Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
This header is used by ifsk. For more information, see:
fltkernel.h contains the following programming interfaces:
Functions
| FLT_IS_FASTIO_OPERATION Learn more about FLT_IS_FASTIO_OPERATION |
| FLT_IS_FS_FILTER_OPERATION Learn more about the FLT_IS_FS_FILTER_OPERATION macro. |
| FLT_IS_IRP_OPERATION Learn more about the FLT_IS_IRP_OPERATION macro. |
| FLT_IS_REISSUED_IO Learn more about the FLT_IS_REISSUED_IO macro. |
| FLT_IS_SYSTEM_BUFFER Learn more about the FLT_IS_SYSTEM_BUFFER macro. |
| FltAcknowledgeEcp The FltAcknowledgeEcp routine is used to mark an extra create parameter context structure (ECP) as acknowledged. |
| FltAcquirePushLockExclusive The FltAcquirePushLockExclusive routine acquires the given push lock for exclusive access by the calling thread. |
| FltAcquirePushLockExclusiveEx The FltAcquirePushLockExclusiveEx routine acquires the given push lock for exclusive access by the calling thread. |
| FltAcquirePushLockShared The FltAcquirePushLockShared routine acquires the given push lock for shared access by the calling thread. |
| FltAcquirePushLockSharedEx The FltAcquirePushLockSharedEx routine acquires the given push lock for shared access by the calling thread. |
| FltAcquireResourceExclusive Learn more about the FltAcquireResourceExclusive function. |
| FltAcquireResourceShared Learn more about the FltAcquireResourceShared function. |
| FltAddOpenReparseEntry This routine adds a caller allocated open reparse structure, OPEN_REPARSE_LIST_ENTRY, into a create operation. |
| FltAdjustDeviceStackSizeForIoRedirection The FltAdjustDeviceStackSizeForIoRedirection routine increases the size of the source device stack to allow a minifilter to redirect I/O from a specified source instance to a specified target instance when the target stack is deeper than the source stack. |
| FltAllocateCallbackData FltAllocateCallbackData allocates a callback data structure that a minifilter driver can use to initiate an I/O request. |
| FltAllocateCallbackDataEx The FltAllocateCallbackDataEx routine allocates a callback data structure and can preallocate memory for additional structures that a minifilter driver can use to initiate an I/O request. |
| FltAllocateContext Learn more about the FltAllocateContext function. |
| FltAllocateDeferredIoWorkItem FltAllocateDeferredIoWorkItem allocates a deferred-I/O work item. |
| FltAllocateExtraCreateParameter The FltAllocateExtraCreateParameter routine allocates paged memory pool for a user-defined extra create parameter (ECP) context structure and generates a pointer to that structure. |
| FltAllocateExtraCreateParameterFromLookasideList The FltAllocateExtraCreateParameterFromLookasideList routine allocates memory pool from a given lookaside list for an extra create parameter (ECP) context structure and generates a pointer to that structure. |
| FltAllocateExtraCreateParameterList The FltAllocateExtraCreateParameterList routine allocates paged pool memory for an extra create parameter (ECP) list structure and generates a pointer to that structure. |
| FltAllocateFileLock The FltAllocateFileLock routine allocates and initializes a new FILE_LOCK structure. |
| FltAllocateGenericWorkItem FltAllocateGenericWorkItem allocates a generic work item. |
| FltAllocatePoolAlignedWithTag FltAllocatePoolAlignedWithTag allocates a device-aligned buffer for use in a noncached I/O operation. |
| FltApplyPriorityInfoThread The FltApplyPriorityInfoThread routine is used by a minifilter driver to apply priority information to a thread. |
| FltAttachVolume FltAttachVolume creates a new minifilter driver instance and attaches it to the given volume. |
| FltAttachVolumeAtAltitude FltAttachVolumeAtAltitude is a debugging support routine that attaches a minifilter driver instance to a volume at a specified altitude, overriding any settings in the minifilter driver's INF file. |
| FltBuildDefaultSecurityDescriptor FltBuildDefaultSecurityDescriptor builds a default security descriptor for use with FltCreateCommunicationPort. |
| FltCancelFileOpen A minifilter driver can use the FltCancelFileOpen routine to close a newly opened or created file. |
| FltCancelIo The FltCancelIo routine cancels an I/O operation. |
| FltCancellableWaitForMultipleObjects The FltCancellableWaitForMultipleObjects executes a cancelable wait operation (a wait that can be terminated) on one or more dispatcher objects. |
| FltCancellableWaitForSingleObject The FltCancellableWaitForSingleObject routine executes a cancelable wait operation (a wait that can be terminated) on a dispatcher object. |
| FltCbdqDisable FltCbdqDisable disables a minifilter driver's callback data queue. |
| FltCbdqEnable FltCbdqEnable enables a callback data queue that was disabled by a previous call to FltCbdqDisable. |
| FltCbdqInitialize FltCbdqInitialize initializes a minifilter driver's callback data queue dispatch table. |
| FltCbdqInsertIo FltCbdqInsertIo inserts the callback data structure for an I/O operation into a filter driver's callback data queue. |
| FltCbdqRemoveIo FltCbdqRemoveIo removes a particular item from a minifilter driver's callback data queue. |
| FltCbdqRemoveNextIo FltCbdqRemoveNextIo removes the next matching item in a minifilter driver's callback data queue. |
| FltCheckAndGrowNameControl The FltCheckAndGrowNameControl routine checks whether the buffer in a FLT_NAME_CONTROL structure is large enough to hold the specified number of bytes. If not, FltCheckAndGrowNameControl replaces it with a larger system-allocated buffer. |
