_INSTANCE = 0x1000000,
>  +    FLT_OBFL_TYPE_FILTER = 0x2000000,
>  +    FLT_OBFL_TYPE_VOLUME = 0x4000000
>  +
>  +} FLT_OBJECT_FLAGS, *PFLT_OBJECT_FLAGS;
>  +
>  +typedef enum _FLT_FILTER_FLAGS
>  +{
>  +    FLTFL_MANDATORY_UNLOAD_IN_PROGRESS = 1,
>  +    FLTFL_FILTERING_INITIATED = 2
>  +
>  +} FLT_FILTER_FLAGS, *PFLT_FILTER_FLAGS;
>  +
>  +typedef struct _FLT_OBJECT   // size = 0x14
>  +{
>  +    volatile FLT_OBJECT_FLAGS Flags;
>  +    ULONG PointerCount;
>  +    EX_RUNDOWN_REF RundownRef;
>  +    LIST_ENTRY PrimaryLink;
>  +
>  +} FLT_OBJECT, *PFLT_OBJECT;
>  +
>  +typedef struct _ALLOCATE_CONTEXT_HEADER
>  +{
>  +    PFLT_FILTER Filter;
>  +    PFLT_CONTEXT_CLEANUP_CALLBACK ContextCleanupCallback;
>  +    struct _ALLOCATE_CONTEXT_HEADER *Next;
>  +    FLT_CONTEXT_TYPE ContextType;
>  +    char Flags;
>  +    char AllocationType;
>  +
>  +} ALLOCATE_CONTEXT_HEADER, *PALLOCATE_CONTEXT_HEADER;
>  +
>  +typedef struct _FLT_RESOURCE_LIST_HEAD
>  +{
>  +    ERESOURCE rLock;
>  +    LIST_ENTRY rList;
>  +    ULONG rCount;
>  +
>  +} FLT_RESOURCE_LIST_HEAD, *PFLT_RESOURCE_LIST_HEAD;
>  +
>  +typedef struct _FLT_MUTEX_LIST_HEAD
>  +{
>  +    FAST_MUTEX mLock;
>  +    LIST_ENTRY mList;
>  +    ULONG mCount;
>  +
>  +} FLT_MUTEX_LIST_HEAD, *PFLT_MUTEX_LIST_HEAD;
>  +
>  +typedef struct _FLT_FILTER   // size = 0x120
>  +{
>  +    FLT_OBJECT Base;
>  +    PVOID Frame;  //FLTP_FRAME
>  +    UNICODE_STRING Name;
>  +    UNICODE_STRING DefaultAltitude;
>  +    FLT_FILTER_FLAGS Flags;
>  +    PDRIVER_OBJECT DriverObject;
>  +    FLT_RESOURCE_LIST_HEAD InstanceList;
>  +    PVOID VerifierExtension;
>  +    PFLT_FILTER_UNLOAD_CALLBACK FilterUnload;
>  +    PFLT_INSTANCE_SETUP_CALLBACK InstanceSetup;
>  +    PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK InstanceQueryTeardown;
>  +    PFLT_INSTANCE_TEARDOWN_CALLBACK InstanceTeardownStart;
>  +    PFLT_INSTANCE_TEARDOWN_CALLBACK InstanceTeardownComplete;
>  +    PALLOCATE_CONTEXT_HEADER SupportedContextsListHead;
>  +    PALLOCATE_CONTEXT_HEADER SupportedContexts[MAX_CONTEXT_TYPES];
>  +    PVOID PreVolumeMount;
>  +    PVOID PostVolumeMount;
>  +    PFLT_GENERATE_FILE_NAME GenerateFileName;
>  +    PFLT_NORMALIZE_NAME_COMPONENT NormalizeNameComponent;
>  +    PFLT_NORMALIZE_CONTEXT_CLEANUP NormalizeContextCleanup;
>  +    PFLT_OPERATION_REGISTRATION Operations;
>  +    PFLT_FILTER_UNLOAD_CALLBACK OldDriverUnload;
>  +    FLT_MUTEX_LIST_HEAD ActiveOpens;
>  +    FLT_MUTEX_LIST_HEAD ConnectionList;
>  +    FLT_MUTEX_LIST_HEAD PortList;
>  +    EX_PUSH_LOCK PortLock;
>  +
>  +}  FLT_FILTER, *PFLT_FILTER;
>  +
