Installable file system

Overview of the Installable file system technology.

To develop Installable file system, you need these headers:

For the programming guide, see Installable file system.

Functions

Title Description
CcCanIWrite function The CcCanIWrite routine determines whether the caller can write to a cached file.
CcCoherencyFlushAndPurgeCache function The CcCoherencyFlushAndPurgeCache routine flushes and/or purges the cache to ensure cache coherency.
CcCopyRead function The CcCopyRead routine copies data from a cached file to a user buffer.
CcCopyReadEx function The CcCopyReadEx routine copies data from a cached file to a user buffer. The I/O byte count for the operation is charged to the issuing thread.
CcCopyWrite function The CcCopyWrite routine copies data from a user buffer to a cached file.
CcCopyWriteEx function The CcCopyWriteEx routine copies data from a user buffer to a cached file. The I/O byte count for the operation is charged to the issuing thread.
CcCopyWriteWontFlush function The CcCopyWriteWontFlush macro determines whether the amount of data to be copied in a call to CcCopyWrite is small enough not to require immediate flushing to disk if CcCopyWrite is called with Wait set to FALSE.
CcDeferWrite function The CcDeferWrite routine defers writing to a cached file.
CcFastCopyRead function The CcFastCopyRead routine performs a fast copy read from a cached file to a buffer in memory.
CcFastCopyWrite function The CcFastCopyWrite routine performs a fast copy write from a buffer in memory to a cached file.
CcFlushCache function The CcFlushCache routine flushes all or a portion of a cached file to disk.
CcGetDirtyPages function The CcGetDirtyPages routine searches for dirty pages in all files that match a given log handle.
CcGetFileObjectFromBcb function Given a pointer to a pinned buffer control block (BCB) for a file, the CcGetFileObjectFromBcb routine returns a pointer to the file object that the cache manager is using for that file.
CcGetFileObjectFromSectionPtrs function Given a pointer to the section object pointers for a cached file, the CcGetFileObjectFromSectionPtrs routine returns a pointer to the file object that the cache manager is using for the file.
CcGetFileObjectFromSectionPtrsRef function When passed a pointer to a SECTION_OBJECT_POINTERS structure for a cached file, the CcGetFileObjectFromSectionPtrsRef routine returns a pointer to the file object that the cache manager is using for the cached file.
CcGetFlushedValidData function The CcGetFlushedValidData routine determines how much of a cached file has been flushed to disk.
CcInitializeCacheMap function File systems call the CcInitializeCacheMap routine to cache a file.
CcIsThereDirtyData function The CcIsThereDirtyData routine determines whether a mounted volume contains any files that have dirty data in the system cache.
CcIsThereDirtyDataEx function The CcIsThereDirtyDataEx routine determines whether a volume contains any files that have dirty data in the system cache.
CcMapData function The CcMapData routine maps a specified byte range of a cached file to a buffer in memory.
CcMdlReadComplete function The CcMdlReadComplete routine frees the memory descriptor lists (MDL) created by CcMdlRead for a cached file.
CcMdlWriteAbort function The CcMdlWriteAbort routine frees memory descriptor lists (MDL) created by an earlier call to CcPrepareMdlWrite.
CcMdlWriteComplete function The CcMdlWriteComplete routine frees the memory descriptor lists (MDL) created by CcPrepareMdlWrite for a cached file.
CcPinMappedData function The CcPinMappedData routine pins the specified byte range of a cached file.
CcPinRead function The CcPinRead routine pins the specified byte range of a cached file and reads the pinned data into a buffer in memory.
CcPrepareMdlWrite function The CcPrepareMdlWrite routine provides direct access to cached file memory so that the caller can write data to the file.
CcPreparePinWrite function The CcPreparePinWrite routine pins the specified byte range of a cached file for write access.
CcPurgeCacheSection function The CcPurgeCacheSection routine purges all or a portion of a cached file from the system cache.
CcRemapBcb function The CcRemapBcb routine maps a buffer control block (BCB) an additional time to preserve it through several calls that perform additional maps and unpins.
CcRepinBcb function The CcRepinBcb routine pins a buffer control block (BCB) an additional time to prevent it from being freed by a subsequent call to CcUnpinData.
CcScheduleReadAhead function The CcScheduleReadAhead routine performs read-ahead (also called "lazy read") on a cached file. CcScheduleReadAhead should never be called directly. The CcReadAhead macro should be called instead.
CcScheduleReadAheadEx function The CcScheduleReadAheadEx routine performs read-ahead (also called "lazy read") on a cached file. The I/O byte count for the operation is charged to the issuing thread.
CcSetAdditionalCacheAttributes function Call the CcSetAdditionalCacheAttributes routine to enable or disable read-ahead (also called "lazy read") or write-behind (also called "lazy write") on a cached file.
CcSetAdditionalCacheAttributesEx function Call the CcSetAdditionalCacheAttributesEx routine to enable extended cache behavior on a cached file.
CcSetBcbOwnerPointer function The CcSetBcbOwnerPointer routine sets the owner thread pointer for a pinned buffer control block (BCB).
CcSetDirtyPageThreshold function The CcSetDirtyPageThreshold routine sets a per-file dirty page threshold on a cached file.
CcSetDirtyPinnedData function The CcSetDirtyPinnedData routine marks as dirty the buffer control block (BCB) for a pinned buffer whose contents have been modified.
CcSetFileSizes function The CcSetFileSizes routine updates the cache maps and section object for a cached file whose size has changed.
CcSetLogHandleForFile function The CcSetLogHandleForFile routine sets a log handle for a file.
CcSetReadAheadGranularity function The CcSetReadAheadGranularity routine sets the read-ahead granularity for a cached file.
CcUninitializeCacheMap function The CcUninitializeCacheMap routine stops the caching of a cached file.
CcUnpinData function The CcUnpinData routine releases cached file data that was mapped or pinned by an earlier call to CcMapData, CcPinRead, or CcPreparePinWrite.
CcUnpinDataForThread function The CcUnpinDataForThread routine releases pages of a cached file whose buffer control block (BCB) was modified by an earlier call to CcSetBcbOwnerPointer.
CcUnpinRepinnedBcb function The CcUnpinRepinnedBcb routine unpins a repinned buffer control block (BCB).
CcWaitForCurrentLazyWriterActivity function The CcWaitForCurrentLazyWriterActivity routine puts the caller into a wait state until the current batch of lazy writer activity is completed.
CcZeroData function The CcZeroData routine zeros the specified range of bytes in a cached or noncached file.
ExAdjustLookasideDepth function Reserved for system use.
ExDisableResourceBoostLite function Reserved for system use.
ExQueryPoolBlockSize function Obsolete.
FltAcknowledgeEcp function The FltAcknowledgeEcp routine is used to mark an extra create parameter context structure (ECP) as acknowledged.
FltAddOpenReparseEntry function This routine adds a caller allocated open reparse structure, OPEN_REPARSE_LIST_ENTRY, into a create operation.
FltAdjustDeviceStackSizeForIoRedirection function The FltAdjustDeviceStackSizeForIoRedirection routine increases the size of the source device stack to allow a minifilter to redirect I/O from a specified source instance to a specified target instance when the target stack is deeper than the source stack.
FltAllocateCallbackData function FltAllocateCallbackData allocates a callback data structure that a minifilter driver can use to initiate an I/O request.
FltAllocateCallbackDataEx function The FltAllocateCallbackDataEx routine allocates a callback data structure and can preallocate memory for additional structures that a minifilter driver can use to initiate an I/O request.
FltAllocateContext function The FltAllocateContext routine allocates a context structure for a specified context type.
FltAllocateDeferredIoWorkItem function FltAllocateDeferredIoWorkItem allocates a deferred-I/O work item.
FltAllocateExtraCreateParameter function The FltAllocateExtraCreateParameter routine allocates paged memory pool for a user-defined extra create parameter (ECP) context structure and generates a pointer to that structure.
FltAllocateExtraCreateParameterFromLookasideList function The FltAllocateExtraCreateParameterFromLookasideList routine allocates memory pool from a given lookaside list for an extra create parameter (ECP) context structure and generates a pointer to that structure.
FltAllocateExtraCreateParameterList function The FltAllocateExtraCreateParameterList routine allocates paged pool memory for an extra create parameter (ECP) list structure and generates a pointer to that structure.
FltAllocateFileLock function The FltAllocateFileLock routine allocates and initializes a new FILE_LOCK structure.
FltAllocateGenericWorkItem function FltAllocateGenericWorkItem allocates a generic work item.
FltAllocatePoolAlignedWithTag function FltAllocatePoolAlignedWithTag allocates a device-aligned buffer for use in a noncached I/O operation.
FltApplyPriorityInfoThread function The FltApplyPriorityInfoThread routine is used by a minifilter driver to apply priority information to a thread.
FltAttachVolume function FltAttachVolume creates a new minifilter driver instance and attaches it to the given volume.
FltAttachVolumeAtAltitude function FltAttachVolumeAtAltitude is a debugging support routine that attaches a minifilter driver instance to a volume at a specified altitude, overriding any settings in the minifilter driver's INF file.
FltBuildDefaultSecurityDescriptor function FltBuildDefaultSecurityDescriptor builds a default security descriptor for use with FltCreateCommunicationPort.
FltCancelFileOpen function A minifilter driver can use the FltCancelFileOpen routine to close a newly opened or created file.
FltCancelIo function The FltCancelIo routine cancels an I/O operation.
FltCancellableWaitForMultipleObjects function The FltCancellableWaitForMultipleObjects executes a cancelable wait operation (a wait that can be terminated) on one or more dispatcher objects.
FltCancellableWaitForSingleObject function The FltCancellableWaitForSingleObject routine executes a cancelable wait operation (a wait that can be terminated) on a dispatcher object.
FltCbdqDisable function FltCbdqDisable disables a minifilter driver's callback data queue.
FltCbdqEnable function FltCbdqEnable enables a callback data queue that was disabled by a previous call to FltCbdqDisable.
FltCbdqInitialize function FltCbdqInitialize initializes a minifilter driver's callback data queue dispatch table.
FltCbdqInsertIo function FltCbdqInsertIo inserts the callback data structure for an I/O operation into a minifilter driver's callback data queue.
FltCbdqRemoveIo function FltCbdqRemoveIo removes a particular item from a minifilter driver's callback data queue.
FltCbdqRemoveNextIo function FltCbdqRemoveNextIo removes the next matching item in a minifilter driver's callback data queue.
FltCheckAndGrowNameControl function The FltCheckAndGrowNameControl routine checks whether the buffer in a FLT_NAME_CONTROL structure is large enough to hold the specified number of bytes. If not, FltCheckAndGrowNameControl replaces it with a larger system-allocated buffer.
FltCheckLockForReadAccess function The FltCheckLockForReadAccess routine determines whether the caller has read access to a locked byte range of a file.
FltCheckLockForWriteAccess function The FltCheckLockForWriteAccess routine determines whether the caller has write access to a locked byte range of a file.
FltCheckOplock function A minifilter driver calls FltCheckOplock to synchronize the callback data structure for an IRP-based file I/O operation with the file's current opportunistic lock (oplock) state.
FltCheckOplockEx function A minifilter driver calls the FltCheckOplockEx routine to synchronize the callback data structure for an IRP-based file I/O operation that has the current opportunistic lock (oplock) state of the file.
FltClearCallbackDataDirty function The FltClearCallbackDataDirty routine clears the callback dirty flag in a callback data structure.
FltClearCancelCompletion function FltClearCancelCompletion clears a cancel routine that was specified for an I/O operation.
FltClose function FltClose closes a file handle that was opened by FltCreateFile or FltCreateFileEx.
FltCloseClientPort function FltCloseClientPort closes a communication client port.
FltCloseCommunicationPort function FltCloseCommunicationPort closes a minifilter driver's communication server port.
FltCloseSectionForDataScan function The FltCloseSectionForDataScan routine closes a section object associated with a file stream.
FltCommitComplete function The FltCommitComplete routine acknowledges a TRANSACTION_NOTIFY_COMMIT notification.
FltCommitFinalizeComplete function The FltCommitFinalizeComplete routine acknowledges a TRANSACTION_NOTIFY_COMMIT_FINALIZE notification.
FltCompareInstanceAltitudes function FltCompareInstanceAltitudes compares the altitudes of two minifilter driver instances.
FltCompletePendedPostOperation function FltCompletePendedPostOperation resumes completion processing for an I/O operation that was pended in a minifilter driver's postoperation callback routine.
FltCompletePendedPreOperation function FltCompletePendedPreOperation resumes processing for an I/O operation that was pended in a minifilter driver's preoperation callback (PFLT_PRE_OPERATION_CALLBACK) routine.
FltCopyOpenReparseList function This routine copies any open reparse information from a previous create into a new ECP list that can be used to issue a second create.