| FltCheckLockForReadAccess The FltCheckLockForReadAccess routine determines whether the caller has read access to a locked byte range of a file. |
| FltCheckLockForWriteAccess The FltCheckLockForWriteAccess routine determines whether the caller has write access to a locked byte range of a file. |
| FltCheckOplock A minifilter driver calls FltCheckOplock to synchronize the callback data structure for an IRP-based file I/O operation with the file's current opportunistic lock (oplock) state. |
| FltCheckOplockEx A minifilter driver calls the FltCheckOplockEx routine to synchronize the callback data structure for an IRP-based file I/O operation (and certain others, see below) that has the current opportunistic lock (oplock) state of the file. |
| FltClearCallbackDataDirty The FltClearCallbackDataDirty routine clears the callback dirty flag in a callback data structure. |
| FltClearCancelCompletion FltClearCancelCompletion clears a cancel routine that was specified for an I/O operation. |
| FltClose FltClose closes a file handle that was opened by FltCreateFile or FltCreateFileEx. |
| FltCloseClientPort FltCloseClientPort closes a communication client port. |
| FltCloseCommunicationPort FltCloseCommunicationPort closes a minifilter driver's communication server port. |
| FltCloseSectionForDataScan The FltCloseSectionForDataScan routine closes a section object associated with a file stream. |
| FltCommitComplete The FltCommitComplete routine acknowledges a TRANSACTION_NOTIFY_COMMIT notification. |
| FltCommitFinalizeComplete The FltCommitFinalizeComplete routine acknowledges a TRANSACTION_NOTIFY_COMMIT_FINALIZE notification. |
| FltCompareInstanceAltitudes FltCompareInstanceAltitudes compares the altitudes of two minifilter driver instances. |
| FltCompletePendedPostOperation FltCompletePendedPostOperation resumes completion processing for an I/O operation that was pended in a minifilter driver's postoperation callback routine. |
| FltCompletePendedPreOperation FltCompletePendedPreOperation resumes processing for an I/O operation that was pended in a minifilter driver's preoperation callback (PFLT_PRE_OPERATION_CALLBACK) routine. |
| FltCopyOpenReparseList This routine copies any open reparse information from a previous create into a new ECP list that can be used to issue a second create. |
| FltCreateCommunicationPort Learn more about the FltCreateCommunicationPort function. |
| FltCreateFile Learn more about the FltCreateFile function. |
| FltCreateFileEx Minifilter drivers call FltCreateFileEx to create a new file or open an existing file. |
| FltCreateFileEx2 Minifilter drivers call FltCreateFileEx2 to create a new file or open an existing file. This routine also includes an optional create context parameter. |
| FltCreateMailslotFile Minifilter drivers call FltCreateMailslotFile to create a new pipe or open an existing mailslot. |
| FltCreateNamedPipeFile Minifilter drivers call FltCreateNamedPipeFile to create a new pipe or open an existing pipe. |
| FltCreateSectionForDataScan The FltCreateSectionForDataScan routine creates a section object for a file. The filter manager can optionally synchronize I/O with the section created. |
| FltCreateSystemVolumeInformationFolder FltCreateSystemVolumeInformationFolder verifies the existence of the "System Volume Information" folder on a file system volume. If the folder is not present, then the folder is created. |
| FltCurrentBatchOplock A minifilter driver calls FltCurrentBatchOplock to determine whether there are any batch or filter opportunistic locks (oplocks) on a file. |
| FltCurrentOplock A minifilter driver calls the FltCurrentOplock routine to determine whether there are any opportunistic locks (oplocks) on a file. |
| FltCurrentOplockH A minifilter driver calls the FltCurrentOplockH routine to determine whether there are any CACHE_HANDLE_LEVEL opportunistic locks (oplocks) on a file. |
| FltDecodeParameters FltDecodeParameters returns pointers to the memory descriptor list (MDL) address, buffer pointer, buffer length, and desired access parameters for an I/O operation. |
| FltDeleteContext FltDeleteContext marks a specified context for deletion. |
| FltDeleteExtraCreateParameterLookasideList The FltDeleteExtraCreateParameterLookasideList routine frees an extra create parameter (ECP) lookaside list. |
| FltDeleteFileContext The FltDeleteFileContext routine retrieves and deletes a file context that a given minifilter driver has set for a given file. |
| FltDeleteInstanceContext FltDeleteInstanceContext removes a context from a given instance and marks the context for deletion. |
| FltDeletePushLock The FltDeletePushLock routine deletes a given push lock. |
| FltDeleteStreamContext FltDeleteStreamContext removes a context that a given minifilter driver instance has set for a given stream and marks the context for deletion. |
| FltDeleteStreamHandleContext FltDeleteStreamHandleContext removes a context that a given minifilter driver instance has set for a given stream handle and marks the context for deletion. |
| FltDeleteTransactionContext The FltDeleteTransactionContext routine removes a context from a given transaction and marks the context for deletion. |
| FltDeleteVolumeContext FltDeleteVolumeContext removes a context that a given minifilter driver has set for a given volume and marks the context for deletion. |
| FltDetachVolume FltDetachVolume detaches a minifilter driver instance from a volume. |
