You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
3101 lines
96 KiB
3101 lines
96 KiB
/*++ BUILD Version: 0007 // Increment this if a change has global effects
|
|
|
|
Copyright (c) Microsoft Corporation. All rights reserved.
|
|
|
|
Module Name:
|
|
|
|
ntioapi.h
|
|
|
|
Abstract:
|
|
|
|
This module contains the user APIs for the NT I/O system.
|
|
|
|
Author:
|
|
|
|
Darryl E. Havens (darrylh) 12-Apr-1989
|
|
|
|
|
|
Revision History:
|
|
|
|
|
|
--*/
|
|
|
|
#ifndef _NTIOAPI_
|
|
#define _NTIOAPI_
|
|
|
|
#if _MSC_VER > 1000
|
|
#pragma once
|
|
#endif
|
|
|
|
//
|
|
// This file contains io definitions that must be portable across operating
|
|
// systems (i.e. DOS)
|
|
//
|
|
|
|
#include <devioctl.h>
|
|
|
|
#ifdef __cplusplus
|
|
extern "C" {
|
|
#endif
|
|
|
|
// begin_ntddk begin_wdm begin_nthal begin_ntifs
|
|
// begin_winnt
|
|
|
|
//
|
|
// Define access rights to files and directories
|
|
//
|
|
|
|
//
|
|
// The FILE_READ_DATA and FILE_WRITE_DATA constants are also defined in
|
|
// devioctl.h as FILE_READ_ACCESS and FILE_WRITE_ACCESS. The values for these
|
|
// constants *MUST* always be in sync.
|
|
// The values are redefined in devioctl.h because they must be available to
|
|
// both DOS and NT.
|
|
//
|
|
|
|
#define FILE_READ_DATA ( 0x0001 ) // file & pipe
|
|
#define FILE_LIST_DIRECTORY ( 0x0001 ) // directory
|
|
|
|
#define FILE_WRITE_DATA ( 0x0002 ) // file & pipe
|
|
#define FILE_ADD_FILE ( 0x0002 ) // directory
|
|
|
|
#define FILE_APPEND_DATA ( 0x0004 ) // file
|
|
#define FILE_ADD_SUBDIRECTORY ( 0x0004 ) // directory
|
|
#define FILE_CREATE_PIPE_INSTANCE ( 0x0004 ) // named pipe
|
|
|
|
|
|
#define FILE_READ_EA ( 0x0008 ) // file & directory
|
|
|
|
#define FILE_WRITE_EA ( 0x0010 ) // file & directory
|
|
|
|
#define FILE_EXECUTE ( 0x0020 ) // file
|
|
#define FILE_TRAVERSE ( 0x0020 ) // directory
|
|
|
|
#define FILE_DELETE_CHILD ( 0x0040 ) // directory
|
|
|
|
#define FILE_READ_ATTRIBUTES ( 0x0080 ) // all
|
|
|
|
#define FILE_WRITE_ATTRIBUTES ( 0x0100 ) // all
|
|
|
|
#define FILE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x1FF)
|
|
|
|
#define FILE_GENERIC_READ (STANDARD_RIGHTS_READ |\
|
|
FILE_READ_DATA |\
|
|
FILE_READ_ATTRIBUTES |\
|
|
FILE_READ_EA |\
|
|
SYNCHRONIZE)
|
|
|
|
|
|
#define FILE_GENERIC_WRITE (STANDARD_RIGHTS_WRITE |\
|
|
FILE_WRITE_DATA |\
|
|
FILE_WRITE_ATTRIBUTES |\
|
|
FILE_WRITE_EA |\
|
|
FILE_APPEND_DATA |\
|
|
SYNCHRONIZE)
|
|
|
|
|
|
#define FILE_GENERIC_EXECUTE (STANDARD_RIGHTS_EXECUTE |\
|
|
FILE_READ_ATTRIBUTES |\
|
|
FILE_EXECUTE |\
|
|
SYNCHRONIZE)
|
|
|
|
// end_winnt
|
|
|
|
|
|
//
|
|
// Define share access rights to files and directories
|
|
//
|
|
|
|
#define FILE_SHARE_READ 0x00000001 // winnt
|
|
#define FILE_SHARE_WRITE 0x00000002 // winnt
|
|
#define FILE_SHARE_DELETE 0x00000004 // winnt
|
|
#define FILE_SHARE_VALID_FLAGS 0x00000007
|
|
|
|
//
|
|
// Define the file attributes values
|
|
//
|
|
// Note: 0x00000008 is reserved for use for the old DOS VOLID (volume ID)
|
|
// and is therefore not considered valid in NT.
|
|
//
|
|
// Note: 0x00000010 is reserved for use for the old DOS SUBDIRECTORY flag
|
|
// and is therefore not considered valid in NT. This flag has
|
|
// been disassociated with file attributes since the other flags are
|
|
// protected with READ_ and WRITE_ATTRIBUTES access to the file.
|
|
//
|
|
// Note: Note also that the order of these flags is set to allow both the
|
|
// FAT and the Pinball File Systems to directly set the attributes
|
|
// flags in attributes words without having to pick each flag out
|
|
// individually. The order of these flags should not be changed!
|
|
//
|
|
|
|
#define FILE_ATTRIBUTE_READONLY 0x00000001 // winnt
|
|
#define FILE_ATTRIBUTE_HIDDEN 0x00000002 // winnt
|
|
#define FILE_ATTRIBUTE_SYSTEM 0x00000004 // winnt
|
|
//OLD DOS VOLID 0x00000008
|
|
|
|
#define FILE_ATTRIBUTE_DIRECTORY 0x00000010 // winnt
|
|
#define FILE_ATTRIBUTE_ARCHIVE 0x00000020 // winnt
|
|
#define FILE_ATTRIBUTE_DEVICE 0x00000040 // winnt
|
|
#define FILE_ATTRIBUTE_NORMAL 0x00000080 // winnt
|
|
|
|
#define FILE_ATTRIBUTE_TEMPORARY 0x00000100 // winnt
|
|
#define FILE_ATTRIBUTE_SPARSE_FILE 0x00000200 // winnt
|
|
#define FILE_ATTRIBUTE_REPARSE_POINT 0x00000400 // winnt
|
|
#define FILE_ATTRIBUTE_COMPRESSED 0x00000800 // winnt
|
|
|
|
#define FILE_ATTRIBUTE_OFFLINE 0x00001000 // winnt
|
|
#define FILE_ATTRIBUTE_NOT_CONTENT_INDEXED 0x00002000 // winnt
|
|
#define FILE_ATTRIBUTE_ENCRYPTED 0x00004000 // winnt
|
|
|
|
#define FILE_ATTRIBUTE_VALID_FLAGS 0x00007fb7
|
|
#define FILE_ATTRIBUTE_VALID_SET_FLAGS 0x000031a7
|
|
|
|
//
|
|
// Define the create disposition values
|
|
//
|
|
|
|
#define FILE_SUPERSEDE 0x00000000
|
|
#define FILE_OPEN 0x00000001
|
|
#define FILE_CREATE 0x00000002
|
|
#define FILE_OPEN_IF 0x00000003
|
|
#define FILE_OVERWRITE 0x00000004
|
|
#define FILE_OVERWRITE_IF 0x00000005
|
|
#define FILE_MAXIMUM_DISPOSITION 0x00000005
|
|
|
|
//
|
|
// Define the create/open option flags
|
|
//
|
|
|
|
#define FILE_DIRECTORY_FILE 0x00000001
|
|
#define FILE_WRITE_THROUGH 0x00000002
|
|
#define FILE_SEQUENTIAL_ONLY 0x00000004
|
|
#define FILE_NO_INTERMEDIATE_BUFFERING 0x00000008
|
|
|
|
#define FILE_SYNCHRONOUS_IO_ALERT 0x00000010
|
|
#define FILE_SYNCHRONOUS_IO_NONALERT 0x00000020
|
|
#define FILE_NON_DIRECTORY_FILE 0x00000040
|
|
#define FILE_CREATE_TREE_CONNECTION 0x00000080
|
|
|
|
#define FILE_COMPLETE_IF_OPLOCKED 0x00000100
|
|
#define FILE_NO_EA_KNOWLEDGE 0x00000200
|
|
#define FILE_OPEN_FOR_RECOVERY 0x00000400
|
|
#define FILE_RANDOM_ACCESS 0x00000800
|
|
|
|
#define FILE_DELETE_ON_CLOSE 0x00001000
|
|
#define FILE_OPEN_BY_FILE_ID 0x00002000
|
|
#define FILE_OPEN_FOR_BACKUP_INTENT 0x00004000
|
|
#define FILE_NO_COMPRESSION 0x00008000
|
|
|
|
#define FILE_RESERVE_OPFILTER 0x00100000
|
|
#define FILE_OPEN_REPARSE_POINT 0x00200000
|
|
#define FILE_OPEN_NO_RECALL 0x00400000
|
|
#define FILE_OPEN_FOR_FREE_SPACE_QUERY 0x00800000
|
|
|
|
#define FILE_COPY_STRUCTURED_STORAGE 0x00000041
|
|
#define FILE_STRUCTURED_STORAGE 0x00000441
|
|
|
|
#define FILE_VALID_OPTION_FLAGS 0x00ffffff
|
|
#define FILE_VALID_PIPE_OPTION_FLAGS 0x00000032
|
|
#define FILE_VALID_MAILSLOT_OPTION_FLAGS 0x00000032
|
|
#define FILE_VALID_SET_FLAGS 0x00000036
|
|
|
|
//
|
|
// Define the I/O status information return values for NtCreateFile/NtOpenFile
|
|
//
|
|
|
|
#define FILE_SUPERSEDED 0x00000000
|
|
#define FILE_OPENED 0x00000001
|
|
#define FILE_CREATED 0x00000002
|
|
#define FILE_OVERWRITTEN 0x00000003
|
|
#define FILE_EXISTS 0x00000004
|
|
#define FILE_DOES_NOT_EXIST 0x00000005
|
|
|
|
// end_ntddk end_wdm end_nthal
|
|
|
|
//
|
|
// Define the I/O status information return values for requests for oplocks
|
|
// via NtFsControlFile
|
|
//
|
|
|
|
#define FILE_OPLOCK_BROKEN_TO_LEVEL_2 0x00000007
|
|
#define FILE_OPLOCK_BROKEN_TO_NONE 0x00000008
|
|
|
|
//
|
|
// Define the I/O status information return values for NtCreateFile/NtOpenFile
|
|
// when the sharing access fails but a batch oplock break is in progress
|
|
//
|
|
|
|
#define FILE_OPBATCH_BREAK_UNDERWAY 0x00000009
|
|
|
|
//
|
|
// Define the filter flags for NtNotifyChangeDirectoryFile
|
|
//
|
|
|
|
#define FILE_NOTIFY_CHANGE_FILE_NAME 0x00000001 // winnt
|
|
#define FILE_NOTIFY_CHANGE_DIR_NAME 0x00000002 // winnt
|
|
#define FILE_NOTIFY_CHANGE_NAME 0x00000003
|
|
#define FILE_NOTIFY_CHANGE_ATTRIBUTES 0x00000004 // winnt
|
|
#define FILE_NOTIFY_CHANGE_SIZE 0x00000008 // winnt
|
|
#define FILE_NOTIFY_CHANGE_LAST_WRITE 0x00000010 // winnt
|
|
#define FILE_NOTIFY_CHANGE_LAST_ACCESS 0x00000020 // winnt
|
|
#define FILE_NOTIFY_CHANGE_CREATION 0x00000040 // winnt
|
|
#define FILE_NOTIFY_CHANGE_EA 0x00000080
|
|
#define FILE_NOTIFY_CHANGE_SECURITY 0x00000100 // winnt
|
|
#define FILE_NOTIFY_CHANGE_STREAM_NAME 0x00000200
|
|
#define FILE_NOTIFY_CHANGE_STREAM_SIZE 0x00000400
|
|
#define FILE_NOTIFY_CHANGE_STREAM_WRITE 0x00000800
|
|
#define FILE_NOTIFY_VALID_MASK 0x00000fff
|
|
|
|
//
|
|
// Define the file action type codes for NtNotifyChangeDirectoryFile
|
|
//
|
|
|
|
#define FILE_ACTION_ADDED 0x00000001 // winnt
|
|
#define FILE_ACTION_REMOVED 0x00000002 // winnt
|
|
#define FILE_ACTION_MODIFIED 0x00000003 // winnt
|
|
#define FILE_ACTION_RENAMED_OLD_NAME 0x00000004 // winnt
|
|
#define FILE_ACTION_RENAMED_NEW_NAME 0x00000005 // winnt
|
|
#define FILE_ACTION_ADDED_STREAM 0x00000006
|
|
#define FILE_ACTION_REMOVED_STREAM 0x00000007
|
|
#define FILE_ACTION_MODIFIED_STREAM 0x00000008
|
|
#define FILE_ACTION_REMOVED_BY_DELETE 0x00000009
|
|
#define FILE_ACTION_ID_NOT_TUNNELLED 0x0000000A
|
|
#define FILE_ACTION_TUNNELLED_ID_COLLISION 0x0000000B
|
|
|
|
//
|
|
// Define the NamedPipeType flags for NtCreateNamedPipeFile
|
|
//
|
|
|
|
#define FILE_PIPE_BYTE_STREAM_TYPE 0x00000000
|
|
#define FILE_PIPE_MESSAGE_TYPE 0x00000001
|
|
|
|
//
|
|
// Define the CompletionMode flags for NtCreateNamedPipeFile
|
|
//
|
|
|
|
#define FILE_PIPE_QUEUE_OPERATION 0x00000000
|
|
#define FILE_PIPE_COMPLETE_OPERATION 0x00000001
|
|
|
|
//
|
|
// Define the ReadMode flags for NtCreateNamedPipeFile
|
|
//
|
|
|
|
#define FILE_PIPE_BYTE_STREAM_MODE 0x00000000
|
|
#define FILE_PIPE_MESSAGE_MODE 0x00000001
|
|
|
|
//
|
|
// Define the NamedPipeConfiguration flags for NtQueryInformation
|
|
//
|
|
|
|
#define FILE_PIPE_INBOUND 0x00000000
|
|
#define FILE_PIPE_OUTBOUND 0x00000001
|
|
#define FILE_PIPE_FULL_DUPLEX 0x00000002
|
|
|
|
//
|
|
// Define the NamedPipeState flags for NtQueryInformation
|
|
//
|
|
|
|
#define FILE_PIPE_DISCONNECTED_STATE 0x00000001
|
|
#define FILE_PIPE_LISTENING_STATE 0x00000002
|
|
#define FILE_PIPE_CONNECTED_STATE 0x00000003
|
|
#define FILE_PIPE_CLOSING_STATE 0x00000004
|
|
|
|
//
|
|
// Define the NamedPipeEnd flags for NtQueryInformation
|
|
//
|
|
|
|
#define FILE_PIPE_CLIENT_END 0x00000000
|
|
#define FILE_PIPE_SERVER_END 0x00000001
|
|
|
|
// end_ntifs
|
|
|
|
//
|
|
// Special values for mailslot information.
|
|
//
|
|
|
|
//
|
|
// Special value for NextMessageSize to indicate that there is no next
|
|
// message.
|
|
//
|
|
|
|
#define MAILSLOT_NO_MESSAGE ((ULONG)-1) // winnt
|
|
|
|
//
|
|
// Special value for mailslot size creation to indicate that MSFS should
|
|
// choose the size of the mailslot buffer.
|
|
//
|
|
|
|
#define MAILSLOT_SIZE_AUTO 0
|
|
|
|
//
|
|
// Special value for read timeout to indicate that mailslot reads should
|
|
// never timeout.