FltCreateCommunicationPort function FltCreateCommunicationPort creates a communication server port on which a minifilter driver can receive connection requests from user-mode applications.
FltCreateFile function Minifilter drivers call FltCreateFile to create a new file or open an existing file.
FltCreateFileEx function Minifilter drivers call FltCreateFileEx to create a new file or open an existing file.
FltCreateFileEx2 function Minifilter drivers call FltCreateFileEx2 to create a new file or open an existing file. This routine also includes an optional create context parameter.
FltCreateMailslotFile function Minifilter drivers call FltCreateMailslotFile to create a new pipe or open an existing mailslot.
FltCreateNamedPipeFile function Minifilter drivers call FltCreateNamedPipeFile to create a new pipe or open an existing pipe.
FltCreateSectionForDataScan function The FltCreateSectionForDataScan routine creates a section object for a file. The filter manager can optionally synchronize I/O with the section created.
FltCreateSystemVolumeInformationFolder function FltCreateSystemVolumeInformationFolder verifies the existence of the "System Volume Information" folder on a file system volume. If the folder is not present, then the folder is created.
FltCurrentBatchOplock function A minifilter driver calls FltCurrentBatchOplock to determine whether there are any batch or filter opportunistic locks (oplocks) on a file.
FltCurrentOplock function A minifilter driver calls the FltCurrentOplock routine to determine whether there are any opportunistic locks (oplocks) on a file.
FltCurrentOplockH function A minifilter driver calls the FltCurrentOplockH routine to determine whether there are any CACHE_HANDLE_LEVEL opportunistic locks (oplocks) on a file.
FltDecodeParameters function FltDecodeParameters returns pointers to the memory descriptor list (MDL) address, buffer pointer, buffer length, and desired access parameters for an I/O operation.
FltDeleteContext function FltDeleteContext marks a specified context for deletion.
FltDeleteExtraCreateParameterLookasideList function The FltDeleteExtraCreateParameterLookasideList routine frees an extra create parameter (ECP) lookaside list.
FltDeleteFileContext function The FltDeleteFileContext routine retrieves and deletes a file context that a given minifilter driver has set for a given file.
FltDeleteInstanceContext function FltDeleteInstanceContext removes a context from a given instance and marks the context for deletion.
FltDeletePushLock function The FltDeletePushLock routine deletes a given push lock.
FltDeleteStreamContext function FltDeleteStreamContext removes a context that a given minifilter driver instance has set for a given stream and marks the context for deletion.
FltDeleteStreamHandleContext function FltDeleteStreamHandleContext removes a context that a given minifilter driver instance has set for a given stream handle and marks the context for deletion.
FltDeleteTransactionContext function The FltDeleteTransactionContext routine removes a context from a given transaction and marks the context for deletion.
FltDeleteVolumeContext function FltDeleteVolumeContext removes a context that a given minifilter driver has set for a given volume and marks the context for deletion.
FltDetachVolume function FltDetachVolume detaches a minifilter driver instance from a volume.
FltDeviceIoControlFile function FltDeviceIoControlFile sends a control code directly to a specified device driver, causing the corresponding driver to perform the specified action.
FltDoCompletionProcessingWhenSafe function If it is safe to do so, the FltDoCompletionProcessingWhenSafe function executes a minifilter driver postoperation callback routine.
FltEnlistInTransaction function The FltEnlistInTransaction routine enlists a minifilter driver in a given transaction.
FltEnumerateFilterInformation function The FltEnumerateFilterInformation routine provides information about all the registered filter drivers (including minifilter and legacy filter drivers) in the system.
FltEnumerateFilters function The FltEnumerateFilters routine enumerates all registered minifilter drivers in the system.
FltEnumerateInstanceInformationByDeviceObject function The FltEnumerateInstanceInformationByDeviceObject routine provides information about minifilter driver instances and legacy filter drivers that are attached to the volume related to a specified device object.
FltEnumerateInstanceInformationByFilter function The FltEnumerateInstanceInformationByFilter routine provides information about instances of a given minifilter driver.
FltEnumerateInstanceInformationByVolume function The FltEnumerateInstanceInformationByVolume routine provides information about minifilter driver instances and legacy filter drivers (Windows Vista only) that are attached to a given volume.
FltEnumerateInstanceInformationByVolumeName function The FltEnumerateInstanceInformationByVolumeName routine provides information about minifilter driver instances and legacy filter drivers that are attached to the volume with the specified name.
FltEnumerateInstances function The FltEnumerateInstances routine enumerates minifilter driver instances for a given minifilter driver or volume.
FltEnumerateVolumeInformation function The FltEnumerateVolumeInformation routine provides information about volumes that are known to the filter manager.
FltEnumerateVolumes function The FltEnumerateVolumes routine enumerates all volumes in the system.
FltFastIoMdlRead function The FltFastIoMdlRead routine returns a memory descriptor list (MDL) that points directly to the specified byte range in the file cache.
FltFastIoMdlReadComplete function The FltFastIoMdlReadComplete routine completes the read operation that the FltFastIoMdlRead routine initiated.
FltFastIoMdlWriteComplete function The FltFastIoMdlWriteComplete routine frees the resources that FltFastIoPrepareMdlWrite allocated.
FltFastIoPrepareMdlWrite function The FltFastIoPrepareMdlWrite routine returns a linked list of memory descriptor lists (MDLs) that point to the specified range of cached file data to write data directly to the cache.
FltFindExtraCreateParameter function The FltFindExtraCreateParameter routine searches a given ECP list for an ECP context structure of a given type and returns a pointer to this structure if it is found.
FltFlushBuffers function The FltFlushBuffers routine is used by the minifilter driver to send a flush request for a given file to the file system.
FltFreeCallbackData function The FltFreeCallbackData routine frees a callback data structure allocated by the FltAllocateCallbackData routine.
FltFreeDeferredIoWorkItem function The FltFreeDeferredIoWorkItem routine frees a work item allocated by the FltAllocateDeferredIoWorkItem routine.
FltFreeExtraCreateParameter function The FltFreeExtraCreateParameter routine frees the memory for an ECP context structure.
FltFreeExtraCreateParameterList function The FltFreeExtraCreateParameterList routine frees an extra create parameter (ECP) list structure.
FltFreeFileLock function The FltFreeFileLock routine uninitializes and frees an initialized FILE_LOCK structure.
FltFreeGenericWorkItem function The FltFreeGenericWorkItem routine frees a work item allocated by the FltAllocateGenericWorkItem routine.
FltFreeOpenReparseList function This routine deallocates any information copied into a create operation by a previous call to FltCopyOpenReparseList.
FltFreePoolAlignedWithTag function The FltFreePoolAlignedWithTag routine frees a cache-aligned buffer that was allocated by a previous call to FltAllocatePoolAlignedWithTag.
FltFreeSecurityDescriptor function FltFreeSecurityDescriptor frees a security descriptor allocated by the FltBuildDefaultSecurityDescriptor routine.
FltFsControlFile function The FltFsControlFile routine sends a control code directly to a specified file system or file system filter driver, causing the corresponding driver to perform the specified action.
FltGetActivityIdCallbackData function The FltGetActivityIdCallbackData routine retrieves the current activity ID associated with a request in a minifilter's callback data.
FltGetBottomInstance function FltGetBottomInstance returns an opaque instance pointer for the minifilter driver instance, if there is one, that is attached at the bottom of the instance stack for a given volume.
FltGetContexts function The FltGetContexts routine retrieves a minifilter driver's contexts for the objects related to the current operation.
FltGetContextsEx function The FltGetContextsEx routine retrieves a minifilter driver's contexts for the objects related to the current operation.
FltGetDestinationFileNameInformation function The FltGetDestinationFileNameInformation routine constructs a full destination path name for a file or directory that is being renamed or for which an NTFS hard link is being created.
FltGetDeviceObject function The FltGetDeviceObject routine returns a pointer to the Filter Manager's volume device object (VDO) for a given volume.
FltGetDiskDeviceObject function The FltGetDiskDeviceObject routine returns a pointer to the disk device object associated with a given volume.
FltGetEcpListFromCallbackData function The FltGetEcpListFromCallbackData routine returns a pointer to an extra create parameter context structure (ECP) list that is associated with a given create operation callback-data object.
FltGetFileContext function The FltGetFileContext routine retrieves a context that was set for a file by a given minifilter driver instance.
FltGetFileNameInformation function The FltGetFileNameInformation routine returns name information for a file or directory.
FltGetFileNameInformationUnsafe function The FltGetFileNameInformationUnsafe routine returns name information for an open file or directory.
FltGetFileSystemType function The FltGetFileSystemType function takes a volume or instance object and provides the file system type of the volume.
FltGetFilterFromInstance function The FltGetFilterFromInstance routine returns an opaque filter pointer for the minifilter driver that created the given instance.
FltGetFilterFromName function The FltGetFilterFromName routine returns an opaque filter pointer for a registered minifilter driver whose name matches the value in the FilterName parameter.
FltGetFilterInformation function The FltGetFilterInformation routine provides information about a minifilter driver.
FltGetInstanceContext function The FltGetInstanceContext routine retrieves a context that was set for an instance by a given minifilter driver.
FltGetInstanceInformation function The FltGetInstanceInformation routine returns information about a minifilter driver instance.
FltGetIoPriorityHint function The FltGetIoPriorityHint routine is used by a minifilter driver to get IO priority information from Callback Data.
FltGetIoPriorityHintFromCallbackData function The FltGetIoPriorityHintFromCallbackData routine is used by a minifilter driver to get IO priority information from callback data.
FltGetIoPriorityHintFromFileObject function The FltGetIoPriorityHintFromFileObject routine is used by a minifilter driver to get IO priority information from a file object.
FltGetIoPriorityHintFromThread function The FltGetIoPriorityHintFromThread routine is used by a minifilter driver to get IO priority information from a thread.
FltGetIrpName function The FltGetIrpName routine returns the name for a major function code as a printable string.
FltGetLowerInstance function The FltGetLowerInstance routine returns an opaque instance pointer for the next lower minifilter driver instance, if there is one, that is attached below a given minifilter driver instance on the same volume.
FltGetNewSystemBufferAddress function The FltGetNewSystemBufferAddress function retrieves the AssociatedIrp.SystemBuffer buffer, which the file system has allocated. A minifilter driver's post-callback routine calls this function.
FltGetNextExtraCreateParameter function The FltGetNextExtraCreateParameter routine returns a pointer to the next (or first) extra create parameter context structure (ECP) in a given ECP list.
FltGetRequestorProcess function The FltGetRequestorProcess routine returns a process pointer for the thread that requested a given I/O operation.
FltGetRequestorProcessId function The FltGetRequestorProcessId routine returns the unique 32-bit process ID for the process associated with the thread that requested a given I/O operation.
FltGetRequestorProcessIdEx function The FltGetRequestorProcessIdEx routine returns the kernel-mode handle for the process that is associated with the thread that requested a given I/O operation.
FltGetRequestorSessionId function The FltGetRequestorSessionId routine returns the session ID of the process that originally requested the specified I/O operation.
FltGetRoutineAddress function The FltGetRoutineAddress routine returns a pointer to a routine specified by the FltMgrRoutineName parameter.
FltGetSectionContext function The FltGetSectionContext routine retrieves a section context that was created for a file stream by a specified minifilter driver instance.
FltGetStreamContext function The FltGetStreamContext routine retrieves a context that was set for a file stream by a given minifilter driver instance.
FltGetStreamHandleContext function The FltGetStreamHandleContext routine retrieves a context that was set for a stream handle by a given minifilter driver instance.
FltGetSwappedBufferMdlAddress function The FltGetSwappedBufferMdlAddress routine returns the memory descriptor list (MDL) address for a buffer that was swapped in by a minifilter driver.
FltGetTopInstance function The FltGetTopInstance routine returns an opaque instance pointer for the minifilter driver instance that is attached at the top of the instance stack for a given volume.
FltGetTransactionContext function The FltGetTransactionContext routine retrieves a context that was set for a transaction by a given minifilter driver.
FltGetTunneledName function The FltGetTunneledName routine retrieves the tunneled name for a file, given the normalized name returned for the file by a previous call to FltGetFileNameInformation, FltGetFileNameInformationUnsafe, or FltGetDestinationFileNameInformation.
FltGetUpperInstance function The FltGetUpperInstance routine returns an opaque instance pointer for the next higher minifilter driver instance, if there is one, that is attached above a given minifilter driver instance on the same volume.
FltGetVolumeContext function The FltGetVolumeContext routine retrieves a context that was set for a volume by a given minifilter driver.
FltGetVolumeFromDeviceObject function The FltGetVolumeFromDeviceObject routine returns an opaque pointer for the volume represented by a volume device object (VDO).