| FltDeviceIoControlFile FltDeviceIoControlFile sends a control code directly to a specified device driver, causing the corresponding driver to perform the specified action. |
| FltDoCompletionProcessingWhenSafe If it is safe to do so, the FltDoCompletionProcessingWhenSafe function executes a minifilter driver postoperation callback routine. |
| FltEnlistInTransaction The FltEnlistInTransaction routine enlists a minifilter driver in a given transaction. |
| FltEnumerateFilterInformation The FltEnumerateFilterInformation routine provides information about all the registered filter drivers (including minifilter and legacy filter drivers) in the system. |
| FltEnumerateFilters The FltEnumerateFilters routine enumerates all registered minifilter drivers in the system. |
| FltEnumerateInstanceInformationByDeviceObject The FltEnumerateInstanceInformationByDeviceObject routine provides information about minifilter driver instances and legacy filter drivers that are attached to the volume related to a specified device object. |
| FltEnumerateInstanceInformationByFilter The FltEnumerateInstanceInformationByFilter routine provides information about instances of a given minifilter driver. |
| FltEnumerateInstanceInformationByVolume The FltEnumerateInstanceInformationByVolume routine provides information about minifilter driver instances and legacy filter drivers (Windows Vista only) that are attached to a given volume. |
| FltEnumerateInstanceInformationByVolumeName The FltEnumerateInstanceInformationByVolumeName routine provides information about minifilter driver instances and legacy filter drivers that are attached to the volume with the specified name. |
| FltEnumerateInstances The FltEnumerateInstances routine enumerates minifilter driver instances for a given minifilter driver or volume. |
| FltEnumerateVolumeInformation The FltEnumerateVolumeInformation routine provides information about volumes that are known to the filter manager. |
| FltEnumerateVolumes The FltEnumerateVolumes routine enumerates all volumes in the system. |
| FltFastIoMdlRead The FltFastIoMdlRead routine returns a memory descriptor list (MDL) that points directly to the specified byte range in the file cache. |
| FltFastIoMdlReadComplete The FltFastIoMdlReadComplete routine completes the read operation that the FltFastIoMdlRead routine initiated. |
| FltFastIoMdlWriteComplete The FltFastIoMdlWriteComplete routine in fltkernel.h frees the resources that FltFastIoPrepareMdlWrite allocated. |
| FltFastIoPrepareMdlWrite The FltFastIoPrepareMdlWrite routine returns a linked list of memory descriptor lists (MDLs) that point to the specified range of cached file data to write data directly to the cache. |
| FltFindExtraCreateParameter The FltFindExtraCreateParameter routine searches a given ECP list for an ECP context structure of a given type and returns a pointer to this structure if it is found. |
| FltFlushBuffers The FltFlushBuffers routine is used by the minifilter driver to send a flush request for a given file to the file system. |
| FltFlushBuffers2 Learn more about the FltFlushBuffers2 function. |
| FltFreeCallbackData The FltFreeCallbackData routine frees a callback data structure allocated by the FltAllocateCallbackData routine. |
| FltFreeDeferredIoWorkItem The FltFreeDeferredIoWorkItem routine frees a work item allocated by the FltAllocateDeferredIoWorkItem routine. |
| FltFreeExtraCreateParameter The FltFreeExtraCreateParameter routine frees the memory for an ECP context structure. |
| FltFreeExtraCreateParameterList The FltFreeExtraCreateParameterList routine frees an extra create parameter (ECP) list structure. |
| FltFreeFileLock The FltFreeFileLock routine uninitializes and frees an initialized FILE_LOCK structure. |
| FltFreeGenericWorkItem The FltFreeGenericWorkItem routine frees a work item allocated by the FltAllocateGenericWorkItem routine. |
| FltFreeOpenReparseList This routine deallocates any information copied into a create operation by a previous call to FltCopyOpenReparseList. |
| FltFreePoolAlignedWithTag The FltFreePoolAlignedWithTag routine frees a cache-aligned buffer that was allocated by a previous call to FltAllocatePoolAlignedWithTag. |
| FltFreeSecurityDescriptor FltFreeSecurityDescriptor frees a security descriptor allocated by the FltBuildDefaultSecurityDescriptor routine. |
| FltFsControlFile The FltFsControlFile routine sends a control code directly to a specified file system or file system filter driver, causing the corresponding driver to perform the specified action. |
| FltGetActivityIdCallbackData The FltGetActivityIdCallbackData routine retrieves the current activity ID associated with a request in a minifilter's callback data. |
| FltGetBottomInstance FltGetBottomInstance returns an opaque instance pointer for the minifilter driver instance, if there is one, that is attached at the bottom of the instance stack for a given volume. |
| FltGetContexts Learn more about the FltGetContexts function. |
| FltGetContextsEx Learn more about the FltGetContextsEx function. |
| FltGetCopyInformationFromCallbackData Learn more about the FltGetCopyInformationFromCallbackData function. |
| FltGetDestinationFileNameInformation Learn more about the FltGetDestinationFileNameInformation routine. |
| FltGetDeviceObject The FltGetDeviceObject routine returns a pointer to the Filter Manager's volume device object (VDO) for a given volume. |