|
|
//
|
|
|
|
#define MAILSLOT_WAIT_FOREVER ((ULONG)-1) // winnt
|
|
|
|
// begin_ntddk begin_wdm begin_nthal begin_ntifs
|
|
//
|
|
// Define special ByteOffset parameters for read and write operations
|
|
//
|
|
|
|
#define FILE_WRITE_TO_END_OF_FILE 0xffffffff
|
|
#define FILE_USE_FILE_POINTER_POSITION 0xfffffffe
|
|
|
|
//
|
|
// Define alignment requirement values
|
|
//
|
|
|
|
#define FILE_BYTE_ALIGNMENT 0x00000000
|
|
#define FILE_WORD_ALIGNMENT 0x00000001
|
|
#define FILE_LONG_ALIGNMENT 0x00000003
|
|
#define FILE_QUAD_ALIGNMENT 0x00000007
|
|
#define FILE_OCTA_ALIGNMENT 0x0000000f
|
|
#define FILE_32_BYTE_ALIGNMENT 0x0000001f
|
|
#define FILE_64_BYTE_ALIGNMENT 0x0000003f
|
|
#define FILE_128_BYTE_ALIGNMENT 0x0000007f
|
|
#define FILE_256_BYTE_ALIGNMENT 0x000000ff
|
|
#define FILE_512_BYTE_ALIGNMENT 0x000001ff
|
|
|
|
//
|
|
// Define the maximum length of a filename string
|
|
//
|
|
|
|
#define MAXIMUM_FILENAME_LENGTH 256
|
|
|
|
// end_ntddk end_wdm end_nthal
|
|
|
|
//
|
|
// Define the file system attributes flags
|
|
//
|
|
|
|
#define FILE_CASE_SENSITIVE_SEARCH 0x00000001 // winnt
|
|
#define FILE_CASE_PRESERVED_NAMES 0x00000002 // winnt
|
|
#define FILE_UNICODE_ON_DISK 0x00000004 // winnt
|
|
#define FILE_PERSISTENT_ACLS 0x00000008 // winnt
|
|
#define FILE_FILE_COMPRESSION 0x00000010 // winnt
|
|
#define FILE_VOLUME_QUOTAS 0x00000020 // winnt
|
|
#define FILE_SUPPORTS_SPARSE_FILES 0x00000040 // winnt
|
|
#define FILE_SUPPORTS_REPARSE_POINTS 0x00000080 // winnt
|
|
#define FILE_SUPPORTS_REMOTE_STORAGE 0x00000100 // winnt
|
|
#define FILE_VOLUME_IS_COMPRESSED 0x00008000 // winnt
|
|
#define FILE_SUPPORTS_OBJECT_IDS 0x00010000 // winnt
|
|
#define FILE_SUPPORTS_ENCRYPTION 0x00020000 // winnt
|
|
#define FILE_NAMED_STREAMS 0x00040000 // winnt
|
|
#define FILE_READ_ONLY_VOLUME 0x00080000 // winnt
|
|
|
|
//
|
|
// Define the flags for NtSet(Query)EaFile service structure entries
|
|
//
|
|
|
|
#define FILE_NEED_EA 0x00000080
|
|
|
|
//
|
|
// Define EA type values
|
|
//
|
|
|
|
#define FILE_EA_TYPE_BINARY 0xfffe
|
|
#define FILE_EA_TYPE_ASCII 0xfffd
|
|
#define FILE_EA_TYPE_BITMAP 0xfffb
|
|
#define FILE_EA_TYPE_METAFILE 0xfffa
|
|
#define FILE_EA_TYPE_ICON 0xfff9
|
|
#define FILE_EA_TYPE_EA 0xffee
|
|
#define FILE_EA_TYPE_MVMT 0xffdf
|
|
#define FILE_EA_TYPE_MVST 0xffde
|
|
#define FILE_EA_TYPE_ASN1 0xffdd
|
|
#define FILE_EA_TYPE_FAMILY_IDS 0xff01
|
|
|
|
// begin_ntddk begin_wdm begin_nthal
|
|
//
|
|
// Define the various device characteristics flags
|
|
//
|
|
|
|
#define FILE_REMOVABLE_MEDIA 0x00000001
|
|
#define FILE_READ_ONLY_DEVICE 0x00000002
|
|
#define FILE_FLOPPY_DISKETTE 0x00000004
|
|
#define FILE_WRITE_ONCE_MEDIA 0x00000008
|
|
#define FILE_REMOTE_DEVICE 0x00000010
|
|
#define FILE_DEVICE_IS_MOUNTED 0x00000020
|
|
#define FILE_VIRTUAL_VOLUME 0x00000040
|
|
#define FILE_AUTOGENERATED_DEVICE_NAME 0x00000080
|
|
#define FILE_DEVICE_SECURE_OPEN 0x00000100
|
|
#define FILE_CHARACTERISTIC_PNP_DEVICE 0x00000800
|
|
|
|
// end_wdm
|
|
|
|
//
|
|
// The FILE_EXPECT flags will only exist for WinXP. After that they will be
|
|
// ignored and an IRP will be sent in their place.
|
|
//
|
|
#define FILE_CHARACTERISTICS_EXPECT_ORDERLY_REMOVAL 0x00000200
|
|
#define FILE_CHARACTERISTICS_EXPECT_SURPRISE_REMOVAL 0x00000300
|
|
#define FILE_CHARACTERISTICS_REMOVAL_POLICY_MASK 0x00000300
|
|
|
|
//
|
|
// flags specified here will be propagated up and down a device stack
|
|
// after FDO and all filter devices are added, but before the device
|
|
// stack is started
|
|
//
|
|
|
|
#define FILE_CHARACTERISTICS_PROPAGATED ( FILE_REMOVABLE_MEDIA | \
|
|
FILE_READ_ONLY_DEVICE | \
|
|
FILE_FLOPPY_DISKETTE | \
|
|
FILE_WRITE_ONCE_MEDIA | \
|
|
FILE_DEVICE_SECURE_OPEN )
|
|
|
|
// end_ntddk end_nthal
|
|
|
|
// begin_ntddk begin_wdm begin_nthal
|
|
//
|
|
// Define the base asynchronous I/O argument types
|
|
//
|
|
|
|
typedef struct _IO_STATUS_BLOCK {
|
|
union {
|
|
NTSTATUS Status;
|
|
PVOID Pointer;
|
|
};
|
|
|
|
ULONG_PTR Information;
|
|
} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;
|
|
|
|
#if defined(_WIN64)
|
|
typedef struct _IO_STATUS_BLOCK32 {
|
|
NTSTATUS Status;
|
|
ULONG Information;
|
|
} IO_STATUS_BLOCK32, *PIO_STATUS_BLOCK32;
|
|
#endif
|
|
|
|
|
|
//
|
|
// Define an Asynchronous Procedure Call from I/O viewpoint
|
|
//
|
|
|
|
typedef
|
|
VOID
|
|
(NTAPI *PIO_APC_ROUTINE) (
|
|
IN PVOID ApcContext,
|
|
IN PIO_STATUS_BLOCK IoStatusBlock,
|
|
IN ULONG Reserved
|
|
);
|
|
#define PIO_APC_ROUTINE_DEFINED
|
|
|
|
// end_ntddk end_wdm end_nthal
|
|
|
|
// begin_winnt
|
|
|
|
//
|
|
// Define the file notification information structure
|
|
//
|
|
|
|
typedef struct _FILE_NOTIFY_INFORMATION {
|
|
ULONG NextEntryOffset;
|
|
ULONG Action;
|
|
ULONG FileNameLength;
|
|
WCHAR FileName[1];
|
|
} FILE_NOTIFY_INFORMATION, *PFILE_NOTIFY_INFORMATION;
|
|
|
|
// end_winnt
|
|
|
|
// begin_ntddk begin_wdm begin_nthal
|
|
//
|
|
// Define the file information class values
|
|
//
|
|
// WARNING: The order of the following values are assumed by the I/O system.
|
|
// Any changes made here should be reflected there as well.
|
|
//
|
|
|
|
typedef enum _FILE_INFORMATION_CLASS {
|
|
// end_wdm
|
|
FileDirectoryInformation = 1,
|
|
FileFullDirectoryInformation, // 2
|
|
FileBothDirectoryInformation, // 3
|
|
FileBasicInformation, // 4 wdm
|
|
FileStandardInformation, // 5 wdm
|
|
FileInternalInformation, // 6
|
|
FileEaInformation, // 7
|
|
FileAccessInformation, // 8
|
|
FileNameInformation, // 9
|
|
FileRenameInformation, // 10
|
|
FileLinkInformation, // 11
|
|
FileNamesInformation, // 12
|
|
FileDispositionInformation, // 13
|
|
FilePositionInformation, // 14 wdm
|
|
FileFullEaInformation, // 15
|
|
FileModeInformation, // 16
|
|
FileAlignmentInformation, // 17
|
|
FileAllInformation, // 18
|
|
FileAllocationInformation, // 19
|
|
FileEndOfFileInformation, // 20 wdm
|
|
FileAlternateNameInformation, // 21
|
|
FileStreamInformation, // 22
|
|
FilePipeInformation, // 23
|
|
FilePipeLocalInformation, // 24
|
|
FilePipeRemoteInformation, // 25
|
|
FileMailslotQueryInformation, // 26
|
|
FileMailslotSetInformation, // 27
|
|
FileCompressionInformation, // 28
|
|
FileObjectIdInformation, // 29
|
|
FileCompletionInformation, // 30
|
|
FileMoveClusterInformation, // 31
|
|
FileQuotaInformation, // 32
|
|
FileReparsePointInformation, // 33
|
|
FileNetworkOpenInformation, // 34
|
|
FileAttributeTagInformation, // 35
|
|
FileTrackingInformation, // 36
|
|
FileIdBothDirectoryInformation, // 37
|
|
FileIdFullDirectoryInformation, // 38
|
|
FileValidDataLengthInformation, // 39
|
|
FileShortNameInformation, // 40
|
|
FileMaximumInformation
|
|
// begin_wdm
|
|
} FILE_INFORMATION_CLASS, *PFILE_INFORMATION_CLASS;
|
|
|
|
//
|
|
// Define the various structures which are returned on query operations
|
|
//
|
|
|
|
// end_ntddk end_wdm end_nthal
|
|
|
|
//
|
|
// NtQueryDirectoryFile return types:
|
|
//
|
|
// FILE_DIRECTORY_INFORMATION
|
|
// FILE_FULL_DIR_INFORMATION
|
|
// FILE_ID_FULL_DIR_INFORMATION
|
|
// FILE_BOTH_DIR_INFORMATION
|
|
// FILE_ID_BOTH_DIR_INFORMATION
|
|
// FILE_NAMES_INFORMATION
|
|
// FILE_OBJECTID_INFORMATION
|
|
//
|
|
|
|
typedef struct _FILE_DIRECTORY_INFORMATION {
|
|
ULONG NextEntryOffset;
|
|
ULONG FileIndex;
|
|
LARGE_INTEGER CreationTime;
|
|
LARGE_INTEGER LastAccessTime;
|
|
LARGE_INTEGER LastWriteTime;
|
|
LARGE_INTEGER ChangeTime;
|
|
LARGE_INTEGER EndOfFile;
|
|
LARGE_INTEGER AllocationSize;
|
|
ULONG FileAttributes;
|
|
ULONG FileNameLength;
|
|
WCHAR FileName[1];
|
|
} FILE_DIRECTORY_INFORMATION, *PFILE_DIRECTORY_INFORMATION;
|
|
|
|
typedef struct _FILE_FULL_DIR_INFORMATION {
|
|
ULONG NextEntryOffset;
|
|
ULONG FileIndex;
|
|
LARGE_INTEGER CreationTime;
|
|
LARGE_INTEGER LastAccessTime;
|
|
LARGE_INTEGER LastWriteTime;
|
|
LARGE_INTEGER ChangeTime;
|
|
LARGE_INTEGER EndOfFile;
|
|
LARGE_INTEGER AllocationSize;
|
|
ULONG FileAttributes;
|
|
ULONG FileNameLength;
|
|
ULONG EaSize;
|
|
WCHAR FileName[1];
|
|
} FILE_FULL_DIR_INFORMATION, *PFILE_FULL_DIR_INFORMATION;
|
|
|
|
typedef struct _FILE_ID_FULL_DIR_INFORMATION {
|
|
ULONG NextEntryOffset;
|
|
ULONG FileIndex;
|
|
LARGE_INTEGER CreationTime;
|
|
LARGE_INTEGER LastAccessTime;
|
|
LARGE_INTEGER LastWriteTime;
|
|
LARGE_INTEGER ChangeTime;
|
|
LARGE_INTEGER EndOfFile;
|
|
LARGE_INTEGER AllocationSize;
|
|
ULONG FileAttributes;
|
|
ULONG FileNameLength;
|
|
ULONG EaSize;
|
|
LARGE_INTEGER FileId;
|
|
WCHAR FileName[1];
|
|
} FILE_ID_FULL_DIR_INFORMATION, *PFILE_ID_FULL_DIR_INFORMATION;
|
|
|
|
typedef struct _FILE_BOTH_DIR_INFORMATION {
|
|
ULONG NextEntryOffset;
|
|
ULONG FileIndex;
|
|
LARGE_INTEGER CreationTime;
|
|
LARGE_INTEGER LastAccessTime;
|
|
LARGE_INTEGER LastWriteTime;
|
|
LARGE_INTEGER ChangeTime;
|
|
LARGE_INTEGER EndOfFile;
|
|
LARGE_INTEGER AllocationSize;
|
|
ULONG FileAttributes;
|
|
ULONG FileNameLength;
|
|
ULONG EaSize;
|
|
CCHAR ShortNameLength;
|
|
WCHAR ShortName[12];
|
|
WCHAR FileName[1];
|
|
} FILE_BOTH_DIR_INFORMATION, *PFILE_BOTH_DIR_INFORMATION;
|
|
|
|
typedef struct _FILE_ID_BOTH_DIR_INFORMATION {
|
|
ULONG NextEntryOffset;
|
|
ULONG FileIndex;
|
|
LARGE_INTEGER CreationTime;
|
|
LARGE_INTEGER LastAccessTime;
|
|
LARGE_INTEGER LastWriteTime;
|
|
LARGE_INTEGER ChangeTime;
|
|
LARGE_INTEGER EndOfFile;
|
|
LARGE_INTEGER AllocationSize;
|
|
ULONG FileAttributes;
|
|
ULONG FileNameLength;
|
|
ULONG EaSize;
|
|
CCHAR ShortNameLength;
|
|
WCHAR ShortName[12];
|
|
LARGE_INTEGER FileId;
|
|
WCHAR FileName[1];
|
|
} FILE_ID_BOTH_DIR_INFORMATION, *PFILE_ID_BOTH_DIR_INFORMATION;
|
|
|
|
typedef struct _FILE_NAMES_INFORMATION {
|
|
ULONG NextEntryOffset;
|
|
ULONG FileIndex;
|
|
ULONG FileNameLength;
|
|
WCHAR FileName[1];
|
|
} FILE_NAMES_INFORMATION, *PFILE_NAMES_INFORMATION;
|
|
|
|
typedef struct _FILE_OBJECTID_INFORMATION {
|
|
LONGLONG FileReference;
|
|
UCHAR ObjectId[16];
|
|
union {
|
|
struct {
|
|
UCHAR BirthVolumeId[16];
|
|
UCHAR BirthObjectId[16];
|
|
UCHAR DomainId[16];
|
|
} ;
|
|
UCHAR ExtendedInfo[48];
|
|
};
|
|
} FILE_OBJECTID_INFORMATION, *PFILE_OBJECTID_INFORMATION;
|
|
|
|
//
|
|
// The following constants provide addition meta characters to fully
|
|
// support the more obscure aspects of DOS wild card processing.