FltGetVolumeFromFileObject function The FltGetVolumeFromFileObject routine returns an opaque pointer for the volume that a given file stream resides on.
FltGetVolumeFromInstance function The FltGetVolumeFromInstance routine returns an opaque pointer for the volume that a given minifilter driver instance is attached to.
FltGetVolumeFromName function The FltGetVolumeFromName routine returns an opaque pointer for the volume whose name matches the value of the VolumeName parameter.
FltGetVolumeGuidName function The FltGetVolumeGuidName routine returns the volume name for a given volume, in volume globally unique identifier (GUID) format.
FltGetVolumeInformation function The FltGetVolumeInformation routine provides information about a given volume.
FltGetVolumeInstanceFromName function The FltGetVolumeInstanceFromName routine returns an opaque instance pointer for the given minifilter driver instance on the given volume.
FltGetVolumeName function The FltGetVolumeName routine gets the volume name for a given volume.
FltGetVolumeProperties function The FltGetVolumeProperties routine returns volume property information for the given volume.
FltInitExtraCreateParameterLookasideList function The FltInitExtraCreateParameterLookasideList routine initializes a paged or non-paged pool lookaside list used for the allocation of one or more extra create parameter context structures (ECPs) of fixed size.
FltInitializeFileLock function The FltInitializeFileLock routine initializes an opaque FILE_LOCK structure that the caller has allocated from paged pool.
FltInitializeOplock function The FltInitializeOplock routine initializes an opportunistic lock (oplock) pointer.
FltInitializePushLock function The FltInitializePushLock routine initializes a push lock variable.
FltInsertExtraCreateParameter function The FltInsertExtraCreateParameter routine inserts an extra create parameter (ECP) context structure into an ECP list.
FltIs32bitProcess function The FltIs32bitProcess routine checks whether the originator of the current I/O operation is a 32-bit user-mode application.
FltIsCallbackDataDirty function The FltIsCallbackDataDirty routine tests the FLTFL_CALLBACK_DATA_DIRTY flag in a callback data structure.
FltIsDirectory function A minifilter driver calls the FltIsDirectory routine to determine whether a given file object represents a directory.
FltIsEcpAcknowledged function The FltIsEcpAcknowledged routine is used to determine if a given extra create parameter context structure (ECP) has been marked as acknowledged.
FltIsEcpFromUserMode function The FltIsEcpFromUserMode routine is used to determine if an extra create parameter context structure (ECP) originated from user mode.
FltIsFltMgrVolumeDeviceObject function The FltIsFltMgrVolumeDeviceObject routine determines whether the given device object belongs to filter manager and if the device object is a volume device object.
FltIsIoCanceled function The FltIsIoCanceled routine checks if an IRP-based operation has been canceled.
FltIsIoRedirectionAllowed function The FltIsIoRedirectionAllowed routine determines whether I/O can be redirected from the specified source filter instance to another specified filter instance.
FltIsIoRedirectionAllowedForOperation function The FltIsIoRedirectionAllowedForOperation routine determines whether I/O can be redirected from the filter instance associated with the specified FLT_CALLBACK_DATA structure to the specified filter instance.
FltIsOperationSynchronous function The FltIsOperationSynchronous routine determines whether a given callback data structure (FLT_CALLBACK_DATA) represents a synchronous or asynchronous I/O operation.
FltIsVolumeSnapshot function The FltIsVolumeSnapshot routine determines whether a volume or minifilter driver instance is attached to a snapshot volume.
FltIsVolumeWritable function The FltIsVolumeWritable routine determines whether the disk device that corresponds to a volume or minifilter driver instance is writable.
FltLoadFilter function The FltLoadFilter routine dynamically loads a minifilter driver into the currently running system.
FltLockUserBuffer function The FltLockUserBuffer routine locks the user buffer for a given I/O operation.
FltNotifyFilterChangeDirectory function The FltNotifyFilterChangeDirectory routine creates a notify structure for an IRP_MN_NOTIFY_CHANGE_DIRECTORY operation and adds it to the specified notify list.
FltObjectDereference function The FltObjectDereference routine removes a rundown reference from an opaque filter, instance, or volume pointer.
FltObjectReference function The FltObjectReference routine adds a rundown reference to an opaque filter, instance, or volume pointer.
FltOpenVolume function The FltOpenVolume routine returns a handle and a file object pointer for the file system volume that a given minifilter driver instance is attached to.
FltOplockBreakH function The FltOplockBreakH routine breaks CACHE_HANDLE_LEVEL opportunistic locks (oplocks).
FltOplockBreakToNone function The FltOplockBreakToNone routine breaks all opportunistic locks (oplocks) immediately without regard for any oplock key.
FltOplockBreakToNoneEx function The FltOplockBreakToNoneEx routine breaks all opportunistic locks (oplocks) immediately without regard for any oplock key.
FltOplockFsctrl function The FltOplockFsctrl routine performs various opportunistic lock (oplock) operations on behalf of a minifilter driver.
FltOplockFsctrlEx function The FltOplockFsctrlEx routine performs various opportunistic lock (oplock) operations on behalf of a minifilter driver.
FltOplockIsFastIoPossible function The FltOplockIsFastIoPossible routine checks a file's opportunistic lock (oplock) state to determine whether fast I/O can be performed on the file.
FltOplockIsSharedRequest function The FltOplockIsSharedRequest routine determines if a request for an opportunistic lock (oplock) wants a shared oplock.
FltOplockKeysEqual function The FltOplockKeysEqual routine compares the opportunistic lock (oplock) keys that are stored in the file object extensions of two file objects.
FltParseFileName function FltParseFileName parses the extension, stream, and final component from a file name string.
FltParseFileNameInformation function FltParseFileNameInformation parses the contents of a FLT_FILE_NAME_INFORMATION structure.
FltPerformAsynchronousIo function A minifilter driver calls FltPerformAsynchronousIo to initiate an asynchronous I/O operation.
FltPerformSynchronousIo function A minifilter driver calls FltPerformSynchronousIo to initiate a synchronous I/O operation after calling FltAllocateCallbackData to allocate a callback data structure for the operation.
FltPrePrepareComplete function The FltPrePrepareComplete routine acknowledges a TRANSACTION_NOTIFY_PREPREPARE notification.
FltPrepareComplete function The FltPrepareComplete routine acknowledges a TRANSACTION_NOTIFY_PREPARE notification.
FltPrepareToReuseEcp function The FltPrepareToReuseEcp routine resets an extra create parameter (ECP) context structure, which prepares it for reuse.
FltProcessFileLock function The FltProcessFileLock routine processes and completes a file lock operation.
FltPropagateActivityIdToThread function The FltPropagateActivityIdToThread routine associates the activity ID from the IRP in the minifilter's callback data with the current thread.
FltPurgeFileNameInformationCache function FltPurgeFileNameInformationCache purges from the Filter Manager's name cache all file name information structures that were generated from names provided by the given minifilter driver instance.
FltQueryDirectoryFile function The FltQueryDirectoryFile routine returns various kinds of information about files in the directory specified by a given file object.
FltQueryEaFile function FltQueryEaFile returns information about extended-attribute (EA) values for a file.
FltQueryInformationFile function FltQueryInformationFile retrieves information for a given file.
FltQueryQuotaInformationFile function The FltQueryQuotaInformationFile routine retrieves quota entries associated with a file object.
FltQuerySecurityObject function FltQuerySecurityObject retrieves a copy of an object's security descriptor.
FltQueryVolumeInformation function The FltQueryVolumeInformation routine retrieves information about the volume that the given instance is attached to.
FltQueryVolumeInformationFile function FltQueryVolumeInformationFile retrieves volume information for a given file, directory, storage device, or volume.
FltQueueDeferredIoWorkItem function The FltQueueDeferredIoWorkItem routine posts an IRP-based I/O operation to a work queue.
FltQueueGenericWorkItem function FltQueueGenericWorkItem posts a work item that is not associated with a specific I/O operation to a work queue.
FltReadFile function FltReadFile reads data from an open file, stream, or device.
FltReadFileEx function FltReadFileEx reads data from an open file, stream, or device. This function extends FltReadFile to allow the optional use of an MDL for read data instead of a mapped buffer address.
FltReferenceContext function FltReferenceContext increments the reference count on a context structure.
FltReferenceFileNameInformation function FltReferenceFileNameInformation increments the reference count on a file name information structure.
FltRegisterFilter function FltRegisterFilter registers a minifilter driver.
FltRegisterForDataScan function The FltRegisterForDataScan routine enables data scanning for the volume attached to the minifilter instance.
FltReissueSynchronousIo function FltReissueSynchronousIo initiates a new synchronous I/O operation that uses the parameters from a previously synchronized I/O operation.
FltReleaseContext function FltReleaseContext decrements the reference count on a context.
FltReleaseContexts function FltReleaseContexts releases each context in a given FLT_RELATED_CONTEXTS structure.
FltReleaseContextsEx function FltReleaseContextsEx releases each context in a given FLT_RELATED_CONTEXTS_EX structure.
FltReleaseFileNameInformation function FltReleaseFileNameInformation releases a file name information structure.
FltRemoveExtraCreateParameter function The FltRemoveExtraCreateParameter routine searches an ECP list for an ECP context structure and, if found, detaches it from the ECP list.
FltRemoveOpenReparseEntry function This routine removes an OPEN_REPARSE_LIST_ENTRY structure (added by FltAddOpenReparseEntry) from a create operation.
FltRequestOperationStatusCallback function FltRequestOperationStatusCallback returns status information for the given I/O operation.
FltRetainSwappedBufferMdlAddress function FltRetainSwappedBufferMdlAddress prevents the Filter Manager from freeing the memory descriptor list (MDL) for a buffer that was swapped in by a minifilter driver.
FltRetrieveIoPriorityInfo function The FltRetrieveIoPriorityInfo routine is used by a minifilter driver to retrieve priority information from a thread.
FltReuseCallbackData function The FltReuseCallbackData routine reinitializes a callback data structure so that it can be reused.
FltRollbackComplete function The FltRollbackComplete routine acknowledges a TRANSACTION_NOTIFY_ROLLBACK notification.
FltRollbackEnlistment function The FltRollbackEnlistment routine rolls back or aborts a transaction on behalf of a minifilter driver.
FltSendMessage function FltSendMessage sends a message to a waiting user-mode application on behalf of a minifilter driver or a minifilter driver instance.
FltSetActivityIdCallbackData function The FltSetActivityIdCallbackData routine sets the a activity ID for an IRP in a minifilter's callback data.
FltSetCallbackDataDirty function A minifilter driver's preoperation or postoperation callback routine calls FltSetCallbackDataDirty to indicate that it has modified the contents of the callback data structure.
FltSetCancelCompletion function A minifilter driver calls FltSetCancelCompletion to specify a cancel routine to be called if a given I/O operation is canceled.
FltSetEaFile function FltSetEaFile sets extended-attribute (EA) values for a file.
FltSetEcpListIntoCallbackData function The FltSetEcpListIntoCallbackData routine attaches an extra create parameter context structure (ECP) list to a create operation callback-data object.
FltSetFileContext function The FltSetFileContext routine sets a context for a file.
FltSetInformationFile function FltSetInformationFile sets information for a given file.
FltSetInstanceContext function FltSetInstanceContext sets a context for a minifilter driver instance.
FltSetIoPriorityHintIntoCallbackData function The FltSetIoPriorityHintIntoCallbackData routine is used by a minifilter driver to set the I/O priority information in callback data.
FltSetIoPriorityHintIntoFileObject function The FltSetIoPriorityHintIntoFileObject routine is used by a minifilter driver to set the I/O priority information in a file object.
FltSetIoPriorityHintIntoThread function The FltSetIoPriorityHintIntoThread routine is used by a minifilter driver to set the IO priority information in a thread.
FltSetQuotaInformationFile function The FltSetQuotaInformationFile routine modifies quota entries for a file object.
FltSetSecurityObject function FltSetSecurityObject sets an object's security state.
FltSetStreamContext function The FltSetStreamContext routine sets a context for a file stream.
FltSetStreamHandleContext function The FltSetStreamHandleContext routine sets a context for a stream handle.
FltSetTransactionContext function The FltSetTransactionContext routine sets a context on a transaction.
FltSetVolumeContext function FltSetVolumeContext sets a context for a volume.
FltSetVolumeInformation function FltSetVolumeInformation changes various kinds of information about the volume that the given instance is attached to.
FltStartFiltering function FltStartFiltering starts filtering for a registered minifilter driver.
FltSupportsFileContexts function The FltSupportsFileContexts routine determines whether the file system supports file contexts for a given file.
FltSupportsFileContextsEx function The FltSupportsFileContextsEx routine determines whether the file system or the filter manager support file contexts for a given file.
