blob: 831c08f1dbeff8e9eef7ad81867958c00f979548 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
|
/*++
Copyright (c) 1999 - 2002 Microsoft Corporation
Module Name:
CtxStruct.h
Abstract:
This is the header file defining the data structures used by the kernel mode
filter driver implementing the context sample.
Environment:
Kernel mode
--*/
//
// Memory Pool Tags
//
#define CTX_STRING_TAG 'tSxC'
#define CTX_RESOURCE_TAG 'cRxC'
#define CTX_INSTANCE_CONTEXT_TAG 'cIxC'
#define CTX_FILE_CONTEXT_TAG 'cFxC'
#define CTX_STREAM_CONTEXT_TAG 'cSxC'
#define CTX_STREAMHANDLE_CONTEXT_TAG 'cHxC'
//
// Context sample filter global data
//
typedef struct _CTX_GLOBAL_DATA {
//
// Handle to minifilter returned from FltRegisterFilter()
//
PFLT_FILTER Filter;
#if DBG
//
// Field to control nature of debug output
//
ULONG DebugLevel;
#endif
} CTX_GLOBAL_DATA, *PCTX_GLOBAL_DATA;
extern CTX_GLOBAL_DATA Globals;
//
// Instance context data structure
//
typedef struct _CTX_INSTANCE_CONTEXT {
//
// Instance for this context.
//
PFLT_INSTANCE Instance;
//
// Volume associated with this instance.
//
PFLT_VOLUME Volume;
//
// Name of the volume associated with this instance.
//
UNICODE_STRING VolumeName;
} CTX_INSTANCE_CONTEXT, *PCTX_INSTANCE_CONTEXT;
#define CTX_INSTANCE_CONTEXT_SIZE sizeof( CTX_INSTANCE_CONTEXT )
//
// File context data structure
//
typedef struct _CTX_FILE_CONTEXT {
//
// Name of the file associated with this context.
//
UNICODE_STRING FileName;
//
// There is no resource to protect the context since the
// filename in the context is never modified. The filename
// is put in when the context is created and then freed
// with context is cleaned-up
//
} CTX_FILE_CONTEXT, *PCTX_FILE_CONTEXT;
#define CTX_FILE_CONTEXT_SIZE sizeof( CTX_FILE_CONTEXT )
//
// Stream context data structure
//
typedef struct _CTX_STREAM_CONTEXT {
//
// Name of the file associated with this context.
//
UNICODE_STRING FileName;
//
// Number of times we saw a create on this stream
//
ULONG CreateCount;
//
// Number of times we saw a cleanup on this stream
//
ULONG CleanupCount;
//
// Number of times we saw a close on this stream
//
ULONG CloseCount;
//
// Lock used to protect this context.
//
PERESOURCE Resource;
} CTX_STREAM_CONTEXT, *PCTX_STREAM_CONTEXT;
#define CTX_STREAM_CONTEXT_SIZE sizeof( CTX_STREAM_CONTEXT )
//
// Stream handle context data structure
//
typedef struct _CTX_STREAMHANDLE_CONTEXT {
//
// Name of the file associated with this context.
//
UNICODE_STRING FileName;
//
// Lock used to protect this context.
//
PERESOURCE Resource;
} CTX_STREAMHANDLE_CONTEXT, *PCTX_STREAMHANDLE_CONTEXT;
#define CTX_STREAMHANDLE_CONTEXT_SIZE sizeof( CTX_STREAMHANDLE_CONTEXT )
//
// Debug helper functions
//
#if DBG
#define DEBUG_TRACE_ERROR 0x00000001 // Errors - whenever we return a failure code
#define DEBUG_TRACE_LOAD_UNLOAD 0x00000002 // Loading/unloading of the filter
#define DEBUG_TRACE_INSTANCES 0x00000004 // Attach / detatch of instances
#define DEBUG_TRACE_INSTANCE_CONTEXT_OPERATIONS 0x00000008 // Operation on instance context
#define DEBUG_TRACE_FILE_CONTEXT_OPERATIONS 0x00000010 // Operation on file context
#define DEBUG_TRACE_STREAM_CONTEXT_OPERATIONS 0x00000020 // Operation on stream context
#define DEBUG_TRACE_STREAMHANDLE_CONTEXT_OPERATIONS 0x00000040 // Operation on stream handle context
#define DEBUG_TRACE_ALL_IO 0x00000080 // All IO operations tracked by this filter
#define DEBUG_TRACE_ALL 0xFFFFFFFF // All flags
#define DebugTrace(Level, Data) \
if ((Level) & Globals.DebugLevel) { \
DbgPrint Data; \
}
#else
#define DebugTrace(Level, Data) {NOTHING;}
#endif
|
