Skip to content

Commit 58210bc

Browse files
diversenokdiversenok
authored
Add filter manager definitions (winsiderss#2165)
* Add filter manager definitions * Add usage comments
1 parent 1624920 commit 58210bc

File tree

2 files changed

+151
-79
lines changed

2 files changed

+151
-79
lines changed

‎phlib/kphcomms.c

Lines changed: 11 additions & 79 deletions
Original file line numberDiff line numberDiff line change
@@ -46,74 +46,6 @@ PH_FREE_LIST KphpCommsReplyFreeList;
4646
#define KPH_COMMS_THREAD_SCALE 2
4747
#define KPH_COMMS_MAX_MESSAGES 1024
4848

49-
// rev
50-
typedef struct _FILTER_PORT_EA
51-
{
52-
PUNICODE_STRING PortName;
53-
PUNICODE_STRING64 PortName64;
54-
USHORT SizeOfContext;
55-
BYTE Padding[6]; // not-used (uninitialized heap bytes)
56-
BYTE ConnectionContext[ANYSIZE_ARRAY];
57-
} FILTER_PORT_EA, *PFILTER_PORT_EA;
58-
59-
#define FLT_PORT_CONTEXT_MAX 0xFFE8
60-
61-
// FILE_FULL_EA_INFORMATION (symbols)
62-
typedef struct _FILTER_PORT_FULL_EA
63-
{
64-
ULONG NextEntryOffset; // 0
65-
UCHAR Flags; // 0
66-
UCHAR EaNameLength; // sizeof(FLT_PORT_EA_NAME) - sizeof(ANSI_NULL)
67-
USHORT EaValueLength; // RTL_SIZEOF_THROUGH_FIELD(FILTER_PORT_EA, Padding) + SizeOfContext
68-
CHAR EaName[8]; // FLTPORT\0
69-
FILTER_PORT_EA EaValue;
70-
} FILTER_PORT_FULL_EA, *PFILTER_PORT_FULL_EA;
71-
72-
#define FLT_PORT_EA_NAME "FLTPORT"
73-
74-
#define FILTER_PORT_EA_SIZE \
75-
(sizeof(FILE_FULL_EA_INFORMATION) + (sizeof(FLT_PORT_EA_NAME) - sizeof(ANSI_NULL)))
76-
#define FILTER_PORT_EA_VALUE_SIZE \
77-
RTL_SIZEOF_THROUGH_FIELD(FILTER_PORT_EA, Padding)
78-
//#define FILTER_PORT_EA_VALUE_OFFSET \
79-
// (FIELD_OFFSET(FILE_FULL_EA_INFORMATION, EaName) + sizeof(FLT_PORT_EA_NAME))
80-
//#define FILTER_PORT_EA_VALUE_SIZE \
81-
// (FIELD_OFFSET(FILTER_PORT_FULL_EA, EaValue.ConnectionContext) - FILTER_PORT_EA_VALUE_OFFSET)
82-
83-
#ifdef _WIN64
84-
C_ASSERT(FILTER_PORT_EA_SIZE == 19); // 0x13
85-
C_ASSERT(FILTER_PORT_EA_VALUE_SIZE == 24); // 0x18
86-
C_ASSERT(FIELD_OFFSET(FILTER_PORT_FULL_EA, EaValue.PortName) == 16); // 0x10
87-
C_ASSERT(FIELD_OFFSET(FILTER_PORT_FULL_EA, EaValue.PortName64) == 24); // 0x18
88-
C_ASSERT(FIELD_OFFSET(FILTER_PORT_FULL_EA, EaValue.SizeOfContext) == 32); // 0x20
89-
C_ASSERT(FIELD_OFFSET(FILTER_PORT_FULL_EA, EaValue.ConnectionContext) == 40); // 0x28
90-
#else
91-
C_ASSERT(FILTER_PORT_EA_SIZE == 19); // 0x13
92-
C_ASSERT(FILTER_PORT_EA_VALUE_SIZE == 16); // 0x18
93-
C_ASSERT(FIELD_OFFSET(FILTER_PORT_FULL_EA, EaValue.PortName) == 16); // 0x10
94-
C_ASSERT(FIELD_OFFSET(FILTER_PORT_FULL_EA, EaValue.PortName64) == 20); // 0x14
95-
C_ASSERT(FIELD_OFFSET(FILTER_PORT_FULL_EA, EaValue.SizeOfContext) == 24); // 0x18
96-
C_ASSERT(FIELD_OFFSET(FILTER_PORT_FULL_EA, EaValue.ConnectionContext) == 32); // 0x20
97-
#endif
98-
99-
typedef struct _FILTER_LOADUNLOAD
100-
{
101-
USHORT Length;
102-
WCHAR Name[ANYSIZE_ARRAY];
103-
} FILTER_LOADUNLOAD, *PFILTER_LOADUNLOAD;
104-
105-
#define FLT_CTL_LOAD CTL_CODE(FILE_DEVICE_DISK_FILE_SYSTEM, 1, METHOD_BUFFERED, FILE_WRITE_ACCESS)
106-
#define FLT_CTL_UNLOAD CTL_CODE(FILE_DEVICE_DISK_FILE_SYSTEM, 2, METHOD_BUFFERED, FILE_WRITE_ACCESS)
107-
#define FLT_CTL_CREATE CTL_CODE(FILE_DEVICE_DISK_FILE_SYSTEM, 3, METHOD_BUFFERED, FILE_READ_ACCESS)
108-
#define FLT_CTL_ATTACH CTL_CODE(FILE_DEVICE_DISK_FILE_SYSTEM, 4, METHOD_BUFFERED, FILE_WRITE_ACCESS)
109-
#define FLT_CTL_DETATCH CTL_CODE(FILE_DEVICE_DISK_FILE_SYSTEM, 5, METHOD_BUFFERED, FILE_WRITE_ACCESS)
110-
#define FLT_CTL_SEND_MESSAGE CTL_CODE(FILE_DEVICE_DISK_FILE_SYSTEM, 6, METHOD_NEITHER, FILE_WRITE_ACCESS)
111-
#define FLT_CTL_GET_MESSAGE CTL_CODE(FILE_DEVICE_DISK_FILE_SYSTEM, 7, METHOD_NEITHER, FILE_READ_ACCESS)
112-
#define FLT_CTL_REPLY_MESSAGE CTL_CODE(FILE_DEVICE_DISK_FILE_SYSTEM, 8, METHOD_NEITHER, FILE_WRITE_ACCESS)
113-
#define FLT_CTL_FIND_FIRST CTL_CODE(FILE_DEVICE_DISK_FILE_SYSTEM, 9, METHOD_BUFFERED, FILE_READ_ACCESS)
114-
#define FLT_CTL_FIND_NEXT CTL_CODE(FILE_DEVICE_DISK_FILE_SYSTEM, 10, METHOD_BUFFERED, FILE_READ_ACCESS)
115-
#define FLT_CTL_QUERY_INFORMATION CTL_CODE(FILE_DEVICE_DISK_FILE_SYSTEM, 11, METHOD_BUFFERED, FILE_READ_ACCESS)
116-
11749
/**
11850
* \brief Wrapper which is essentially FilterpDeviceIoControl.
11951
*
@@ -255,7 +187,7 @@ NTSTATUS KphFilterLoadUnload(
255187
OBJECT_ATTRIBUTES objectAttributes;
256188
IO_STATUS_BLOCK ioStatusBlock;
257189
ULONG filterNameBufferLength;
258-
PFILTER_LOADUNLOAD filterNameBuffer;
190+
PFLT_LOAD_PARAMETERS filterNameBuffer;
259191
SECURITY_QUALITY_OF_SERVICE filterSecurityQos =
260192
{
261193
sizeof(SECURITY_QUALITY_OF_SERVICE),
@@ -264,7 +196,7 @@ NTSTATUS KphFilterLoadUnload(
264196
TRUE
265197
};
266198