FltSupportsStreamContexts function FltSupportsStreamContexts determines whether stream contexts are supported on a given file object.
FltSupportsStreamHandleContexts function FltSupportsStreamHandleContexts determines whether stream handle contexts are supported on a given file object.
FltTagFile function FltTagFile sets a reparse tag on a file or directory.
FltUninitializeFileLock function The FltUninitializeFileLock routine uninitializes a FILE_LOCK structure.
FltUninitializeOplock function FltUninitializeOplock uninitializes an opportunistic lock (oplock) pointer.
FltUnloadFilter function A minifilter driver that has loaded a supporting minifilter driver by calling FltLoadFilter can unload the minifilter driver by calling FltUnloadFilter.
FltUnregisterFilter function A registered minifilter driver calls FltUnregisterFilter to unregister itself so that the Filter Manager no longer calls it to process I/O operations.
FltUntagFile function FltUntagFile removes a reparse point from a file or directory.
FltWriteFile function FltWriteFile is used to write data to an open file, stream, or device.
FltWriteFileEx function FltWriteFileEx is used to write data to an open file, stream, or device. This function extends FltWriteFile to allow the optional use of an MDL for write data instead of a mapped buffer address.
FsRtlAcknowledgeEcp function The FsRtlAcknowledgeEcp routine marks an extra create parameter (ECP) context structure as acknowledged.
FsRtlAcquireFileExclusive function Reserved for system use.
FsRtlAcquireFileExclusive function Reserved for system use.
FsRtlAddLargeMcbEntry function The FsRtlAddLargeMcbEntry routine adds a new mapping to an existing map control block (MCB).
FsRtlAddLargeMcbEntry function The FsRtlAddLargeMcbEntry routine adds a new mapping to an existing map control block (MCB).
FsRtlAddMcbEntry function Obsolete.
FsRtlAddMcbEntry function Obsolete.
FsRtlAddToTunnelCache function The FsRtlAddToTunnelCache routine caches a file name that is removed from a directory when a file is renamed or deleted.
FsRtlAddToTunnelCache function The FsRtlAddToTunnelCache routine caches a file name that is removed from a directory when a file is renamed or deleted.
FsRtlAllocateExtraCreateParameter function The FsRtlAllocateExtraCreateParameter routine allocates memory for a user-defined extra create parameter (ECP) context structure and generates a pointer to that structure.
FsRtlAllocateExtraCreateParameterFromLookasideList function The FsRtlAllocateExtraCreateParameterFromLookasideList routine allocates memory pool from a given lookaside list for an extra create parameter (ECP) context structure, and generates a pointer to that structure.
FsRtlAllocateExtraCreateParameterList function The FsRtlAllocateExtraCreateParameterList routine allocates paged pool memory for an ECP_LIST structure and generates a pointer to that structure.
FsRtlAllocateFileLock function The FsRtlAllocateFileLock routine allocates and initializes a new FILE_LOCK structure.
FsRtlAllocateFileLock function The FsRtlAllocateFileLock routine allocates and initializes a new FILE_LOCK structure.
FsRtlAllocateFileLock function The FsRtlAllocateFileLock routine allocates and initializes a new FILE_LOCK structure.
FsRtlAllocateResource function Obsolete.
FsRtlAreNamesEqual function The FsRtlAreNamesEqual routine determines whether two Unicode strings are equal.
FsRtlAreNamesEqual function The FsRtlAreNamesEqual routine determines whether two Unicode strings are equal.
FsRtlAreThereCurrentOrInProgressFileLocks function TheFsRtlAreThereCurrentOrInProgressFileLocks routine determines if there are byte range locks assigned to a file or any lock operations in progress for that file.
FsRtlAreThereCurrentOrInProgressFileLocks function TheFsRtlAreThereCurrentOrInProgressFileLocks routine determines if there are byte range locks assigned to a file or any lock operations in progress for that file.
FsRtlAreThereWaitingFileLocks function The FsRtlAreThereWaitingFileLocks routine checks a file lock queue for any waiting file locks.
FsRtlAreThereWaitingFileLocks function The FsRtlAreThereWaitingFileLocks routine checks a file lock queue for any waiting file locks.
FsRtlAreVolumeStartupApplicationsComplete function The FsRtlAreVolumeStartupApplicationsComplete function determines whether volume startup applications have completed processing.
FsRtlBalanceReads function The FsRtlBalanceReads routine signals to a fault-tolerant disk driver that it is now safe to start balancing reads from a mirrored drive.
FsRtlCancellableWaitForMultipleObjects function The FsRtlCancellableWaitForMultipleObjects routine executes a cancelable wait operation (a wait that can be terminated) on one or more dispatcher objects.
FsRtlCancellableWaitForSingleObject function The FsRtlCancellableWaitForSingleObject routine executes a cancelable wait operation (a wait that can be terminated) on a dispatcher object.
FsRtlChangeBackingFileObject function The FsRtlChangeBackingFileObject routine replaces the current file object with a new file object.
FsRtlCheckLockForOplockRequest function The FsRtlCheckLockForOplockRequest routine checks for locks within the allocation size of a file. The file lock object is checked for the presence of byte range locks that would prevent an oplock request from being granted.
FsRtlCheckLockForOplockRequest function The FsRtlCheckLockForOplockRequest routine checks for locks within the allocation size of a file. The file lock object is checked for the presence of byte range locks that would prevent an oplock request from being granted.
FsRtlCheckLockForOplockRequest function The FsRtlCheckLockForOplockRequest routine checks for locks within the allocation size of a file. The file lock object is checked for the presence of byte range locks that would prevent an oplock request from being granted.
FsRtlCheckLockForReadAccess function The FsRtlCheckLockForReadAccess routine determines whether the process associated with a given IRP has read access to a locked region of a file.
FsRtlCheckLockForReadAccess function The FsRtlCheckLockForReadAccess routine determines whether the process associated with a given IRP has read access to a locked region of a file.
FsRtlCheckLockForReadAccess function The FsRtlCheckLockForReadAccess routine determines whether the process associated with a given IRP has read access to a locked region of a file.
FsRtlCheckLockForWriteAccess function The FsRtlCheckLockForWriteAccess routine determines whether the process associated with a given IRP has write access to a locked region of a file.
FsRtlCheckLockForWriteAccess function The FsRtlCheckLockForWriteAccess routine determines whether the process associated with a given IRP has write access to a locked region of a file.
FsRtlCheckLockForWriteAccess function The FsRtlCheckLockForWriteAccess routine determines whether the process associated with a given IRP has write access to a locked region of a file.
FsRtlCheckOplock function The FsRtlCheckOplock routine synchronizes the IRP for a file I/O operation with the file's current opportunistic lock (oplock) state.
FsRtlCheckOplock function The FsRtlCheckOplock routine synchronizes the IRP for a file I/O operation with the file's current opportunistic lock (oplock) state.
FsRtlCheckOplockEx function The FsRtlCheckOplockEx routine synchronizes the IRP for a file I/O operation with the current opportunistic lock (oplock) state of the file.
FsRtlCheckOplockEx function The FsRtlCheckOplockEx routine synchronizes the IRP for a file I/O operation with the current opportunistic lock (oplock) state of the file.
FsRtlCheckUpperOplock function The FsRtlCheckUpperOplock routine provides opportunistic lock (oplock) checking in secondary, or layered, file systems when the oplocks they hold change state.
FsRtlCheckUpperOplock function The FsRtlCheckUpperOplock routine provides opportunistic lock (oplock) checking in secondary, or layered, file systems when the oplocks they hold change state.
FsRtlCopyRead function The FsRtlCopyRead routine copies data from a cached file to a user buffer.
FsRtlCopyRead function The FsRtlCopyRead routine copies data from a cached file to a user buffer.
FsRtlCopyRead function The FsRtlCopyRead routine copies data from a cached file to a user buffer.
FsRtlCopyWrite function The FsRtlCopyWrite routine copies data from a user buffer to a cached file.
FsRtlCopyWrite function The FsRtlCopyWrite routine copies data from a user buffer to a cached file.
FsRtlCopyWrite function The FsRtlCopyWrite routine copies data from a user buffer to a cached file.
FsRtlCreateSectionForDataScan function The FsRtlCreateSectionForDataScan routine creates a section object.
FsRtlCurrentBatchOplock function A file system or filter driver calls FsRtlCurrentBatchOplock to determine whether there are any batch or filter opportunistic locks (oplocks) on a file.
FsRtlCurrentOplock function A file system or filter driver calls FsRtlCurrentOplock to determine whether there are any opportunistic locks (oplocks) on a file.
FsRtlCurrentOplockH function A file system or filter driver calls FsRtlCurrentOplockH to determine whether there are any CACHE_HANDLE_LEVEL opportunistic locks (oplocks) on a file.
FsRtlDeleteExtraCreateParameterLookasideList function The FsRtlDeleteExtraCreateParameterLookasideList routine frees an extra create parameter (ECP) lookaside list.
FsRtlDeleteKeyFromTunnelCache function The FsRtlDeleteKeyFromTunnelCache routine deletes any tunnel cache entries for files in a directory that is being deleted.
FsRtlDeleteKeyFromTunnelCache function The FsRtlDeleteKeyFromTunnelCache routine deletes any tunnel cache entries for files in a directory that is being deleted.
FsRtlDeleteTunnelCache function The FsRtlDeleteTunnelCache routine deletes a tunnel cache.
FsRtlDeregisterUncProvider function The FsRtlDeregisterUncProvider routine deregisters a redirector that was registered as a Universal Naming Convention (UNC) provider with the multiple UNC provider (MUP).
FsRtlDissectDbcs function Given an ANSI or double-byte character set (DBCS) pathname string, the FsRtlDissectDbcs routine returns two strings
FsRtlDissectDbcs function Given an ANSI or double-byte character set (DBCS) pathname string, the FsRtlDissectDbcs routine returns two strings
FsRtlDissectName function Given a Unicode pathname string, the FsRtlDissectName routine returns two strings, one containing the first file name found in the string, the other containing the remaining unparsed portion of the pathname string.
FsRtlDissectName function Given a Unicode pathname string, the FsRtlDissectName routine returns two strings, one containing the first file name found in the string, the other containing the remaining unparsed portion of the pathname string.
FsRtlDoesDbcsContainWildCards function The FsRtlDoesDbcsContainWildCards routine determines whether an ANSI or double-byte character set (DBCS) string contains wildcard characters.
FsRtlDoesNameContainWildCards function The FsRtlDoesNameContainWildCards routine determines whether a Unicode string contains wildcard characters.
FsRtlFastCheckLockForRead function The FsRtlFastCheckLockForRead routine determines whether the specified process has read access to a locked byte range of a file.
FsRtlFastCheckLockForRead function The FsRtlFastCheckLockForRead routine determines whether the specified process has read access to a locked byte range of a file.
FsRtlFastCheckLockForRead function The FsRtlFastCheckLockForRead routine determines whether the specified process has read access to a locked byte range of a file.
FsRtlFastCheckLockForWrite function The FsRtlFastCheckLockForWrite routine determines whether the specified process has write access to a locked byte range of a file.
FsRtlFastCheckLockForWrite function The FsRtlFastCheckLockForWrite routine determines whether the specified process has write access to a locked byte range of a file.
FsRtlFastCheckLockForWrite function The FsRtlFastCheckLockForWrite routine determines whether the specified process has write access to a locked byte range of a file.
FsRtlFastUnlockAll function The FsRtlFastUnlockAll routine releases all byte-range locks that were acquired by the specified process for a file.
FsRtlFastUnlockAll function The FsRtlFastUnlockAll routine releases all byte-range locks that were acquired by the specified process for a file.
FsRtlFastUnlockAll function The FsRtlFastUnlockAll routine releases all byte-range locks that were acquired by the specified process for a file.
FsRtlFastUnlockAllByKey function The FsRtlFastUnlockAllByKey routine releases all byte-range locks that were acquired by the specified process, with the specified key value, for a file.
FsRtlFastUnlockAllByKey function The FsRtlFastUnlockAllByKey routine releases all byte-range locks that were acquired by the specified process, with the specified key value, for a file.
FsRtlFastUnlockAllByKey function The FsRtlFastUnlockAllByKey routine releases all byte-range locks that were acquired by the specified process, with the specified key value, for a file.
FsRtlFastUnlockSingle function The FsRtlFastUnlockSingle routine releases a byte-range lock that was acquired by the specified process, with the specified key value, file offset, and length, for a file.
FsRtlFastUnlockSingle function The FsRtlFastUnlockSingle routine releases a byte-range lock that was acquired by the specified process, with the specified key value, file offset, and length, for a file.
FsRtlFastUnlockSingle function The FsRtlFastUnlockSingle routine releases a byte-range lock that was acquired by the specified process, with the specified key value, file offset, and length, for a file.