| FltGetDiskDeviceObject The FltGetDiskDeviceObject routine returns a pointer to the disk device object associated with a given volume. |
| FltGetEcpListFromCallbackData The FltGetEcpListFromCallbackData routine returns a pointer to an extra create parameter context structure (ECP) list that is associated with a given create operation callback-data object. |
| FltGetFileContext Learn more about the FltGetFileContext function. |
| FltGetFileNameInformation The FltGetFileNameInformation routine returns name information for a file or directory. |
| FltGetFileNameInformationUnsafe The FltGetFileNameInformationUnsafe routine returns name information for an open file or directory. |
| FltGetFileSystemType The FltGetFileSystemType function takes a volume or instance object and provides the file system type of the volume. |
| FltGetFilterFromInstance The FltGetFilterFromInstance routine returns an opaque filter pointer for the minifilter driver that created the given instance. |
| FltGetFilterFromName The FltGetFilterFromName routine returns an opaque filter pointer for a registered minifilter driver whose name matches the value in the FilterName parameter. |
| FltGetFilterInformation The FltGetFilterInformation routine provides information about a minifilter driver. |
| FltGetInstanceContext Learn more about the FltGetInstanceContext function. |
| FltGetInstanceInformation The FltGetInstanceInformation routine returns information about a minifilter driver instance. |
| FltGetIoPriorityHint The FltGetIoPriorityHint routine is used by a minifilter driver to get IO priority information from Callback Data. |
| FltGetIoPriorityHintFromCallbackData The FltGetIoPriorityHintFromCallbackData routine is used by a minifilter driver to get IO priority information from callback data. |
| FltGetIoPriorityHintFromFileObject The FltGetIoPriorityHintFromFileObject routine is used by a minifilter driver to get IO priority information from a file object. |
| FltGetIoPriorityHintFromThread The FltGetIoPriorityHintFromThread routine is used by a minifilter driver to get IO priority information from a thread. |
| FltGetIrpName The FltGetIrpName routine returns the name for a major function code as a printable string. |
| FltGetLowerInstance The FltGetLowerInstance routine returns an opaque instance pointer for the next lower minifilter driver instance, if there is one, that is attached below a given minifilter driver instance on the same volume. |
| FltGetNewSystemBufferAddress The FltGetNewSystemBufferAddress function retrieves the AssociatedIrp.SystemBuffer buffer, which the file system has allocated. A minifilter driver's post-callback routine calls this function. |
| FltGetNextExtraCreateParameter The FltGetNextExtraCreateParameter routine returns a pointer to the next (or first) extra create parameter context structure (ECP) in a given ECP list. |
| FltGetRequestorProcess The FltGetRequestorProcess routine returns a process pointer for the thread that requested a given I/O operation. |
| FltGetRequestorProcessId The FltGetRequestorProcessId routine returns the unique 32-bit process ID for the process associated with the thread that requested a given I/O operation. |
| FltGetRequestorProcessIdEx The FltGetRequestorProcessIdEx routine returns the kernel-mode handle for the process that is associated with the thread that requested a given I/O operation. |
| FltGetRequestorSessionId The FltGetRequestorSessionId routine returns the session ID of the process that originally requested the specified I/O operation. |
| FltGetRoutineAddress The FltGetRoutineAddress routine returns a pointer to a routine specified by the FltMgrRoutineName parameter. |
| FltGetSectionContext Learn more about the FltGetSectionContext function. |
| FltGetStreamContext Learn more about the FltGetStreamContext function. |
| FltGetStreamHandleContext Learn more about the FltGetStreamHandleContext function. |
| FltGetSwappedBufferMdlAddress The FltGetSwappedBufferMdlAddress routine returns the memory descriptor list (MDL) address for a buffer that was swapped in by a minifilter driver. |
| FltGetTopInstance The FltGetTopInstance routine returns an opaque instance pointer for the minifilter driver instance that is attached at the top of the instance stack for a given volume. |
| FltGetTransactionContext The FltGetTransactionContext routine retrieves a context that was set for a transaction by a given minifilter driver. |
| FltGetTunneledName The FltGetTunneledName routine retrieves the tunneled name for a file, given the normalized name returned for the file by a previous call to FltGetFileNameInformation, FltGetFileNameInformationUnsafe, or FltGetDestinationFileNameInformation. |
| FltGetUpperInstance The FltGetUpperInstance routine returns an opaque instance pointer for the next higher minifilter driver instance, if there is one, that is attached above a given minifilter driver instance on the same volume. |
| FltGetVolumeContext Learn more about the FltGetVolumeContext function. |
| FltGetVolumeFromDeviceObject The FltGetVolumeFromDeviceObject routine returns an opaque pointer for the volume represented by a volume device object (VDO). |
| FltGetVolumeFromFileObject The FltGetVolumeFromFileObject routine returns an opaque pointer for the volume that a given file stream resides on. |
| FltGetVolumeFromInstance The FltGetVolumeFromInstance routine returns an opaque pointer for the volume that a given minifilter driver instance is attached to. |
