minifilter 0.0.0

TODO
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135

use core::ffi::*;

pub type POpaque = *mut c_void;
pub type Stub = *mut c_void;

pub type NTSTATUS = c_long;

#[repr(C)]
pub struct FLT_CONTEXT_REGISTRATION {
    pub ContextType: u16,
    pub Flags: u16,
    pub ContextCleanupCallback: *const extern "C" fn(POpaque, u16),
    pub Size: u64,
    pub PoolTag: u32,
    pub ContextAllocateCallback: *const extern "C" fn(Stub) -> NTSTATUS,
    pub ContextFreeCallback: *const extern "C" fn(Stub) -> NTSTATUS,
    pub Reserved1: POpaque,
}

const TestChecker: [u8; 56] = [0; core::mem::size_of::<FLT_CONTEXT_REGISTRATION>()];

#[repr(C)]
pub struct FLT_OPERATION_REGISTRATION {
    pub MajorFunction: u8,
    pub Flags: u32,
    pub PreOperation: *const extern "C" fn(POpaque, *const FLT_RELATED_OBJECTS, POpaque) -> i32,
    pub PostOperation:
        *const extern "C" fn(POpaque, *const FLT_RELATED_OBJECTS, POpaque, u32) -> i32,
    pub Reserved1: POpaque,
}

#[repr(C)]
pub struct UNICODE_STRING {
    pub Length: u16,
    pub MaximumLength: u16,
    pub buffer: *mut u16,
}

#[repr(C)]
pub struct FILE_OBJECT {
    pub Type: i16,
    pub Size: i16,
    pub DeviceObject: POpaque,
    pub Vpb: POpaque,
    pub FsContext: POpaque,
    pub FsContext2: POpaque,
    pub SectionObjectPointer: POpaque,
    pub PrivateCacheMap: POpaque,
    pub FinalStatus: i32,
    pub RelatedFileObject: *mut FILE_OBJECT,
    pub LockOperation: bool,
    pub DeletePending: bool,
    pub ReadAccess: bool,
    pub WriteAccess: bool,
    pub DeleteAccess: bool,
    pub SharedRead: bool,
    pub SharedWrite: bool,
    pub SharedDelete: bool,
    pub Flags: u32,
    pub FileName: UNICODE_STRING,
    pub CurrentByteOffset: u64,
    pub Waiters: u32, // volatile
    pub Busy: u32,    // volatile
    pub LastLock: POpaque,
    // Incomplete
}

#[repr(C)]
pub struct FLT_RELATED_OBJECTS {
    pub Size: u16,
    pub TransactionContext: u16,
    pub Filter: POpaque,
    pub Volume: POpaque,
    pub Instance: POpaque,
    pub FileObject: *const FILE_OBJECT,
    pub Transaction: POpaque,
}

#[repr(C)]
pub struct FLT_REGISTRATION {
    pub Size: u16,
    pub Version: u16,
    pub Flags: u32,
    pub ContextRegistration: *const FLT_CONTEXT_REGISTRATION,
    pub OperationRegistration: *const FLT_OPERATION_REGISTRATION,
    pub FilterUnloadCallback: *const extern "C" fn(u32) -> NTSTATUS,
    pub InstanceSetupCallback: *const extern "C" fn(POpaque, u32, u32, i32) -> NTSTATUS,
    pub InstanceQueryTeardownCallback: *const extern "C" fn(POpaque, u32) -> NTSTATUS,
    pub InstanceTeardownStartCallback: *const extern "C" fn(POpaque, u32) -> NTSTATUS,
    pub InstanceTeardownCompleteCallback: *const extern "C" fn(POpaque, u32) -> NTSTATUS,
    pub GenerateFileNameCallback: *const extern "C" fn(Stub) -> NTSTATUS,
    pub NormalizeNameComponentCallback: *const extern "C" fn(Stub) -> NTSTATUS,
    pub NormalizeContextCleanupCallback: *const extern "C" fn(Stub) -> NTSTATUS,
    pub TransactionNotificationCallback: *const extern "C" fn(Stub) -> NTSTATUS,
    pub NormalizeNameComponentExCallback: *const extern "C" fn(Stub) -> NTSTATUS,
    // pub SectionNotificationCallback: *const extern "C" fn(Stub) -> NTSTATUS,
}

extern "C" {
    pub fn DbgPrint(Format: *const u8, ...);

    pub fn FltRegisterFilter(
        driver: POpaque,
        registration: *const FLT_REGISTRATION,
        ret_filter: *mut POpaque,
    ) -> NTSTATUS;
    pub fn FltStartFiltering(filter: POpaque) -> NTSTATUS;
    pub fn FltUnregisterFilter(filter: POpaque);
    pub fn FltReferenceContext(context: POpaque);
    pub fn FltReleaseContext(context: POpaque);
    pub fn FltAllocateContext(
        filter: POpaque,
        context_type: u16,
        context_size: u64,
        pool_type: i32,
        returned_context: *mut POpaque,
    ) -> NTSTATUS;

    pub fn FltSetInstanceContext(
        instance: POpaque,
        operation: i32,
        new_context: POpaque,
        old_context: *mut POpaque,
    ) -> i32;
    pub fn FltGetInstanceContext(instance: POpaque, context: *mut POpaque) -> i32;

    pub fn FltGetRequestorProcess(callback_data: POpaque) -> POpaque;

    pub fn SeLocateProcessImageName(
        process: POpaque,
        image_file_name: *mut *mut UNICODE_STRING,
    ) -> i32;

    pub fn ExFreePoolWithTag(p: POpaque, tag: u32);
}