>  +typedef enum _FLT_yINSTANCE_FLAGS
>  +{
>  +    INSFL_CAN_BE_DETACHED = 0x01,
>  +    INSFL_DELETING = 0x02,
>  +    INSFL_INITING = 0x04
>  +
>  +} FLT_INSTANCE_FLAGS, *PFLT_INSTANCE_FLAGS;
>  +
>  +typedef struct _FLT_TYPE
>  +{
>  +    USHORT Signature;
>  +    USHORT Size;
>  +
>  +} FLT_TYPE, *PFLT_TYPE;
>  +
>  +typedef struct _FLT_INSTANCE   // size = 0x144 (324)
>  +{
>  +    FLT_OBJECT Base;
>  +    ULONG OperationRundownRef;
>  +    PVOID Volume; //PFLT_VOLUME
>  +    PFLT_FILTER Filter;
>  +    FLT_INSTANCE_FLAGS Flags;
>  +    UNICODE_STRING Altitude;
>  +    UNICODE_STRING Name;
>  +    LIST_ENTRY FilterLink;
>  +    ERESOURCE ContextLock;
>  +    PVOID Context; //PCONTEXT_NODE
>  +    PVOID TrackCompletionNodes; //PRACK_COMPLETION_NODES
>  +    PVOID CallbackNodes[50]; //PCALLBACK_NODE
>  +
>  +} FLT_INSTANCE, *PFLT_INSTANCE;
>  +
>  +// http://fsfilters.blogspot.co.uk/2010/02/filter-manager-
>  concepts-part-1.html
>  +typedef struct _FLTP_FRAME
>  +{
>  +    FLT_TYPE Type;
>  +    LIST_ENTRY Links;
>  +    unsigned int FrameID;
>  +    ERESOURCE AltitudeLock;
>  +    UNICODE_STRING AltitudeIntervalLow;
>  +    UNICODE_STRING AltitudeIntervalHigh;
>  +    char LargeIrpCtrlStackSize;
>  +    char SmallIrpCtrlStackSize;
>  +    FLT_RESOURCE_LIST_HEAD RegisteredFilters;
>  +    FLT_RESOURCE_LIST_HEAD AttachedVolumes;
>  +    LIST_ENTRY MountingVolumes;
>  +    FLT_MUTEX_LIST_HEAD AttachedFileSystems;
>  +    FLT_MUTEX_LIST_HEAD ZombiedFltObjectContexts;
>  +    ERESOURCE FilterUnloadLock;
>  +    FAST_MUTEX DeviceObjectAttachLock;
>  +    //FLT_PRCB *Prcb;
>  +    void *PrcbPoolToFree;
>  +    void *LookasidePoolToFree;
>  +    //FLTP_IRPCTRL_STACK_PROFILER IrpCtrlStackProfiler;
>  +    NPAGED_LOOKASIDE_LIST SmallIrpCtrlLookasideList;
>  +    NPAGED_LOOKASIDE_LIST LargeIrpCtrlLookasideList;
>  +    //STATIC_IRP_CONTROL GlobalSIC;
>  +
>  +} FLTP_FRAME, *PFLTP_FRAME;
>  +
>  +
>  +// http://fsfilters.blogspot.co.uk/2010/02/filter-manager-
>  concepts-part-6.html
>  +typedef struct _STREAM_LIST_CTRL // size = 0xC8 (200)
>  +{
>  +    FLT_TYPE Type;
>  +    FSRTL_PER_STREAM_CONTEXT ContextCtrl;
>  +    LIST_ENTRY VolumeLink;
>  +    //STREAM_LIST_CTRL_FLAGS Flags;
>  +    int UseCount;
>  +    ERESOURCE ContextLock;
>  +    //CONTEXT_LIST_CTRL StreamContexts;
>  +    //CONTEXT_LIST_CTRL StreamHandleContexts;
>  +    ERESOURCE NameCacheLock;
>  +    LARGE_INTEGER LastRenameCompleted;
>  +    //NAME_CACHE_LIST_CTRL NormalizedNameCache;
>  +   // NAME_CACHE_LIST_CTRL ShortNameCache;
>  +   // NAME_CACHE_LIST_CTRL OpenedNameCache;