|
|
//
|
|
|
|
#define ANSI_DOS_STAR ('<')
|
|
#define ANSI_DOS_QM ('>')
|
|
#define ANSI_DOS_DOT ('"')
|
|
|
|
#define DOS_STAR (L'<')
|
|
#define DOS_QM (L'>')
|
|
#define DOS_DOT (L'"')
|
|
|
|
//
|
|
// NtQuery(Set)InformationFile return types:
|
|
//
|
|
// FILE_BASIC_INFORMATION
|
|
// FILE_STANDARD_INFORMATION
|
|
// FILE_INTERNAL_INFORMATION
|
|
// FILE_EA_INFORMATION
|
|
// FILE_ACCESS_INFORMATION
|
|
// FILE_POSITION_INFORMATION
|
|
// FILE_MODE_INFORMATION
|
|
// FILE_ALIGNMENT_INFORMATION
|
|
// FILE_NAME_INFORMATION
|
|
// FILE_ALL_INFORMATION
|
|
//
|
|
// FILE_NETWORK_OPEN_INFORMATION
|
|
//
|
|
// FILE_ALLOCATION_INFORMATION
|
|
// FILE_COMPRESSION_INFORMATION
|
|
// FILE_DISPOSITION_INFORMATION
|
|
// FILE_END_OF_FILE_INFORMATION
|
|
// FILE_LINK_INFORMATION
|
|
// FILE_MOVE_CLUSTER_INFORMATION
|
|
// FILE_RENAME_INFORMATION
|
|
// FILE_SHORT_NAME_INFORMATION
|
|
// FILE_STREAM_INFORMATION
|
|
// FILE_COMPLETION_INFORMATION
|
|
//
|
|
// FILE_PIPE_INFORMATION
|
|
// FILE_PIPE_LOCAL_INFORMATION
|
|
// FILE_PIPE_REMOTE_INFORMATION
|
|
//
|
|
// FILE_MAILSLOT_QUERY_INFORMATION
|
|
// FILE_MAILSLOT_SET_INFORMATION
|
|
// FILE_REPARSE_POINT_INFORMATION
|
|
//
|
|
|
|
typedef struct _FILE_BASIC_INFORMATION { // ntddk wdm nthal
|
|
LARGE_INTEGER CreationTime; // ntddk wdm nthal
|
|
LARGE_INTEGER LastAccessTime; // ntddk wdm nthal
|
|
LARGE_INTEGER LastWriteTime; // ntddk wdm nthal
|
|
LARGE_INTEGER ChangeTime; // ntddk wdm nthal
|
|
ULONG FileAttributes; // ntddk wdm nthal
|
|
} FILE_BASIC_INFORMATION, *PFILE_BASIC_INFORMATION; // ntddk wdm nthal
|
|
// ntddk wdm nthal
|
|
typedef struct _FILE_STANDARD_INFORMATION { // ntddk wdm nthal
|
|
LARGE_INTEGER AllocationSize; // ntddk wdm nthal
|
|
LARGE_INTEGER EndOfFile; // ntddk wdm nthal
|
|
ULONG NumberOfLinks; // ntddk wdm nthal
|
|
BOOLEAN DeletePending; // ntddk wdm nthal
|
|
BOOLEAN Directory; // ntddk wdm nthal
|
|
} FILE_STANDARD_INFORMATION, *PFILE_STANDARD_INFORMATION; // ntddk wdm nthal
|
|
// ntddk wdm nthal
|
|
typedef struct _FILE_INTERNAL_INFORMATION {
|
|
LARGE_INTEGER IndexNumber;
|
|
} FILE_INTERNAL_INFORMATION, *PFILE_INTERNAL_INFORMATION;
|
|
|
|
typedef struct _FILE_EA_INFORMATION {
|
|
ULONG EaSize;
|
|
} FILE_EA_INFORMATION, *PFILE_EA_INFORMATION;
|
|
|
|
typedef struct _FILE_ACCESS_INFORMATION {
|
|
ACCESS_MASK AccessFlags;
|
|
} FILE_ACCESS_INFORMATION, *PFILE_ACCESS_INFORMATION;
|
|
|
|
typedef struct _FILE_POSITION_INFORMATION { // ntddk wdm nthal
|
|
LARGE_INTEGER CurrentByteOffset; // ntddk wdm nthal
|
|
} FILE_POSITION_INFORMATION, *PFILE_POSITION_INFORMATION; // ntddk wdm nthal
|
|
// ntddk wdm nthal
|
|
typedef struct _FILE_MODE_INFORMATION {
|
|
ULONG Mode;
|
|
} FILE_MODE_INFORMATION, *PFILE_MODE_INFORMATION;
|
|
|
|
typedef struct _FILE_ALIGNMENT_INFORMATION { // ntddk nthal
|
|
ULONG AlignmentRequirement; // ntddk nthal
|
|
} FILE_ALIGNMENT_INFORMATION, *PFILE_ALIGNMENT_INFORMATION; // ntddk nthal
|
|
// ntddk nthal
|
|
typedef struct _FILE_NAME_INFORMATION { // ntddk
|
|
ULONG FileNameLength; // ntddk
|
|
WCHAR FileName[1]; // ntddk
|
|
} FILE_NAME_INFORMATION, *PFILE_NAME_INFORMATION; // ntddk
|
|
// ntddk
|
|
typedef struct _FILE_ALL_INFORMATION {
|
|
FILE_BASIC_INFORMATION BasicInformation;
|
|
FILE_STANDARD_INFORMATION StandardInformation;
|
|
FILE_INTERNAL_INFORMATION InternalInformation;
|
|
FILE_EA_INFORMATION EaInformation;
|
|
FILE_ACCESS_INFORMATION AccessInformation;
|
|
FILE_POSITION_INFORMATION PositionInformation;
|
|
FILE_MODE_INFORMATION ModeInformation;
|
|
FILE_ALIGNMENT_INFORMATION AlignmentInformation;
|
|
FILE_NAME_INFORMATION NameInformation;
|
|
} FILE_ALL_INFORMATION, *PFILE_ALL_INFORMATION;
|
|
|
|
typedef struct _FILE_NETWORK_OPEN_INFORMATION { // ntddk wdm nthal
|
|
LARGE_INTEGER CreationTime; // ntddk wdm nthal
|
|
LARGE_INTEGER LastAccessTime; // ntddk wdm nthal
|
|
LARGE_INTEGER LastWriteTime; // ntddk wdm nthal
|
|
LARGE_INTEGER ChangeTime; // ntddk wdm nthal
|
|
LARGE_INTEGER AllocationSize; // ntddk wdm nthal
|
|
LARGE_INTEGER EndOfFile; // ntddk wdm nthal
|
|
ULONG FileAttributes; // ntddk wdm nthal
|
|
} FILE_NETWORK_OPEN_INFORMATION, *PFILE_NETWORK_OPEN_INFORMATION; // ntddk wdm nthal
|
|
// ntddk wdm nthal
|
|
typedef struct _FILE_ATTRIBUTE_TAG_INFORMATION { // ntddk nthal
|
|
ULONG FileAttributes; // ntddk nthal
|
|
ULONG ReparseTag; // ntddk nthal
|
|
} FILE_ATTRIBUTE_TAG_INFORMATION, *PFILE_ATTRIBUTE_TAG_INFORMATION; // ntddk nthal
|
|
// ntddk nthal
|
|
typedef struct _FILE_ALLOCATION_INFORMATION {
|
|
LARGE_INTEGER AllocationSize;
|
|
} FILE_ALLOCATION_INFORMATION, *PFILE_ALLOCATION_INFORMATION;
|
|
|
|
|
|
typedef struct _FILE_COMPRESSION_INFORMATION {
|
|
LARGE_INTEGER CompressedFileSize;
|
|
USHORT CompressionFormat;
|
|
UCHAR CompressionUnitShift;
|
|
UCHAR ChunkShift;
|
|
UCHAR ClusterShift;
|
|
UCHAR Reserved[3];
|
|
} FILE_COMPRESSION_INFORMATION, *PFILE_COMPRESSION_INFORMATION;
|
|
|
|
|
|
typedef struct _FILE_DISPOSITION_INFORMATION { // ntddk nthal
|
|
BOOLEAN DeleteFile; // ntddk nthal
|
|
} FILE_DISPOSITION_INFORMATION, *PFILE_DISPOSITION_INFORMATION; // ntddk nthal
|
|
// ntddk nthal
|
|
typedef struct _FILE_END_OF_FILE_INFORMATION { // ntddk nthal
|
|
LARGE_INTEGER EndOfFile; // ntddk nthal
|
|
} FILE_END_OF_FILE_INFORMATION, *PFILE_END_OF_FILE_INFORMATION; // ntddk nthal
|
|
// ntddk nthal
|
|
typedef struct _FILE_VALID_DATA_LENGTH_INFORMATION { // ntddk nthal
|
|
LARGE_INTEGER ValidDataLength; // ntddk nthal
|
|
} FILE_VALID_DATA_LENGTH_INFORMATION, *PFILE_VALID_DATA_LENGTH_INFORMATION; // ntddk nthal
|
|
|
|
#ifdef _MAC
|
|
#pragma warning( disable : 4121)
|
|
#endif
|
|
|
|
typedef struct _FILE_LINK_INFORMATION {
|
|
BOOLEAN ReplaceIfExists;
|
|
HANDLE RootDirectory;
|
|
ULONG FileNameLength;
|
|
WCHAR FileName[1];
|
|
} FILE_LINK_INFORMATION, *PFILE_LINK_INFORMATION;
|
|
|
|
|
|
#ifdef _MAC
|
|
#pragma warning( default : 4121 )
|
|
#endif
|
|
|
|
typedef struct _FILE_MOVE_CLUSTER_INFORMATION {
|
|
ULONG ClusterCount;
|
|
HANDLE RootDirectory;
|
|
ULONG FileNameLength;
|
|
WCHAR FileName[1];
|
|
} FILE_MOVE_CLUSTER_INFORMATION, *PFILE_MOVE_CLUSTER_INFORMATION;
|
|
|
|
#ifdef _MAC
|
|
#pragma warning( disable : 4121)
|
|
#endif
|
|
|
|
|
|
typedef struct _FILE_RENAME_INFORMATION {
|
|
BOOLEAN ReplaceIfExists;
|
|
HANDLE RootDirectory;
|
|
ULONG FileNameLength;
|
|
WCHAR FileName[1];
|
|
} FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION;
|
|
|
|
#ifdef _MAC
|
|
#pragma warning( default : 4121 )
|
|
#endif
|
|
|
|
typedef struct _FILE_STREAM_INFORMATION {
|
|
ULONG NextEntryOffset;
|
|
ULONG StreamNameLength;
|
|
LARGE_INTEGER StreamSize;
|
|
LARGE_INTEGER StreamAllocationSize;
|
|
WCHAR StreamName[1];
|
|
} FILE_STREAM_INFORMATION, *PFILE_STREAM_INFORMATION;
|
|
|
|
typedef struct _FILE_TRACKING_INFORMATION {
|
|
HANDLE DestinationFile;
|
|
ULONG ObjectInformationLength;
|
|
CHAR ObjectInformation[1];
|
|
} FILE_TRACKING_INFORMATION, *PFILE_TRACKING_INFORMATION;
|
|
|
|
typedef struct _FILE_COMPLETION_INFORMATION {
|
|
HANDLE Port;
|
|
PVOID Key;
|
|
} FILE_COMPLETION_INFORMATION, *PFILE_COMPLETION_INFORMATION;
|
|
|
|
typedef struct _FILE_PIPE_INFORMATION {
|
|
ULONG ReadMode;
|
|
ULONG CompletionMode;
|
|
} FILE_PIPE_INFORMATION, *PFILE_PIPE_INFORMATION;
|
|
|
|
typedef struct _FILE_PIPE_LOCAL_INFORMATION {
|
|
ULONG NamedPipeType;
|
|
ULONG NamedPipeConfiguration;
|
|
ULONG MaximumInstances;
|
|
ULONG CurrentInstances;
|
|
ULONG InboundQuota;
|
|
ULONG ReadDataAvailable;
|
|
ULONG OutboundQuota;
|
|
ULONG WriteQuotaAvailable;
|
|
ULONG NamedPipeState;
|
|
ULONG NamedPipeEnd;
|
|
} FILE_PIPE_LOCAL_INFORMATION, *PFILE_PIPE_LOCAL_INFORMATION;
|
|
|
|
typedef struct _FILE_PIPE_REMOTE_INFORMATION {
|
|
LARGE_INTEGER CollectDataTime;
|
|
ULONG MaximumCollectionCount;
|
|
} FILE_PIPE_REMOTE_INFORMATION, *PFILE_PIPE_REMOTE_INFORMATION;
|
|
|
|
|
|
typedef struct _FILE_MAILSLOT_QUERY_INFORMATION {
|
|
ULONG MaximumMessageSize;
|
|
ULONG MailslotQuota;
|
|
ULONG NextMessageSize;
|
|
ULONG MessagesAvailable;
|
|
LARGE_INTEGER ReadTimeout;
|
|
} FILE_MAILSLOT_QUERY_INFORMATION, *PFILE_MAILSLOT_QUERY_INFORMATION;
|
|
|
|
typedef struct _FILE_MAILSLOT_SET_INFORMATION {
|
|
PLARGE_INTEGER ReadTimeout;
|
|
} FILE_MAILSLOT_SET_INFORMATION, *PFILE_MAILSLOT_SET_INFORMATION;
|
|
|
|
typedef struct _FILE_REPARSE_POINT_INFORMATION {
|
|
LONGLONG FileReference;
|
|
ULONG Tag;
|
|
} FILE_REPARSE_POINT_INFORMATION, *PFILE_REPARSE_POINT_INFORMATION;
|
|
|
|
//
|
|
// NtQuery(Set)EaFile
|
|
//
|
|
// The offset for the start of EaValue is EaName[EaNameLength + 1]
|
|
//
|
|
|
|
// begin_ntddk begin_wdm
|
|
|
|
typedef struct _FILE_FULL_EA_INFORMATION {
|
|
ULONG NextEntryOffset;
|
|
UCHAR Flags;
|
|
UCHAR EaNameLength;
|
|
USHORT EaValueLength;
|
|
CHAR EaName[1];
|
|
} FILE_FULL_EA_INFORMATION, *PFILE_FULL_EA_INFORMATION;
|
|
|
|
// end_ntddk end_wdm
|
|
|
|
typedef struct _FILE_GET_EA_INFORMATION {
|
|
ULONG NextEntryOffset;
|
|
UCHAR EaNameLength;
|
|
CHAR EaName[1];
|
|
} FILE_GET_EA_INFORMATION, *PFILE_GET_EA_INFORMATION;
|
|
|
|
//
|
|
// NtQuery(Set)QuotaInformationFile
|
|
//
|
|
|
|
typedef struct _FILE_GET_QUOTA_INFORMATION {
|
|
ULONG NextEntryOffset;
|
|
ULONG SidLength;
|
|
SID Sid;
|
|
} FILE_GET_QUOTA_INFORMATION, *PFILE_GET_QUOTA_INFORMATION;
|
|
|
|
typedef struct _FILE_QUOTA_INFORMATION {
|
|
ULONG NextEntryOffset;
|
|
ULONG SidLength;
|
|
LARGE_INTEGER ChangeTime;
|
|
LARGE_INTEGER QuotaUsed;
|
|
LARGE_INTEGER QuotaThreshold;
|
|
LARGE_INTEGER QuotaLimit;
|
|
SID Sid;
|
|
} FILE_QUOTA_INFORMATION, *PFILE_QUOTA_INFORMATION;
|
|
|
|
// begin_ntddk begin_wdm begin_nthal
|
|
//
|
|
// Define the file system information class values
|
|
//
|
|
// WARNING: The order of the following values are assumed by the I/O system.
|
|
// Any changes made here should be reflected there as well.
