Signed-off-by: Alistair Leslie-Hughes leslie_alistair@hotmail.com --- include/ddk/wdm.h | 94 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 94 insertions(+)
diff --git a/include/ddk/wdm.h b/include/ddk/wdm.h index 834f208..b47995f 100644 --- a/include/ddk/wdm.h +++ b/include/ddk/wdm.h @@ -44,6 +44,7 @@ typedef ULONG_PTR KSPIN_LOCK, *PKSPIN_LOCK;
typedef ULONG_PTR ERESOURCE_THREAD; typedef ERESOURCE_THREAD *PERESOURCE_THREAD; +typedef struct _FILE_GET_QUOTA_INFORMATION *PFILE_GET_QUOTA_INFORMATION;
struct _KDPC; struct _KAPC; @@ -1223,6 +1224,99 @@ typedef struct _KLOCK_QUEUE_HANDLE { typedef NTSTATUS (NTAPI EX_CALLBACK_FUNCTION)(void *CallbackContext, void *Argument1, void *Argument2); typedef EX_CALLBACK_FUNCTION *PEX_CALLBACK_FUNCTION;
+typedef ULONG OB_OPERATION; + +typedef struct _OB_PRE_CREATE_HANDLE_INFORMATION { + ACCESS_MASK DesiredAccess; + ACCESS_MASK OriginalDesiredAccess; +} OB_PRE_CREATE_HANDLE_INFORMATION, *POB_PRE_CREATE_HANDLE_INFORMATION; + +typedef struct _OB_PRE_DUPLICATE_HANDLE_INFORMATION { + ACCESS_MASK DesiredAccess; + ACCESS_MASK OriginalDesiredAccess; + void *SourceProcess; + void *TargetProcess; +} OB_PRE_DUPLICATE_HANDLE_INFORMATION, *POB_PRE_DUPLICATE_HANDLE_INFORMATION; + +typedef union _OB_PRE_OPERATION_PARAMETERS { + OB_PRE_CREATE_HANDLE_INFORMATION CreateHandleInformation; + OB_PRE_DUPLICATE_HANDLE_INFORMATION DuplicateHandleInformation; +} OB_PRE_OPERATION_PARAMETERS, *POB_PRE_OPERATION_PARAMETERS; + +typedef struct _OB_PRE_OPERATION_INFORMATION { + OB_OPERATION Operation; + union { + ULONG Flags; + struct { + ULONG KernelHandle:1; + ULONG Reserved:31; + } DUMMYSTRUCTNAME; + } DUMMYUNIONNAME; + void *Object; + POBJECT_TYPE ObjectType; + void *CallContext; + POB_PRE_OPERATION_PARAMETERS Parameters; +} OB_PRE_OPERATION_INFORMATION, *POB_PRE_OPERATION_INFORMATION; + +typedef struct _OB_POST_CREATE_HANDLE_INFORMATION { + ACCESS_MASK GrantedAccess; +} OB_POST_CREATE_HANDLE_INFORMATION, *POB_POST_CREATE_HANDLE_INFORMATION; + +typedef struct _OB_POST_DUPLICATE_HANDLE_INFORMATION { + ACCESS_MASK GrantedAccess; +} OB_POST_DUPLICATE_HANDLE_INFORMATION, *POB_POST_DUPLICATE_HANDLE_INFORMATION; + +typedef union _OB_POST_OPERATION_PARAMETERS { + OB_POST_CREATE_HANDLE_INFORMATION CreateHandleInformation; + OB_POST_DUPLICATE_HANDLE_INFORMATION DuplicateHandleInformation; +} OB_POST_OPERATION_PARAMETERS, *POB_POST_OPERATION_PARAMETERS; + +typedef struct _OB_POST_OPERATION_INFORMATION { + OB_OPERATION Operation; + union { + ULONG Flags; + struct { + ULONG KernelHandle:1; + ULONG Reserved:31; + } DUMMYSTRUCTNAME; + } DUMMYUNIONNAME; + void *Object; + POBJECT_TYPE ObjectType; + void *CallContext; + NTSTATUS ReturnStatus; + POB_POST_OPERATION_PARAMETERS Parameters; +} OB_POST_OPERATION_INFORMATION,*POB_POST_OPERATION_INFORMATION; + +typedef enum _OB_PREOP_CALLBACK_STATUS { + OB_PREOP_SUCCESS +} OB_PREOP_CALLBACK_STATUS, *POB_PREOP_CALLBACK_STATUS; + +typedef OB_PREOP_CALLBACK_STATUS (WINAPI *POB_PRE_OPERATION_CALLBACK)(void *, POB_PRE_OPERATION_INFORMATION); +typedef void (WINAPI *POB_POST_OPERATION_CALLBACK)(void *, POB_POST_OPERATION_INFORMATION); + +typedef struct _OB_OPERATION_REGISTRATION { + POBJECT_TYPE *ObjectType; + OB_OPERATION Operations; + POB_PRE_OPERATION_CALLBACK PreOperation; + POB_POST_OPERATION_CALLBACK PostOperation; +} OB_OPERATION_REGISTRATION, *POB_OPERATION_REGISTRATION; + +typedef struct _OB_CALLBACK_REGISTRATION { + USHORT Version; + USHORT OperationRegistrationCount; + UNICODE_STRING Altitude; + void *RegistrationContext; + OB_OPERATION_REGISTRATION *OperationRegistration; +} OB_CALLBACK_REGISTRATION, *POB_CALLBACK_REGISTRATION; + +#define OB_FLT_REGISTRATION_VERSION_0100 0x0100 +#define OB_FLT_REGISTRATION_VERSION OB_FLT_REGISTRATION_VERSION_0100 + +typedef enum _DIRECTORY_NOTIFY_INFORMATION_CLASS { + DirectoryNotifyInformation = 1, + DirectoryNotifyExtendedInformation +} DIRECTORY_NOTIFY_INFORMATION_CLASS, *PDIRECTORY_NOTIFY_INFORMATION_CLASS; + NTSTATUS WINAPI ObCloseHandle(IN HANDLE handle);
#ifdef NONAMELESSUNION