| FltGetVolumeFromName The FltGetVolumeFromName routine returns an opaque pointer for the volume whose name matches the value of the VolumeName parameter. |
| FltGetVolumeGuidName The FltGetVolumeGuidName routine returns the volume name for a given volume, in volume globally unique identifier (GUID) format. |
| FltGetVolumeInformation The FltGetVolumeInformation routine provides information about a given volume. |
| FltGetVolumeInstanceFromName The FltGetVolumeInstanceFromName routine returns an opaque instance pointer for the given minifilter driver instance on the given volume. |
| FltGetVolumeName The FltGetVolumeName routine gets the volume name for a given volume. |
| FltGetVolumeProperties The FltGetVolumeProperties routine returns volume property information for the given volume. |
| FltInitExtraCreateParameterLookasideList The FltInitExtraCreateParameterLookasideList routine initializes a paged or non-paged pool lookaside list used for the allocation of one or more extra create parameter context structures (ECPs) of fixed size. |
| FltInitializeFileLock The FltInitializeFileLock routine initializes an opaque FILE_LOCK structure that the caller has allocated from paged pool. |
| FltInitializeOplock The FltInitializeOplock routine initializes an opportunistic lock (oplock) pointer. |
| FltInitializePushLock Learn more about the FltInitializePushLock function. |
| FltInsertExtraCreateParameter The FltInsertExtraCreateParameter routine inserts an extra create parameter (ECP) context structure into an ECP list. |
| FltIs32bitProcess The FltIs32bitProcess routine checks whether the originator of the current I/O operation is a 32-bit user-mode application. |
| FltIsCallbackDataDirty The FltIsCallbackDataDirty routine tests the FLTFL_CALLBACK_DATA_DIRTY flag in a callback data structure. |
| FltIsDirectory A minifilter driver calls the FltIsDirectory routine to determine whether a given file object represents a directory. |
| FltIsEcpAcknowledged The FltIsEcpAcknowledged routine is used to determine if a given extra create parameter context structure (ECP) has been marked as acknowledged. |
| FltIsEcpFromUserMode The FltIsEcpFromUserMode routine is used to determine if an extra create parameter context structure (ECP) originated from user mode. |
| FltIsFltMgrVolumeDeviceObject The FltIsFltMgrVolumeDeviceObject routine determines whether the given device object belongs to filter manager and if the device object is a volume device object. |
| FltIsIoCanceled The FltIsIoCanceled routine checks if an IRP-based operation has been canceled. |
| FltIsIoRedirectionAllowed The FltIsIoRedirectionAllowed routine determines whether I/O can be redirected from the specified source filter instance to another specified filter instance. |
| FltIsIoRedirectionAllowedForOperation The FltIsIoRedirectionAllowedForOperation routine determines whether I/O can be redirected from the filter instance associated with the specified FLT_CALLBACK_DATA structure to the specified filter instance. |
| FltIsOperationSynchronous The FltIsOperationSynchronous routine determines whether a given callback data structure (FLT_CALLBACK_DATA) represents a synchronous or asynchronous I/O operation. |
| FltIsVolumeSnapshot The FltIsVolumeSnapshot routine determines whether a volume or minifilter driver instance is attached to a snapshot volume. |
| FltIsVolumeWritable The FltIsVolumeWritable routine determines whether the disk device that corresponds to a volume or minifilter driver instance is writable. |
| FltLoadFilter The FltLoadFilter routine dynamically loads a minifilter driver into the currently running system. |
| FltLockUserBuffer Learn more about the FltLockUserBuffer function. |
| FltMupGetProviderInfoFromFileObject Learn more about the FltMupGetProviderInfoFromFileObject function. |
| FltNotifyFilterChangeDirectory The FltNotifyFilterChangeDirectory routine creates a notify structure for an IRP_MN_NOTIFY_CHANGE_DIRECTORY operation and adds it to the specified notify list. |
| FltObjectDereference The FltObjectDereference routine removes a rundown reference from an opaque filter, instance, or volume pointer. |
| FltObjectReference The FltObjectReference routine adds a rundown reference to an opaque filter, instance, or volume pointer. |
| FltOpenVolume The FltOpenVolume routine returns a handle and a file object pointer for the file system volume that a given minifilter driver instance is attached to. |
| FltOplockBreakH The FltOplockBreakH routine breaks CACHE_HANDLE_LEVEL opportunistic locks (oplocks). |
| FltOplockBreakToNone The FltOplockBreakToNone routine breaks all opportunistic locks (oplocks) immediately without regard for any oplock key. |
| FltOplockBreakToNoneEx The FltOplockBreakToNoneEx routine breaks all opportunistic locks (oplocks) immediately without regard for any oplock key. |
| FltOplockFsctrl The FltOplockFsctrl routine performs various opportunistic lock (oplock) operations on behalf of a minifilter driver. |
| FltOplockFsctrlEx The FltOplockFsctrlEx routine performs various opportunistic lock (oplock) operations on behalf of a minifilter driver. |
| FltOplockIsFastIoPossible The FltOplockIsFastIoPossible routine checks a file's opportunistic lock (oplock) state to determine whether fast I/O can be performed on the file. |
| FltOplockIsSharedRequest The FltOplockIsSharedRequest routine determines if a request for an opportunistic lock (oplock) wants a shared oplock. |
| FltOplockKeysEqual The FltOplockKeysEqual routine compares the opportunistic lock (oplock) keys that are stored in the file object extensions of two file objects. |
