1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
|
////////////////////////////////////////////////////////////////////////////////////////////////////
//
// Copyright (c) 2014 Microsoft Corporation. All Rights Reserved.
//
// Module Name:
// HelperFunctions_FlowContext.h
//
// Abstract:
// This module contains prototypes for kernel helper functions that assist with FLOW_CONTEXT.
//
// Author:
// Dusty Harper (DHarper)
//
// Revision History:
//
// [ Month ][Day] [Year] - [Revision]-[ Comments ]
// December 13, 2013 - 1.1 - Creation
//
////////////////////////////////////////////////////////////////////////////////////////////////////
#ifndef HELPERFUNCTIONS_FLOW_CONTEXT_H
#define HELPERFUNCTIONS_FLOW_CONTEXT_H
typedef struct SERIALIZATION_LIST_
{
KSPIN_LOCK spinLock;
WDFWAITLOCK waitLock;
LIST_ENTRY listHead;
INT64 numEntries;
}SERIALIZATION_LIST, *PSERIALIZATION_LIST;
typedef enum CONTEXT_TYPE_
{
CONTEXT_TYPE_DEFAULT = 0,
CONTEXT_TYPE_STREAM,
#if(NTDDI_VERSION >= NTDDI_WIN7)
CONTEXT_TYPE_ALE_ENDPOINT_CLOSURE,
#endif /// (NTDDI_VERSION >= NTDDI_WIN7)
CONTEXT_TYPE_MAX
}CONTEXT_TYPE;
typedef struct STREAM_CONTEXT_
{
UINT64 filterID;
UINT32 processorID;
BYTE pReserved[1];
SERIALIZATION_LIST serializationList;
}STREAM_CONTEXT, *PSTREAM_CONTEXT;
#if(NTDDI_VERSION >= NTDDI_WIN7)
typedef struct ALE_ENDPOINT_CLOSURE_CONTEXT_
{
UINT64 filterID;
KSPIN_LOCK spinLock;
BYTE pReserved[3];
VOID* pPendData;
}ALE_ENDPOINT_CLOSURE_CONTEXT, *PALE_ENDPOINT_CLOSURE_CONTEXT;
#endif /// (NTDDI_VERSION >= NTDDI_WIN7)
typedef struct FLOW_CONTEXT_
{
UINT64 flowID;
UINT32 calloutID;
UINT16 layerID;
UINT16 contextType;
union
{
VOID* pContext;
STREAM_CONTEXT* pStreamContext;
#if(NTDDI_VERSION >= NTDDI_WIN7)
ALE_ENDPOINT_CLOSURE_CONTEXT* pALEEndpointClosureContext;
};
union
{
UINT32 aecCalloutID;
UINT32 injectionCalloutID;
};
union
{
UINT16 aecLayerID;
UINT16 injectionLayerID;
};
BYTE pReserved[2];
#else
};
#endif /// (NTDDI_VERSION >= NTDDI_WIN7)
}FLOW_CONTEXT, *PFLOW_CONTEXT;
_IRQL_requires_min_(PASSIVE_LEVEL)
_IRQL_requires_max_(DISPATCH_LEVEL)
_IRQL_requires_same_
_Success_(return == STATUS_SUCCESS)
inline NTSTATUS KrnlHlprFlowContextPurge(_Inout_ FLOW_CONTEXT* pFlowContext);
_At_(*ppFlowContext, _Pre_ _Notnull_)
_At_(*ppFlowContext, _Post_ _Null_ __drv_freesMem(Pool))
_IRQL_requires_min_(PASSIVE_LEVEL)
_IRQL_requires_max_(DISPATCH_LEVEL)
_IRQL_requires_same_
_Success_(return == STATUS_SUCCESS && *ppFlowContext == 0)
NTSTATUS KrnlHlprFlowContextDestroy(_Inout_ FLOW_CONTEXT** ppFlowContext);
_IRQL_requires_min_(PASSIVE_LEVEL)
_IRQL_requires_max_(DISPATCH_LEVEL)
_IRQL_requires_same_
_Check_return_
_Success_(return == STATUS_SUCCESS)
NTSTATUS KrnlHlprFlowContextPopulate(_Inout_ FLOW_CONTEXT* pFlowContext,
_In_ UINT64 flowHandle,
_In_ UINT16 layerID,
_In_ UINT32 calloutID,
_In_ UINT8 contextType = CONTEXT_TYPE_DEFAULT,
_In_opt_ const VOID* pProviderContext = 0);
_At_(*ppFlowContext, _Pre_ _Null_)
_When_(return != STATUS_SUCCESS, _At_(*ppFlowContext, _Post_ _Null_))
_When_(return == STATUS_SUCCESS, _At_(*ppFlowContext, _Post_ _Notnull_ __drv_allocatesMem(Pool)))
_IRQL_requires_min_(PASSIVE_LEVEL)
_IRQL_requires_max_(DISPATCH_LEVEL)
_IRQL_requires_same_
_Check_return_
_Success_(return == STATUS_SUCCESS)
NTSTATUS KrnlHlprFlowContextCreate(_Outptr_ FLOW_CONTEXT** ppFlowContext,
_In_ UINT64 flowHandle,
_In_ UINT16 layerID,
_In_ UINT32 calloutID,
_In_ UINT8 contextType = CONTEXT_TYPE_DEFAULT,
_In_opt_ const VOID* pProviderContext = 0);
#endif /// HELPERFUNCTIONS_FLOW_CONTEXT_H
|
