fltkernel.h header
This header is used by ifsk. For more information, see:
fltkernel.h contains the following programming interfaces:
Functions
| FLT_IS_FASTIO_OPERATION Learn more about FLT_IS_FASTIO_OPERATION |
| FLT_IS_FS_FILTER_OPERATION Learn more about the FLT_IS_FS_FILTER_OPERATION macro. |
| FLT_IS_IRP_OPERATION Learn more about the FLT_IS_IRP_OPERATION macro. |
| FLT_IS_REISSUED_IO Learn more about the FLT_IS_REISSUED_IO macro. |
| FLT_IS_SYSTEM_BUFFER Learn more about the FLT_IS_SYSTEM_BUFFER macro. |
| FltAcknowledgeEcp The FltAcknowledgeEcp routine is used to mark an extra create parameter context structure (ECP) as acknowledged. |
| FltAcquirePushLockExclusive The FltAcquirePushLockExclusive routine acquires the given push lock for exclusive access by the calling thread. |
| FltAcquirePushLockExclusiveEx The FltAcquirePushLockExclusiveEx routine acquires the given push lock for exclusive access by the calling thread. |
| FltAcquirePushLockShared The FltAcquirePushLockShared routine acquires the given push lock for shared access by the calling thread. |
| FltAcquirePushLockSharedEx The FltAcquirePushLockSharedEx routine acquires the given push lock for shared access by the calling thread. |
| FltAcquireResourceExclusive Learn more about the FltAcquireResourceExclusive function. |
| FltAcquireResourceShared Learn more about the FltAcquireResourceShared function. |
| FltAddOpenReparseEntry This routine adds a caller allocated open reparse structure, OPEN_REPARSE_LIST_ENTRY, into a create operation. |
| FltAdjustDeviceStackSizeForIoRedirection The FltAdjustDeviceStackSizeForIoRedirection routine increases the size of the source device stack to allow a minifilter to redirect I/O from a specified source instance to a specified target instance when the target stack is deeper than the source stack. |
| FltAllocateCallbackData FltAllocateCallbackData allocates a callback data structure that a minifilter driver can use to initiate an I/O request. |
| FltAllocateCallbackDataEx The FltAllocateCallbackDataEx routine allocates a callback data structure and can preallocate memory for additional structures that a minifilter driver can use to initiate an I/O request. |
| FltAllocateContext Learn more about the FltAllocateContext function. |
| FltAllocateDeferredIoWorkItem FltAllocateDeferredIoWorkItem allocates a deferred-I/O work item. |
| FltAllocateExtraCreateParameter The FltAllocateExtraCreateParameter routine allocates paged memory pool for a user-defined extra create parameter (ECP) context structure and generates a pointer to that structure. |
| FltAllocateExtraCreateParameterFromLookasideList The FltAllocateExtraCreateParameterFromLookasideList routine allocates memory pool from a given lookaside list for an extra create parameter (ECP) context structure and generates a pointer to that structure. |
| FltAllocateExtraCreateParameterList The FltAllocateExtraCreateParameterList routine allocates paged pool memory for an extra create parameter (ECP) list structure and generates a pointer to that structure. |
| FltAllocateFileLock The FltAllocateFileLock routine allocates and initializes a new FILE_LOCK structure. |
| FltAllocateGenericWorkItem FltAllocateGenericWorkItem allocates a generic work item. |
| FltAllocatePoolAlignedWithTag FltAllocatePoolAlignedWithTag allocates a device-aligned buffer for use in a noncached I/O operation. |
| FltApplyPriorityInfoThread The FltApplyPriorityInfoThread routine is used by a minifilter driver to apply priority information to a thread. |
| FltAttachVolume FltAttachVolume creates a new minifilter driver instance and attaches it to the given volume. |
| FltAttachVolumeAtAltitude FltAttachVolumeAtAltitude is a debugging support routine that attaches a minifilter driver instance to a volume at a specified altitude, overriding any settings in the minifilter driver's INF file. |
| FltBuildDefaultSecurityDescriptor FltBuildDefaultSecurityDescriptor builds a default security descriptor for use with FltCreateCommunicationPort. |
| FltCancelFileOpen A minifilter driver can use the FltCancelFileOpen routine to close a newly opened or created file. |
| FltCancelIo The FltCancelIo routine cancels an I/O operation. |
| FltCancellableWaitForMultipleObjects The FltCancellableWaitForMultipleObjects executes a cancelable wait operation (a wait that can be terminated) on one or more dispatcher objects. |
| FltCancellableWaitForSingleObject The FltCancellableWaitForSingleObject routine executes a cancelable wait operation (a wait that can be terminated) on a dispatcher object. |
| FltCbdqDisable FltCbdqDisable disables a minifilter driver's callback data queue. |
| FltCbdqEnable FltCbdqEnable enables a callback data queue that was disabled by a previous call to FltCbdqDisable. |
| FltCbdqInitialize FltCbdqInitialize initializes a minifilter driver's callback data queue dispatch table. |
| FltCbdqInsertIo FltCbdqInsertIo inserts the callback data structure for an I/O operation into a filter driver's callback data queue. |
| FltCbdqRemoveIo FltCbdqRemoveIo removes a particular item from a minifilter driver's callback data queue. |
| FltCbdqRemoveNextIo FltCbdqRemoveNextIo removes the next matching item in a minifilter driver's callback data queue. |
| FltCheckAndGrowNameControl The FltCheckAndGrowNameControl routine checks whether the buffer in a FLT_NAME_CONTROL structure is large enough to hold the specified number of bytes. If not, FltCheckAndGrowNameControl replaces it with a larger system-allocated buffer. |
