/// <summary> /// Enumerate the list of filter volumes. /// </summary> /// <returns>The list of filter volumes</returns> public static IEnumerable <FilterVolume> GetFilterVolumes() { return(EnumFilter(b => FilterManagerNativeMethods.FilterVolumeFindFirst(FILTER_VOLUME_INFORMATION_CLASS.FilterVolumeStandardInformation, b, b.GetLength(), out _, out IntPtr handle).CreateResult(false, () => handle), (h, b) => FilterManagerNativeMethods.FilterVolumeFindNext(h, FILTER_VOLUME_INFORMATION_CLASS.FilterVolumeStandardInformation, b, b.GetLength(), out _), FilterManagerNativeMethods.FilterVolumeInstanceFindClose, (SafeStructureInOutBuffer <FILTER_VOLUME_STANDARD_INFORMATION> b) => b.Result.NextEntryOffset, (SafeStructureInOutBuffer <FILTER_VOLUME_STANDARD_INFORMATION> b) => new FilterVolume(b))); }
/// <summary> /// Enumerate the list of filter drivers attached to a volume. /// </summary> /// <param name="volume_name">The name of volume, e.g. C:\</param> /// <returns>The list of filter volume instances.</returns> public static IEnumerable <FilterInstance> GetFilterVolumeInstances(string volume_name) { return(EnumFilter(b => FilterManagerNativeMethods.FilterVolumeInstanceFindFirst(volume_name, INSTANCE_INFORMATION_CLASS.InstanceFullInformation, b, b.GetLength(), out _, out IntPtr handle).CreateResult(false, () => handle), (h, b) => FilterManagerNativeMethods.FilterVolumeInstanceFindNext(h, INSTANCE_INFORMATION_CLASS.InstanceFullInformation, b, b.GetLength(), out _), FilterManagerNativeMethods.FilterVolumeInstanceFindClose, (SafeStructureInOutBuffer <FILTER_INSTANCE_FULL_INFORMATION> b) => b.Result.NextEntryOffset, (SafeStructureInOutBuffer <FILTER_INSTANCE_FULL_INFORMATION> b) => new FilterInstance(b))); }
/// <summary> /// Get message from port. /// </summary> /// <param name="max_message_size">The maximum message size to receive.</param> /// <param name="throw_on_error">True to throw on error.</param> /// <returns>The returned message.</returns> public NtResult <FilterConnectionPortMessage> GetMessage(int max_message_size, bool throw_on_error) { using (var buffer = new SafeStructureInOutBuffer <FILTER_MESSAGE_HEADER>(max_message_size, true)) { return(FilterManagerNativeMethods.FilterGetMessage(Handle, buffer, buffer.Length, IntPtr.Zero).CreateResult(throw_on_error, () => new FilterConnectionPortMessage(buffer))); } }
/// <summary> /// Reply to message. /// </summary> /// <param name="status">The NT status code.</param> /// <param name="message_id">The message ID from GetMessage.</param> /// <param name="data">The data to send.</param> /// <param name="throw_on_error">True to throw on error.</param> /// <returns>The NT status code.</returns> public NtStatus ReplyMessage(NtStatus status, ulong message_id, byte[] data, bool throw_on_error) { FILTER_REPLY_HEADER header = new FILTER_REPLY_HEADER() { MessageId = message_id, Status = status }; using (var buffer = header.ToBuffer(data.Length, true)) { buffer.Data.WriteBytes(data); return(FilterManagerNativeMethods.FilterReplyMessage(Handle, buffer, buffer.Length).ToNtException(throw_on_error)); } }
/// <summary> /// Attach a filter to a volume. /// </summary> /// <param name="filter_name">The filter name.</param> /// <param name="volume_name">The volume name.</param> /// <param name="altitude">Optional altitude of the filter.</param> /// <param name="instance_name">Optional instance name.</param> /// <param name="throw_on_error">True to throw on error.</param> /// <returns>The created instance name.</returns> public static NtResult <string> Attach(string filter_name, string volume_name, string altitude, string instance_name, bool throw_on_error) { if (filter_name is null) { throw new ArgumentNullException(nameof(filter_name)); } if (volume_name is null) { throw new ArgumentNullException(nameof(volume_name)); } StringBuilder builder = new StringBuilder(INSTANCE_NAME_MAX_CHARS); if (string.IsNullOrEmpty(altitude)) { return(FilterManagerNativeMethods.FilterAttach(filter_name, volume_name, instance_name, builder.Capacity, builder).CreateResult(throw_on_error, builder.ToString)); } return(FilterManagerNativeMethods.FilterAttachAtAltitude(filter_name, volume_name, altitude, instance_name, builder.Capacity, builder).CreateResult(throw_on_error, builder.ToString)); }
/// <summary> /// Open a filter communications port. /// </summary> /// <param name="port_name">The port name, e.g. \FilterName</param> /// <param name="sync_handle">Make the handle synchronous.</param> /// <param name="context">Optional context data.</param> /// <param name="throw_on_error">True to throw on error.</param> /// <returns>The filter communications port.</returns> public static NtResult <FilterCommunicationPort> Open(string port_name, bool sync_handle, byte[] context, bool throw_on_error) { return(FilterManagerNativeMethods.FilterConnectCommunicationPort(port_name, sync_handle ? FilterConnectFlags.FLT_PORT_FLAG_SYNC_HANDLE : 0, context, (short)(context?.Length ?? 0), null, out SafeKernelObjectHandle handle).CreateResult(throw_on_error, () => new FilterCommunicationPort(handle))); }
/// <summary> /// Send a message to the filter. /// </summary> /// <param name="input">The input buffer.</param> /// <param name="output">The output buffer.</param> /// <param name="throw_on_error">True to throw on error.</param> /// <returns>The bytes in the output buffer.</returns> public NtResult <int> SendMessage(SafeBuffer input, SafeBuffer output, bool throw_on_error) { return(FilterManagerNativeMethods.FilterSendMessage(Handle, input ?? SafeHGlobalBuffer.Null, input?.GetLength() ?? 0, output ?? SafeHGlobalBuffer.Null, output?.GetLength() ?? 0, out int bytes_returned).CreateResult(throw_on_error, () => bytes_returned)); }
/// <summary> /// Attach a filter to a volume. /// </summary> /// <param name="filter_name">The filter name.</param> /// <param name="volume_name">The volume name.</param> /// <param name="instance_name">Optional instance name.</param> /// <param name="throw_on_error">True to throw on error.</param> /// <returns>The NT status code.</returns> public static NtStatus Detach(string filter_name, string volume_name, string instance_name, bool throw_on_error) { return(FilterManagerNativeMethods.FilterDetach(filter_name, volume_name, instance_name).ToNtException(throw_on_error)); }