|
|
|
|
typedef enum _FSINFOCLASS {
|
|
FileFsVolumeInformation = 1,
|
|
FileFsLabelInformation, // 2
|
|
FileFsSizeInformation, // 3
|
|
FileFsDeviceInformation, // 4
|
|
FileFsAttributeInformation, // 5
|
|
FileFsControlInformation, // 6
|
|
FileFsFullSizeInformation, // 7
|
|
FileFsObjectIdInformation, // 8
|
|
FileFsDriverPathInformation, // 9
|
|
FileFsMaximumInformation
|
|
} FS_INFORMATION_CLASS, *PFS_INFORMATION_CLASS;
|
|
|
|
// end_ntddk end_wdm end_nthal
|
|
//
|
|
// NtQuery[Set]VolumeInformationFile types:
|
|
//
|
|
// FILE_FS_LABEL_INFORMATION
|
|
// FILE_FS_VOLUME_INFORMATION
|
|
// FILE_FS_SIZE_INFORMATION
|
|
// FILE_FS_DEVICE_INFORMATION
|
|
// FILE_FS_ATTRIBUTE_INFORMATION
|
|
// FILE_FS_CONTROL_INFORMATION
|
|
// FILE_FS_OBJECTID_INFORMATION
|
|
//
|
|
|
|
typedef struct _FILE_FS_LABEL_INFORMATION {
|
|
ULONG VolumeLabelLength;
|
|
WCHAR VolumeLabel[1];
|
|
} FILE_FS_LABEL_INFORMATION, *PFILE_FS_LABEL_INFORMATION;
|
|
|
|
typedef struct _FILE_FS_VOLUME_INFORMATION {
|
|
LARGE_INTEGER VolumeCreationTime;
|
|
ULONG VolumeSerialNumber;
|
|
ULONG VolumeLabelLength;
|
|
BOOLEAN SupportsObjects;
|
|
WCHAR VolumeLabel[1];
|
|
} FILE_FS_VOLUME_INFORMATION, *PFILE_FS_VOLUME_INFORMATION;
|
|
|
|
typedef struct _FILE_FS_SIZE_INFORMATION {
|
|
LARGE_INTEGER TotalAllocationUnits;
|
|
LARGE_INTEGER AvailableAllocationUnits;
|
|
ULONG SectorsPerAllocationUnit;
|
|
ULONG BytesPerSector;
|
|
} FILE_FS_SIZE_INFORMATION, *PFILE_FS_SIZE_INFORMATION;
|
|
|
|
typedef struct _FILE_FS_FULL_SIZE_INFORMATION {
|
|
LARGE_INTEGER TotalAllocationUnits;
|
|
LARGE_INTEGER CallerAvailableAllocationUnits;
|
|
LARGE_INTEGER ActualAvailableAllocationUnits;
|
|
ULONG SectorsPerAllocationUnit;
|
|
ULONG BytesPerSector;
|
|
} FILE_FS_FULL_SIZE_INFORMATION, *PFILE_FS_FULL_SIZE_INFORMATION;
|
|
|
|
typedef struct _FILE_FS_OBJECTID_INFORMATION {
|
|
UCHAR ObjectId[16];
|
|
UCHAR ExtendedInfo[48];
|
|
} FILE_FS_OBJECTID_INFORMATION, *PFILE_FS_OBJECTID_INFORMATION;
|
|
|
|
typedef struct _FILE_FS_DEVICE_INFORMATION { // ntddk wdm nthal
|
|
DEVICE_TYPE DeviceType; // ntddk wdm nthal
|
|
ULONG Characteristics; // ntddk wdm nthal
|
|
} FILE_FS_DEVICE_INFORMATION, *PFILE_FS_DEVICE_INFORMATION; // ntddk wdm nthal
|
|
// ntddk wdm nthal
|
|
typedef struct _FILE_FS_ATTRIBUTE_INFORMATION {
|
|
ULONG FileSystemAttributes;
|
|
LONG MaximumComponentNameLength;
|
|
ULONG FileSystemNameLength;
|
|
WCHAR FileSystemName[1];
|
|
} FILE_FS_ATTRIBUTE_INFORMATION, *PFILE_FS_ATTRIBUTE_INFORMATION;
|
|
|
|
typedef struct _FILE_FS_DRIVER_PATH_INFORMATION {
|
|
BOOLEAN DriverInPath;
|
|
ULONG DriverNameLength;
|
|
WCHAR DriverName[1];
|
|
} FILE_FS_DRIVER_PATH_INFORMATION, *PFILE_FS_DRIVER_PATH_INFORMATION;
|
|
|
|
|
|
//
|
|
// File system control flags
|
|
//
|
|
|
|
#define FILE_VC_QUOTA_NONE 0x00000000
|
|
#define FILE_VC_QUOTA_TRACK 0x00000001
|
|
#define FILE_VC_QUOTA_ENFORCE 0x00000002
|
|
#define FILE_VC_QUOTA_MASK 0x00000003
|
|
|
|
#define FILE_VC_CONTENT_INDEX_DISABLED 0x00000008
|
|
|
|
#define FILE_VC_LOG_QUOTA_THRESHOLD 0x00000010
|
|
#define FILE_VC_LOG_QUOTA_LIMIT 0x00000020
|
|
#define FILE_VC_LOG_VOLUME_THRESHOLD 0x00000040
|
|
#define FILE_VC_LOG_VOLUME_LIMIT 0x00000080
|
|
|
|
#define FILE_VC_QUOTAS_INCOMPLETE 0x00000100
|
|
#define FILE_VC_QUOTAS_REBUILDING 0x00000200
|
|
|
|
#define FILE_VC_VALID_MASK 0x000003ff
|
|
|
|
typedef struct _FILE_FS_CONTROL_INFORMATION {
|
|
LARGE_INTEGER FreeSpaceStartFiltering;
|
|
LARGE_INTEGER FreeSpaceThreshold;
|
|
LARGE_INTEGER FreeSpaceStopFiltering;
|
|
LARGE_INTEGER DefaultQuotaThreshold;
|
|
LARGE_INTEGER DefaultQuotaLimit;
|
|
ULONG FileSystemControlFlags;
|
|
} FILE_FS_CONTROL_INFORMATION, *PFILE_FS_CONTROL_INFORMATION;
|
|
|
|
// begin_winnt begin_ntddk begin_nthal
|
|
|
|
//
|
|
// Define segement buffer structure for scatter/gather read/write.
|
|
//
|
|
|
|
typedef union _FILE_SEGMENT_ELEMENT {
|
|
PVOID64 Buffer;
|
|
ULONGLONG Alignment;
|
|
}FILE_SEGMENT_ELEMENT, *PFILE_SEGMENT_ELEMENT;
|
|
|
|
// end_ntifs end_winnt end_ntddk end_nthal
|
|
|
|
//
|
|
// I/O system user APIs
|
|
//
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtCancelIoFile(
|
|
IN HANDLE FileHandle,
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtCreateNamedPipeFile(
|
|
OUT PHANDLE FileHandle,
|
|
IN ULONG DesiredAccess,
|
|
IN POBJECT_ATTRIBUTES ObjectAttributes,
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock,
|
|
IN ULONG ShareAccess,
|
|
IN ULONG CreateDisposition,
|
|
IN ULONG CreateOptions,
|
|
IN ULONG NamedPipeType,
|
|
IN ULONG ReadMode,
|
|
IN ULONG CompletionMode,
|
|
IN ULONG MaximumInstances,
|
|
IN ULONG InboundQuota,
|
|
IN ULONG OutboundQuota,
|
|
IN PLARGE_INTEGER DefaultTimeout OPTIONAL
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtCreateMailslotFile(
|
|
OUT PHANDLE FileHandle,
|
|
IN ULONG DesiredAccess,
|
|
IN POBJECT_ATTRIBUTES ObjectAttributes,
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock,
|
|
ULONG CreateOptions,
|
|
IN ULONG MailslotQuota,
|
|
IN ULONG MaximumMessageSize,
|
|
IN PLARGE_INTEGER ReadTimeout
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtDeleteFile(
|
|
IN POBJECT_ATTRIBUTES ObjectAttributes
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtFlushBuffersFile(
|
|
IN HANDLE FileHandle,
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtNotifyChangeDirectoryFile(
|
|
IN HANDLE FileHandle,
|
|
IN HANDLE Event OPTIONAL,
|
|
IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
|
|
IN PVOID ApcContext OPTIONAL,
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock,
|
|
OUT PVOID Buffer,
|
|
IN ULONG Length,
|
|
IN ULONG CompletionFilter,
|
|
IN BOOLEAN WatchTree
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtQueryAttributesFile(
|
|
IN POBJECT_ATTRIBUTES ObjectAttributes,
|
|
OUT PFILE_BASIC_INFORMATION FileInformation
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtQueryFullAttributesFile(
|
|
IN POBJECT_ATTRIBUTES ObjectAttributes,
|
|
OUT PFILE_NETWORK_OPEN_INFORMATION FileInformation
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtQueryEaFile(
|
|
IN HANDLE FileHandle,
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock,
|
|
OUT PVOID Buffer,
|
|
IN ULONG Length,
|
|
IN BOOLEAN ReturnSingleEntry,
|
|
IN PVOID EaList OPTIONAL,
|
|
IN ULONG EaListLength,
|
|
IN PULONG EaIndex OPTIONAL,
|
|
IN BOOLEAN RestartScan
|
|
);
|
|
|
|
// begin_ntifs
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtCreateFile(
|
|
OUT PHANDLE FileHandle,
|
|
IN ACCESS_MASK DesiredAccess,
|
|
IN POBJECT_ATTRIBUTES ObjectAttributes,
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock,
|
|
IN PLARGE_INTEGER AllocationSize OPTIONAL,
|
|
IN ULONG FileAttributes,
|
|
IN ULONG ShareAccess,
|
|
IN ULONG CreateDisposition,
|
|
IN ULONG CreateOptions,
|
|
IN PVOID EaBuffer OPTIONAL,
|
|
IN ULONG EaLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtDeviceIoControlFile(
|
|
IN HANDLE FileHandle,
|
|
IN HANDLE Event OPTIONAL,
|
|
IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
|
|
IN PVOID ApcContext OPTIONAL,
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock,
|
|
IN ULONG IoControlCode,
|
|
IN PVOID InputBuffer OPTIONAL,
|
|
IN ULONG InputBufferLength,
|
|
OUT PVOID OutputBuffer OPTIONAL,
|
|
IN ULONG OutputBufferLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtFsControlFile(
|
|
IN HANDLE FileHandle,
|
|
IN HANDLE Event OPTIONAL,
|
|
IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
|
|
IN PVOID ApcContext OPTIONAL,
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock,
|
|
IN ULONG FsControlCode,
|
|
IN PVOID InputBuffer OPTIONAL,
|
|
IN ULONG InputBufferLength,
|
|
OUT PVOID OutputBuffer OPTIONAL,
|
|
IN ULONG OutputBufferLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtLockFile(
|
|
IN HANDLE FileHandle,
|
|
IN HANDLE Event OPTIONAL,
|
|
IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
|
|
IN PVOID ApcContext OPTIONAL,
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock,
|
|
IN PLARGE_INTEGER ByteOffset,
|
|
IN PLARGE_INTEGER Length,
|
|
IN ULONG Key,
|
|
IN BOOLEAN FailImmediately,
|
|
IN BOOLEAN ExclusiveLock
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtOpenFile(
|
|
OUT PHANDLE FileHandle,
|
|
IN ACCESS_MASK DesiredAccess,
|
|
IN POBJECT_ATTRIBUTES ObjectAttributes,
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock,
|
|
IN ULONG ShareAccess,
|
|
IN ULONG OpenOptions
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtQueryDirectoryFile(
|
|
IN HANDLE FileHandle,
|
|
IN HANDLE Event OPTIONAL,
|
|
IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
|
|
IN PVOID ApcContext OPTIONAL,
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock,
|
|
OUT PVOID FileInformation,
|
|
IN ULONG Length,
|
|
IN FILE_INFORMATION_CLASS FileInformationClass,
|
|
IN BOOLEAN ReturnSingleEntry,
|
|
IN PUNICODE_STRING FileName OPTIONAL,
|
|
IN BOOLEAN RestartScan
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtQueryInformationFile(
|
|
IN HANDLE FileHandle,
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock,
|
|
OUT PVOID FileInformation,
|
|
IN ULONG Length,
|
|
IN FILE_INFORMATION_CLASS FileInformationClass
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtQueryQuotaInformationFile(
|
|
IN HANDLE FileHandle,
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock,
|
|
OUT PVOID Buffer,
|
|
IN ULONG Length,
|
|
IN BOOLEAN ReturnSingleEntry,
|
|
IN PVOID SidList OPTIONAL,
|
|
IN ULONG SidListLength,
|
|
IN PSID StartSid OPTIONAL,
|
|
IN BOOLEAN RestartScan
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtQueryVolumeInformationFile(
|
|
IN HANDLE FileHandle,
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock,
|
|
OUT PVOID FsInformation,
|
|
IN ULONG Length,
|
|
IN FS_INFORMATION_CLASS FsInformationClass
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtReadFile(
|
|
IN HANDLE FileHandle,
|
|
IN HANDLE Event OPTIONAL,
|
|
IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
|
|
IN PVOID ApcContext OPTIONAL,
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock,
|
|
OUT PVOID Buffer,
|
|
IN ULONG Length,
|
|
IN PLARGE_INTEGER ByteOffset OPTIONAL,
|
|
IN PULONG Key OPTIONAL
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtSetInformationFile(
|
|
IN HANDLE FileHandle,
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock,
|
|
IN PVOID FileInformation,
|
|
IN ULONG Length,
|
|
IN FILE_INFORMATION_CLASS FileInformationClass
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtSetQuotaInformationFile(
|
|
IN HANDLE FileHandle,
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock,
|
|
IN PVOID Buffer,
|
|
IN ULONG Length
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtSetVolumeInformationFile(
|
|
IN HANDLE FileHandle,
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock,
|
|
IN PVOID FsInformation,
|
|
IN ULONG Length,
|
|
IN FS_INFORMATION_CLASS FsInformationClass
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtWriteFile(
|
|
IN HANDLE FileHandle,
|
|
IN HANDLE Event OPTIONAL,
|
|
IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
|
|
IN PVOID ApcContext OPTIONAL,
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock,
|
|
IN PVOID Buffer,
|
|
IN ULONG Length,
|
|
IN PLARGE_INTEGER ByteOffset OPTIONAL,
|
|
IN PULONG Key OPTIONAL
|
|
);
|
|
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtUnlockFile(
|
|
IN HANDLE FileHandle,
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock,
|
|
IN PLARGE_INTEGER ByteOffset,
|
|
IN PLARGE_INTEGER Length,
|
|
IN ULONG Key
|
|
);
|
|
// end_ntifs
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtReadFile64(
|
|
IN HANDLE FileHandle,
|
|
IN HANDLE Event OPTIONAL,
|
|
IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
|
|
IN PVOID ApcContext OPTIONAL,
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock,
|
|
OUT PVOID64 *Buffer,
|
|
IN ULONG Length,
|
|
IN PLARGE_INTEGER ByteOffset OPTIONAL,
|
|
IN PULONG Key OPTIONAL
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtReadFileScatter(
|
|
IN HANDLE FileHandle,
|
|
IN HANDLE Event OPTIONAL,
|
|
IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
|
|
IN PVOID ApcContext OPTIONAL,
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock,
|
|
IN PFILE_SEGMENT_ELEMENT SegmentArray,
|
|
IN ULONG Length,
|
|
IN PLARGE_INTEGER ByteOffset OPTIONAL,
|
|
IN PULONG Key OPTIONAL
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtSetEaFile(
|
|
IN HANDLE FileHandle,
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock,
|
|
IN PVOID Buffer,
|
|
IN ULONG Length
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtWriteFile64(
|
|
IN HANDLE FileHandle,
|
|
IN HANDLE Event OPTIONAL,
|
|
IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
|
|
IN PVOID ApcContext OPTIONAL,
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock,
|
|
IN PVOID64 *Buffer,
|
|
IN ULONG Length,
|
|
IN PLARGE_INTEGER ByteOffset OPTIONAL,
|
|
IN PULONG Key OPTIONAL
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtWriteFileGather(
|
|
IN HANDLE FileHandle,
|
|
IN HANDLE Event OPTIONAL,
|
|
IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
|
|
IN PVOID ApcContext OPTIONAL,
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock,
|
|
IN PFILE_SEGMENT_ELEMENT SegmentArray,
|
|
IN ULONG Length,
|
|
IN PLARGE_INTEGER ByteOffset OPTIONAL,
|
|
IN PULONG Key OPTIONAL
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtLoadDriver(
|
|
IN PUNICODE_STRING DriverServiceName
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtUnloadDriver(
|
|
IN PUNICODE_STRING DriverServiceName
|
|
);
|
|
|
|
// begin_ntifs
|
|
//
|
|
// Macro definition for defining IOCTL and FSCTL function control codes. Note
|
|
// that function codes 0-2047 are reserved for Microsoft Corporation, and
|
|
// 2048-4095 are reserved for customers.
|
|
//
|
|
// These macros are defined in devioctl.h which contains the portable IO
|
|
// definitions (for use by both DOS and NT)
|
|
//
|
|
|
|
//
|
|
// The IoGetFunctionCodeFromCtlCode( ControlCode ) Macro is defined in io.h
|
|
// This macro is used to extract the function code from an IOCTL (or FSCTL).
|
|
// The macro can only be used in kernel mode code.
|
|
//
|
|
|
|
//
|
|
// General File System control codes - Note that these values are valid
|
|
// regardless of the actual file system type
|
|
//
|
|
|
|
//
|
|
// IMPORTANT: These values have been arranged in order of increasing
|
|
// control codes. Do NOT breaks this!! Add all new codes
|
|
// at end of list regardless of functionality type.
|
|
//
|
|
// Note: FSCTL_QUERY_RETRIEVAL_POINTER and FSCTL_MARK_AS_SYSTEM_HIVE only
|
|
// work from Kernel mode on local paging files or the system hives.
|
|
//
|
|
|
|
// begin_winioctl
|
|
#ifndef _FILESYSTEMFSCTL_
|
|
#define _FILESYSTEMFSCTL_
|
|
|
|
//
|
|
// The following is a list of the native file system fsctls followed by
|
|
// additional network file system fsctls. Some values have been
|
|
// decommissioned.