| FltCheckLockForReadAccess The FltCheckLockForReadAccess routine determines whether the caller has read access to a locked byte range of a file. |
| FltCheckLockForWriteAccess The FltCheckLockForWriteAccess routine determines whether the caller has write access to a locked byte range of a file. |
| FltCheckOplock A minifilter driver calls FltCheckOplock to synchronize the callback data structure for an IRP-based file I/O operation with the file's current opportunistic lock (oplock) state. |
| FltCheckOplockEx A minifilter driver calls the FltCheckOplockEx routine to synchronize the callback data structure for an IRP-based file I/O operation that has the current opportunistic lock (oplock) state of the file. |
| FltClearCallbackDataDirty The FltClearCallbackDataDirty routine clears the callback dirty flag in a callback data structure. |
| FltClearCancelCompletion FltClearCancelCompletion clears a cancel routine that was specified for an I/O operation. |
| FltClose FltClose closes a file handle that was opened by FltCreateFile or FltCreateFileEx. |
| FltCloseClientPort FltCloseClientPort closes a communication client port. |
| FltCloseCommunicationPort FltCloseCommunicationPort closes a minifilter driver's communication server port. |
| FltCloseSectionForDataScan The FltCloseSectionForDataScan routine closes a section object associated with a file stream. |
| FltCommitComplete The FltCommitComplete routine acknowledges a TRANSACTION_NOTIFY_COMMIT notification. |
| FltCommitFinalizeComplete The FltCommitFinalizeComplete routine acknowledges a TRANSACTION_NOTIFY_COMMIT_FINALIZE notification. |
| FltCompareInstanceAltitudes FltCompareInstanceAltitudes compares the altitudes of two minifilter driver instances. |
| FltCompletePendedPostOperation FltCompletePendedPostOperation resumes completion processing for an I/O operation that was pended in a minifilter driver's postoperation callback routine. |
| FltCompletePendedPreOperation FltCompletePendedPreOperation resumes processing for an I/O operation that was pended in a minifilter driver's preoperation callback (PFLT_PRE_OPERATION_CALLBACK) routine. |
| FltCopyOpenReparseList This routine copies any open reparse information from a previous create into a new ECP list that can be used to issue a second create. |
| FltCreateCommunicationPort FltCreateCommunicationPort creates a communication server port on which a minifilter driver can receive connection requests from user-mode applications. |
| FltCreateFile Learn more about the FltCreateFile function. |
| FltCreateFileEx Minifilter drivers call FltCreateFileEx to create a new file or open an existing file. |
| FltCreateFileEx2 Minifilter drivers call FltCreateFileEx2 to create a new file or open an existing file. This routine also includes an optional create context parameter. |
| FltCreateMailslotFile Minifilter drivers call FltCreateMailslotFile to create a new pipe or open an existing mailslot. |
| FltCreateNamedPipeFile Minifilter drivers call FltCreateNamedPipeFile to create a new pipe or open an existing pipe. |
| FltCreateSectionForDataScan The FltCreateSectionForDataScan routine creates a section object for a file. The filter manager can optionally synchronize I/O with the section created. |
| FltCreateSystemVolumeInformationFolder FltCreateSystemVolumeInformationFolder verifies the existence of the "System Volume Information" folder on a file system volume. If the folder is not present, then the folder is created. |
| FltCurrentBatchOplock A minifilter driver calls FltCurrentBatchOplock to determine whether there are any batch or filter opportunistic locks (oplocks) on a file. |
| FltCurrentOplock A minifilter driver calls the FltCurrentOplock routine to determine whether there are any opportunistic locks (oplocks) on a file. |
| FltCurrentOplockH A minifilter driver calls the FltCurrentOplockH routine to determine whether there are any CACHE_HANDLE_LEVEL opportunistic locks (oplocks) on a file. |
| FltDecodeParameters FltDecodeParameters returns pointers to the memory descriptor list (MDL) address, buffer pointer, buffer length, and desired access parameters for an I/O operation. |
| FltDeleteContext FltDeleteContext marks a specified context for deletion. |
| FltDeleteExtraCreateParameterLookasideList The FltDeleteExtraCreateParameterLookasideList routine frees an extra create parameter (ECP) lookaside list. |
| FltDeleteFileContext The FltDeleteFileContext routine retrieves and deletes a file context that a given minifilter driver has set for a given file. |
| FltDeleteInstanceContext FltDeleteInstanceContext removes a context from a given instance and marks the context for deletion. |
| FltDeletePushLock The FltDeletePushLock routine deletes a given push lock. |
| FltDeleteStreamContext FltDeleteStreamContext removes a context that a given minifilter driver instance has set for a given stream and marks the context for deletion. |
| FltDeleteStreamHandleContext FltDeleteStreamHandleContext removes a context that a given minifilter driver instance has set for a given stream handle and marks the context for deletion. |
| FltDeleteTransactionContext The FltDeleteTransactionContext routine removes a context from a given transaction and marks the context for deletion. |
| FltDeleteVolumeContext FltDeleteVolumeContext removes a context that a given minifilter driver has set for a given volume and marks the context for deletion. |