| FltParseFileName FltParseFileName parses the extension, stream, and final component from a file name string. |
| FltParseFileNameInformation FltParseFileNameInformation parses the contents of a FLT_FILE_NAME_INFORMATION structure. |
| FltPerformAsynchronousIo A minifilter driver calls FltPerformAsynchronousIo to initiate an asynchronous I/O operation. |
| FltPerformSynchronousIo A minifilter driver calls FltPerformSynchronousIo to initiate a synchronous I/O operation after calling FltAllocateCallbackData to allocate a callback data structure for the operation. |
| FltPrepareComplete The FltPrepareComplete routine acknowledges a TRANSACTION_NOTIFY_PREPARE notification. |
| FltPrepareToReuseEcp The FltPrepareToReuseEcp routine resets an extra create parameter (ECP) context structure, which prepares it for reuse. |
| FltPrePrepareComplete The FltPrePrepareComplete routine acknowledges a TRANSACTION_NOTIFY_PREPREPARE notification. |
| FltProcessFileLock The FltProcessFileLock routine processes and completes a file lock operation. |
| FltPropagateActivityIdToThread The FltPropagateActivityIdToThread routine associates the activity ID from the IRP in the minifilter's callback data with the current thread. |
| FltPropagateIrpExtension The FltPropagateIrpExtension routine copies the IRP extension from one minifilter's callback data to another's callback data. |
| FltPurgeFileNameInformationCache FltPurgeFileNameInformationCache purges from the Filter Manager's name cache all file name information structures that were generated from names provided by the given minifilter driver instance. |
| FltQueryDirectoryFile The FltQueryDirectoryFile routine returns various kinds of information about files in the directory specified by a given file object. |
| FltQueryDirectoryFileEx FltQueryDirectoryFileEx returns various kinds of information about files in the directory specified by a given file object. |
| FltQueryEaFile FltQueryEaFile returns information about extended-attribute (EA) values for a file. |
| FltQueryInformationByName The FltQueryInformationByName routine returns the requested information about a named file. |
| FltQueryInformationFile FltQueryInformationFile retrieves information for a given file. |
| FltQueryQuotaInformationFile The FltQueryQuotaInformationFile routine retrieves quota entries associated with a file object. |
| FltQuerySecurityObject FltQuerySecurityObject retrieves a copy of an object's security descriptor. |
| FltQueryVolumeInformation The FltQueryVolumeInformation routine retrieves information about the volume that the given instance is attached to. |
| FltQueryVolumeInformationFile FltQueryVolumeInformationFile retrieves volume information for a given file, directory, storage device, or volume. |
| FltQueueDeferredIoWorkItem The FltQueueDeferredIoWorkItem routine posts an IRP-based I/O operation to a work queue. |
| FltQueueGenericWorkItem FltQueueGenericWorkItem posts a work item that is not associated with a specific I/O operation to a work queue. |
| FltReadFile Learn more about the FltReadFile function. |
| FltReadFileEx Learn more about the FltReadFileEx function. |
| FltReferenceContext FltReferenceContext increments the reference count on a context structure. |
| FltReferenceFileNameInformation FltReferenceFileNameInformation increments the reference count on a file name information structure. |
| FltRegisterFilter FltRegisterFilter registers a minifilter driver. |
| FltRegisterForDataScan The FltRegisterForDataScan routine enables data scanning for the volume attached to the minifilter instance. |
| FltReissueSynchronousIo FltReissueSynchronousIo initiates a new synchronous I/O operation that uses the parameters from a previously synchronized I/O operation. |
| FltReleaseContext FltReleaseContext decrements the reference count on a context. |
| FltReleaseContexts FltReleaseContexts releases each context in a given FLT_RELATED_CONTEXTS structure. |
| FltReleaseContextsEx FltReleaseContextsEx releases each context in a given FLT_RELATED_CONTEXTS_EX structure. |
| FltReleaseFileNameInformation FltReleaseFileNameInformation releases a file name information structure. |
| FltReleasePushLock The FltReleasePushLock routine releases a specified push lock owned by the current thread. |
| FltReleasePushLockEx The FltReleasePushLockEx routine releases a specified push lock owned by the current thread. |
| FltReleaseResource Learn more about the FltReleaseResource function. |
| FltRemoveExtraCreateParameter The FltRemoveExtraCreateParameter routine searches an ECP list for an ECP context structure and, if found, detaches it from the ECP list. |
| FltRemoveOpenReparseEntry This routine removes an OPEN_REPARSE_LIST_ENTRY structure (added by FltAddOpenReparseEntry) from a create operation. |
| FltRequestFileInfoOnCreateCompletion A minifilter calls FltRequestFileInfoOnCreateCompletion during file pre-create to request that the file system stores the specified file information for retrieval upon create complete. |
| FltRequestOperationStatusCallback FltRequestOperationStatusCallback returns status information for the given I/O operation. |
| FltRequestSecurityInfoOnCreateCompletion A minifilter calls FltRequestSecurityInfoOnCreateCompletion during file pre-create to request that the file system stores the file security information for retrieval upon create complete. |