267-
RtlInitUnicodeString(&objectName, L"\\FileSystem\\Filters\\FltMgr");
199+
RtlInitUnicodeString(&objectName, FLT_MSG_DEVICE_NAME);
268200
InitializeObjectAttributes(
269201
&objectAttributes,
270202
&objectName,
@@ -291,10 +223,10 @@ NTSTATUS KphFilterLoadUnload(
291223
if (!NT_SUCCESS(status))
292224
return status;
293225

294-
filterNameBufferLength = UFIELD_OFFSET(FILTER_LOADUNLOAD, Name[ServiceName->Length]) + sizeof(UNICODE_NULL);
226+
filterNameBufferLength = UFIELD_OFFSET(FLT_LOAD_PARAMETERS, FilterName[ServiceName->Length]) + sizeof(UNICODE_NULL);
295227
filterNameBuffer = PhAllocateZero(filterNameBufferLength);
296-
filterNameBuffer->Length = (USHORT)ServiceName->Length;
297-
RtlCopyMemory(filterNameBuffer->Name, ServiceName->Buffer, ServiceName->Length);
228+
filterNameBuffer->FilterNameSize = (USHORT)ServiceName->Length;
229+
RtlCopyMemory(filterNameBuffer->FilterName, ServiceName->Buffer, ServiceName->Length);
298230