| FltDetachVolume FltDetachVolume detaches a minifilter driver instance from a volume. |
| FltDeviceIoControlFile FltDeviceIoControlFile sends a control code directly to a specified device driver, causing the corresponding driver to perform the specified action. |
| FltDoCompletionProcessingWhenSafe If it is safe to do so, the FltDoCompletionProcessingWhenSafe function executes a minifilter driver postoperation callback routine. |
| FltEnlistInTransaction The FltEnlistInTransaction routine enlists a minifilter driver in a given transaction. |
| FltEnumerateFilterInformation The FltEnumerateFilterInformation routine provides information about all the registered filter drivers (including minifilter and legacy filter drivers) in the system. |
| FltEnumerateFilters The FltEnumerateFilters routine enumerates all registered minifilter drivers in the system. |
| FltEnumerateInstanceInformationByDeviceObject The FltEnumerateInstanceInformationByDeviceObject routine provides information about minifilter driver instances and legacy filter drivers that are attached to the volume related to a specified device object. |
| FltEnumerateInstanceInformationByFilter The FltEnumerateInstanceInformationByFilter routine provides information about instances of a given minifilter driver. |
| FltEnumerateInstanceInformationByVolume The FltEnumerateInstanceInformationByVolume routine provides information about minifilter driver instances and legacy filter drivers (Windows Vista only) that are attached to a given volume. |
| FltEnumerateInstanceInformationByVolumeName The FltEnumerateInstanceInformationByVolumeName routine provides information about minifilter driver instances and legacy filter drivers that are attached to the volume with the specified name. |
| FltEnumerateInstances The FltEnumerateInstances routine enumerates minifilter driver instances for a given minifilter driver or volume. |
| FltEnumerateVolumeInformation The FltEnumerateVolumeInformation routine provides information about volumes that are known to the filter manager. |
| FltEnumerateVolumes The FltEnumerateVolumes routine enumerates all volumes in the system. |
| FltFastIoMdlRead The FltFastIoMdlRead routine returns a memory descriptor list (MDL) that points directly to the specified byte range in the file cache. |
| FltFastIoMdlReadComplete The FltFastIoMdlReadComplete routine completes the read operation that the FltFastIoMdlRead routine initiated. |
| FltFastIoMdlWriteComplete The FltFastIoMdlWriteComplete routine in fltkernel.h frees the resources that FltFastIoPrepareMdlWrite allocated. |
| FltFastIoPrepareMdlWrite The FltFastIoPrepareMdlWrite routine returns a linked list of memory descriptor lists (MDLs) that point to the specified range of cached file data to write data directly to the cache. |
| FltFindExtraCreateParameter The FltFindExtraCreateParameter routine searches a given ECP list for an ECP context structure of a given type and returns a pointer to this structure if it is found. |
| FltFlushBuffers The FltFlushBuffers routine is used by the minifilter driver to send a flush request for a given file to the file system. |
| FltFlushBuffers2 Learn more about the FltFlushBuffers2 function. |
| FltFreeCallbackData The FltFreeCallbackData routine frees a callback data structure allocated by the FltAllocateCallbackData routine. |
| FltFreeDeferredIoWorkItem The FltFreeDeferredIoWorkItem routine frees a work item allocated by the FltAllocateDeferredIoWorkItem routine. |
| FltFreeExtraCreateParameter The FltFreeExtraCreateParameter routine frees the memory for an ECP context structure. |
| FltFreeExtraCreateParameterList The FltFreeExtraCreateParameterList routine frees an extra create parameter (ECP) list structure. |
| FltFreeFileLock The FltFreeFileLock routine uninitializes and frees an initialized FILE_LOCK structure. |
| FltFreeGenericWorkItem The FltFreeGenericWorkItem routine frees a work item allocated by the FltAllocateGenericWorkItem routine. |
| FltFreeOpenReparseList This routine deallocates any information copied into a create operation by a previous call to FltCopyOpenReparseList. |
| FltFreePoolAlignedWithTag The FltFreePoolAlignedWithTag routine frees a cache-aligned buffer that was allocated by a previous call to FltAllocatePoolAlignedWithTag. |
| FltFreeSecurityDescriptor FltFreeSecurityDescriptor frees a security descriptor allocated by the FltBuildDefaultSecurityDescriptor routine. |
| FltFsControlFile The FltFsControlFile routine sends a control code directly to a specified file system or file system filter driver, causing the corresponding driver to perform the specified action. |
| FltGetActivityIdCallbackData The FltGetActivityIdCallbackData routine retrieves the current activity ID associated with a request in a minifilter's callback data. |
| FltGetBottomInstance FltGetBottomInstance returns an opaque instance pointer for the minifilter driver instance, if there is one, that is attached at the bottom of the instance stack for a given volume. |
| FltGetContexts Learn more about the FltGetContexts function. |
| FltGetContextsEx Learn more about the FltGetContextsEx function. |
| FltGetCopyInformationFromCallbackData Learn more about the FltGetCopyInformationFromCallbackData function. |
| FltGetDestinationFileNameInformation Learn more about the FltGetDestinationFileNameInformation routine. |
