mirror of
https://github.com/BeneficialCode/WinArk.git
synced 2026-10-18 13:41:03 +08:00
CORP\zengquan
32 lines
1.2 KiB
C
32 lines
1.2 KiB
C
#pragma once
|
|
|
|
#include "ExecutiveResource.h"
|
|
|
|
struct FilterState {
|
|
PFLT_FILTER Filter;
|
|
UNICODE_STRING Extensions;
|
|
ExecutiveResource Lock;
|
|
PDRIVER_OBJECT DriverObject;
|
|
};
|
|
|
|
extern FilterState g_State;
|
|
|
|
NTSTATUS InitMiniFilter(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath);
|
|
NTSTATUS DelProtectUnload(_In_ FLT_FILTER_UNLOAD_FLAGS Flags);
|
|
NTSTATUS DelProtectInstanceSetup(
|
|
_In_ PCFLT_RELATED_OBJECTS FltObjects,
|
|
_In_ FLT_INSTANCE_SETUP_FLAGS Flags,
|
|
_In_ DEVICE_TYPE VolumeDeviceType,
|
|
_In_ FLT_FILESYSTEM_TYPE VolumeFilesystemType);
|
|
NTSTATUS DelProtectInstanceQueryTeardown(
|
|
_In_ PCFLT_RELATED_OBJECTS FltObjects,
|
|
_In_ FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags);
|
|
VOID DelProtectInstanceTeardownStart(
|
|
_In_ PCFLT_RELATED_OBJECTS FltObjects,
|
|
_In_ FLT_INSTANCE_TEARDOWN_FLAGS Flags);
|
|
VOID DelProtectInstanceTeardownComplete(
|
|
_In_ PCFLT_RELATED_OBJECTS FltObjects,
|
|
_In_ FLT_INSTANCE_TEARDOWN_FLAGS Flags);
|
|
FLT_PREOP_CALLBACK_STATUS DelProtectPreCreate(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID*);
|
|
FLT_PREOP_CALLBACK_STATUS DelProtectPreSetInformation(PFLT_CALLBACK_DATA Data,PCFLT_RELATED_OBJECTS FltObjects, PVOID*);
|
|
bool IsDeleteAllowed(PCUNICODE_STRING filename); |