FsRtlFindExtraCreateParameter function The FsRtlFindExtraCreateParameter routine searches a given ECP list for an ECP context structure of a given type and returns a pointer to this structure if it is found.
FsRtlFindInTunnelCache function The FsRtlFindInTunnelCache routine searches for a matching entry in the tunnel cache that matches the specified name.
FsRtlFindInTunnelCache function The FsRtlFindInTunnelCache routine searches for a matching entry in the tunnel cache that matches the specified name.
FsRtlFreeExtraCreateParameter function The FsRtlFreeExtraCreateParameter routine frees the memory for an ECP context structure.
FsRtlFreeExtraCreateParameterList function The FsRtlFreeExtraCreateParameterList routine frees an extra create parameter (ECP) list structure.
FsRtlFreeFileLock function The FsRtlFreeFileLock routine uninitializes and frees a file lock structure.
FsRtlFreeFileLock function The FsRtlFreeFileLock routine uninitializes and frees a file lock structure.
FsRtlGetEcpListFromIrp function The FsRtlGetEcpListFromIrp routine returns a pointer to an extra create parameter (ECP) context structure list that is associated with a given IRP_MJ_CREATE operation.
FsRtlGetFileSize function The FsRtlGetFileSize routine is used to get the size of a file.
FsRtlGetFileSize function The FsRtlGetFileSize routine is used to get the size of a file.
FsRtlGetFileSize function The FsRtlGetFileSize routine is used to get the size of a file.
FsRtlGetNextExtraCreateParameter function The FsRtlGetNextExtraCreateParameter routine returns a pointer to the next (or first) extra create parameter (ECP) context structure in a given ECP list.
FsRtlGetNextFileLock function The FsRtlGetNextFileLock routine is used to enumerate the byte-range locks that currently exist for a specified file.
FsRtlGetNextFileLock function The FsRtlGetNextFileLock routine is used to enumerate the byte-range locks that currently exist for a specified file.
FsRtlGetNextFileLock function The FsRtlGetNextFileLock routine is used to enumerate the byte-range locks that currently exist for a specified file.
FsRtlGetNextLargeMcbEntry function The FsRtlGetNextLargeMcbEntry routine retrieves a mapping run from a map control block (MCB).
FsRtlGetNextLargeMcbEntry function The FsRtlGetNextLargeMcbEntry routine retrieves a mapping run from a map control block (MCB).
FsRtlGetNextMcbEntry function Obsolete.
FsRtlGetNextMcbEntry function Obsolete.
FsRtlGetSectorSizeInformation function The FsRtlGetSectorSizeInformation routine retrieves the physical and logical sector size information for a storage volume.
FsRtlGetSupportedFeatures function The FsRtlGetSupportedFeatures routine returns the supported features of a volume attached to the specified device object.
FsRtlIncrementCcFastMdlReadWait function The FsRtlIncrementCcFastMdlReadWait routine increments the cache manager's CcFastMdlReadWait performance counter member in a processor control block (PRCB) object.
FsRtlIncrementCcFastReadNoWait function The FsRtlIncrementCcFastReadNoWait routine increments the CcFastReadNoWait performance counter in a per processor control block of cache manager system counters.
FsRtlIncrementCcFastReadNotPossible function The FsRtlIncrementCcFastReadNotPossible routine increments the CcFastReadNotPossible performance counter in a per processor control block of cache manager system counters.
FsRtlIncrementCcFastReadResourceMiss function The FsRtlIncrementCcFastReadResourceMiss routine increments the CcFastReadNotPossible performance counter in a per processor control block of cache manager system counters.
FsRtlIncrementCcFastReadWait function The FsRtlIncrementCcFastReadWait routine increments the CcFastReadWait performance counter in a per processor control block of cache manager system counters.
FsRtlInitExtraCreateParameterLookasideList function The FsRtlInitExtraCreateParameterLookasideList routine initializes a paged or nonpaged pool lookaside list used for the allocation of one or more extra create parameter context structures (ECPs) of fixed size.
FsRtlInitializeExtraCreateParameter function The FsRtlInitializeExtraCreateParameter routine initializes an extra create parameter (ECP) context structure.
FsRtlInitializeExtraCreateParameterList function The FsRtlInitializeExtraCreateParameterList routine initializes an extra create parameter (ECP) context structure list.
FsRtlInitializeFileLock function The FsRtlInitializeFileLock routine initializes a FILE_LOCK structure.
FsRtlInitializeFileLock function The FsRtlInitializeFileLock routine initializes a FILE_LOCK structure.
FsRtlInitializeFileLock function The FsRtlInitializeFileLock routine initializes a FILE_LOCK structure.
FsRtlInitializeLargeMcb function The FsRtlInitializeLargeMcb routine initializes a map control block (MCB) structure.
FsRtlInitializeLargeMcb function The FsRtlInitializeLargeMcb routine initializes a map control block (MCB) structure.
FsRtlInitializeMcb function Obsolete.
FsRtlInitializeMcb function Obsolete.
FsRtlInitializeOplock function FsRtlInitializeOplock initializes an opportunistic lock (oplock) pointer.
FsRtlInitializeTunnelCache function The FsRtlInitializeTunnelCache routine initializes a new tunnel cache for a volume.
FsRtlInsertExtraCreateParameter function The FsRtlInsertExtraCreateParameter routine inserts an extra create parameter (ECP) context structure into an ECP list.
FsRtlInsertPerFileContext function The FsRtlInsertPerFileContext routine associates a FSRTL_PER_FILE_CONTEXT object with a driver-specified context object for a file.
FsRtlInsertPerFileObjectContext function For a "legacy" file system filter driver, the FsRtlInsertPerFileObjectContext function associates context information with a file object.
FsRtlInsertPerStreamContext function The FsRtlInsertPerStreamContext routine associates a file system filter driver's per-stream context structure with a file stream.
FsRtlIsDaxVolume function This routine queries if the specified file is on a direct access (DAX) volume.
FsRtlIsDbcsInExpression function The FsRtlIsDbcsInExpression routine determines whether an ANSI or double-byte character set (DBCS) string matches the specified pattern.
FsRtlIsDbcsInExpression function The FsRtlIsDbcsInExpression routine determines whether an ANSI or double-byte character set (DBCS) string matches the specified pattern.
FsRtlIsEcpAcknowledged function The FsRtlIsEcpAcknowledged routine is used to determine if a given extra create parameter (ECP) context structure has been marked as acknowledged.
FsRtlIsEcpFromUserMode function The FsRtlIsEcpFromUserMode routine determines whether an extra create parameter (ECP) context structure originated from user mode.
FsRtlIsFatDbcsLegal function The FsRtlIsFatDbcsLegal routine determines whether the specified ANSI or double-byte character set (DBCS) string is a legal FAT file name.
FsRtlIsFatDbcsLegal function The FsRtlIsFatDbcsLegal routine determines whether the specified ANSI or double-byte character set (DBCS) string is a legal FAT file name.
FsRtlIsHpfsDbcsLegal function The FsRtlIsHpfsDbcsLegal routine determines whether the specified ANSI or double-byte character set (DBCS) string is a legal HPFS file name.
FsRtlIsHpfsDbcsLegal function The FsRtlIsHpfsDbcsLegal routine determines whether the specified ANSI or double-byte character set (DBCS) string is a legal HPFS file name.
FsRtlIsNameInExpression function The FsRtlIsNameInExpression routine determines whether a Unicode string matches the specified pattern.
FsRtlIsNameInExpression function The FsRtlIsNameInExpression routine determines whether a Unicode string matches the specified pattern.
FsRtlIsNtstatusExpected function The FsRtlIsNtstatusExpected routine determines whether the specified exception is handled by the exception filter.
FsRtlIsPagingFile function The FsRtlIsPagingFile routine determines whether a given file is a paging file.
FsRtlIsSystemPagingFile function The FsRtlIsSystemPagingFile routine determines whether a given file is currently a system paging file.
FsRtlIsTotalDeviceFailure function The FsRtlIsTotalDeviceFailure routine determines whether a media or other hardware failure has occurred.
FsRtlIsTotalDeviceFailure function The FsRtlIsTotalDeviceFailure routine determines whether a media or other hardware failure has occurred.
FsRtlIssueDeviceIoControl function The FsRtlIssueDeviceIoControl routine sends a synchronous device I/O control request to a target device object.
FsRtlLogCcFlushError function The FsRtlLogCcFlushError routine logs a lost delayed-write error and displays a dialog box to the user.
FsRtlLookupLargeMcbEntry function Given a virtual block number (VBN) and a map control block (MCB), the FsRtlLookupLargeMcbEntry routine searches the MCB for mapping information corresponding to the specified VBN.
FsRtlLookupLargeMcbEntry function Given a virtual block number (VBN) and a map control block (MCB), the FsRtlLookupLargeMcbEntry routine searches the MCB for mapping information corresponding to the specified VBN.
FsRtlLookupLastLargeMcbEntry function The FsRtlLookupLastLargeMcbEntry routine retrieves the last mapping entry stored in the map control block (MCB).
FsRtlLookupLastLargeMcbEntry function The FsRtlLookupLastLargeMcbEntry routine retrieves the last mapping entry stored in the map control block (MCB).
FsRtlLookupLastLargeMcbEntryAndIndex function The FsRtlLookupLastLargeMcbEntryAndIndex routine retrieves the last mapping entry stored in a given map control block (MCB).
FsRtlLookupLastLargeMcbEntryAndIndex function The FsRtlLookupLastLargeMcbEntryAndIndex routine retrieves the last mapping entry stored in a given map control block (MCB).
FsRtlLookupLastMcbEntry function Obsolete.
FsRtlLookupLastMcbEntry function Obsolete.
FsRtlLookupMcbEntry function Obsolete.
FsRtlLookupMcbEntry function Obsolete.
FsRtlLookupPerFileContext function The FsRtlLookupPerFileContext routine returns a pointer to a FSRTL_PER_FILE_CONTEXT object that is associated with a specified file.
FsRtlLookupPerFileObjectContext function For a "legacy" file system filter driver, the FsRtlLookupPerFileObjectContext function retrieves context information previously associated with a file object.
FsRtlLookupPerStreamContextInternal function Reserved for system use.
FsRtlMdlReadCompleteDev function The FltFastIoMdlReadComplete routine completes the read operation that the FltFastIoMdlRead routine initiated.
FsRtlMdlReadCompleteDev function The FltFastIoMdlReadComplete routine completes the read operation that the FltFastIoMdlRead routine initiated.
FsRtlMdlReadCompleteDev function The FltFastIoMdlReadComplete routine completes the read operation that the FltFastIoMdlRead routine initiated.
FsRtlMdlReadDev function The FltFastIoMdlRead routine returns a memory descriptor list (MDL) that points directly to the specified byte range in the file cache.
FsRtlMdlReadDev function The FltFastIoMdlRead routine returns a memory descriptor list (MDL) that points directly to the specified byte range in the file cache.
FsRtlMdlReadDev function The FltFastIoMdlRead routine returns a memory descriptor list (MDL) that points directly to the specified byte range in the file cache.
FsRtlMdlReadEx function The FsRtlMdlReadEx routine performs a fast cached MDL read. If the requested data is not cached, the routine reverts to an IRP based MDL read operation.
FsRtlMdlReadEx function The FsRtlMdlReadEx routine performs a fast cached MDL read. If the requested data is not cached, the routine reverts to an IRP based MDL read operation.
FsRtlMdlReadEx function The FsRtlMdlReadEx routine performs a fast cached MDL read. If the requested data is not cached, the routine reverts to an IRP based MDL read operation.
FsRtlMdlWriteCompleteDev function The FltFastIoMdlWriteComplete routine frees the resources that FltFastIoPrepareMdlWrite allocated.
FsRtlMdlWriteCompleteDev function The FltFastIoMdlWriteComplete routine frees the resources that FltFastIoPrepareMdlWrite allocated.
FsRtlMdlWriteCompleteDev function The FltFastIoMdlWriteComplete routine frees the resources that FltFastIoPrepareMdlWrite allocated.
FsRtlMupGetProviderIdFromName function The FsRtlMupGetProviderIdFromName routine gets the provider identifier of a network redirector that is registered with the multiple UNC provider (MUP) from the device name of the network redirector.
FsRtlMupGetProviderInfoFromFileObject function The FsRtlMupGetProviderInfoFromFileObject routine gets information about a network redirector that is registered with the multiple UNC provider (MUP) from a file object for a file that is located on a remote file system.
FsRtlNormalizeNtstatus function The FsRtlNormalizeNtstatus routine translates an arbitrary exception into a status value that is handled by the exception filter.
FsRtlNormalizeNtstatus function The FsRtlNormalizeNtstatus routine translates an arbitrary exception into a status value that is handled by the exception filter.