| FltGetDeviceObject The FltGetDeviceObject routine returns a pointer to the Filter Manager's volume device object (VDO) for a given volume. |
| FltGetDiskDeviceObject The FltGetDiskDeviceObject routine returns a pointer to the disk device object associated with a given volume. |
| FltGetEcpListFromCallbackData The FltGetEcpListFromCallbackData routine returns a pointer to an extra create parameter context structure (ECP) list that is associated with a given create operation callback-data object. |
| FltGetFileContext Learn more about the FltGetFileContext function. |
| FltGetFileNameInformation The FltGetFileNameInformation routine returns name information for a file or directory. |
| FltGetFileNameInformationUnsafe The FltGetFileNameInformationUnsafe routine returns name information for an open file or directory. |
| FltGetFileSystemType The FltGetFileSystemType function takes a volume or instance object and provides the file system type of the volume. |
| FltGetFilterFromInstance The FltGetFilterFromInstance routine returns an opaque filter pointer for the minifilter driver that created the given instance. |
| FltGetFilterFromName The FltGetFilterFromName routine returns an opaque filter pointer for a registered minifilter driver whose name matches the value in the FilterName parameter. |
| FltGetFilterInformation The FltGetFilterInformation routine provides information about a minifilter driver. |
| FltGetInstanceContext Learn more about the FltGetInstanceContext function. |
| FltGetInstanceInformation The FltGetInstanceInformation routine returns information about a minifilter driver instance. |
| FltGetIoPriorityHint The FltGetIoPriorityHint routine is used by a minifilter driver to get IO priority information from Callback Data. |
| FltGetIoPriorityHintFromCallbackData The FltGetIoPriorityHintFromCallbackData routine is used by a minifilter driver to get IO priority information from callback data. |
| FltGetIoPriorityHintFromFileObject The FltGetIoPriorityHintFromFileObject routine is used by a minifilter driver to get IO priority information from a file object. |
| FltGetIoPriorityHintFromThread The FltGetIoPriorityHintFromThread routine is used by a minifilter driver to get IO priority information from a thread. |
| FltGetIrpName The FltGetIrpName routine returns the name for a major function code as a printable string. |
| FltGetLowerInstance The FltGetLowerInstance routine returns an opaque instance pointer for the next lower minifilter driver instance, if there is one, that is attached below a given minifilter driver instance on the same volume. |
| FltGetNewSystemBufferAddress The FltGetNewSystemBufferAddress function retrieves the AssociatedIrp.SystemBuffer buffer, which the file system has allocated. A minifilter driver's post-callback routine calls this function. |
| FltGetNextExtraCreateParameter The FltGetNextExtraCreateParameter routine returns a pointer to the next (or first) extra create parameter context structure (ECP) in a given ECP list. |
| FltGetRequestorProcess The FltGetRequestorProcess routine returns a process pointer for the thread that requested a given I/O operation. |
| FltGetRequestorProcessId The FltGetRequestorProcessId routine returns the unique 32-bit process ID for the process associated with the thread that requested a given I/O operation. |
| FltGetRequestorProcessIdEx The FltGetRequestorProcessIdEx routine returns the kernel-mode handle for the process that is associated with the thread that requested a given I/O operation. |
| FltGetRequestorSessionId The FltGetRequestorSessionId routine returns the session ID of the process that originally requested the specified I/O operation. |
| FltGetRoutineAddress The FltGetRoutineAddress routine returns a pointer to a routine specified by the FltMgrRoutineName parameter. |
| FltGetSectionContext Learn more about the FltGetSectionContext function. |
| FltGetStreamContext Learn more about the FltGetStreamContext function. |
| FltGetStreamHandleContext Learn more about the FltGetStreamHandleContext function. |
| FltGetSwappedBufferMdlAddress The FltGetSwappedBufferMdlAddress routine returns the memory descriptor list (MDL) address for a buffer that was swapped in by a minifilter driver. |
| FltGetTopInstance The FltGetTopInstance routine returns an opaque instance pointer for the minifilter driver instance that is attached at the top of the instance stack for a given volume. |
| FltGetTransactionContext The FltGetTransactionContext routine retrieves a context that was set for a transaction by a given minifilter driver. |
| FltGetTunneledName The FltGetTunneledName routine retrieves the tunneled name for a file, given the normalized name returned for the file by a previous call to FltGetFileNameInformation, FltGetFileNameInformationUnsafe, or FltGetDestinationFileNameInformation. |
| FltGetUpperInstance The FltGetUpperInstance routine returns an opaque instance pointer for the next higher minifilter driver instance, if there is one, that is attached above a given minifilter driver instance on the same volume. |
| FltGetVolumeContext Learn more about the FltGetVolumeContext function. |
| FltGetVolumeFromDeviceObject The FltGetVolumeFromDeviceObject routine returns an opaque pointer for the volume represented by a volume device object (VDO). |
| FltGetVolumeFromFileObject The FltGetVolumeFromFileObject routine returns an opaque pointer for the volume that a given file stream resides on. |