|
|
//
|
|
|
|
#define FSCTL_REQUEST_OPLOCK_LEVEL_1 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 0, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
#define FSCTL_REQUEST_OPLOCK_LEVEL_2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 1, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
#define FSCTL_REQUEST_BATCH_OPLOCK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 2, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
#define FSCTL_OPLOCK_BREAK_ACKNOWLEDGE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 3, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
#define FSCTL_OPBATCH_ACK_CLOSE_PENDING CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 4, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
#define FSCTL_OPLOCK_BREAK_NOTIFY CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 5, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
#define FSCTL_LOCK_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 6, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
#define FSCTL_UNLOCK_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 7, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
#define FSCTL_DISMOUNT_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 8, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
// decommissioned fsctl value 9
|
|
#define FSCTL_IS_VOLUME_MOUNTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 10, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
#define FSCTL_IS_PATHNAME_VALID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 11, METHOD_BUFFERED, FILE_ANY_ACCESS) // PATHNAME_BUFFER,
|
|
#define FSCTL_MARK_VOLUME_DIRTY CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 12, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
// decommissioned fsctl value 13
|
|
#define FSCTL_QUERY_RETRIEVAL_POINTERS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 14, METHOD_NEITHER, FILE_ANY_ACCESS)
|
|
#define FSCTL_GET_COMPRESSION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 15, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
#define FSCTL_SET_COMPRESSION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 16, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
|
|
// decommissioned fsctl value 17
|
|
// decommissioned fsctl value 18
|
|
#define FSCTL_MARK_AS_SYSTEM_HIVE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 19, METHOD_NEITHER, FILE_ANY_ACCESS)
|
|
#define FSCTL_OPLOCK_BREAK_ACK_NO_2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 20, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
#define FSCTL_INVALIDATE_VOLUMES CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 21, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
#define FSCTL_QUERY_FAT_BPB CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 22, METHOD_BUFFERED, FILE_ANY_ACCESS) // FSCTL_QUERY_FAT_BPB_BUFFER
|
|
#define FSCTL_REQUEST_FILTER_OPLOCK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 23, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
#define FSCTL_FILESYSTEM_GET_STATISTICS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 24, METHOD_BUFFERED, FILE_ANY_ACCESS) // FILESYSTEM_STATISTICS
|
|
#if(_WIN32_WINNT >= 0x0400)
|
|
#define FSCTL_GET_NTFS_VOLUME_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 25, METHOD_BUFFERED, FILE_ANY_ACCESS) // NTFS_VOLUME_DATA_BUFFER
|
|
#define FSCTL_GET_NTFS_FILE_RECORD CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 26, METHOD_BUFFERED, FILE_ANY_ACCESS) // NTFS_FILE_RECORD_INPUT_BUFFER, NTFS_FILE_RECORD_OUTPUT_BUFFER
|
|
#define FSCTL_GET_VOLUME_BITMAP CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 27, METHOD_NEITHER, FILE_ANY_ACCESS) // STARTING_LCN_INPUT_BUFFER, VOLUME_BITMAP_BUFFER
|
|
#define FSCTL_GET_RETRIEVAL_POINTERS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 28, METHOD_NEITHER, FILE_ANY_ACCESS) // STARTING_VCN_INPUT_BUFFER, RETRIEVAL_POINTERS_BUFFER
|
|
#define FSCTL_MOVE_FILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 29, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) // MOVE_FILE_DATA,
|
|
#define FSCTL_IS_VOLUME_DIRTY CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 30, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
// decomissioned fsctl value 31
|
|
#define FSCTL_ALLOW_EXTENDED_DASD_IO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 32, METHOD_NEITHER, FILE_ANY_ACCESS)
|
|
#endif /* _WIN32_WINNT >= 0x0400 */
|
|
|
|
#if(_WIN32_WINNT >= 0x0500)
|
|
// decommissioned fsctl value 33
|
|
// decommissioned fsctl value 34
|
|
#define FSCTL_FIND_FILES_BY_SID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 35, METHOD_NEITHER, FILE_ANY_ACCESS) // FIND_BY_SID_DATA, FIND_BY_SID_OUTPUT
|
|
// decommissioned fsctl value 36
|
|
// decommissioned fsctl value 37
|
|
#define FSCTL_SET_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 38, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) // FILE_OBJECTID_BUFFER
|
|
#define FSCTL_GET_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 39, METHOD_BUFFERED, FILE_ANY_ACCESS) // FILE_OBJECTID_BUFFER
|
|
#define FSCTL_DELETE_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 40, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
|
|
#define FSCTL_SET_REPARSE_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 41, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) // REPARSE_DATA_BUFFER,
|
|
#define FSCTL_GET_REPARSE_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 42, METHOD_BUFFERED, FILE_ANY_ACCESS) // REPARSE_DATA_BUFFER
|
|
#define FSCTL_DELETE_REPARSE_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 43, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) // REPARSE_DATA_BUFFER,
|
|
#define FSCTL_ENUM_USN_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 44, METHOD_NEITHER, FILE_ANY_ACCESS) // MFT_ENUM_DATA,
|
|
#define FSCTL_SECURITY_ID_CHECK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 45, METHOD_NEITHER, FILE_READ_DATA) // BULK_SECURITY_TEST_DATA,
|
|
#define FSCTL_READ_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 46, METHOD_NEITHER, FILE_ANY_ACCESS) // READ_USN_JOURNAL_DATA, USN
|
|
#define FSCTL_SET_OBJECT_ID_EXTENDED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 47, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
|
|
#define FSCTL_CREATE_OR_GET_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 48, METHOD_BUFFERED, FILE_ANY_ACCESS) // FILE_OBJECTID_BUFFER
|
|
#define FSCTL_SET_SPARSE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 49, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
|
|
#define FSCTL_SET_ZERO_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 50, METHOD_BUFFERED, FILE_WRITE_DATA) // FILE_ZERO_DATA_INFORMATION,
|
|
#define FSCTL_QUERY_ALLOCATED_RANGES CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 51, METHOD_NEITHER, FILE_READ_DATA) // FILE_ALLOCATED_RANGE_BUFFER, FILE_ALLOCATED_RANGE_BUFFER
|
|
// decommissioned fsctl value 52
|
|
#define FSCTL_SET_ENCRYPTION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 53, METHOD_NEITHER, FILE_ANY_ACCESS) // ENCRYPTION_BUFFER, DECRYPTION_STATUS_BUFFER
|
|
#define FSCTL_ENCRYPTION_FSCTL_IO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 54, METHOD_NEITHER, FILE_ANY_ACCESS)
|
|
#define FSCTL_WRITE_RAW_ENCRYPTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 55, METHOD_NEITHER, FILE_SPECIAL_ACCESS) // ENCRYPTED_DATA_INFO,
|
|
#define FSCTL_READ_RAW_ENCRYPTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 56, METHOD_NEITHER, FILE_SPECIAL_ACCESS) // REQUEST_RAW_ENCRYPTED_DATA, ENCRYPTED_DATA_INFO
|
|
#define FSCTL_CREATE_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 57, METHOD_NEITHER, FILE_ANY_ACCESS) // CREATE_USN_JOURNAL_DATA,
|
|
#define FSCTL_READ_FILE_USN_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 58, METHOD_NEITHER, FILE_ANY_ACCESS) // Read the Usn Record for a file
|
|
#define FSCTL_WRITE_USN_CLOSE_RECORD CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 59, METHOD_NEITHER, FILE_ANY_ACCESS) // Generate Close Usn Record
|
|
#define FSCTL_EXTEND_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 60, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
#define FSCTL_QUERY_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 61, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
#define FSCTL_DELETE_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 62, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
#define FSCTL_MARK_HANDLE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 63, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
#define FSCTL_SIS_COPYFILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 64, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
#define FSCTL_SIS_LINK_FILES CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 65, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
|
|
#define FSCTL_HSM_MSG CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 66, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
|
|
// decommissioned fsctl value 67
|
|
#define FSCTL_HSM_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 68, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
|
|
#define FSCTL_RECALL_FILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 69, METHOD_NEITHER, FILE_ANY_ACCESS)
|
|
// decommissioned fsctl value 70
|
|
#define FSCTL_READ_FROM_PLEX CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 71, METHOD_OUT_DIRECT, FILE_READ_DATA)
|
|
#define FSCTL_FILE_PREFETCH CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 72, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) // FILE_PREFETCH
|
|
#endif /* _WIN32_WINNT >= 0x0500 */
|
|
|
|
//
|
|
// The following long list of structs are associated with the preceeding
|
|
// file system fsctls.
|
|
//
|
|
|
|
//
|
|
// Structure for FSCTL_IS_PATHNAME_VALID
|
|
//
|
|
|
|
typedef struct _PATHNAME_BUFFER {
|
|
|
|
ULONG PathNameLength;
|
|
WCHAR Name[1];
|
|
|
|
} PATHNAME_BUFFER, *PPATHNAME_BUFFER;
|
|
|
|
//
|
|
// Structure for FSCTL_QUERY_BPB_INFO
|
|
//
|
|
|
|
typedef struct _FSCTL_QUERY_FAT_BPB_BUFFER {
|
|
|
|
UCHAR First0x24BytesOfBootSector[0x24];
|
|
|
|
} FSCTL_QUERY_FAT_BPB_BUFFER, *PFSCTL_QUERY_FAT_BPB_BUFFER;
|
|
|
|
#if(_WIN32_WINNT >= 0x0400)
|
|
//
|
|
// Structures for FSCTL_GET_NTFS_VOLUME_DATA.
|
|
// The user must pass the basic buffer below. Ntfs
|
|
// will return as many fields as available in the extended
|
|
// buffer which follows immediately after the VOLUME_DATA_BUFFER.
|
|
//
|
|
|
|
typedef struct {
|
|
|
|
LARGE_INTEGER VolumeSerialNumber;
|
|
LARGE_INTEGER NumberSectors;
|
|
LARGE_INTEGER TotalClusters;
|
|
LARGE_INTEGER FreeClusters;
|
|
LARGE_INTEGER TotalReserved;
|
|
ULONG BytesPerSector;
|
|
ULONG BytesPerCluster;
|
|
ULONG BytesPerFileRecordSegment;
|
|
ULONG ClustersPerFileRecordSegment;
|
|
LARGE_INTEGER MftValidDataLength;
|
|
LARGE_INTEGER MftStartLcn;
|
|
LARGE_INTEGER Mft2StartLcn;
|
|
LARGE_INTEGER MftZoneStart;
|
|
LARGE_INTEGER MftZoneEnd;
|
|
|
|
} NTFS_VOLUME_DATA_BUFFER, *PNTFS_VOLUME_DATA_BUFFER;
|
|
|
|
typedef struct {
|
|
|
|
ULONG ByteCount;
|
|
|
|
USHORT MajorVersion;
|
|
USHORT MinorVersion;
|
|
|
|
} NTFS_EXTENDED_VOLUME_DATA, *PNTFS_EXTENDED_VOLUME_DATA;
|
|
#endif /* _WIN32_WINNT >= 0x0400 */
|
|
|
|
#if(_WIN32_WINNT >= 0x0400)
|
|
//
|
|
// Structure for FSCTL_GET_VOLUME_BITMAP
|
|
//
|
|
|
|
typedef struct {
|
|
|
|
LARGE_INTEGER StartingLcn;
|
|
|
|
} STARTING_LCN_INPUT_BUFFER, *PSTARTING_LCN_INPUT_BUFFER;
|
|
|
|
typedef struct {
|
|
|
|
LARGE_INTEGER StartingLcn;
|
|
LARGE_INTEGER BitmapSize;
|
|
UCHAR Buffer[1];
|
|
|
|
} VOLUME_BITMAP_BUFFER, *PVOLUME_BITMAP_BUFFER;
|
|
#endif /* _WIN32_WINNT >= 0x0400 */
|
|
|
|
#if(_WIN32_WINNT >= 0x0400)
|
|
//
|
|
// Structure for FSCTL_GET_RETRIEVAL_POINTERS
|
|
//
|
|
|
|
typedef struct {
|
|
|
|
LARGE_INTEGER StartingVcn;
|
|
|
|
} STARTING_VCN_INPUT_BUFFER, *PSTARTING_VCN_INPUT_BUFFER;
|
|
|
|
typedef struct RETRIEVAL_POINTERS_BUFFER {
|
|
|
|
ULONG ExtentCount;
|
|
LARGE_INTEGER StartingVcn;
|
|
struct {
|
|
LARGE_INTEGER NextVcn;
|
|
LARGE_INTEGER Lcn;
|
|
} Extents[1];
|
|
|
|
} RETRIEVAL_POINTERS_BUFFER, *PRETRIEVAL_POINTERS_BUFFER;
|
|
#endif /* _WIN32_WINNT >= 0x0400 */
|
|
|
|
#if(_WIN32_WINNT >= 0x0400)
|
|
//
|
|
// Structures for FSCTL_GET_NTFS_FILE_RECORD
|
|
//
|
|
|
|
typedef struct {
|
|
|
|
LARGE_INTEGER FileReferenceNumber;
|
|
|
|
} NTFS_FILE_RECORD_INPUT_BUFFER, *PNTFS_FILE_RECORD_INPUT_BUFFER;
|
|
|
|
typedef struct {
|
|
|
|
LARGE_INTEGER FileReferenceNumber;
|
|
ULONG FileRecordLength;
|
|
UCHAR FileRecordBuffer[1];
|
|
|
|
} NTFS_FILE_RECORD_OUTPUT_BUFFER, *PNTFS_FILE_RECORD_OUTPUT_BUFFER;
|
|
#endif /* _WIN32_WINNT >= 0x0400 */
|
|
|
|
#if(_WIN32_WINNT >= 0x0400)
|
|
//
|
|
// Structure for FSCTL_MOVE_FILE
|
|
//
|
|
|
|
typedef struct {
|
|
|
|
HANDLE FileHandle;
|
|
LARGE_INTEGER StartingVcn;
|
|
LARGE_INTEGER StartingLcn;
|
|
ULONG ClusterCount;
|
|
|
|
} MOVE_FILE_DATA, *PMOVE_FILE_DATA;
|
|
|
|
#if defined(_WIN64)
|
|
//
|
|
// 32/64 Bit thunking support structure
|
|
//
|
|
|
|
typedef struct _MOVE_FILE_DATA32 {
|
|
|
|
UINT32 FileHandle;
|
|
LARGE_INTEGER StartingVcn;
|
|
LARGE_INTEGER StartingLcn;
|
|
ULONG ClusterCount;
|
|
|
|
} MOVE_FILE_DATA32, *PMOVE_FILE_DATA32;
|
|
#endif
|
|
#endif /* _WIN32_WINNT >= 0x0400 */
|
|
|
|
#if(_WIN32_WINNT >= 0x0500)
|
|
//
|
|
// Structures for FSCTL_FIND_FILES_BY_SID
|
|
//
|
|
|
|
typedef struct {
|
|
ULONG Restart;
|
|
SID Sid;
|
|
} FIND_BY_SID_DATA, *PFIND_BY_SID_DATA;
|
|
|
|
typedef struct {
|
|
ULONG NextEntryOffset;
|
|
ULONG FileIndex;
|
|
ULONG FileNameLength;
|
|
WCHAR FileName[1];
|
|
} FIND_BY_SID_OUTPUT, *PFIND_BY_SID_OUTPUT;
|
|
|
|
#endif /* _WIN32_WINNT >= 0x0500 */
|
|
|
|
#if(_WIN32_WINNT >= 0x0500)
|
|
//
|
|
// The following structures apply to Usn operations.
|
|
//
|
|
|
|
//
|
|
// Structure for FSCTL_ENUM_USN_DATA
|
|
//
|
|
|
|
typedef struct {
|
|
|
|
ULONGLONG StartFileReferenceNumber;
|
|
USN LowUsn;
|
|
USN HighUsn;
|
|
|
|
} MFT_ENUM_DATA, *PMFT_ENUM_DATA;
|
|
|
|
//
|
|
// Structure for FSCTL_CREATE_USN_JOURNAL
|
|
//
|
|
|
|
typedef struct {
|
|
|
|
ULONGLONG MaximumSize;
|
|
ULONGLONG AllocationDelta;
|
|
|
|
} CREATE_USN_JOURNAL_DATA, *PCREATE_USN_JOURNAL_DATA;
|
|
|
|
//
|
|
// Structure for FSCTL_READ_USN_JOURNAL
|
|
//
|
|
|
|
typedef struct {
|
|
|
|
USN StartUsn;
|
|
ULONG ReasonMask;
|
|
ULONG ReturnOnlyOnClose;
|
|
ULONGLONG Timeout;
|
|
ULONGLONG BytesToWaitFor;
|
|
ULONGLONG UsnJournalID;
|
|
|
|
} READ_USN_JOURNAL_DATA, *PREAD_USN_JOURNAL_DATA;
|
|
|
|
//
|
|
// The initial Major.Minor version of the Usn record will be 2.0.
|
|
// In general, the MinorVersion may be changed if fields are added
|
|
// to this structure in such a way that the previous version of the
|
|
// software can still correctly the fields it knows about. The
|
|
// MajorVersion should only be changed if the previous version of
|
|
// any software using this structure would incorrectly handle new
|
|
// records due to structure changes.
|
|
//
|
|
// The first update to this will force the structure to version 2.0.
|
|
// This will add the extended information about the source as
|
|
// well as indicate the file name offset within the structure.
|
|
//
|
|
// The following structure is returned with these fsctls.
