1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
|
/*++
Copyright (c) 2011 Microsoft Corporation
Module Name:
avlib.h
Abstract:
This header file defines the common data structure used by kernel and user.
Environment:
User mode
Kernel mode
--*/
#ifndef __AVLIB_H__
#define __AVLIB_H__
#if defined(_MSC_VER)
#if (_MSC_VER >= 1200)
#pragma warning(push)
#pragma warning(disable:4201) // nonstandard extension used : nameless struct/union
#endif
#endif
//
// Name of AV filter server ports
//
#define AV_SCAN_PORT_NAME L"\\MicrosoftAvSampleFilterScanPort"
#define AV_ABORT_PORT_NAME L"\\MicrosoftAvSampleFilterAbortPort"
#define AV_QUERY_PORT_NAME L"\\MicrosoftAvSampleFilterQueryPort"
//
// Definition of invalide section handle for data scan
//
#define AV_INVALID_SECTION_HANDLE ((HANDLE)((LONG_PTR)(-1)))
//
// Command type enumeration, please see COMMAND_MESSAGE below
//
typedef enum _AVSCAN_COMMAND {
AvIsFileModified,
AvCmdCreateSectionForDataScan,
AvCmdCloseSectionForDataScan
} AVSCAN_COMMAND;
//
// Message type enumeration, please see AV_SCANNER_NOTIFICATION below
//
typedef enum _AVSCAN_MESSAGE {
AvMsgStartScanning,
AvMsgAbortScanning,
AvMsgFilterUnloading
} AVSCAN_MESSAGE;
typedef enum _AVSCAN_REASON {
AvScanOnOpen,
AvScanOnCleanup
} AVSCAN_REASON;
typedef enum _AVSCAN_RESULT {
AvScanResultUndetermined,
AvScanResultInfected,
AvScanResultClean
} AVSCAN_RESULT;
//
// Defines the commands between the user program and the filter
// Command: User -> Kernel
//
typedef struct _COMMAND_MESSAGE {
//
// Command type
//
AVSCAN_COMMAND Command;
//
// Scan identifier.
// This argument will be checked in message notificaiton callback.
//
LONGLONG ScanId;
//
// Scan thread id. This id will be used in cancel message passing.
// So that we will know which scan thread to cancel.
//
ULONG ScanThreadId;
union {
//
// When user program is connecting for query (AvConnectForQuery)
// it has to pass the file handle to query the status of the file.
// Valid when Command == AvIsFileModified
//
HANDLE FileHandle;
//
// The result result.
// Valid when Command == AvCmdCloseSectionForDataScan
//
AVSCAN_RESULT ScanResult;
};
} COMMAND_MESSAGE, *PCOMMAND_MESSAGE;
//
// Message: Kernel -> User Message
//
typedef struct _SCANNER_NOTIFICATION {
//
// Message type
//
AVSCAN_MESSAGE Message;
//
// Reason
//
AVSCAN_REASON Reason;
//
// Scan identifier.
// This argument will be checked in message notificaiton callback.
//
LONGLONG ScanId;
//
// Scan thread id. This id will be used in cancel message passing.
// So that we will know which scan thread to cancel.
//
ULONG ScanThreadId;
} AV_SCANNER_NOTIFICATION, *PAV_SCANNER_NOTIFICATION;
//
// Connection type enumeration. It would be mainly used in connection context.
//
typedef enum _AVSCAN_CONNECTION_TYPE {
AvConnectForScan = 1,
AvConnectForAbort,
AvConnectForQuery
} AVSCAN_CONNECTION_TYPE, *PAVSCAN_CONNECTION_TYPE;
//
// Connection context. It will be passed through FilterConnectCommunicationPort(...)
//
typedef struct _AV_CONNECTION_CONTEXT {
AVSCAN_CONNECTION_TYPE Type;
} AV_CONNECTION_CONTEXT, *PAV_CONNECTION_CONTEXT;
//
// The following string is actully "message to be found"
//
#define AV_DEFAULT_SEARCH_PATTERN "7?));=?z.5z8?z<5/4>"
#define AV_DEFAULT_SEARCH_PATTERN_SIZE sizeof(AV_DEFAULT_SEARCH_PATTERN)
#define AV_DEFAULT_PATTERN_XOR_KEY 90
#if defined(_MSC_VER)
#if (_MSC_VER >= 1200)
#pragma warning(pop)
#endif
#endif
#endif
|