| FltGetVolumeFromInstance The FltGetVolumeFromInstance routine returns an opaque pointer for the volume that a given minifilter driver instance is attached to. |
| FltGetVolumeFromName The FltGetVolumeFromName routine returns an opaque pointer for the volume whose name matches the value of the VolumeName parameter. |
| FltGetVolumeGuidName The FltGetVolumeGuidName routine returns the volume name for a given volume, in volume globally unique identifier (GUID) format. |
| FltGetVolumeInformation The FltGetVolumeInformation routine provides information about a given volume. |
| FltGetVolumeInstanceFromName The FltGetVolumeInstanceFromName routine returns an opaque instance pointer for the given minifilter driver instance on the given volume. |
| FltGetVolumeName The FltGetVolumeName routine gets the volume name for a given volume. |
| FltGetVolumeProperties The FltGetVolumeProperties routine returns volume property information for the given volume. |
| FltInitExtraCreateParameterLookasideList The FltInitExtraCreateParameterLookasideList routine initializes a paged or non-paged pool lookaside list used for the allocation of one or more extra create parameter context structures (ECPs) of fixed size. |
| FltInitializeFileLock The FltInitializeFileLock routine initializes an opaque FILE_LOCK structure that the caller has allocated from paged pool. |
| FltInitializeOplock The FltInitializeOplock routine initializes an opportunistic lock (oplock) pointer. |
| FltInitializePushLock The FltInitializePushLock routine initializes a push lock variable. |
| FltInsertExtraCreateParameter The FltInsertExtraCreateParameter routine inserts an extra create parameter (ECP) context structure into an ECP list. |
| FltIs32bitProcess The FltIs32bitProcess routine checks whether the originator of the current I/O operation is a 32-bit user-mode application. |
| FltIsCallbackDataDirty The FltIsCallbackDataDirty routine tests the FLTFL_CALLBACK_DATA_DIRTY flag in a callback data structure. |
| FltIsDirectory A minifilter driver calls the FltIsDirectory routine to determine whether a given file object represents a directory. |
| FltIsEcpAcknowledged The FltIsEcpAcknowledged routine is used to determine if a given extra create parameter context structure (ECP) has been marked as acknowledged. |
| FltIsEcpFromUserMode The FltIsEcpFromUserMode routine is used to determine if an extra create parameter context structure (ECP) originated from user mode. |
| FltIsFltMgrVolumeDeviceObject The FltIsFltMgrVolumeDeviceObject routine determines whether the given device object belongs to filter manager and if the device object is a volume device object. |
| FltIsIoCanceled The FltIsIoCanceled routine checks if an IRP-based operation has been canceled. |
| FltIsIoRedirectionAllowed The FltIsIoRedirectionAllowed routine determines whether I/O can be redirected from the specified source filter instance to another specified filter instance. |
| FltIsIoRedirectionAllowedForOperation The FltIsIoRedirectionAllowedForOperation routine determines whether I/O can be redirected from the filter instance associated with the specified FLT_CALLBACK_DATA structure to the specified filter instance. |
| FltIsOperationSynchronous The FltIsOperationSynchronous routine determines whether a given callback data structure (FLT_CALLBACK_DATA) represents a synchronous or asynchronous I/O operation. |
| FltIsVolumeSnapshot The FltIsVolumeSnapshot routine determines whether a volume or minifilter driver instance is attached to a snapshot volume. |
| FltIsVolumeWritable The FltIsVolumeWritable routine determines whether the disk device that corresponds to a volume or minifilter driver instance is writable. |
| FltLoadFilter The FltLoadFilter routine dynamically loads a minifilter driver into the currently running system. |
| FltLockUserBuffer Learn more about the FltLockUserBuffer function. |
| FltNotifyFilterChangeDirectory The FltNotifyFilterChangeDirectory routine creates a notify structure for an IRP_MN_NOTIFY_CHANGE_DIRECTORY operation and adds it to the specified notify list. |
| FltObjectDereference The FltObjectDereference routine removes a rundown reference from an opaque filter, instance, or volume pointer. |
| FltObjectReference The FltObjectReference routine adds a rundown reference to an opaque filter, instance, or volume pointer. |
| FltOpenVolume The FltOpenVolume routine returns a handle and a file object pointer for the file system volume that a given minifilter driver instance is attached to. |
| FltOplockBreakH The FltOplockBreakH routine breaks CACHE_HANDLE_LEVEL opportunistic locks (oplocks). |
| FltOplockBreakToNone The FltOplockBreakToNone routine breaks all opportunistic locks (oplocks) immediately without regard for any oplock key. |
| FltOplockBreakToNoneEx The FltOplockBreakToNoneEx routine breaks all opportunistic locks (oplocks) immediately without regard for any oplock key. |
| FltOplockFsctrl The FltOplockFsctrl routine performs various opportunistic lock (oplock) operations on behalf of a minifilter driver. |
| FltOplockFsctrlEx The FltOplockFsctrlEx routine performs various opportunistic lock (oplock) operations on behalf of a minifilter driver. |
| FltOplockIsFastIoPossible The FltOplockIsFastIoPossible routine checks a file's opportunistic lock (oplock) state to determine whether fast I/O can be performed on the file. |
| FltOplockIsSharedRequest The FltOplockIsSharedRequest routine determines if a request for an opportunistic lock (oplock) wants a shared oplock. |