|
|
//
|
|
// FSCTL_READ_USN_JOURNAL
|
|
// FSCTL_READ_FILE_USN_DATA
|
|
// FSCTL_ENUM_USN_DATA
|
|
//
|
|
|
|
typedef struct {
|
|
|
|
ULONG RecordLength;
|
|
USHORT MajorVersion;
|
|
USHORT MinorVersion;
|
|
ULONGLONG FileReferenceNumber;
|
|
ULONGLONG ParentFileReferenceNumber;
|
|
USN Usn;
|
|
LARGE_INTEGER TimeStamp;
|
|
ULONG Reason;
|
|
ULONG SourceInfo;
|
|
ULONG SecurityId;
|
|
ULONG FileAttributes;
|
|
USHORT FileNameLength;
|
|
USHORT FileNameOffset;
|
|
WCHAR FileName[1];
|
|
|
|
} USN_RECORD, *PUSN_RECORD;
|
|
|
|
#define USN_PAGE_SIZE (0x1000)
|
|
|
|
#define USN_REASON_DATA_OVERWRITE (0x00000001)
|
|
#define USN_REASON_DATA_EXTEND (0x00000002)
|
|
#define USN_REASON_DATA_TRUNCATION (0x00000004)
|
|
#define USN_REASON_NAMED_DATA_OVERWRITE (0x00000010)
|
|
#define USN_REASON_NAMED_DATA_EXTEND (0x00000020)
|
|
#define USN_REASON_NAMED_DATA_TRUNCATION (0x00000040)
|
|
#define USN_REASON_FILE_CREATE (0x00000100)
|
|
#define USN_REASON_FILE_DELETE (0x00000200)
|
|
#define USN_REASON_EA_CHANGE (0x00000400)
|
|
#define USN_REASON_SECURITY_CHANGE (0x00000800)
|
|
#define USN_REASON_RENAME_OLD_NAME (0x00001000)
|
|
#define USN_REASON_RENAME_NEW_NAME (0x00002000)
|
|
#define USN_REASON_INDEXABLE_CHANGE (0x00004000)
|
|
#define USN_REASON_BASIC_INFO_CHANGE (0x00008000)
|
|
#define USN_REASON_HARD_LINK_CHANGE (0x00010000)
|
|
#define USN_REASON_COMPRESSION_CHANGE (0x00020000)
|
|
#define USN_REASON_ENCRYPTION_CHANGE (0x00040000)
|
|
#define USN_REASON_OBJECT_ID_CHANGE (0x00080000)
|
|
#define USN_REASON_REPARSE_POINT_CHANGE (0x00100000)
|
|
#define USN_REASON_STREAM_CHANGE (0x00200000)
|
|
|
|
#define USN_REASON_CLOSE (0x80000000)
|
|
|
|
//
|
|
// Structure for FSCTL_QUERY_USN_JOUNAL
|
|
//
|
|
|
|
typedef struct {
|
|
|
|
ULONGLONG UsnJournalID;
|
|
USN FirstUsn;
|
|
USN NextUsn;
|
|
USN LowestValidUsn;
|
|
USN MaxUsn;
|
|
ULONGLONG MaximumSize;
|
|
ULONGLONG AllocationDelta;
|
|
|
|
} USN_JOURNAL_DATA, *PUSN_JOURNAL_DATA;
|
|
|
|
//
|
|
// Structure for FSCTL_DELETE_USN_JOURNAL
|
|
//
|
|
|
|
typedef struct {
|
|
|
|
ULONGLONG UsnJournalID;
|
|
ULONG DeleteFlags;
|
|
|
|
} DELETE_USN_JOURNAL_DATA, *PDELETE_USN_JOURNAL_DATA;
|
|
|
|
#define USN_DELETE_FLAG_DELETE (0x00000001)
|
|
#define USN_DELETE_FLAG_NOTIFY (0x00000002)
|
|
|
|
#define USN_DELETE_VALID_FLAGS (0x00000003)
|
|
|
|
//
|
|
// Structure for FSCTL_MARK_HANDLE
|
|
//
|
|
|
|
typedef struct {
|
|
|
|
ULONG UsnSourceInfo;
|
|
HANDLE VolumeHandle;
|
|
ULONG HandleInfo;
|
|
|
|
} MARK_HANDLE_INFO, *PMARK_HANDLE_INFO;
|
|
|
|
#if defined(_WIN64)
|
|
//
|
|
// 32/64 Bit thunking support structure
|
|
//
|
|
|
|
typedef struct {
|
|
|
|
ULONG UsnSourceInfo;
|
|
UINT32 VolumeHandle;
|
|
ULONG HandleInfo;
|
|
|
|
} MARK_HANDLE_INFO32, *PMARK_HANDLE_INFO32;
|
|
#endif
|
|
|
|
//
|
|
// Flags for the additional source information above.
|
|
//
|
|
// USN_SOURCE_DATA_MANAGEMENT - Service is not modifying the external view
|
|
// of any part of the file. Typical case is HSM moving data to
|
|
// and from external storage.
|
|
//
|
|
// USN_SOURCE_AUXILIARY_DATA - Service is not modifying the external view
|
|
// of the file with regard to the application that created this file.
|
|
// Can be used to add private data streams to a file.
|
|
//
|
|
// USN_SOURCE_REPLICATION_MANAGEMENT - Service is modifying a file to match
|
|
// the contents of the same file which exists in another member of the
|
|
// replica set.
|
|
//
|
|
|
|
#define USN_SOURCE_DATA_MANAGEMENT (0x00000001)
|
|
#define USN_SOURCE_AUXILIARY_DATA (0x00000002)
|
|
#define USN_SOURCE_REPLICATION_MANAGEMENT (0x00000004)
|
|
|
|
//
|
|
// Flags for the HandleInfo field above
|
|
//
|
|
// MARK_HANDLE_PROTECT_CLUSTERS - disallow any defragmenting (FSCTL_MOVE_FILE) until the
|
|
// the handle is closed
|
|
//
|
|
|
|
#define MARK_HANDLE_PROTECT_CLUSTERS (0x00000001)
|
|
|
|
#endif /* _WIN32_WINNT >= 0x0500 */
|
|
|
|
#if(_WIN32_WINNT >= 0x0500)
|
|
//
|
|
// Structure for FSCTL_SECURITY_ID_CHECK
|
|
//
|
|
|
|
typedef struct {
|
|
|
|
ACCESS_MASK DesiredAccess;
|
|
ULONG SecurityIds[1];
|
|
|
|
} BULK_SECURITY_TEST_DATA, *PBULK_SECURITY_TEST_DATA;
|
|
#endif /* _WIN32_WINNT >= 0x0500 */
|
|
|
|
#if(_WIN32_WINNT >= 0x0500)
|
|
//
|
|
// Output flags for the FSCTL_IS_VOLUME_DIRTY
|
|
//
|
|
|
|
#define VOLUME_IS_DIRTY (0x00000001)
|
|
#define VOLUME_UPGRADE_SCHEDULED (0x00000002)
|
|
#endif /* _WIN32_WINNT >= 0x0500 */
|
|
|
|
//
|
|
// Structures for FSCTL_FILE_PREFETCH
|
|
//
|
|
|
|
typedef struct _FILE_PREFETCH {
|
|
ULONG Type;
|
|
ULONG Count;
|
|
ULONGLONG Prefetch[1];
|
|
} FILE_PREFETCH, *PFILE_PREFETCH;
|
|
|
|
#define FILE_PREFETCH_TYPE_FOR_CREATE 0x1
|
|
|
|
// Structures for FSCTL_FILESYSTEM_GET_STATISTICS
|
|
//
|
|
// Filesystem performance counters
|
|
//
|
|
|
|
typedef struct _FILESYSTEM_STATISTICS {
|
|
|
|
USHORT FileSystemType;
|
|
USHORT Version; // currently version 1
|
|
|
|
ULONG SizeOfCompleteStructure; // must by a mutiple of 64 bytes
|
|
|
|
ULONG UserFileReads;
|
|
ULONG UserFileReadBytes;
|
|
ULONG UserDiskReads;
|
|
ULONG UserFileWrites;
|
|
ULONG UserFileWriteBytes;
|
|
ULONG UserDiskWrites;
|
|
|
|
ULONG MetaDataReads;
|
|
ULONG MetaDataReadBytes;
|
|
ULONG MetaDataDiskReads;
|
|
ULONG MetaDataWrites;
|
|
ULONG MetaDataWriteBytes;
|
|
ULONG MetaDataDiskWrites;
|
|
|
|
//
|
|
// The file system's private structure is appended here.
|
|
//
|
|
|
|
} FILESYSTEM_STATISTICS, *PFILESYSTEM_STATISTICS;
|
|
|
|
// values for FS_STATISTICS.FileSystemType
|
|
|
|
#define FILESYSTEM_STATISTICS_TYPE_NTFS 1
|
|
#define FILESYSTEM_STATISTICS_TYPE_FAT 2
|
|
|
|
//
|
|
// File System Specific Statistics Data
|
|
//
|
|
|
|
typedef struct _FAT_STATISTICS {
|
|
ULONG CreateHits;
|
|
ULONG SuccessfulCreates;
|
|
ULONG FailedCreates;
|
|
|
|
ULONG NonCachedReads;
|
|
ULONG NonCachedReadBytes;
|
|
ULONG NonCachedWrites;
|
|
ULONG NonCachedWriteBytes;
|
|
|
|
ULONG NonCachedDiskReads;
|
|
ULONG NonCachedDiskWrites;
|
|
} FAT_STATISTICS, *PFAT_STATISTICS;
|
|
|
|
typedef struct _NTFS_STATISTICS {
|
|
|
|
ULONG LogFileFullExceptions;
|
|
ULONG OtherExceptions;
|
|
|
|
//
|
|
// Other meta data io's
|
|
//
|
|
|
|
ULONG MftReads;
|
|
ULONG MftReadBytes;
|
|
ULONG MftWrites;
|
|
ULONG MftWriteBytes;
|
|
struct {
|
|
USHORT Write;
|
|
USHORT Create;
|
|
USHORT SetInfo;
|
|
USHORT Flush;
|
|
} MftWritesUserLevel;
|
|
|
|
USHORT MftWritesFlushForLogFileFull;
|
|
USHORT MftWritesLazyWriter;
|
|
USHORT MftWritesUserRequest;
|
|
|
|
ULONG Mft2Writes;
|
|
ULONG Mft2WriteBytes;
|
|
struct {
|
|
USHORT Write;
|
|
USHORT Create;
|
|
USHORT SetInfo;
|
|
USHORT Flush;
|
|
} Mft2WritesUserLevel;
|
|
|
|
USHORT Mft2WritesFlushForLogFileFull;
|
|
USHORT Mft2WritesLazyWriter;
|
|
USHORT Mft2WritesUserRequest;
|
|
|
|
ULONG RootIndexReads;
|
|
ULONG RootIndexReadBytes;
|
|
ULONG RootIndexWrites;
|
|
ULONG RootIndexWriteBytes;
|
|
|
|
ULONG BitmapReads;
|
|
ULONG BitmapReadBytes;
|
|
ULONG BitmapWrites;
|
|
ULONG BitmapWriteBytes;
|
|
|
|
USHORT BitmapWritesFlushForLogFileFull;
|
|
USHORT BitmapWritesLazyWriter;
|
|
USHORT BitmapWritesUserRequest;
|
|
|
|
struct {
|
|
USHORT Write;
|
|
USHORT Create;
|
|
USHORT SetInfo;
|
|
} BitmapWritesUserLevel;
|
|
|
|
ULONG MftBitmapReads;
|
|
ULONG MftBitmapReadBytes;
|
|
ULONG MftBitmapWrites;
|
|
ULONG MftBitmapWriteBytes;
|
|
|
|
USHORT MftBitmapWritesFlushForLogFileFull;
|
|
USHORT MftBitmapWritesLazyWriter;
|
|
USHORT MftBitmapWritesUserRequest;
|
|
|
|
struct {
|
|
USHORT Write;
|
|
USHORT Create;
|
|
USHORT SetInfo;
|
|
USHORT Flush;
|
|
} MftBitmapWritesUserLevel;
|
|
|
|
ULONG UserIndexReads;
|
|
ULONG UserIndexReadBytes;
|
|
ULONG UserIndexWrites;
|
|
ULONG UserIndexWriteBytes;
|
|
|
|
//
|
|
// Additions for NT 5.0
|
|
//
|
|
|
|
ULONG LogFileReads;
|
|
ULONG LogFileReadBytes;
|
|
ULONG LogFileWrites;
|
|
ULONG LogFileWriteBytes;
|
|
|
|
struct {
|
|
ULONG Calls; // number of individual calls to allocate clusters
|
|
ULONG Clusters; // number of clusters allocated
|
|
ULONG Hints; // number of times a hint was specified
|
|
|
|
ULONG RunsReturned; // number of runs used to satisify all the requests
|
|
|
|
ULONG HintsHonored; // number of times the hint was useful
|
|
ULONG HintsClusters; // number of clusters allocated via the hint
|
|
ULONG Cache; // number of times the cache was useful other than the hint
|
|
ULONG CacheClusters; // number of clusters allocated via the cache other than the hint
|
|
ULONG CacheMiss; // number of times the cache wasn't useful
|
|
ULONG CacheMissClusters; // number of clusters allocated without the cache
|
|
} Allocate;
|
|
|
|
} NTFS_STATISTICS, *PNTFS_STATISTICS;
|
|
|
|
#if(_WIN32_WINNT >= 0x0500)
|
|
//
|
|
// Structure for FSCTL_SET_OBJECT_ID, FSCTL_GET_OBJECT_ID, and FSCTL_CREATE_OR_GET_OBJECT_ID
|
|
//
|
|
|
|
#if _MSC_VER >= 1200
|
|
#pragma warning(push)
|
|
#endif
|
|
#pragma warning(disable:4201) // unnamed struct
|
|
|
|
typedef struct _FILE_OBJECTID_BUFFER {
|
|
|
|
//
|
|
// This is the portion of the object id that is indexed.
|
|
//
|
|
|
|
UCHAR ObjectId[16];
|
|
|
|
//
|
|
// This portion of the object id is not indexed, it's just
|
|
// some metadata for the user's benefit.
|
|
//
|
|
|
|
union {
|
|
struct {
|
|
UCHAR BirthVolumeId[16];
|
|
UCHAR BirthObjectId[16];
|
|
UCHAR DomainId[16];
|
|
} ;
|
|
UCHAR ExtendedInfo[48];
|
|
};
|
|
|
|
} FILE_OBJECTID_BUFFER, *PFILE_OBJECTID_BUFFER;
|
|
|
|
#if _MSC_VER >= 1200
|
|
#pragma warning(pop)
|
|
#else
|
|
#pragma warning( default : 4201 )
|
|
#endif
|
|
|
|
#endif /* _WIN32_WINNT >= 0x0500 */
|
|
|
|
|
|
#if(_WIN32_WINNT >= 0x0500)
|
|
//
|
|
// Structure for FSCTL_SET_SPARSE
|
|
//
|
|
|
|
typedef struct _FILE_SET_SPARSE_BUFFER {
|
|
BOOLEAN SetSparse;
|
|
} FILE_SET_SPARSE_BUFFER, *PFILE_SET_SPARSE_BUFFER;
|
|
|
|
|
|
#endif /* _WIN32_WINNT >= 0x0500 */
|
|
|
|
|
|
#if(_WIN32_WINNT >= 0x0500)
|
|
//
|
|
// Structure for FSCTL_SET_ZERO_DATA
|
|
//
|
|
|
|
typedef struct _FILE_ZERO_DATA_INFORMATION {
|
|
|
|
LARGE_INTEGER FileOffset;
|
|
LARGE_INTEGER BeyondFinalZero;
|
|
|
|
} FILE_ZERO_DATA_INFORMATION, *PFILE_ZERO_DATA_INFORMATION;
|
|
#endif /* _WIN32_WINNT >= 0x0500 */
|
|
|
|
#if(_WIN32_WINNT >= 0x0500)
|
|
//
|
|
// Structure for FSCTL_QUERY_ALLOCATED_RANGES
|
|
//
|
|
|
|
//
|
|
// Querying the allocated ranges requires an output buffer to store the
|
|
// allocated ranges and an input buffer to specify the range to query.
|
|
// The input buffer contains a single entry, the output buffer is an
|
|
// array of the following structure.
|
|
//
|
|
|
|
typedef struct _FILE_ALLOCATED_RANGE_BUFFER {
|
|
|
|
LARGE_INTEGER FileOffset;
|
|
LARGE_INTEGER Length;
|
|
|
|
} FILE_ALLOCATED_RANGE_BUFFER, *PFILE_ALLOCATED_RANGE_BUFFER;
|
|
#endif /* _WIN32_WINNT >= 0x0500 */
|
|
|
|
#if(_WIN32_WINNT >= 0x0500)
|
|
//
|
|
// Structures for FSCTL_SET_ENCRYPTION, FSCTL_WRITE_RAW_ENCRYPTED, and FSCTL_READ_RAW_ENCRYPTED
|
|
//
|
|
|
|
//
|
|
// The input buffer to set encryption indicates whether we are to encrypt/decrypt a file
|
|
// or an individual stream.