FsRtlNotifyCleanup function When the last handle to a file object is released, the FsRtlNotifyCleanup routine removes the file object's notify structure, if present, from the specified notify list.
FsRtlNotifyCleanup function When the last handle to a file object is released, the FsRtlNotifyCleanup routine removes the file object's notify structure, if present, from the specified notify list.
FsRtlNotifyCleanupAll function The FsRtlNotifyCleanupAll routine removes all members of the specified notification list.
FsRtlNotifyCleanupAll function The FsRtlNotifyCleanupAll routine removes all members of the specified notification list.
FsRtlNotifyFilterChangeDirectory function The FsRtlNotifyFilterChangeDirectory routine creates a notify structure for an IRP_MN_NOTIFY_CHANGE_DIRECTORY request and adds it to the specified notify list.
FsRtlNotifyFilterChangeDirectory function The FsRtlNotifyFilterChangeDirectory routine creates a notify structure for an IRP_MN_NOTIFY_CHANGE_DIRECTORY request and adds it to the specified notify list.
FsRtlNotifyFilterReportChange function FsRtlNotifyFilterReportChange completes IRP_MN_NOTIFY_CHANGE_DIRECTORY requests that are pending in the specified notify list.
FsRtlNotifyFilterReportChange function FsRtlNotifyFilterReportChange completes IRP_MN_NOTIFY_CHANGE_DIRECTORY requests that are pending in the specified notify list.
FsRtlNotifyFullChangeDirectory function The FsRtlNotifyFullChangeDirectory routine creates a notify structure for a notification request and adds it to the specified notify list.
FsRtlNotifyFullChangeDirectory function The FsRtlNotifyFullChangeDirectory routine creates a notify structure for a notification request and adds it to the specified notify list.
FsRtlNotifyFullReportChange function The FsRtlNotifyFullReportChange routine completes pending notify change IRPs.
FsRtlNotifyFullReportChange function The FsRtlNotifyFullReportChange routine completes pending notify change IRPs.
FsRtlNotifyInitializeSync function The FsRtlNotifyInitializeSync routine allocates and initializes a synchronization object for a notify list.
FsRtlNotifyUninitializeSync function The FsRtlNotifyUninitializeSync routine deallocates the synchronization object for a notify list.
FsRtlNotifyVolumeEvent function The FsRtlNotifyVolumeEvent routine notifies any registered applications that a volume event is occurring.
FsRtlNotifyVolumeEvent function The FsRtlNotifyVolumeEvent routine notifies any registered applications that a volume event is occurring.
FsRtlNotifyVolumeEventEx function The FsRtlNotifyVolumeEventEx routine notifies any registered applications that a volume event is occurring. Volume events include the volume being locked, unlocked, mounted, or made read-only.
FsRtlNotifyVolumeEventEx function The FsRtlNotifyVolumeEventEx routine notifies any registered applications that a volume event is occurring. Volume events include the volume being locked, unlocked, mounted, or made read-only.
FsRtlNumberOfRunsInLargeMcb function The FsRtlNumberOfRunsInLargeMcb routine returns the number of runs in a map control block (MCB).
FsRtlNumberOfRunsInMcb function Obsolete.
FsRtlOplockBreakH function The FsRtlOplockBreakH routine breaks CACHE_HANDLE_LEVEL opportunistic locks (oplocks).
FsRtlOplockBreakH function The FsRtlOplockBreakH routine breaks CACHE_HANDLE_LEVEL opportunistic locks (oplocks).
FsRtlOplockBreakToNone function Obsolete.
FsRtlOplockBreakToNone function Obsolete.
FsRtlOplockBreakToNoneEx function The FsRtlOplockBreakToNoneEx routine breaks all opportunistic locks (oplocks) immediately without regard for any oplock key.
FsRtlOplockBreakToNoneEx function The FsRtlOplockBreakToNoneEx routine breaks all opportunistic locks (oplocks) immediately without regard for any oplock key.
FsRtlOplockFsctrl function FsRtlOplockFsctrl performs various opportunistic lock (oplock) operations on behalf of a file system or filter driver.
FsRtlOplockFsctrl function FsRtlOplockFsctrl performs various opportunistic lock (oplock) operations on behalf of a file system or filter driver.
FsRtlOplockFsctrlEx function The FsRtlOplockFsctrlEx routine performs various opportunistic lock (oplock) operations on behalf of a file system or filter driver.
FsRtlOplockFsctrlEx function The FsRtlOplockFsctrlEx routine performs various opportunistic lock (oplock) operations on behalf of a file system or filter driver.
FsRtlOplockIsFastIoPossible function FsRtlOplockIsFastIoPossible checks a file's opportunistic lock (oplock) state to determine whether fast I/O can be performed on the file.
FsRtlOplockIsSharedRequest function The FsRtlOplockIsSharedRequest routine determines if a request for an opportunistic lock (oplock) wants a shared oplock.
FsRtlOplockKeysEqual function The FsRtlOplockKeysEqual routine compares the opportunistic lock (oplock) keys that are stored in the file object extensions of two file objects.
FsRtlOplockKeysEqual function The FsRtlOplockKeysEqual routine compares the opportunistic lock (oplock) keys that are stored in the file object extensions of two file objects.
FsRtlPostPagingFileStackOverflow function The FsRtlPostPagingFileStackOverflow routine posts a paging file stack overflow item to the stack overflow thread.
FsRtlPostPagingFileStackOverflow function The FsRtlPostPagingFileStackOverflow routine posts a paging file stack overflow item to the stack overflow thread.
FsRtlPostStackOverflow function The FsRtlPostStackOverflow routine posts a stack overflow item to the stack overflow thread.
FsRtlPostStackOverflow function The FsRtlPostStackOverflow routine posts a stack overflow item to the stack overflow thread.
FsRtlPrepareMdlWriteDev function The FltFastIoPrepareMdlWrite routine returns a linked list of memory descriptor lists (MDLs) that point to the specified range of cached file data to write data directly to the cache.
FsRtlPrepareMdlWriteDev function The FltFastIoPrepareMdlWrite routine returns a linked list of memory descriptor lists (MDLs) that point to the specified range of cached file data to write data directly to the cache.
FsRtlPrepareMdlWriteDev function The FltFastIoPrepareMdlWrite routine returns a linked list of memory descriptor lists (MDLs) that point to the specified range of cached file data to write data directly to the cache.
FsRtlPrepareMdlWriteEx function The FsRtlPrepareMdlWriteEx routine returns a linked list of memory descriptor lists (MDLs) that point to the specified range of cached file data to write data directly to the cache.
FsRtlPrepareMdlWriteEx function The FsRtlPrepareMdlWriteEx routine returns a linked list of memory descriptor lists (MDLs) that point to the specified range of cached file data to write data directly to the cache.
FsRtlPrepareMdlWriteEx function The FsRtlPrepareMdlWriteEx routine returns a linked list of memory descriptor lists (MDLs) that point to the specified range of cached file data to write data directly to the cache.
FsRtlPrepareToReuseEcp function The FsRtlPrepareToReuseEcp routine resets an extra create parameter (ECP) context structure, which prepares it for reuse.
FsRtlPrivateLock function Obsolete.
FsRtlPrivateLock function Obsolete.
FsRtlProcessFileLock function The FsRtlProcessFileLock routine processes and completes an IRP for a file lock operation.
FsRtlProcessFileLock function The FsRtlProcessFileLock routine processes and completes an IRP for a file lock operation.
FsRtlProcessFileLock function The FsRtlProcessFileLock routine processes and completes an IRP for a file lock operation.
FsRtlQueryCachedVdl function The current valid data length (VDL) for a cached file is retrieved with the FsRtlQueryCachedVdl routine.
FsRtlQueryKernelEaFile function The routine FsRtlQueryKernelEaFile is used to build an explicit QueryEA request and synchronously wait for it to complete, returning the result. This allows the caller to do this by FileObject instead of a handle.
FsRtlRegisterFileSystemFilterCallbacks function File system filter drivers and file systems call the FsRtlRegisterFileSystemFilterCallbacks routine to register notification callback routines to be invoked when the underlying file system performs certain operations.
FsRtlRegisterUncProvider function The FsRtlRegisterUncProvider routine registers a network redirector as a universal naming convention (UNC) provider with the system multiple UNC provider (MUP).
FsRtlRegisterUncProvider function The FsRtlRegisterUncProvider routine registers a network redirector as a universal naming convention (UNC) provider with the system multiple UNC provider (MUP).
FsRtlRegisterUncProviderEx function The FsRtlRegisterUncProviderEx routine registers a network redirector as a universal naming convention (UNC) provider with the system multiple UNC provider (MUP).
FsRtlRegisterUncProviderEx function The FsRtlRegisterUncProviderEx routine registers a network redirector as a universal naming convention (UNC) provider with the system multiple UNC provider (MUP).
FsRtlReleaseFile function Reserved for system use.
FsRtlReleaseFile function Reserved for system use.
FsRtlRemoveDotsFromPath function The FsRtlRemoveDotsFromPath routine removes unnecessary occurrences of '.' and '..' from the specified path.
FsRtlRemoveExtraCreateParameter function The FsRtlRemoveExtraCreateParameter routine searches an ECP list for an ECP context structure and, if found, detaches it from the ECP list.
FsRtlRemoveLargeMcbEntry function The FsRtlRemoveLargeMcbEntry routine removes one or more mappings from a map control block (MCB).
FsRtlRemoveLargeMcbEntry function The FsRtlRemoveLargeMcbEntry routine removes one or more mappings from a map control block (MCB).
FsRtlRemoveMcbEntry function Obsolete.
FsRtlRemoveMcbEntry function Obsolete.
FsRtlRemovePerFileContext function The FsRtlRemovePerFileContext routine returns a pointer to a FSRTL_PER_FILE_CONTEXT object that is associated with a file.
FsRtlRemovePerFileObjectContext function For a "legacy" file system filter driver, the FsRtlRemovePerFileObjectContext function unlinks a per-file-object context information structure from the list of per-file-object contexts previously associated with a file object.
FsRtlRemovePerStreamContext function FsRtlRemovePerStreamContext removes a per-stream context structure from the list of per-stream contexts associated with a file stream.
FsRtlResetLargeMcb function The FsRtlResetLargeMcb routine truncates a map control block (MCB) structure to contain zero mapping pairs. It does not shrink the mapping pairs array.
FsRtlResetLargeMcb function The FsRtlResetLargeMcb routine truncates a map control block (MCB) structure to contain zero mapping pairs. It does not shrink the mapping pairs array.
FsRtlSetEcpListIntoIrp function The FsRtlSetEcpListIntoIrp routine attaches an extra create parameter (ECP) context structure list to an IRP_MJ_CREATE operation.
FsRtlSetKernelEaFile function The routine FsRtlQueryKernelEaFile is used to set, modify and/or delete extended attribute (EA) values for a file and synchronously wait for it to complete, returning a result.
FsRtlSetupAdvancedHeader function The FsRtlSetupAdvancedHeader macro is used by file systems to initialize an FSRTL_ADVANCED_FCB_HEADER structure for use with filter contexts.
FsRtlSplitLargeMcb function The FsRtlSplitLargeMcb routine inserts a hole into the mappings in a map control block (MCB).
FsRtlSplitLargeMcb function The FsRtlSplitLargeMcb routine inserts a hole into the mappings in a map control block (MCB).
FsRtlTeardownPerFileContexts function File systems call theFsRtlTeardownPerFileContexts routine to free FSRTL_PER_FILE_CONTEXT objects that are associated with a file control block (FCB) structure.
FsRtlTeardownPerStreamContexts function The FsRtlTeardownPerStreamContexts routine frees all per-stream context structures associated with a given FSRTL_ADVANCED_FCB_HEADER structure.
FsRtlTruncateLargeMcb function The FsRtlTruncateLargeMcb routine truncates a large map control block (MCB).
FsRtlTruncateLargeMcb function The FsRtlTruncateLargeMcb routine truncates a large map control block (MCB).
FsRtlTruncateMcb function Obsolete.
FsRtlTruncateMcb function Obsolete.
FsRtlUninitializeFileLock function The FsRtlUninitializeFileLock routine uninitializes a FILE_LOCK structure.
FsRtlUninitializeFileLock function The FsRtlUninitializeFileLock routine uninitializes a FILE_LOCK structure.
FsRtlUninitializeLargeMcb function The FsRtlUninitializeLargeMcb routine uninitializes a large map-control block (MCB).
FsRtlUninitializeMcb function Obsolete.
FsRtlUninitializeOplock function FsRtlUninitializeOplock uninitializes an opportunistic lock (oplock) pointer.
FsRtlUpperOplockFsctrl function The FsRtlUpperOplockFsctrl routine processes opportunistic lock (oplock) requests and acknowledgments for secondary, or layered, file systems.