| FltOplockKeysEqual The FltOplockKeysEqual routine compares the opportunistic lock (oplock) keys that are stored in the file object extensions of two file objects. |
| FltParseFileName FltParseFileName parses the extension, stream, and final component from a file name string. |
| FltParseFileNameInformation FltParseFileNameInformation parses the contents of a FLT_FILE_NAME_INFORMATION structure. |
| FltPerformAsynchronousIo A minifilter driver calls FltPerformAsynchronousIo to initiate an asynchronous I/O operation. |
| FltPerformSynchronousIo A minifilter driver calls FltPerformSynchronousIo to initiate a synchronous I/O operation after calling FltAllocateCallbackData to allocate a callback data structure for the operation. |
| FltPrepareComplete The FltPrepareComplete routine acknowledges a TRANSACTION_NOTIFY_PREPARE notification. |
| FltPrepareToReuseEcp The FltPrepareToReuseEcp routine resets an extra create parameter (ECP) context structure, which prepares it for reuse. |
| FltPrePrepareComplete The FltPrePrepareComplete routine acknowledges a TRANSACTION_NOTIFY_PREPREPARE notification. |
| FltProcessFileLock The FltProcessFileLock routine processes and completes a file lock operation. |
| FltPropagateActivityIdToThread The FltPropagateActivityIdToThread routine associates the activity ID from the IRP in the minifilter's callback data with the current thread. |
| FltPropagateIrpExtension The FltPropagateIrpExtension routine copies the IRP extension from one minifilter's callback data to another's callback data. |
| FltPurgeFileNameInformationCache FltPurgeFileNameInformationCache purges from the Filter Manager's name cache all file name information structures that were generated from names provided by the given minifilter driver instance. |
| FltQueryDirectoryFile The FltQueryDirectoryFile routine returns various kinds of information about files in the directory specified by a given file object. |
| FltQueryDirectoryFileEx FltQueryDirectoryFileEx returns various kinds of information about files in the directory specified by a given file object. |
| FltQueryEaFile FltQueryEaFile returns information about extended-attribute (EA) values for a file. |
| FltQueryInformationByName The FltQueryInformationByName routine returns the requested information about a named file. |
| FltQueryInformationFile FltQueryInformationFile retrieves information for a given file. |
| FltQueryQuotaInformationFile The FltQueryQuotaInformationFile routine retrieves quota entries associated with a file object. |
| FltQuerySecurityObject FltQuerySecurityObject retrieves a copy of an object's security descriptor. |
| FltQueryVolumeInformation The FltQueryVolumeInformation routine retrieves information about the volume that the given instance is attached to. |
| FltQueryVolumeInformationFile FltQueryVolumeInformationFile retrieves volume information for a given file, directory, storage device, or volume. |
| FltQueueDeferredIoWorkItem The FltQueueDeferredIoWorkItem routine posts an IRP-based I/O operation to a work queue. |
| FltQueueGenericWorkItem FltQueueGenericWorkItem posts a work item that is not associated with a specific I/O operation to a work queue. |
| FltReadFile Learn more about the FltReadFile function. |
| FltReadFileEx Learn more about the FltReadFileEx function. |
| FltReferenceContext FltReferenceContext increments the reference count on a context structure. |
| FltReferenceFileNameInformation FltReferenceFileNameInformation increments the reference count on a file name information structure. |
| FltRegisterFilter FltRegisterFilter registers a minifilter driver. |
| FltRegisterForDataScan The FltRegisterForDataScan routine enables data scanning for the volume attached to the minifilter instance. |
| FltReissueSynchronousIo FltReissueSynchronousIo initiates a new synchronous I/O operation that uses the parameters from a previously synchronized I/O operation. |
| FltReleaseContext FltReleaseContext decrements the reference count on a context. |
| FltReleaseContexts FltReleaseContexts releases each context in a given FLT_RELATED_CONTEXTS structure. |
| FltReleaseContextsEx FltReleaseContextsEx releases each context in a given FLT_RELATED_CONTEXTS_EX structure. |
| FltReleaseFileNameInformation FltReleaseFileNameInformation releases a file name information structure. |
| FltReleasePushLock The FltReleasePushLock routine releases a specified push lock owned by the current thread. |
| FltReleasePushLockEx The FltReleasePushLockEx routine releases a specified push lock owned by the current thread. |
| FltReleaseResource Learn more about the FltReleaseResource function. |
| FltRemoveExtraCreateParameter The FltRemoveExtraCreateParameter routine searches an ECP list for an ECP context structure and, if found, detaches it from the ECP list. |
| FltRemoveOpenReparseEntry This routine removes an OPEN_REPARSE_LIST_ENTRY structure (added by FltAddOpenReparseEntry) from a create operation. |
| FltRequestFileInfoOnCreateCompletion A minifilter calls FltRequestFileInfoOnCreateCompletion during file pre-create to request that the file manager stores the specified file information for retrieval upon create complete. |
| FltRequestOperationStatusCallback FltRequestOperationStatusCallback returns status information for the given I/O operation. |
| FltRetainSwappedBufferMdlAddress FltRetainSwappedBufferMdlAddress prevents the Filter Manager from freeing the memory descriptor list (MDL) for a buffer that was swapped in by a minifilter driver. |