| FltRetainSwappedBufferMdlAddress FltRetainSwappedBufferMdlAddress prevents the Filter Manager from freeing the memory descriptor list (MDL) for a buffer that was swapped in by a minifilter driver. |
| FltRetrieveFileInfoOnCreateCompletion FltRetrieveFileInfoOnCreateCompletion retrieves the requested file information during file post create. |
| FltRetrieveFileInfoOnCreateCompletionEx FltRetrieveFileInfoOnCreateCompletionEx queries for the specified file information upon file creation completion. |
| FltRetrieveIoPriorityInfo The FltRetrieveIoPriorityInfo routine is used by a minifilter driver to retrieve priority information from a thread. |
| FltReuseCallbackData The FltReuseCallbackData routine reinitializes a callback data structure so that it can be reused. |
| FltRollbackComplete The FltRollbackComplete routine acknowledges a TRANSACTION_NOTIFY_ROLLBACK notification. |
| FltRollbackEnlistment The FltRollbackEnlistment routine rolls back or aborts a transaction on behalf of a minifilter driver. |
| FltSendMessage FltSendMessage sends a message to a waiting user-mode application on behalf of a minifilter driver or a minifilter driver instance. |
| FltSetActivityIdCallbackData The FltSetActivityIdCallbackData routine sets the activity ID for an IRP in a minifilter's callback data. |
| FltSetCallbackDataDirty A minifilter driver's preoperation or postoperation callback routine calls FltSetCallbackDataDirty to indicate that it has modified the contents of the callback data structure. |
| FltSetCancelCompletion A minifilter driver calls FltSetCancelCompletion to specify a cancel routine to be called if a given I/O operation is canceled. |
| FltSetEaFile FltSetEaFile sets extended-attribute (EA) values for a file. |
| FltSetEcpListIntoCallbackData The FltSetEcpListIntoCallbackData routine attaches an extra create parameter context structure (ECP) list to a create operation callback-data object. |
| FltSetFileContext The FltSetFileContext routine sets a context for a file. |
| FltSetInformationFile FltSetInformationFile sets information for a given file. |
| FltSetInstanceContext FltSetInstanceContext sets a context for a minifilter driver instance. |
| FltSetIoPriorityHintIntoCallbackData The FltSetIoPriorityHintIntoCallbackData routine is used by a minifilter driver to set the I/O priority information in callback data. |
| FltSetIoPriorityHintIntoFileObject The FltSetIoPriorityHintIntoFileObject routine is used by a minifilter driver to set the I/O priority information in a file object. |
| FltSetIoPriorityHintIntoThread The FltSetIoPriorityHintIntoThread routine is used by a minifilter driver to set the IO priority information in a thread. |
| FltSetQuotaInformationFile The FltSetQuotaInformationFile routine modifies quota entries for a file object. |
| FltSetSecurityObject FltSetSecurityObject sets an object's security state. |
| FltSetStreamContext The FltSetStreamContext routine sets a context for a file stream. |
| FltSetStreamHandleContext The FltSetStreamHandleContext routine sets a context for a stream handle. |
| FltSetTransactionContext The FltSetTransactionContext routine sets a context on a transaction. |
| FltSetVolumeContext FltSetVolumeContext sets a context for a volume. |
| FltSetVolumeInformation FltSetVolumeInformation changes various kinds of information about the volume that the given instance is attached to. |
| FltStartFiltering FltStartFiltering starts filtering for a registered minifilter driver. |
| FltSupportsFileContexts The FltSupportsFileContexts routine determines whether the file system supports file contexts for a given file. |
| FltSupportsFileContextsEx The FltSupportsFileContextsEx routine determines whether the file system or the filter manager support file contexts for a given file. |
| FltSupportsStreamContexts FltSupportsStreamContexts determines whether stream contexts are supported on a given file object. |
| FltSupportsStreamHandleContexts FltSupportsStreamHandleContexts determines whether stream handle contexts are supported on a given file object. |
| FltTagFile FltTagFile sets a reparse tag on a file or directory. |
| FltTagFileEx FltTagFileEx sets a reparse flag on a file or directory. |
| FltUninitializeFileLock The FltUninitializeFileLock routine uninitializes a FILE_LOCK structure. |
| FltUninitializeOplock FltUninitializeOplock uninitializes an opportunistic lock (oplock) pointer. |
| FltUnloadFilter A minifilter driver that has loaded a supporting minifilter driver by calling FltLoadFilter can unload the minifilter driver by calling FltUnloadFilter. |
| FltUnregisterFilter A registered minifilter driver calls FltUnregisterFilter to unregister itself so that the Filter Manager no longer calls it to process I/O operations. |
| FltUntagFile FltUntagFile removes a reparse point from a file or directory. |
| FltVetoBypassIo Learn more about the FltVetoBypassIO function. |
| FltWriteFile Learn more about the FltWriteFile function. |
| FltWriteFileEx Learn more about the FltWriteFileEx function. |
Callback functions
| PFLT_COMPLETE_LOCK_CALLBACK_DATA_ROUTINE A minifilter driver can register a routine of type PFLT_COMPLETE_LOCK_CALLBACK_DATA_ROUTINE as the minifilter driver's CompleteLockCallbackDataRoutine callback routine for a FILE_LOCK structure. |
| PFLT_COMPLETED_ASYNC_IO_CALLBACK A minifilter driver that initiates an asynchronous I/O operation can specify a routine of type PFLT_COMPLETED_ASYNC_IO_CALLBACK routine to be called when the operation is completed. |