299231
status = NtDeviceIoControlFile(
300232
fileHandle,
@@ -430,7 +362,7 @@ NTSTATUS KphpFilterConnectCommunicationPort(
430362
UNICODE_STRING64 portName64;
431363
ULONG eaLength;
432364
PFILE_FULL_EA_INFORMATION ea;
433-
PFILTER_PORT_EA eaValue;
365+
PFLT_CONNECT_CONTEXT eaValue;
434366
IO_STATUS_BLOCK isb;
435367

436368
*Port = NULL;
@@ -455,8 +387,8 @@ NTSTATUS KphpFilterConnectCommunicationPort(
455387
// Build the filter EA, this contains the port name and the context.
456388
//
457389

458-
eaLength = FILTER_PORT_EA_SIZE
459-
+ FILTER_PORT_EA_VALUE_SIZE
390+
eaLength = FLT_PORT_FULL_EA_SIZE
391+
+ FLT_PORT_FULL_EA_VALUE_SIZE
460392
+ SizeOfContext;
461393

462394
ea = PhAllocateZeroSafe(eaLength);
@@ -467,7 +399,7 @@ NTSTATUS KphpFilterConnectCommunicationPort(
467399

468400
ea->Flags = 0;
469401
ea->EaNameLength = sizeof(FLT_PORT_EA_NAME) - sizeof(ANSI_NULL);
470-
ea->EaValueLength = FILTER_PORT_EA_VALUE_SIZE + SizeOfContext;
402+
ea->EaValueLength = FLT_PORT_FULL_EA_VALUE_SIZE + SizeOfContext;
471403
RtlCopyMemory(ea->EaName, FLT_PORT_EA_NAME, sizeof(FLT_PORT_EA_NAME));
472404
eaValue = PTR_ADD_OFFSET(ea->EaName, sizeof(FLT_PORT_EA_NAME));
473405
eaValue->PortName = &portName;
@@ -476,12 +408,12 @@ NTSTATUS KphpFilterConnectCommunicationPort(
476408

477409
if (SizeOfContext > 0)
478410
{
479-
RtlCopyMemory(eaValue->ConnectionContext,
411+
RtlCopyMemory(eaValue->Context,
480412
ConnectionContext,
481413
SizeOfContext);
482414
}
483415

484-
RtlInitUnicodeString(&objectName, L"\\FileSystem\\Filters\\FltMgrMsg");
416+
RtlInitUnicodeString(&objectName, FLT_MSG_DEVICE_NAME);
485417
InitializeObjectAttributes(&objectAttributes,
486418
&objectName,
487419
OBJ_CASE_INSENSITIVE | (WindowsVersion < WINDOWS_10 ? 0 : OBJ_DONT_REPARSE),

‎phnt/include/ntioapi.h

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2959,6 +2959,146 @@ typedef struct _MOUNTMGR_VOLUME_PATHS
29592959
(s)->Length == 98 && \
29602960
(s)->Buffer[1] == '?')
29612961