>  +    int AllNameContextsTemporary;
>  +
>  +} STREAM_LIST_CTRL, *PSTREAM_LIST_CTRL;
>  +
>  +
>  +typedef struct _FLT_SERVER_PORT_OBJECT
>  +{
>  +    LIST_ENTRY FilterLink;
>  +    PFLT_CONNECT_NOTIFY ConnectNotify;
>  +    PFLT_DISCONNECT_NOTIFY DisconnectNotify;
>  +    PFLT_MESSAGE_NOTIFY MessageNotify;
>  +    PFLT_FILTER Filter;
>  +    PVOID Cookie;
>  +    ULONG Flags;
>  +    LONG NumberOfConnections;
>  +    LONG MaxConnections;
>  +
>  +} FLT_SERVER_PORT_OBJECT, *PFLT_SERVER_PORT_OBJECT;
>  +
>  +
>  +typedef struct _FLT_PORT_OBJECT
>  +{
>  +    LIST_ENTRY FilterLink;
>  +    PFLT_SERVER_PORT_OBJECT ServerPort;
>  +    PVOID Cookie;
>  +    EX_RUNDOWN_REF MsgNotifRundownRef;
>  +    FAST_MUTEX Lock;
>  +    PVOID MsgQ; // FLT_MESSAGE_WAITER_QUEUE MsgQ;
>  +    ULONGLONG MessageId;
>  +    KEVENT DisconnectEvent;
>  +    BOOLEAN Disconnected;
>  +
>  +} FLT_PORT_OBJECT, *PFLT_PORT_OBJECT;
>  +
>  +
>  +
>  +
>  +
>  +VOID
>  +FltpExInitializeRundownProtection(
>  +    _Out_ PEX_RUNDOWN_REF RundownRef
>  +);
>  +
>  +BOOLEAN
>  +FltpExAcquireRundownProtection(
>  +    _Inout_ PEX_RUNDOWN_REF RundownRef
>  +);
>  +
>  +BOOLEAN
>  +FltpExReleaseRundownProtection(
>  +    _Inout_ PEX_RUNDOWN_REF RundownRef
>  +);
>  +
>  +NTSTATUS
>  +NTAPI
>  +FltpObjectRundownWait(
>  +    _Inout_ PEX_RUNDOWN_REF RundownRef
>  +);
>  +
>  +BOOLEAN
>  +FltpExRundownCompleted(
>  +    _Inout_ PEX_RUNDOWN_REF RundownRef
>  +);
>  +
>  +
>  +NTSTATUS
>  +FltpGetBaseDeviceObjectName(
>  +    _In_ PDEVICE_OBJECT DeviceObject,
>  +    _Inout_ PUNICODE_STRING ObjectName
>  +);
>  +
>  +NTSTATUS
>  +FltpGetObjectName(
>  +    _In_ PVOID Object,
>  +    _Inout_ PUNICODE_STRING ObjectName
>  +);
>  +
>  +ULONG
>  +FltpObjectPointerReference(
>  +    _In_ PFLT_OBJECT Object
>  +);
>  +
>  +VOID
>  +FltpObjectPointerDereference(
>  +    _In_ PFLT_OBJECT Object
>  +);
>  +
>  +NTSTATUS
>  +FltpReallocateUnicodeString(
>  +    _In_ PUNICODE_STRING String,
>  +    _In_ SIZE_T NewLength,
>  +    _In_ BOOLEAN CopyExisting
>  +);
>  +
>  +VOID
>  +FltpFreeUnicodeString(
>  +    _In_ PUNICODE_STRING String
>  +);
>  +
>  +
>  +
>  +NTSTATUS
>  +FltpDeviceControlHandler(
>  +    _In_ PDEVICE_OBJECT DeviceObject,
>  +    _Inout_ PIRP Irp
>  +);
>  +
>  +NTSTATUS
>  +FltpDispatchHandler(
>  +    _In_ PDEVICE_OBJECT DeviceObject,
>  +    _Inout_ PIRP Irp
>  +);
>  +
>  +
>  +
>  +#endif /* _FLTMGR_INTERNAL_H */
>
>  Propchange: trunk/reactos/drivers/filters/fltmgr/fltmgrint.h
>  ------------------------------------------------------------
>  ------------------
>      svn:eol-style = native
>
>
>