FsRtlUpperOplockFsctrl function The FsRtlUpperOplockFsctrl routine processes opportunistic lock (oplock) requests and acknowledgments for secondary, or layered, file systems.
FsRtlValidateReparsePointBuffer function The FsRtlValidateReparsePointBuffer routine verifies that the specified reparse point buffer is valid.
GetSecurityUserInfo function The GetSecurityUserInfo function retrieves information about a logon session.
IoAcquireVpbSpinLock function The IoAcquireVpbSpinLock routine acquires the Volume Parameter Block (VPB) spin lock.
IoCheckDesiredAccess function Reserved for system use.
IoCheckEaBufferValidity function The IoCheckEaBufferValidity routine checks whether the specified extended attribute (EA) buffer is valid.
IoCheckFunctionAccess function Reserved for system use.
IoCheckQuerySetFileInformation function Reserved for system use.
IoCheckQuerySetVolumeInformation function Reserved for system use.
IoCheckQuotaBufferValidity function The IoCheckQuotaBufferValidity routine checks whether the specified quota buffer is valid.
IoCreateStreamFileObject function The IoCreateStreamFileObject routine creates a new stream file object.
IoCreateStreamFileObjectEx function The IoCreateStreamFileObjectEx routine creates a new stream file object.
IoCreateStreamFileObjectEx2 function The IoCreateStreamFileObjectEx2 routine creates a new stream file object with create options for a target device object.
IoCreateStreamFileObjectLite function The IoCreateStreamFileObjectLite routine creates a new stream file object, but does not cause an IRP_MJ_CLEANUP request to be sent to the file system driver stack.
IoEnumerateDeviceObjectList function The IoEnumerateDeviceObjectList routine enumerates a driver's device object list.
IoEnumerateRegisteredFiltersList function The IoEnumerateRegisteredFiltersList routine enumerates the file system filter drivers that have registered with the system.
IoFastQueryNetworkAttributes function Reserved for system use.
IoGetAttachedDevice function The IoGetAttachedDevice routine returns a pointer to the highest-level device object associated with the specified device.
IoGetBaseFileSystemDeviceObject function Reserved for system use.
IoGetDeviceAttachmentBaseRef function The IoGetDeviceAttachmentBaseRef routine returns a pointer to the lowest-level device object in a file system or device driver stack.
IoGetDeviceToVerify function The IoGetDeviceToVerify routine returns a pointer to the device object, representing a removable-media device, that is the target of the given thread's I/O request.
IoGetDiskDeviceObject function The IoGetDiskDeviceObject routine retrieves a pointer to the disk device object associated with a given file system volume device object.
IoGetLowerDeviceObject function The IoGetLowerDeviceObject routine returns a pointer to the next-lower-level device object on the driver stack.
IoGetRequestorProcess function The IoGetRequestorProcess routine returns a process pointer for the thread that originally requested a given I/O operation.
IoGetRequestorProcessId function The IoGetRequestorProcessId routine returns the unique 32-bit process ID for the thread that originally requested a given I/O operation.
IoGetRequestorSessionId function The IoGetRequestorSessionId routine returns the session ID for the process that originally requested a given I/O operation.
IoGetTopLevelIrp function The IoGetTopLevelIrp routine returns the value of the TopLevelIrp field of the current thread.
IoInitializePriorityInfo function The IoInitializePriorityInfo routine initializes a structure of type IO_PRIORITY_INFO.
IoIsOperationSynchronous function The IoIsOperationSynchronous routine determines whether a given IRP represents a synchronous or asynchronous I/O request.
IoIsSystemThread function The IoIsSystemThread routine checks whether a given thread is a system thread.
IoIsValidNameGraftingBuffer function Reserved for system use.
IoPageRead function Reserved for system use.
IoQueryFileDosDeviceName function The IoQueryFileDosDeviceName routine retrieves an MS-DOS device name for a file.
IoQueryFileInformation function Reserved for system use.
IoQueryVolumeInformation function Reserved for system use.
IoQueueThreadIrp function Reserved for system use.
IoRegisterFileSystem function The IoRegisterFileSystem routine adds a file system's control device object to the global file system queue.
IoRegisterFsRegistrationChange function The IoRegisterFsRegistrationChange routine registers a file system filter driver's notification routine to be called whenever a file system registers or unregisters itself as an active file system.
IoRegisterFsRegistrationChangeEx function The IoRegisterFsRegistrationChangeEx routine registers a file system filter driver's notification routine to be called whenever a file system registers or unregisters itself as an active file system.
IoRegisterFsRegistrationChangeMountAware function The IoRegisterFsRegistrationChangeMountAware routine registers a file system filter driver's notification routine. This notification routine is called whenever a file system registers or unregisters itself as an active file system.
IoReleaseVpbSpinLock function The IoReleaseVpbSpinLock routine releases the Volume Parameter Block (VPB) spin lock.
IoReplaceFileObjectName function The IoReplaceFileObjectName routine replaces the name of a file object.
IoSetDeviceToVerify function The IoSetDeviceToVerify routine specifies a device object to be verified. The specified device object represents a removable media device.
IoSetInformation function Reserved for system use.
IoSetTopLevelIrp function The IoSetTopLevelIrp routine sets the value of the TopLevelIrp field of the current thread.
IoSynchronousPageWrite function Reserved for system use.
IoThreadToProcess function The IoThreadToProcess routine returns a pointer to the process for the specified thread.
IoUnregisterFileSystem function The IoUnregisterFileSystem routine removes a file system's control device object from the global file system queue.
IoUnregisterFsRegistrationChange function The IoUnregisterFsRegistrationChange routine unregisters file system filter driver's file system registration change notification routine.
IoVerifyVolume function The IoVerifyVolume routine sends a volume verify request to the given removable-media device.
KeAttachProcess function Obsolete.
KeDetachProcess function Obsolete.
KeInitializeMutant function Reserved for system use.
KeInitializeQueue function The KeInitializeQueue routine initializes a queue object on which threads can wait for entries.
KeInsertHeadQueue function The KeInsertHeadQueue routine inserts an entry at the head of the given queue if it cannot immediately use the entry to satisfy a thread wait.
KeInsertQueue function The KeInsertQueue routine inserts an entry at the tail of the given queue if it cannot immediately use the entry to satisfy a thread wait.
KeReadStateMutant function Reserved for system use.
KeReadStateQueue function Reserved for system use.
KeReleaseMutant function Reserved for system use.
KeReleaseQueuedSpinLock function Reserved for system use.
KeRemoveQueue function The KeRemoveQueue routine gives the calling thread a pointer to a dequeued entry from the given queue object or allows the caller to wait, up to an optional timeout interval, on the queue object.
KeRundownQueue function The KeRundownQueue routine cleans up a queue object, flushing any queued entries.
KeSetIdealProcessorThread function Reserved for system use.
KeStackAttachProcess function The KeStackAttachProcess routine attaches the current thread to the address space of the target process.
KeTryToAcquireQueuedSpinLock function Reserved for system use.
KeUnstackDetachProcess function The KeUnstackDetachProcess routine detaches the current thread from the address space of a process and restores the previous attach state.
MapSecurityError function The MapSecurityError function maps a security interface SECURITY_STATUS status code to a corresponding NSTATUS status code.
MmCanFileBeTruncated function The MmCanFileBeTruncated routine checks whether a file can be truncated.
MmDoesFileHaveUserWritableReferences function The MmDoesFileHaveUserWritableReferences function returns the number of writable references for a file object.
MmFlushImageSection function The MmFlushImageSection routine flushes the image section for a file.
MmForceSectionClosed function The MmForceSectionClosed routine deletes the data and image sections for a file that is no longer in use.
MmGetMaximumFileSectionSize function The MmGetMaximumFileSectionSize returns the maximum possible size of a file section for the current version of Windows.
MmIsRecursiveIoFault function The MmIsRecursiveIoFault routine determines whether the current page fault is occurring during an I/O operation.
MmPrefetchPages function The MmPrefetchPages routine reads groups of pages from secondary storage in the optimal fashion.
MmSetAddressRangeModified function The MmSetAddressRangeModified routine marks currently valid pages in the specified range of the system cache as modified.
ObInsertObject function Reserved for system use.
ObIsKernelHandle function The ObIsKernelHandle routine determines whether the specified handle is a kernel handle.
ObMakeTemporaryObject function Reserved for system use.
ObOpenObjectByPointer function The ObOpenObjectByPointer function opens an object referenced by a pointer and returns a handle to the object.
ObQueryNameString function The ObQueryNameString routine supplies the name, if there is one, of a given object to which the caller has a pointer.
ObQueryObjectAuditingByHandle function Reserved for system use.
PsChargePoolQuota function The PsChargePoolQuota routine charges pool quota of the specified pool type to the specified process.
PsDereferenceImpersonationToken function The PsDereferenceImpersonationToken routine decrements the reference count of an impersonation token.
PsDereferencePrimaryToken function The PsDereferencePrimaryToken routine decrements the reference count of a primary token.
PsGetProcessExitTime function The PsGetProcessExitTime routine returns the exit time for the current process.
PsImpersonateClient function The PsImpersonateClient routine causes a server thread to impersonate a client.
PsIsDiskCountersEnabled function The enabled state of the per process disk I/O counters is returned by the PsIsDiskCountersEnabled routine.
PsIsThreadTerminating function The PsIsThreadTerminating routine checks whether a thread is terminating.
PsLookupProcessByProcessId function The PsLookupProcessByProcessId routine accepts the process ID of a process and returns a referenced pointer to EPROCESS structure of the process.
PsLookupThreadByThreadId function The PsLookupThreadByThreadId routine accepts the thread ID of a thread and returns a referenced pointer to the ETHREAD structure of the thread.
PsReferenceImpersonationToken function The PsReferenceImpersonationToken routine increments the reference count of the impersonation token for the specified thread.
PsReferencePrimaryToken function The PsReferencePrimaryToken routine increments the reference count of the primary token for the specified process.
PsReturnPoolQuota function The PsReturnPoolQuota routine returns pool quota of the specified pool type to the specified process.
PsRevertToSelf function The PsRevertToSelf routine ends the calling thread's impersonation of a client.
PsUpdateDiskCounters function The PsUpdateDiskCounters routine updates the disk I/O counters of a given process.
RtlAbsoluteToSelfRelativeSD function The RtlAbsoluteToSelfRelativeSD routine creates a new security descriptor in self-relative format by using a security descriptor in absolute format as a template.
RtlAddAccessAllowedAce function The RtlAddAccessAllowedAce routine adds an access-allowed access control entry (ACE) to an access control list (ACL). The access is granted to the specified security identifier (SID).
RtlAddAccessAllowedAceEx function The RtlAddAccessAllowedAceEx routine adds an access-allowed access control entry (ACE) with inheritance ACE flags to an access control list (ACL). The access is granted to the specified security identifier (SID).
RtlAddAce function The RtlAddAce routine adds one or more access control entries (ACEs) to a specified access control list (ACL).
RtlAllocateAndInitializeSid function Reserved for system use.
RtlAllocateHeap function The RtlAllocateHeap routine allocates a block of memory from a heap.
RtlAppendStringToString function The RtlAppendStringToString routine concatenates two counted strings. It copies bytes from the source up to the length of the destination buffer.
RtlCaptureContext function The RtlCaptureContext function retrieves a context record in the context of the caller.
RtlCaptureStackBackTrace function The RtlCaptureStackBackTrace routine captures a stack back trace by walking up the stack and recording the information for each frame.
RtlCompareMemoryUlong function The RtlCompareMemoryUlong routine returns how many bytes in a block of memory match a specified pattern.
RtlCompressBuffer function The RtlCompressBuffer function compresses a buffer and can be used by a file system driver to facilitate the implementation of file compression.
RtlCompressChunks function Reserved for system use.
RtlConvertSidToUnicodeString function The RtlConvertSidToUnicodeString routine generates a printable Unicode string representation of a security identifier (SID).
RtlCopyLuid function The RtlCopyLuid routine copies a locally unique identifier (LUID) to a buffer.
RtlCopySid function The RtlCopySid routine copies the value of a security identifier (SID) to a buffer.
RtlCreateAcl function The RtlCreateAcl routine creates and initializes an access control list (ACL).
RtlCreateHeap function The RtlCreateHeap routine creates a heap object that can be used by the calling process. This routine reserves space in the virtual address space of the process and allocates physical storage for a specified initial portion of this block.
RtlCreateSecurityDescriptorRelative function The RtlCreateSecurityDescriptorRelative routine initializes a new security descriptor in self-relative format.
RtlCreateSystemVolumeInformationFolder function The RtlCreateSystemVolumeInformationFolder routine verifies the existence of the "System Volume Information" folder on a file system volume. If the folder is not present, then the folder is created.