| FltRetrieveFileInfoOnCreateCompletion FltRetrieveFileInfoOnCreateCompletion retrieves the requested file information during file post create. |
| FltRetrieveFileInfoOnCreateCompletionEx FltRetrieveFileInfoOnCreateCompletionEx queries for the specified file information upon file creation completion. |
| FltRetrieveIoPriorityInfo The FltRetrieveIoPriorityInfo routine is used by a minifilter driver to retrieve priority information from a thread. |
| FltReuseCallbackData The FltReuseCallbackData routine reinitializes a callback data structure so that it can be reused. |
| FltRollbackComplete The FltRollbackComplete routine acknowledges a TRANSACTION_NOTIFY_ROLLBACK notification. |
| FltRollbackEnlistment The FltRollbackEnlistment routine rolls back or aborts a transaction on behalf of a minifilter driver. |
| FltSendMessage FltSendMessage sends a message to a waiting user-mode application on behalf of a minifilter driver or a minifilter driver instance. |
| FltSetActivityIdCallbackData The FltSetActivityIdCallbackData routine sets the a activity ID for an IRP in a minifilter's callback data. |
| FltSetCallbackDataDirty A minifilter driver's preoperation or postoperation callback routine calls FltSetCallbackDataDirty to indicate that it has modified the contents of the callback data structure. |
| FltSetCancelCompletion A minifilter driver calls FltSetCancelCompletion to specify a cancel routine to be called if a given I/O operation is canceled. |
| FltSetEaFile FltSetEaFile sets extended-attribute (EA) values for a file. |
| FltSetEcpListIntoCallbackData The FltSetEcpListIntoCallbackData routine attaches an extra create parameter context structure (ECP) list to a create operation callback-data object. |
| FltSetFileContext The FltSetFileContext routine sets a context for a file. |
| FltSetInformationFile FltSetInformationFile sets information for a given file. |
| FltSetInstanceContext FltSetInstanceContext sets a context for a minifilter driver instance. |
| FltSetIoPriorityHintIntoCallbackData The FltSetIoPriorityHintIntoCallbackData routine is used by a minifilter driver to set the I/O priority information in callback data. |
| FltSetIoPriorityHintIntoFileObject The FltSetIoPriorityHintIntoFileObject routine is used by a minifilter driver to set the I/O priority information in a file object. |
| FltSetIoPriorityHintIntoThread The FltSetIoPriorityHintIntoThread routine is used by a minifilter driver to set the IO priority information in a thread. |
| FltSetQuotaInformationFile The FltSetQuotaInformationFile routine modifies quota entries for a file object. |
| FltSetSecurityObject FltSetSecurityObject sets an object's security state. |
| FltSetStreamContext The FltSetStreamContext routine sets a context for a file stream. |
| FltSetStreamHandleContext The FltSetStreamHandleContext routine sets a context for a stream handle. |
| FltSetTransactionContext The FltSetTransactionContext routine sets a context on a transaction. |
| FltSetVolumeContext FltSetVolumeContext sets a context for a volume. |
| FltSetVolumeInformation FltSetVolumeInformation changes various kinds of information about the volume that the given instance is attached to. |
| FltStartFiltering FltStartFiltering starts filtering for a registered minifilter driver. |
| FltSupportsFileContexts The FltSupportsFileContexts routine determines whether the file system supports file contexts for a given file. |
| FltSupportsFileContextsEx The FltSupportsFileContextsEx routine determines whether the file system or the filter manager support file contexts for a given file. |
| FltSupportsStreamContexts FltSupportsStreamContexts determines whether stream contexts are supported on a given file object. |
| FltSupportsStreamHandleContexts FltSupportsStreamHandleContexts determines whether stream handle contexts are supported on a given file object. |
| FltTagFile FltTagFile sets a reparse tag on a file or directory. |
| FltTagFileEx FltTagFileEx sets a reparse flag on a file or directory. |
| FltUninitializeFileLock The FltUninitializeFileLock routine uninitializes a FILE_LOCK structure. |
| FltUninitializeOplock FltUninitializeOplock uninitializes an opportunistic lock (oplock) pointer. |
| FltUnloadFilter A minifilter driver that has loaded a supporting minifilter driver by calling FltLoadFilter can unload the minifilter driver by calling FltUnloadFilter. |
| FltUnregisterFilter A registered minifilter driver calls FltUnregisterFilter to unregister itself so that the Filter Manager no longer calls it to process I/O operations. |
| FltUntagFile FltUntagFile removes a reparse point from a file or directory. |
| FltVetoBypassIo Learn more about the FltVetoBypassIO function. |
| FltWriteFile Learn more about the FltWriteFile function. |
| FltWriteFileEx Learn more about the FltWriteFileEx function. |
Callback functions
| PFLT_COMPLETE_LOCK_CALLBACK_DATA_ROUTINE A minifilter driver can register a routine of type PFLT_COMPLETE_LOCK_CALLBACK_DATA_ROUTINE as the minifilter driver's CompleteLockCallbackDataRoutine callback routine for a FILE_LOCK structure. |
| PFLT_COMPLETED_ASYNC_IO_CALLBACK A minifilter driver that initiates an asynchronous I/O operation can specify a routine of type PFLT_COMPLETED_ASYNC_IO_CALLBACK routine to be called when the operation is completed. |