2962+
// Filter manager
2963+
2964+
// rev
2965+
#define FLT_SYMLINK_NAME L"\\Global??\\FltMgr"
2966+
#define FLT_MSG_SYMLINK_NAME L"\\Global??\\FltMgrMsg"
2967+
#define FLT_DEVICE_NAME L"\\FileSystem\\Filters\\FltMgr"
2968+
#define FLT_MSG_DEVICE_NAME L"\\FileSystem\\Filters\\FltMgrMsg"
2969+
2970+
// private
2971+
typedef struct _FLT_CONNECT_CONTEXT
2972+
{
2973+
PUNICODE_STRING PortName;
2974+
PUNICODE_STRING64 PortName64;
2975+
USHORT SizeOfContext;
2976+
UCHAR Padding[6]; // unused
2977+
_Field_size_bytes_(SizeOfContext) UCHAR Context[ANYSIZE_ARRAY];
2978+
} FLT_CONNECT_CONTEXT, *PFLT_CONNECT_CONTEXT;
2979+
2980+
// rev
2981+
#define FLT_PORT_EA_NAME "FLTPORT"
2982+
#define FLT_PORT_CONTEXT_MAX 0xFFE8
2983+
2984+
// combined FILE_FULL_EA_INFORMATION and FLT_CONNECT_CONTEXT
2985+
typedef struct _FLT_PORT_FULL_EA
2986+
{
2987+
ULONG NextEntryOffset; // 0
2988+
UCHAR Flags; // 0
2989+
UCHAR EaNameLength; // sizeof(FLT_PORT_EA_NAME) - sizeof(ANSI_NULL)
2990+
USHORT EaValueLength; // RTL_SIZEOF_THROUGH_FIELD(FLT_CONNECT_CONTEXT, Padding) + SizeOfContext
2991+
CHAR EaName[8]; // FLTPORT\0
2992+
FLT_CONNECT_CONTEXT EaValue;
2993+
} FLT_PORT_FULL_EA, *PFLT_PORT_FULL_EA;
2994+
2995+
#define FLT_PORT_FULL_EA_SIZE \
2996+
(sizeof(FILE_FULL_EA_INFORMATION) + (sizeof(FLT_PORT_EA_NAME) - sizeof(ANSI_NULL)))
2997+
#define FLT_PORT_FULL_EA_VALUE_SIZE \
2998+
RTL_SIZEOF_THROUGH_FIELD(FLT_CONNECT_CONTEXT, Padding)
2999+
3000+
// begin_rev
3001+
3002+
// IOCTLs for unlinked FltMgr handles
3003+
#define FLT_CTL_LOAD CTL_CODE(FILE_DEVICE_DISK_FILE_SYSTEM, 1, METHOD_BUFFERED, FILE_WRITE_ACCESS) // in: FLT_LOAD_PARAMETERS // requires SeLoadDriverPrivilege
3004+
#define FLT_CTL_UNLOAD CTL_CODE(FILE_DEVICE_DISK_FILE_SYSTEM, 2, METHOD_BUFFERED, FILE_WRITE_ACCESS) // in: FLT_LOAD_PARAMETERS // requires SeLoadDriverPrivilege
3005+
#define FLT_CTL_LINK_HANDLE CTL_CODE(FILE_DEVICE_DISK_FILE_SYSTEM, 3, METHOD_BUFFERED, FILE_READ_ACCESS) // in: FLT_LINK // specializes the handle
3006+
#define FLT_CTL_ATTACH CTL_CODE(FILE_DEVICE_DISK_FILE_SYSTEM, 4, METHOD_BUFFERED, FILE_WRITE_ACCESS) // in: FLT_ATTACH
3007+
#define FLT_CTL_DETATCH CTL_CODE(FILE_DEVICE_DISK_FILE_SYSTEM, 5, METHOD_BUFFERED, FILE_WRITE_ACCESS) // in: FLT_INSTANCE_PARAMETERS
3008+
3009+
// IOCTLs for port-specific FltMgrMsg handles (opened using the extended attribute)
3010+
#define FLT_CTL_SEND_MESSAGE CTL_CODE(FILE_DEVICE_DISK_FILE_SYSTEM, 6, METHOD_NEITHER, FILE_WRITE_ACCESS) // in, out: filter-specific
3011+
#define FLT_CTL_GET_MESSAGE CTL_CODE(FILE_DEVICE_DISK_FILE_SYSTEM, 7, METHOD_NEITHER, FILE_READ_ACCESS) // out: filter-specific
3012+
#define FLT_CTL_REPLY_MESSAGE CTL_CODE(FILE_DEVICE_DISK_FILE_SYSTEM, 8, METHOD_NEITHER, FILE_WRITE_ACCESS) // in: filter-specific
3013+
3014+
// IOCTLs for linked FltMgr handles; depend on previously used FLT_LINK_TYPE
3015+
//
3016+
// Find first/next:
3017+
// FILTER - enumerates nested instances; in: INSTANCE_INFORMATION_CLASS
3018+
// FILTER_VOLUME - enumerates nested instances; in: INSTANCE_INFORMATION_CLASS
3019+
// FILTER_MANAGER - enumerates all filters; in: FILTER_INFORMATION_CLASS
3020+