|
|
//
|
|
|
|
typedef struct _ENCRYPTION_BUFFER {
|
|
|
|
ULONG EncryptionOperation;
|
|
UCHAR Private[1];
|
|
|
|
} ENCRYPTION_BUFFER, *PENCRYPTION_BUFFER;
|
|
|
|
#define FILE_SET_ENCRYPTION 0x00000001
|
|
#define FILE_CLEAR_ENCRYPTION 0x00000002
|
|
#define STREAM_SET_ENCRYPTION 0x00000003
|
|
#define STREAM_CLEAR_ENCRYPTION 0x00000004
|
|
|
|
#define MAXIMUM_ENCRYPTION_VALUE 0x00000004
|
|
|
|
//
|
|
// The optional output buffer to set encryption indicates that the last encrypted
|
|
// stream in a file has been marked as decrypted.
|
|
//
|
|
|
|
typedef struct _DECRYPTION_STATUS_BUFFER {
|
|
|
|
BOOLEAN NoEncryptedStreams;
|
|
|
|
} DECRYPTION_STATUS_BUFFER, *PDECRYPTION_STATUS_BUFFER;
|
|
|
|
#define ENCRYPTION_FORMAT_DEFAULT (0x01)
|
|
|
|
#define COMPRESSION_FORMAT_SPARSE (0x4000)
|
|
|
|
//
|
|
// Request Encrypted Data structure. This is used to indicate
|
|
// the range of the file to read. It also describes the
|
|
// output buffer used to return the data.
|
|
//
|
|
|
|
typedef struct _REQUEST_RAW_ENCRYPTED_DATA {
|
|
|
|
//
|
|
// Requested file offset and requested length to read.
|
|
// The fsctl will round the starting offset down
|
|
// to a file system boundary. It will also
|
|
// round the length up to a file system boundary.
|
|
//
|
|
|
|
LONGLONG FileOffset;
|
|
ULONG Length;
|
|
|
|
} REQUEST_RAW_ENCRYPTED_DATA, *PREQUEST_RAW_ENCRYPTED_DATA;
|
|
|
|
//
|
|
// Encrypted Data Information structure. This structure
|
|
// is used to return raw encrypted data from a file in
|
|
// order to perform off-line recovery. The data will be
|
|
// encrypted or encrypted and compressed. The off-line
|
|
// service will need to use the encryption and compression
|
|
// format information to recover the file data. In the
|
|
// event that the data is both encrypted and compressed then
|
|
// the decryption must occur before decompression. All
|
|
// the data units below must be encrypted and compressed
|
|
// with the same format.
|
|
//
|
|
// The data will be returned in units. The data unit size
|
|
// will be fixed per request. If the data is compressed
|
|
// then the data unit size will be the compression unit size.
|
|
//
|
|
// This structure is at the beginning of the buffer used to
|
|
// return the encrypted data. The actual raw bytes from
|
|
// the file will follow this buffer. The offset of the
|
|
// raw bytes from the beginning of this structure is
|
|
// specified in the REQUEST_RAW_ENCRYPTED_DATA structure
|
|
// described above.
|
|
//
|
|
|
|
typedef struct _ENCRYPTED_DATA_INFO {
|
|
|
|
//
|
|
// This is the file offset for the first entry in the
|
|
// data block array. The file system will round
|
|
// the requested start offset down to a boundary
|
|
// that is consistent with the format of the file.
|
|
//
|
|
|
|
ULONGLONG StartingFileOffset;
|
|
|
|
//
|
|
// Data offset in output buffer. The output buffer
|
|
// begins with an ENCRYPTED_DATA_INFO structure.
|
|
// The file system will then store the raw bytes from
|
|
// disk beginning at the following offset within the
|
|
// output buffer.
|
|
//
|
|
|
|
ULONG OutputBufferOffset;
|
|
|
|
//
|
|
// The number of bytes being returned that are within
|
|
// the size of the file. If this value is less than
|
|
// (NumberOfDataBlocks << DataUnitShift), it means the
|
|
// end of the file occurs within this transfer. Any
|
|
// data beyond file size is invalid and was never
|
|
// passed to the encryption driver.
|
|
//
|
|
|
|
ULONG BytesWithinFileSize;
|
|
|
|
//
|
|
// The number of bytes being returned that are below
|
|
// valid data length. If this value is less than
|
|
// (NumberOfDataBlocks << DataUnitShift), it means the
|
|
// end of the valid data occurs within this transfer.
|
|
// After decrypting the data from this transfer, any
|
|
// byte(s) beyond valid data length must be zeroed.
|
|
//
|
|
|
|
ULONG BytesWithinValidDataLength;
|
|
|
|
//
|
|
// Code for the compression format as defined in
|
|
// ntrtl.h. Note that COMPRESSION_FORMAT_NONE
|
|
// and COMPRESSION_FORMAT_DEFAULT are invalid if
|
|
// any of the described chunks are compressed.
|
|
//
|
|
|
|
USHORT CompressionFormat;
|
|
|
|
//
|
|
// The DataUnit is the granularity used to access the
|
|
// disk. It will be the same as the compression unit
|
|
// size for a compressed file. For an uncompressed
|
|
// file, it will be some cluster-aligned power of 2 that
|
|
// the file system deems convenient. A caller should
|
|
// not expect that successive calls will have the
|
|
// same data unit shift value as the previous call.
|
|
//
|
|
// Since chunks and compression units are expected to be
|
|
// powers of 2 in size, we express them log2. So, for
|
|
// example (1 << ChunkShift) == ChunkSizeInBytes. The
|
|
// ClusterShift indicates how much space must be saved
|
|
// to successfully compress a compression unit - each
|
|
// successfully compressed data unit must occupy
|
|
// at least one cluster less in bytes than an uncompressed
|
|
// data block unit.
|
|
//
|
|
|
|
UCHAR DataUnitShift;
|
|
UCHAR ChunkShift;
|
|
UCHAR ClusterShift;
|
|
|
|
//
|
|
// The format for the encryption.
|
|
//
|
|
|
|
UCHAR EncryptionFormat;
|
|
|
|
//
|
|
// This is the number of entries in the data block size
|
|
// array.
|
|
//
|
|
|
|
USHORT NumberOfDataBlocks;
|
|
|
|
//
|
|
// This is an array of sizes in the data block array. There
|
|
// must be one entry in this array for each data block
|
|
// read from disk. The size has a different meaning
|
|
// depending on whether the file is compressed.
|
|
//
|
|
// A size of zero always indicates that the final data consists entirely
|
|
// of zeroes. There is no decryption or decompression to
|
|
// perform.
|
|
//
|
|
// If the file is compressed then the data block size indicates
|
|
// whether this block is compressed. A size equal to
|
|
// the block size indicates that the corresponding block did
|
|
// not compress. Any other non-zero size indicates the
|
|
// size of the compressed data which needs to be
|
|
// decrypted/decompressed.
|
|
//
|
|
// If the file is not compressed then the data block size
|
|
// indicates the amount of data within the block that
|
|
// needs to be decrypted. Any other non-zero size indicates
|
|
// that the remaining bytes in the data unit within the file
|
|
// consists of zeros. An example of this is when the
|
|
// the read spans the valid data length of the file. There
|
|
// is no data to decrypt past the valid data length.
|
|
//
|
|
|
|
ULONG DataBlockSize[ANYSIZE_ARRAY];
|
|
|
|
} ENCRYPTED_DATA_INFO;
|
|
typedef ENCRYPTED_DATA_INFO *PENCRYPTED_DATA_INFO;
|
|
#endif /* _WIN32_WINNT >= 0x0500 */
|
|
|
|
#if(_WIN32_WINNT >= 0x0500)
|
|
//
|
|
// FSCTL_READ_FROM_PLEX support
|
|
// Request Plex Read Data structure. This is used to indicate
|
|
// the range of the file to read. It also describes
|
|
// which plex to perform the read from.
|
|
//
|
|
|
|
typedef struct _PLEX_READ_DATA_REQUEST {
|
|
|
|
//
|
|
// Requested offset and length to read.
|
|
// The offset can be the virtual offset (vbo) in to a file,
|
|
// or a volume. In the case of a file offset,
|
|
// the fsd will round the starting offset down
|
|
// to a file system boundary. It will also
|
|
// round the length up to a file system boundary and
|
|
// enforce any other applicable limits.
|
|
//
|
|
|
|
LARGE_INTEGER ByteOffset;
|
|
ULONG ByteLength;
|
|
ULONG PlexNumber;
|
|
|
|
} PLEX_READ_DATA_REQUEST, *PPLEX_READ_DATA_REQUEST;
|
|
#endif /* _WIN32_WINNT >= 0x0500 */
|
|
|
|
#if(_WIN32_WINNT >= 0x0500)
|
|
//
|
|
// FSCTL_SIS_COPYFILE support
|
|
// Source and destination file names are passed in the FileNameBuffer.
|
|
// Both strings are null terminated, with the source name starting at
|
|
// the beginning of FileNameBuffer, and the destination name immediately
|
|
// following. Length fields include terminating nulls.
|
|
//
|
|
|
|
typedef struct _SI_COPYFILE {
|
|
ULONG SourceFileNameLength;
|
|
ULONG DestinationFileNameLength;
|
|
ULONG Flags;
|
|
WCHAR FileNameBuffer[1];
|
|
} SI_COPYFILE, *PSI_COPYFILE;
|
|
|
|
#define COPYFILE_SIS_LINK 0x0001 // Copy only if source is SIS
|
|
#define COPYFILE_SIS_REPLACE 0x0002 // Replace destination if it exists, otherwise don't.
|
|
#define COPYFILE_SIS_FLAGS 0x0003
|
|
#endif /* _WIN32_WINNT >= 0x0500 */
|
|
|
|
#endif // _FILESYSTEMFSCTL_
|
|
|
|
// end_winioctl
|
|
|
|
//
|
|
// Structures for FSCTL_SET_REPARSE_POINT, FSCTL_GET_REPARSE_POINT, and FSCTL_DELETE_REPARSE_POINT
|
|
//
|
|
|
|
//
|
|
// The reparse structure is used by layered drivers to store data in a
|
|
// reparse point. The constraints on reparse tags are defined below.
|
|
// This version of the reparse data buffer is only for Microsoft tags.
|
|
//
|
|
|
|
#if _MSC_VER >= 1200
|
|
#pragma warning(push)
|
|
#endif
|
|
#pragma warning(disable:4201) // unnamed struct
|
|
|
|
typedef struct _REPARSE_DATA_BUFFER {
|
|
ULONG ReparseTag;
|
|
USHORT ReparseDataLength;
|
|
USHORT Reserved;
|
|
union {
|
|
struct {
|
|
USHORT SubstituteNameOffset;
|
|
USHORT SubstituteNameLength;
|
|
USHORT PrintNameOffset;
|
|
USHORT PrintNameLength;
|
|
WCHAR PathBuffer[1];
|
|
} SymbolicLinkReparseBuffer;
|
|
struct {
|
|
USHORT SubstituteNameOffset;
|
|
USHORT SubstituteNameLength;
|
|
USHORT PrintNameOffset;
|
|
USHORT PrintNameLength;
|
|
WCHAR PathBuffer[1];
|
|
} MountPointReparseBuffer;
|
|
struct {
|
|
UCHAR DataBuffer[1];
|
|
} GenericReparseBuffer;
|
|
};
|
|
} REPARSE_DATA_BUFFER, *PREPARSE_DATA_BUFFER;
|
|
|
|
#if _MSC_VER >= 1200
|
|
#pragma warning(pop)
|
|
#else
|
|
#pragma warning( default : 4201 )
|
|
#endif
|
|
|
|
#define REPARSE_DATA_BUFFER_HEADER_SIZE FIELD_OFFSET(REPARSE_DATA_BUFFER, GenericReparseBuffer)
|
|
|
|
|
|
// begin_winnt
|
|
//
|
|
// The reparse GUID structure is used by all 3rd party layered drivers to
|
|
// store data in a reparse point. For non-Microsoft tags, The GUID field
|
|
// cannot be GUID_NULL.
|
|
// The constraints on reparse tags are defined below.
|
|
// Microsoft tags can also be used with this format of the reparse point buffer.
|
|
//
|
|
|
|
typedef struct _REPARSE_GUID_DATA_BUFFER {
|
|
ULONG ReparseTag;
|
|
USHORT ReparseDataLength;
|
|
USHORT Reserved;
|
|
GUID ReparseGuid;
|
|
struct {
|
|
UCHAR DataBuffer[1];
|
|
} GenericReparseBuffer;
|
|
} REPARSE_GUID_DATA_BUFFER, *PREPARSE_GUID_DATA_BUFFER;
|
|
|
|
#define REPARSE_GUID_DATA_BUFFER_HEADER_SIZE FIELD_OFFSET(REPARSE_GUID_DATA_BUFFER, GenericReparseBuffer)
|
|
|
|
|
|
// end_winnt end_ntifs
|
|
|
|
//
|
|
// The reparse information structure is used to return information about
|
|
// a reparse point to the caller.
|
|
//
|
|
|
|
typedef struct _REPARSE_POINT_INFORMATION {
|
|
USHORT ReparseDataLength;
|
|
USHORT UnparsedNameLength;
|
|
} REPARSE_POINT_INFORMATION, *PREPARSE_POINT_INFORMATION;
|
|
|
|
// begin_winnt begin_ntifs
|
|
|
|
//
|
|
// Maximum allowed size of the reparse data.
|
|
//
|
|
|
|
#define MAXIMUM_REPARSE_DATA_BUFFER_SIZE ( 16 * 1024 )
|
|
|
|
//
|
|
// Predefined reparse tags.
|
|
// These tags need to avoid conflicting with IO_REMOUNT defined in ntos\inc\io.h
|
|
//
|
|
|
|
#define IO_REPARSE_TAG_RESERVED_ZERO (0)
|
|
#define IO_REPARSE_TAG_RESERVED_ONE (1)
|
|
|
|
//
|
|
// The value of the following constant needs to satisfy the following conditions:
|
|
// (1) Be at least as large as the largest of the reserved tags.
|
|
// (2) Be strictly smaller than all the tags in use.
|
|
//
|
|
|
|
#define IO_REPARSE_TAG_RESERVED_RANGE IO_REPARSE_TAG_RESERVED_ONE
|
|
|
|
//
|
|
// The reparse tags are a ULONG. The 32 bits are laid out as follows:
|
|
//
|
|
// 3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1
|
|
// 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
|
|
// +-+-+-+-+-----------------------+-------------------------------+
|
|
// |M|R|N|R| Reserved bits | Reparse Tag Value |
|
|
// +-+-+-+-+-----------------------+-------------------------------+
|
|
//
|
|
// M is the Microsoft bit. When set to 1, it denotes a tag owned by Microsoft.
|
|
// All ISVs must use a tag with a 0 in this position.
|
|
// Note: If a Microsoft tag is used by non-Microsoft software, the
|
|
// behavior is not defined.
|
|
//
|
|
// R is reserved. Must be zero for non-Microsoft tags.
|
|
//
|
|
// N is name surrogate. When set to 1, the file represents another named
|
|
// entity in the system.
|
|
//
|
|
// The M and N bits are OR-able.
|
|
// The following macros check for the M and N bit values:
|
|
//
|
|
|
|
//
|
|
// Macro to determine whether a reparse point tag corresponds to a tag
|
|
// owned by Microsoft.
|
|
//
|
|
|
|
#define IsReparseTagMicrosoft(_tag) ( \
|
|
((_tag) & 0x80000000) \
|
|
)
|
|
|
|
//
|
|
// Macro to determine whether a reparse point tag is a name surrogate
|
|
//
|
|
|
|
#define IsReparseTagNameSurrogate(_tag) ( \
|
|
((_tag) & 0x20000000) \
|
|
)
|
|
|
|
// end_winnt
|
|
|
|
//
|
|
// The following constant represents the bits that are valid to use in
|
|
// reparse tags.
|
|
//
|
|
|
|
#define IO_REPARSE_TAG_VALID_VALUES (0xF000FFFF)
|
|
|
|
//
|
|
// Macro to determine whether a reparse tag is a valid tag.
|
|
//
|
|
|
|
#define IsReparseTagValid(_tag) ( \
|
|
!((_tag) & ~IO_REPARSE_TAG_VALID_VALUES) && \
|
|
((_tag) > IO_REPARSE_TAG_RESERVED_RANGE) \
|
|
)
|
|
|
|
//
|
|
// Microsoft tags for reparse points.