| PFLT_CONNECT_NOTIFY Learn about the PFLT_CONNECT_NOTIFY callback function. |
| PFLT_CONTEXT_ALLOCATE_CALLBACK A minifilter driver can register a routine of type PFLT_CONTEXT_ALLOCATE_CALLBACK as the minifilter driver's ContextAllocateCallback routine. |
| PFLT_CONTEXT_CLEANUP_CALLBACK A minifilter driver can register a routine of type PFLT_CONTEXT_CLEANUP_CALLBACK as the minifilter driver's ContextCleanupCallback routine. |
| PFLT_CONTEXT_FREE_CALLBACK A minifilter can register a routine of type PFLT_CONTEXT_FREE_CALLBACK as the minifilter driver's ContextFreeCallback routine. |
| PFLT_DISCONNECT_NOTIFY Learn about the PFLT_DISCONNECT_NOTIFY callback function. |
| PFLT_FILTER_UNLOAD_CALLBACK A minifilter driver can register a routine of type PFLT_FILTER_UNLOAD_CALLBACK as the minifilter driver's FilterUnloadCallback routine. |
| PFLT_GENERATE_FILE_NAME A minifilter driver that provides file names for the filter manager's name cache can register a routine of type PFLT_GENERATE_FILE_NAME as the minifilter driver's GenerateFileNameCallback routine. |
| PFLT_GET_OPERATION_STATUS_CALLBACK A minifilter driver can register a routine of type PFLT_GET_OPERATION_STATUS_CALLBACK as the minifilter driver's OperationStatusCallback routine. |
| PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK A minifilter driver can register a routine of type PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK as the minifilter driver's InstanceQueryTeardownCallback routine. |
| PFLT_INSTANCE_SETUP_CALLBACK A minifilter driver can register a routine of type PFLT_INSTANCE_SETUP_CALLBACK as the minifilter driver's InstanceSetupCallback routine. |
| PFLT_INSTANCE_TEARDOWN_CALLBACK A minifilter driver can register two routines of type PFLT_INSTANCE_TEARDOWN_CALLBACK as the minifilter driver's InstanceTeardownStartCallback and InstanceTeardownCompleteCallback routines. |
| PFLT_MESSAGE_NOTIFY Learn more about the PFLT_MESSAGE_NOTIFY callback function. |
| PFLT_NORMALIZE_CONTEXT_CLEANUP A minifilter driver that provides file names for the filter manager's name cache can register a routine of type PFLT_NORMALIZE_CONTEXT_CLEANUP as the minifilter driver's NormalizeContextCleanupCallback routine. |
| PFLT_NORMALIZE_NAME_COMPONENT A minifilter driver that provides file names for the filter manager's name cache can register a routine of type PFLT_NORMALIZE_NAME_COMPONENT as the minifilter driver's NormalizeNameComponentCallback routine. |
| PFLT_NORMALIZE_NAME_COMPONENT_EX A minifilter driver that provides file names for the filter manager's name cache can register a routine of type PFLT_NORMALIZE_NAME_COMPONENT_EX as the minifilter driver's NormalizeNameComponentExCallback callback routine. |
| PFLT_POST_OPERATION_CALLBACK A minifilter driver can register one or more routines of type PFLT_POST_OPERATION_CALLBACK to perform completion processing for I/O operations. |
| PFLT_PRE_OPERATION_CALLBACK A minifilter driver's PFLT_PRE_OPERATION_CALLBACK routine performs pre-operation processing for I/O operations. |
| PFLT_SECTION_CONFLICT_NOTIFICATION_CALLBACK A minifilter driver can optionally register a routine of type PFLT_CONTEXT_ALLOCATE_CALLBACK as the minifilter driver's SectionNotificationCallback routine. |
| PFLT_TRANSACTION_NOTIFICATION_CALLBACK A minifilter driver can register a routine of type PFLT_TRANSACTION_NOTIFICATION_CALLBACK as its TransactionNotificationCallback routine. |
Structures
| FLT_CALLBACK_DATA The FLT_CALLBACK_DATA structure represents an I/O operation. The Filter Manager and minifilters use this structure to initiate and process I/O operations. |
| FLT_CALLBACK_DATA_QUEUE FLT_CALLBACK_DATA_QUEUE is an opaque structure that is used to specify the callback routines for a minifilter's callback data queue. Do not set the members of this structure directly. Use FltCbdqInitialize to initialize this structure. |
| FLT_CONTEXT_REGISTRATION The FLT_CONTEXT_REGISTRATION structure is used to register context types. |
| FLT_CREATEFILE_TARGET_ECP_CONTEXT The FLT_CREATEFILE_TARGET_ECP_CONTEXT structure is an extra create parameter (ECP) used to return reparse target information back to the caller of FltCreateFileEx2. |
| FLT_FILE_NAME_INFORMATION The FLT_FILE_NAME_INFORMATION structure contains file name information. |
| FLT_IO_PARAMETER_BLOCK Learn more about the FLT_IO_PARAMETER_BLOCK structure. |
| FLT_NAME_CONTROL A minifilter that provides file names for the Filter Manager's name cache can use the FLT_NAME_CONTROL structure to manage its name buffers. |
| FLT_OPERATION_REGISTRATION The FLT_OPERATION_REGISTRATION structure is used to register operation callback routines. |
| FLT_PARAMETERS The FLT_PARAMETERS union defines, for a minifilter, the request-type-specific parameters associated with an I/O operation. |
| FLT_REGISTRATION The FLT_REGISTRATION structure is passed as a parameter to FltRegisterFilter. |
| FLT_RELATED_CONTEXTS The FLT_RELATED_CONTEXTS structure contains a minifilter driver's contexts for the objects associated with an I/O operation. |
| FLT_RELATED_CONTEXTS_EX The FLT_RELATED_CONTEXTS_EX structure contains a minifilter driver's contexts for the objects associated with an I/O operation. |
| FLT_RELATED_OBJECTS The FLT_RELATED_OBJECTS structure contains opaque pointers for the objects associated with an operation. |
| FLT_TAG_DATA_BUFFER The FLT_TAG_DATA_BUFFER structure contains information about a reparse point tag. |
| FLT_VOLUME_PROPERTIES The FLT_VOLUME_PROPERTIES structure is passed as a parameter to FltGetVolumeProperties. |