// FILTER_MANAGER_VOLUME - enumerates all volumes; in: FILTER_VOLUME_INFORMATION_CLASS
3021+
//
3022+
// Get information:
3023+
// FILTER - queries filter; in: FILTER_INFORMATION_CLASS
3024+
// FILTER_INSTANCE - queries instance; in: INSTANCE_INFORMATION_CLASS
3025+
//
3026+
#define FLT_CTL_FIND_FIRST CTL_CODE(FILE_DEVICE_DISK_FILE_SYSTEM, 9, METHOD_BUFFERED, FILE_READ_ACCESS) // in: *_INFORMATION_CLASS, out: *_INFORMATION (from fltUserStructures.h)
3027+
#define FLT_CTL_FIND_NEXT CTL_CODE(FILE_DEVICE_DISK_FILE_SYSTEM, 10, METHOD_BUFFERED, FILE_READ_ACCESS) // in: *_INFORMATION_CLASS, out: *_INFORMATION (from fltUserStructures.h)
3028+
#define FLT_CTL_GET_INFORMATION CTL_CODE(FILE_DEVICE_DISK_FILE_SYSTEM, 11, METHOD_BUFFERED, FILE_READ_ACCESS) // in: *_INFORMATION_CLASS, out: *_INFORMATION (from fltUserStructures.h)
3029+
3030+
// end_rev
3031+
3032+
// private
3033+
typedef struct _FLT_LOAD_PARAMETERS
3034+
{
3035+
USHORT FilterNameSize;
3036+
_Field_size_bytes_(FilterNameSize) WCHAR FilterName[ANYSIZE_ARRAY];
3037+
} FLT_LOAD_PARAMETERS, *PFLT_LOAD_PARAMETERS;
3038+
3039+
// private
3040+
typedef enum _FLT_LINK_TYPE
3041+
{
3042+
FILTER = 0, // FLT_FILTER_PARAMETERS
3043+
FILTER_INSTANCE = 1, // FLT_INSTANCE_PARAMETERS
3044+
FILTER_VOLUME = 2, // FLT_VOLUME_PARAMETERS
3045+
FILTER_MANAGER = 3, // nothing
3046+
FILTER_MANAGER_VOLUME = 4, // nothing
3047+
} FLT_LINK_TYPE, *PFLT_LINK_TYPE;
3048+
3049+
// private
3050+
typedef struct _FLT_LINK
3051+
{
3052+
FLT_LINK_TYPE Type;
3053+
ULONG ParametersOffset; // from this struct
3054+
} FLT_LINK, *PFLT_LINK;
3055+
3056+
// rev
3057+
typedef struct _FLT_FILTER_PARAMETERS
3058+
{
3059+
USHORT FilterNameSize;
3060+
USHORT FilterNameOffset; // to WCHAR[] from this struct
3061+
} FLT_FILTER_PARAMETERS, *PFLT_FILTER_PARAMETERS;
3062+
3063+
// private
3064+
typedef struct _FLT_INSTANCE_PARAMETERS
3065+
{
3066+
USHORT FilterNameSize;
3067+
USHORT FilterNameOffset; // to WCHAR[] from this struct
3068+
USHORT VolumeNameSize;
3069+
USHORT VolumeNameOffset; // to WCHAR[] from this struct
3070+
USHORT InstanceNameSize;
3071+
USHORT InstanceNameOffset; // to WCHAR[] from this struct
3072+
} FLT_INSTANCE_PARAMETERS, *PFLT_INSTANCE_PARAMETERS;
3073+
3074+
// rev
3075+
typedef struct _FLT_VOLUME_PARAMETERS
3076+
{
3077+
USHORT VolumeNameSize;
3078+
USHORT VolumeNameOffset; // to WCHAR[] from this struct
3079+
} FLT_VOLUME_PARAMETERS, *PFLT_VOLUME_PARAMETERS;
3080+
3081+
// private
3082+
typedef enum _ATTACH_TYPE
3083+
{
3084+
AltitudeBased = 0,
3085+
InstanceNameBased = 1,
3086+
} ATTACH_TYPE, *PATTACH_TYPE;
3087+
3088+
// private
3089+
typedef struct _FLT_ATTACH
3090+
{
3091+
USHORT FilterNameSize;
3092+
USHORT FilterNameOffset; // to WCHAR[] from this struct
3093+
USHORT VolumeNameSize;
3094+
USHORT VolumeNameOffset; // to WCHAR[] from this struct
3095+
ATTACH_TYPE Type;
3096+
USHORT InstanceNameSize;
3097+
USHORT InstanceNameOffset; // to WCHAR[] from this struct
3098+
USHORT AltitudeSize;
3099+
USHORT AltitudeOffset; // to WCHAR[] from this struct
3100+
} FLT_ATTACH, *PFLT_ATTACH;
3101+
29623102
#if (PHNT_MODE != PHNT_MODE_KERNEL)
29633103

29643104
//

0 commit comments

Comments
 (0)