|
|
//
|
|
|
|
#define IO_REPARSE_TAG_SYMBOLIC_LINK IO_REPARSE_TAG_RESERVED_ZERO
|
|
#define IO_REPARSE_TAG_MOUNT_POINT (0xA0000003L) // winnt ntifs
|
|
#define IO_REPARSE_TAG_HSM (0xC0000004L) // winnt ntifs
|
|
#define IO_REPARSE_TAG_SIS (0x80000007L) // winnt ntifs
|
|
|
|
//
|
|
// The reparse tag 0x80000008 is reserved for Microsoft internal use
|
|
// (may be published in the future)
|
|
//
|
|
|
|
//
|
|
// Microsoft reparse tag reserved for DFS
|
|
//
|
|
|
|
#define IO_REPARSE_TAG_DFS (0x8000000AL) // winnt ntifs
|
|
|
|
//
|
|
// Microsoft reparse tag reserved for the file system filter manager
|
|
//
|
|
|
|
#define IO_REPARSE_TAG_FILTER_MANAGER (0x8000000BL) // winnt ntifs
|
|
|
|
|
|
//
|
|
// Non-Microsoft tags for reparse points
|
|
//
|
|
|
|
//
|
|
// Tag allocated to CONGRUENT, May 2000. Used by IFSTEST
|
|
//
|
|
|
|
#define IO_REPARSE_TAG_IFSTEST_CONGRUENT (0x00000009L)
|
|
|
|
//
|
|
// Tag allocated to ARKIVIO
|
|
//
|
|
|
|
#define IO_REPARSE_TAG_ARKIVIO (0x0000000CL)
|
|
|
|
//
|
|
// Tag allocated to SOLUTIONSOFT
|
|
//
|
|
|
|
#define IO_REPARSE_TAG_SOLUTIONSOFT (0x2000000DL)
|
|
|
|
|
|
//
|
|
// Tag allocated to COMMVAULT
|
|
//
|
|
|
|
#define IO_REPARSE_TAG_COMMVAULT (0x0000000EL)
|
|
|
|
|
|
//
|
|
// The following three FSCTLs are placed in this file to facilitate sharing
|
|
// between the redirector and the IO subsystem
|
|
//
|
|
// This FSCTL is used to garner the link tracking information for a file.
|
|
// The data structures used for retreving the information are
|
|
// LINK_TRACKING_INFORMATION defined further down in this file.
|
|
//
|
|
|
|
#define FSCTL_LMR_GET_LINK_TRACKING_INFORMATION CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM,58,METHOD_BUFFERED,FILE_ANY_ACCESS)
|
|
|
|
//
|
|
// This FSCTL is used to update the link tracking information on a server for
|
|
// an intra machine/ inter volume move on that server
|
|
//
|
|
|
|
#define FSCTL_LMR_SET_LINK_TRACKING_INFORMATION CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM,59,METHOD_BUFFERED,FILE_ANY_ACCESS)
|
|
|
|
//
|
|
// The following IOCTL is used in link tracking implementation. It determines if the
|
|
// two file objects passed in are on the same server. This IOCTL is available in
|
|
// kernel mode only since it accepts FILE_OBJECT as parameters
|
|
//
|
|
|
|
#define IOCTL_LMR_ARE_FILE_OBJECTS_ON_SAME_SERVER CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM,60,METHOD_BUFFERED,FILE_ANY_ACCESS)
|
|
|
|
|
|
|
|
//
|
|
// Named Pipe file control code and structure declarations
|
|
//
|
|
|
|
//
|
|
// External named pipe file control operations
|
|
//
|
|
|
|
#define FSCTL_PIPE_ASSIGN_EVENT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 0, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
#define FSCTL_PIPE_DISCONNECT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 1, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
#define FSCTL_PIPE_LISTEN CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
#define FSCTL_PIPE_PEEK CTL_CODE(FILE_DEVICE_NAMED_PIPE, 3, METHOD_BUFFERED, FILE_READ_DATA)
|
|
#define FSCTL_PIPE_QUERY_EVENT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 4, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
#define FSCTL_PIPE_TRANSCEIVE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 5, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
|
|
#define FSCTL_PIPE_WAIT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 6, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
#define FSCTL_PIPE_IMPERSONATE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 7, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
#define FSCTL_PIPE_SET_CLIENT_PROCESS CTL_CODE(FILE_DEVICE_NAMED_PIPE, 8, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
#define FSCTL_PIPE_QUERY_CLIENT_PROCESS CTL_CODE(FILE_DEVICE_NAMED_PIPE, 9, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
|
|
//
|
|
// Internal named pipe file control operations
|
|
//
|
|
|
|
#define FSCTL_PIPE_INTERNAL_READ CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2045, METHOD_BUFFERED, FILE_READ_DATA)
|
|
#define FSCTL_PIPE_INTERNAL_WRITE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2046, METHOD_BUFFERED, FILE_WRITE_DATA)
|
|
#define FSCTL_PIPE_INTERNAL_TRANSCEIVE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2047, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
|
|
#define FSCTL_PIPE_INTERNAL_READ_OVFLOW CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2048, METHOD_BUFFERED, FILE_READ_DATA)
|
|
|
|
//
|
|
// Define entry types for query event information
|
|
//
|
|
|
|
#define FILE_PIPE_READ_DATA 0x00000000
|
|
#define FILE_PIPE_WRITE_SPACE 0x00000001
|
|
|
|
//
|
|
// Named pipe file system control structure declarations
|
|
//
|
|
|
|
// Control structure for FSCTL_PIPE_ASSIGN_EVENT
|
|
|
|
typedef struct _FILE_PIPE_ASSIGN_EVENT_BUFFER {
|
|
HANDLE EventHandle;
|
|
ULONG KeyValue;
|
|
} FILE_PIPE_ASSIGN_EVENT_BUFFER, *PFILE_PIPE_ASSIGN_EVENT_BUFFER;
|
|
|
|
// Control structure for FSCTL_PIPE_PEEK
|
|
|
|
typedef struct _FILE_PIPE_PEEK_BUFFER {
|
|
ULONG NamedPipeState;
|
|
ULONG ReadDataAvailable;
|
|
ULONG NumberOfMessages;
|
|
ULONG MessageLength;
|
|
CHAR Data[1];
|
|
} FILE_PIPE_PEEK_BUFFER, *PFILE_PIPE_PEEK_BUFFER;
|
|
|
|
// Control structure for FSCTL_PIPE_QUERY_EVENT
|
|
|
|
typedef struct _FILE_PIPE_EVENT_BUFFER {
|
|
ULONG NamedPipeState;
|
|
ULONG EntryType;
|
|
ULONG ByteCount;
|
|
ULONG KeyValue;
|
|
ULONG NumberRequests;
|
|
} FILE_PIPE_EVENT_BUFFER, *PFILE_PIPE_EVENT_BUFFER;
|
|
|
|
// Control structure for FSCTL_PIPE_WAIT
|
|
|
|
typedef struct _FILE_PIPE_WAIT_FOR_BUFFER {
|
|
LARGE_INTEGER Timeout;
|
|
ULONG NameLength;
|
|
BOOLEAN TimeoutSpecified;
|
|
WCHAR Name[1];
|
|
} FILE_PIPE_WAIT_FOR_BUFFER, *PFILE_PIPE_WAIT_FOR_BUFFER;
|
|
|
|
// Control structure for FSCTL_PIPE_SET_CLIENT_PROCESS and FSCTL_PIPE_QUERY_CLIENT_PROCESS
|
|
|
|
typedef struct _FILE_PIPE_CLIENT_PROCESS_BUFFER {
|
|
#if !defined(BUILD_WOW6432)
|
|
PVOID ClientSession;
|
|
PVOID ClientProcess;
|
|
#else
|
|
ULONGLONG ClientSession;
|
|
ULONGLONG ClientProcess;
|
|
#endif
|
|
} FILE_PIPE_CLIENT_PROCESS_BUFFER, *PFILE_PIPE_CLIENT_PROCESS_BUFFER;
|
|
|
|
// This is an extension to the client process info buffer containing the client
|
|
// computer name
|
|
|
|
#define FILE_PIPE_COMPUTER_NAME_LENGTH 15
|
|
|
|
typedef struct _FILE_PIPE_CLIENT_PROCESS_BUFFER_EX {
|
|
#if !defined(BUILD_WOW6432)
|
|
PVOID ClientSession;
|
|
PVOID ClientProcess;
|
|
#else
|
|
ULONGLONG ClientSession;
|
|
ULONGLONG ClientProcess;
|
|
#endif
|
|
USHORT ClientComputerNameLength; // in bytes
|
|
WCHAR ClientComputerBuffer[FILE_PIPE_COMPUTER_NAME_LENGTH+1]; // terminated
|
|
} FILE_PIPE_CLIENT_PROCESS_BUFFER_EX, *PFILE_PIPE_CLIENT_PROCESS_BUFFER_EX;
|
|
|
|
// end_ntifs
|
|
|
|
|
|
//
|
|
// Mailslot file control code and structure definitions.
|
|
//
|
|
|
|
//
|
|
// Mailslot classes.
|
|
//
|
|
|
|
#define MAILSLOT_CLASS_FIRSTCLASS 1
|
|
#define MAILSLOT_CLASS_SECONDCLASS 2
|
|
|
|
//
|
|
// Mailslot file control operations.
|
|
//
|
|
|
|
#define FSCTL_MAILSLOT_PEEK CTL_CODE(FILE_DEVICE_MAILSLOT, 0, METHOD_NEITHER, FILE_READ_DATA) // ntifs
|
|
|
|
// Output control structure for FSCTL_MAILSLOT_PEEK
|
|
|
|
typedef struct _FILE_MAILSLOT_PEEK_BUFFER {
|
|
ULONG ReadDataAvailable;
|
|
ULONG NumberOfMessages;
|
|
ULONG MessageLength;
|
|
} FILE_MAILSLOT_PEEK_BUFFER, *PFILE_MAILSLOT_PEEK_BUFFER;
|
|
|
|
// begin_ntifs
|
|
//
|
|
// Control structure for FSCTL_LMR_GET_LINK_TRACKING_INFORMATION
|
|
//
|
|
|
|
//
|
|
// For links on DFS volumes the volume id and machine id are returned for
|
|
// link tracking
|
|
//
|
|
|
|
typedef enum _LINK_TRACKING_INFORMATION_TYPE {
|
|
NtfsLinkTrackingInformation,
|
|
DfsLinkTrackingInformation
|
|
} LINK_TRACKING_INFORMATION_TYPE, *PLINK_TRACKING_INFORMATION_TYPE;
|
|
|
|
typedef struct _LINK_TRACKING_INFORMATION {
|
|
LINK_TRACKING_INFORMATION_TYPE Type;
|
|
UCHAR VolumeId[16];
|
|
} LINK_TRACKING_INFORMATION, *PLINK_TRACKING_INFORMATION;
|
|
|
|
//
|
|
// Control structure for FSCTL_LMR_SET_LINK_TRACKING_INFORMATION
|
|
//
|
|
|
|
typedef struct _REMOTE_LINK_TRACKING_INFORMATION_ {
|
|
PVOID TargetFileObject;
|
|
ULONG TargetLinkTrackingInformationLength;
|
|
UCHAR TargetLinkTrackingInformationBuffer[1];
|
|
} REMOTE_LINK_TRACKING_INFORMATION,
|
|
*PREMOTE_LINK_TRACKING_INFORMATION;
|
|
|
|
|
|
// end_ntifs
|
|
//
|
|
// I/O Completion Specific Access Rights.
|
|
//
|
|
|
|
#define IO_COMPLETION_QUERY_STATE 0x0001
|
|
#define IO_COMPLETION_MODIFY_STATE 0x0002 // winnt
|
|
#define IO_COMPLETION_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|0x3) // winnt
|
|
|
|
//
|
|
// I/O Completion Information Classes.
|
|
//
|
|
|
|
typedef enum _IO_COMPLETION_INFORMATION_CLASS {
|
|
IoCompletionBasicInformation
|
|
} IO_COMPLETION_INFORMATION_CLASS;
|
|
|
|
//
|
|
// I/O Completition Information Structures.
|
|
//
|
|
|
|
typedef struct _IO_COMPLETION_BASIC_INFORMATION {
|
|
LONG Depth;
|
|
} IO_COMPLETION_BASIC_INFORMATION, *PIO_COMPLETION_BASIC_INFORMATION;
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtCreateIoCompletion (
|
|
OUT PHANDLE IoCompletionHandle,
|
|
IN ACCESS_MASK DesiredAccess,
|
|
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
|
|
IN ULONG Count OPTIONAL
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtOpenIoCompletion (
|
|
OUT PHANDLE IoCompletionHandle,
|
|
IN ACCESS_MASK DesiredAccess,
|
|
IN POBJECT_ATTRIBUTES ObjectAttributes
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtQueryIoCompletion (
|
|
IN HANDLE IoCompletionHandle,
|
|
IN IO_COMPLETION_INFORMATION_CLASS IoCompletionInformationClass,
|
|
OUT PVOID IoCompletionInformation,
|
|
IN ULONG IoCompletionInformationLength,
|
|
OUT PULONG ReturnLength OPTIONAL
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtSetIoCompletion (
|
|
IN HANDLE IoCompletionHandle,
|
|
IN PVOID KeyContext,
|
|
IN PVOID ApcContext,
|
|
IN NTSTATUS IoStatus,
|
|
IN ULONG_PTR IoStatusInformation
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtRemoveIoCompletion (
|
|
IN HANDLE IoCompletionHandle,
|
|
OUT PVOID *KeyContext,
|
|
OUT PVOID *ApcContext,
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock,
|
|
IN PLARGE_INTEGER Timeout
|
|
);
|
|
|
|
|
|
//
|
|
// Defines that are used to access the registry, but are not registry
|
|
// specific.
|
|
//
|
|
|
|
// begin_ntddk begin_wdm begin_nthal begin_ntminiport begin_ntndis begin_ntifs
|
|
//
|
|
// Define the I/O bus interface types.
|
|
//
|
|
|
|
typedef enum _INTERFACE_TYPE {
|
|
InterfaceTypeUndefined = -1,
|
|
Internal,
|
|
Isa,
|
|
Eisa,
|
|
MicroChannel,
|
|
TurboChannel,
|
|
PCIBus,
|
|
VMEBus,
|
|
NuBus,
|
|
PCMCIABus,
|
|
CBus,
|
|
MPIBus,
|
|
MPSABus,
|
|
ProcessorInternal,
|
|
InternalPowerBus,
|
|
PNPISABus,
|
|
PNPBus,
|
|
MaximumInterfaceType
|
|
}INTERFACE_TYPE, *PINTERFACE_TYPE;
|
|
|
|
//
|
|
// Define the DMA transfer widths.
|
|
//
|
|
|
|
typedef enum _DMA_WIDTH {
|
|
Width8Bits,
|
|
Width16Bits,
|
|
Width32Bits,
|
|
MaximumDmaWidth
|
|
}DMA_WIDTH, *PDMA_WIDTH;
|
|
|
|
//
|
|
// Define DMA transfer speeds.
|
|
//
|
|
|
|
typedef enum _DMA_SPEED {
|
|
Compatible,
|
|
TypeA,
|
|
TypeB,
|
|
TypeC,
|
|
TypeF,
|
|
MaximumDmaSpeed
|
|
}DMA_SPEED, *PDMA_SPEED;
|
|
|
|
//
|
|
// Define Interface reference/dereference routines for
|
|
// Interfaces exported by IRP_MN_QUERY_INTERFACE
|
|
//
|
|
|
|
typedef VOID (*PINTERFACE_REFERENCE)(PVOID Context);
|
|
typedef VOID (*PINTERFACE_DEREFERENCE)(PVOID Context);
|
|
|
|
// end_wdm
|
|
|
|
//
|
|
// Define types of bus information.
|
|
//
|
|
|
|
typedef enum _BUS_DATA_TYPE {
|
|
ConfigurationSpaceUndefined = -1,
|
|
Cmos,
|
|
EisaConfiguration,
|
|
Pos,
|
|
CbusConfiguration,
|
|
PCIConfiguration,
|
|
VMEConfiguration,
|
|
NuBusConfiguration,
|
|
PCMCIAConfiguration,
|
|
MPIConfiguration,
|
|
MPSAConfiguration,
|
|
PNPISAConfiguration,
|
|
SgiInternalConfiguration,
|
|
MaximumBusDataType
|
|
} BUS_DATA_TYPE, *PBUS_DATA_TYPE;
|
|
|
|
// end_ntddk end_nthal end_ntminiport end_ntndis end_ntifs
|
|
|
|
#ifdef __cplusplus
|
|
}
|
|
#endif
|
|
|
|
#endif // _NTIOAPI_
|