| PFLT_CONTEXT_ALLOCATE_CALLBACK A minifilter driver can register a routine of type PFLT_CONTEXT_ALLOCATE_CALLBACK as the minifilter driver's ContextAllocateCallback routine. |
| PFLT_CONTEXT_CLEANUP_CALLBACK A minifilter driver can register a routine of type PFLT_CONTEXT_CLEANUP_CALLBACK as the minifilter driver's ContextCleanupCallback routine. |
| PFLT_CONTEXT_FREE_CALLBACK A minifilter can register a routine of type PFLT_CONTEXT_FREE_CALLBACK as the minifilter driver's ContextFreeCallback routine. |
| PFLT_FILTER_UNLOAD_CALLBACK A minifilter driver can register a routine of type PFLT_FILTER_UNLOAD_CALLBACK as the minifilter driver's FilterUnloadCallback routine. |
| PFLT_GENERATE_FILE_NAME A minifilter driver that provides file names for the filter manager's name cache can register a routine of type PFLT_GENERATE_FILE_NAME as the minifilter driver's GenerateFileNameCallback routine. |
| PFLT_GET_OPERATION_STATUS_CALLBACK A minifilter driver can register a routine of type PFLT_GET_OPERATION_STATUS_CALLBACK as the minifilter driver's OperationStatusCallback routine. |
| PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK A minifilter driver can register a routine of type PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK as the minifilter driver's InstanceQueryTeardownCallback routine. |
| PFLT_INSTANCE_SETUP_CALLBACK A minifilter driver can register a routine of type PFLT_INSTANCE_SETUP_CALLBACK as the minifilter driver's InstanceSetupCallback routine. |
| PFLT_INSTANCE_TEARDOWN_CALLBACK A minifilter driver can register two routines of type PFLT_INSTANCE_TEARDOWN_CALLBACK as the minifilter driver's InstanceTeardownStartCallback and InstanceTeardownCompleteCallback routines. |
| PFLT_NORMALIZE_CONTEXT_CLEANUP A minifilter driver that provides file names for the filter manager's name cache can register a routine of type PFLT_NORMALIZE_CONTEXT_CLEANUP as the minifilter driver's NormalizeContextCleanupCallback routine. |
| PFLT_NORMALIZE_NAME_COMPONENT A minifilter driver that provides file names for the filter manager's name cache can register a routine of type PFLT_NORMALIZE_NAME_COMPONENT as the minifilter driver's NormalizeNameComponentCallback routine. |
| PFLT_NORMALIZE_NAME_COMPONENT_EX A minifilter driver that provides file names for the filter manager's name cache can register a routine of type PFLT_NORMALIZE_NAME_COMPONENT_EX as the minifilter driver's NormalizeNameComponentExCallback callback routine. |
| PFLT_POST_OPERATION_CALLBACK A minifilter driver can register one or more routines of type PFLT_POST_OPERATION_CALLBACK to perform completion processing for I/O operations. |
| PFLT_PRE_OPERATION_CALLBACK A minifilter driver's PFLT_PRE_OPERATION_CALLBACK routine performs pre-operation processing for I/O operations. |
| PFLT_SECTION_CONFLICT_NOTIFICATION_CALLBACK A minifilter driver can optionally register a routine of type PFLT_CONTEXT_ALLOCATE_CALLBACK as the minifilter driver's SectionNotificationCallback routine. |
| PFLT_TRANSACTION_NOTIFICATION_CALLBACK A minifilter driver can register a routine of type PFLT_TRANSACTION_NOTIFICATION_CALLBACK as its TransactionNotificationCallback routine. |
Structures
| FLT_CALLBACK_DATA The FLT_CALLBACK_DATA structure represents an I/O operation. The Filter Manager and minifilters use this structure to initiate and process I/O operations. |
| FLT_CALLBACK_DATA_QUEUE FLT_CALLBACK_DATA_QUEUE is an opaque structure that is used to specify the callback routines for a minifilter's callback data queue. Do not set the members of this structure directly. Use FltCbdqInitialize to initialize this structure. |
| FLT_CONTEXT_REGISTRATION The FLT_CONTEXT_REGISTRATION structure is used to register context types. |
| FLT_CREATEFILE_TARGET_ECP_CONTEXT The FLT_CREATEFILE_TARGET_ECP_CONTEXT structure is an extra create parameter (ECP) used to return reparse target information back to the caller of FltCreateFileEx2. |
| FLT_FILE_NAME_INFORMATION The FLT_FILE_NAME_INFORMATION structure contains file name information. |
| FLT_IO_PARAMETER_BLOCK The FLT_IO_PARAMETER_BLOCK structure contains the parameters for the I/O operation that is represented by a callback data (FLT_CALLBACK_DATA) structure. |
| FLT_NAME_CONTROL A minifilter that provides file names for the Filter Manager's name cache can use the FLT_NAME_CONTROL structure to manage its name buffers. |
| FLT_OPERATION_REGISTRATION The FLT_OPERATION_REGISTRATION structure is used to register operation callback routines. |
| FLT_PARAMETERS The FLT_PARAMETERS union defines, for a minifilter, the request-type-specific parameters associated with an I/O operation. |
| FLT_REGISTRATION The FLT_REGISTRATION structure is passed as a parameter to FltRegisterFilter. |
| FLT_RELATED_CONTEXTS The FLT_RELATED_CONTEXTS structure contains a minifilter driver's contexts for the objects associated with an I/O operation. |
| FLT_RELATED_CONTEXTS_EX The FLT_RELATED_CONTEXTS_EX structure contains a minifilter driver's contexts for the objects associated with an I/O operation. |
| FLT_RELATED_OBJECTS The FLT_RELATED_OBJECTS structure contains opaque pointers for the objects associated with an operation. |
| FLT_TAG_DATA_BUFFER The FLT_TAG_DATA_BUFFER structure contains information about a reparse point tag. |
| FLT_VOLUME_PROPERTIES The FLT_VOLUME_PROPERTIES structure is passed as a parameter to FltGetVolumeProperties. |
Feedback
Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see: https://aka.ms/ContentUserFeedback.
Submit and view feedback for