RtlCreateUnicodeString function The RtlCreateUnicodeString routine creates a new counted Unicode string.
RtlCustomCPToUnicodeN function Reserved for system use.
RtlDecompressBuffer function The RtlDecompressBuffer function decompresses an entire compressed buffer.
RtlDecompressBufferEx function The RtlDecompressBufferEx function decompresses an entire compressed buffer.
RtlDecompressBufferEx2 function The RtlDecompressBufferEx2 function decompresses an entire compressed buffer, using multiple processors where possible. Multiple processor support is only implemented for kernel mode callers.
RtlDecompressChunks function Reserved for system use.
RtlDecompressFragment function The RtlDecompressFragment function is used to decompress part of a compressed buffer (that is, a buffer "fragment").
RtlDecompressFragmentEx function The RtlDecompressFragmentEx function is used to decompress part of a compressed buffer (that is, a buffer "fragment"), using multiple processors where possible.
RtlDeleteAce function The RtlDeleteAce routine deletes an access control entry (ACE) from a specified access control list (ACL).
RtlDescribeChunk function Reserved for system use.
RtlDestroyHeap function The RtlDestroyHeap routine destroys the specified heap object. RtlDestroyHeap decommits and releases all the pages of a private heap object, and it invalidates the handle to the heap.
RtlDowncaseUnicodeString function The RtlDowncaseUnicodeString routine converts the specified Unicode source string to lowercase. The translation conforms to the current system locale information.
RtlEqualPrefixSid function The RtlEqualPrefixSid routine determines whether two security-identifier (SID) prefixes are equal. An SID prefix is the entire SID except for the last subauthority value.
RtlEqualSid function The RtlEqualSid routine determines whether two security identifier (SID) values are equal. Two SIDs must match exactly to be considered equal.
RtlFillMemoryUlong function The RtlFillMemoryUlong routine fills the specified range of memory with one or more repetitions of a ULONG value.
RtlFindUnicodePrefix function The RtlFindUnicodePrefix routine searches for the best match for a given Unicode file name in a prefix table.
RtlFreeHeap function The RtlFreeHeap routine frees a memory block that was allocated from a heap by RtlAllocateHeap.
RtlFreeOemString function The RtlFreeOemString routine releases storage that was allocated by any of the Rtl..ToOemString routines.
RtlFreeSid function Reserved for system use.
RtlGenerate8dot3Name function The RtlGenerate8dot3Name routine generates a short (8.3) name for the specified long file name.
RtlGetAce function The RtlGetAce routine obtains a pointer to an access control entry (ACE) in an access control list (ACL).
RtlGetCompressionWorkSpaceSize function The RtlGetCompressionWorkSpaceSize function is used to determine the correct size of the WorkSpace buffer for the RtlCompressBuffer and RtlDecompressFragment functions.
RtlGetDaclSecurityDescriptor function The RtlGetDaclSecurityDescriptor routine returns a pointer to the discretionary ACL (DACL) for a security descriptor.
RtlGetGroupSecurityDescriptor function The RtlGetGroupSecurityDescriptor routine returns the primary group information for a given security descriptor.
RtlGetOwnerSecurityDescriptor function The RtlGetOwnerSecurityDescriptor routine returns the owner information for a given security descriptor.
RtlGetSaclSecurityDescriptor function The RtlGetSaclSecurityDescriptor routine returns a pointer to the system ACL (SACL) for a security descriptor.
RtlIdentifierAuthoritySid function Reserved for system use.
RtlInitCodePageTable function Reserved for system use.
RtlInitializeSid function The RtlInitializeSid routine initializes a security identifier (SID) structure.
RtlInitializeSidEx function The RtlInitializeSidEx routine initializes a pre-allocated security identifier (SID) structure.
RtlInitializeUnicodePrefix function The RtlInitializeUnicodePrefix routine initializes a prefix table.
RtlInsertUnicodePrefix function The RtlInsertUnicodePrefix routine inserts a new element into a Unicode prefix table.
RtlIsCloudFilesPlaceholder function The RtlIsCloudFilesPlaceholder routine determines if a file or a directory is a CloudFiles placeholder, based on the FileAttributes and ReparseTag values of the file.
RtlIsNameLegalDOS8Dot3 function The RtlIsNameLegalDOS8Dot3 routine determines whether a given name represents a valid short (8.3) file name.
RtlIsPartialPlaceholder function The RtlIsPartialPlaceholder routine determines if a file or a directory is a CloudFiles placeholder, based on the FileAttributes and ReparseTag values of the file.
RtlIsPartialPlaceholderFileHandle function The RtlIsPartialPlaceholderFileHandle routine determines if a file is a known type of placeholder, based on a file handle.
RtlIsPartialPlaceholderFileInfo function The RtlIsPartialPlaceholderFileInfo routine determines if a file is a known type of placeholder, based on the information returned by NtQueryInformationFile or NtQueryDirectoryFile.
RtlIsValidOemCharacter function The RtlIsValidOemCharacter routine determines if the specified Unicode character can be mapped to a valid OEM character.
RtlLengthRequiredSid function The RtlLengthRequiredSid routine returns the length, in bytes, of the buffer required to store a security identifier (SID) with a specified number of subauthorities.
RtlLengthSid function The RtlLengthSid routine returns the length, in bytes, of a valid security identifier (SID).
RtlMultiByteToUnicodeN function The RtlMultiByteToUnicodeN routine translates the specified source string into a Unicode string, using the current system ANSI code page (ACP). The source string is not necessarily from a multibyte character set.
RtlMultiByteToUnicodeSize function The RtlMultiByteToUnicodeSize routine determines the number of bytes that are required to store the Unicode translation for the specified source string.
RtlNextUnicodePrefix function The RtlNextUnicodePrefix routine is used to enumerate the elements in a Unicode prefix table.
RtlNtStatusToDosError function The RtlNtStatusToDosError routine converts the specified NTSTATUS code to its equivalent system error code.
RtlNtStatusToDosErrorNoTeb function Reserved for system use.
RtlOemStringToCountedUnicodeString function The RtlOemStringToCountedUnicodeString routine translates the specified source string into a Unicode string using the current system OEM code page.
RtlOemStringToUnicodeString function The RtlOemStringToUnicodeString routine translates a given source string into a null-terminated Unicode string using the current system OEM code page.
RtlOemToUnicodeN function The RtlOemToUnicodeN routine translates the specified source string into a Unicode string, using the current system OEM code page.
RtlQueryThreadPlaceholderCompatibilityMode function RtlQueryThreadPlaceholderCompatibilityMode is a routine which returns the placeholder compatibility mode for the current thread.
RtlRandom function The RtlRandom routine returns a random number that was generated from a given seed value.
RtlRandomEx function The RtlRandomEx routine returns a random number that was generated from a given seed value.
RtlRemoveUnicodePrefix function The RtlRemoveUnicodePrefix routine removes an element from a prefix table.
RtlReserveChunk function Reserved for system use.
RtlSecondsSince1970ToTime function The RtlSecondsSince1970ToTime routine converts the elapsed time, in seconds, since the beginning of 1970 to an absolute system time value.
RtlSecondsSince1980ToTime function The RtlSecondsSince1980ToTime routine converts the elapsed time, in seconds, since the beginning of 1980 to an absolute system time value.
RtlSelfRelativeToAbsoluteSD function The RtlSelfRelativeToAbsoluteSD routine creates a new security descriptor in absolute format by using a security descriptor in self-relative format as a template.
RtlSetGroupSecurityDescriptor function The RtlSetGroupSecurityDescriptor routine sets the primary group information of an absolute-format security descriptor. It replaces any primary group information that is already present in the security descriptor.
RtlSetOwnerSecurityDescriptor function The RtlSetOwnerSecurityDescriptor routine sets the owner information of an absolute-format security descriptor. It replaces any owner information that is already present in the security descriptor.
RtlSetThreadPlaceholderCompatibilityMode function RtlSetThreadPlaceholderCompatibilityMode is a routine which sets the placeholder compatibility mode for the current thread.
RtlSubAuthorityCountSid function Reserved for system use.
RtlSubAuthoritySid function The RtlSubAuthoritySid routine returns a pointer to a specified subauthority of a security identifier (SID).
RtlTimeToSecondsSince1970 function The RtlTimeToSecondsSince1970 routine converts a given absolute system time value to the elapsed time, in seconds, since the beginning of 1970.
RtlTimeToSecondsSince1980 function The RtlTimeToSecondsSince1980 routine converts a given absolute system time value to the elapsed time, in seconds, since the beginning of 1980.
RtlUnicodeStringToCountedOemString function The RtlUnicodeStringToCountedOemString routine translates the specified Unicode source string into a counted OEM string using the current system OEM code page.
RtlUnicodeStringToOemString function The RtlUnicodeStringToOemString routine translates a given Unicode source string into an OEM string using the current system OEM code page.
RtlUnicodeToCustomCPN function Reserved for system use.
RtlUnicodeToMultiByteN function The RtlUnicodeToMultiByteN routine translates the specified Unicode string into a new character string, using the current system ANSI code page (ACP). The translated string is not necessarily from a multibyte character set.
RtlUnicodeToMultiByteSize function The RtlUnicodeToMultiByteSize routine determines the number of bytes that are required to store the multibyte translation for the specified Unicode string. The translation is assumed to use the current system ANSI code page (ACP).
RtlUnicodeToOemN function The RtlUnicodeToOemN routine translates a given Unicode string to an OEM string, using the current system OEM code page.
RtlUpcaseUnicodeStringToCountedOemString function The RtlUpcaseUnicodeStringToCountedOemString routine translates a given Unicode source string into an uppercase counted OEM string using the current system OEM code page.
RtlUpcaseUnicodeStringToOemString function The RtlUpcaseUnicodeStringToOemString routine translates a given Unicode source string into an uppercase OEM string using the current system OEM code page.
RtlUpcaseUnicodeToCustomCPN function Reserved for system use.
RtlUpcaseUnicodeToMultiByteN function The RtlUpcaseUnicodeToMultiByteN routine translates the specified Unicode string into a new uppercase character string, using the current system ANSI code page (ACP). The translated string is not necessarily from a multibyte character set.
RtlUpcaseUnicodeToOemN function The RtlUpcaseUnicodeToOemN routine translates a given Unicode string into an uppercase OEM string, using the current system OEM code page.
RtlValidSid function The RtlValidSid routine validates a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum.
RtlxOemStringToUnicodeSize function Reserved for system use.
RtlxUnicodeStringToOemSize function Reserved for system use.
RxAcquireExclusiveFcbResourceInMRx function RxAcquireExclusiveFcbResourceInMRx acquires the FCB resource for a network mini-redirector driver in exclusive mode.
RxAcquireSharedFcbResourceInMRx function RxAcquireSharedFcbResourceInMRx acquires the FCB resource for a network mini-redirector driver in shared mode.
RxAcquireSharedFcbResourceInMRxEx function RxAcquireSharedFcbResourceInMRxEx acquires the FCB resource for a network mini-redirector driver in shared mode.
RxAssociateContextWithMid function RxAssociateContextWithMid associates the supplied opaque context with an available multiplex ID (MID) from a MID_ATLAS.
RxCancelTimerRequest function RxCancelTimerRequest cancels a recurrent timer request. The request to be canceled is identified by the worker thread routine and associated context.
RxCeAllocateIrpWithMDL function RxCeAllocateIrpWithMDL allocates an IRP and associates it with an existing memory descriptor list.
RxCeBuildAddress function RxCeBuildAddress associates a transport address with a transport binding.
RxCeBuildConnection function RxCeBuildConnection establishes a connection between a local RDBSS connection address and a given remote address.
RxCeBuildConnectionOverMultipleTransports function RxCeBuildConnectionOverMultipleTransports establishes a connection between a local RDBSS connection address and a given remote address and supports multiple transports.
RxCeBuildTransport function RxCeBuildTransport binds an RDBSS transport object to a specified transport name.
RxCeBuildVC function RxCeBuildVC adds a virtual circuit to a specified RDBSS connection..
RxCeCancelConnectRequest function RxCeCancelConnectRequest cancels a previously issued connection request. Note that this routine is not currently implemented.
RxCeFreeIrp function RxCeFreeIrp frees an IRP.
RxCeInitiateVCDisconnect function RxCeInitiateVCDisconnect initiates a disconnect on the virtual circuit.
RxCeQueryAdapterStatus function RxCeQueryAdapterStatus returns the ADAPTER_STATUS structure for a given transport in a caller-allocated buffer.
RxCeQueryInformation function RxCeQueryInformation queries information about a connection in a caller-allocated buffer.
RxCeQueryTransportInformation function RxCeQueryTransportInformation queries transport information for a given transport.
RxCeSend function RxCeSend sends a transport service data unit (TSDU) along the specified connection on a virtual circuit.
RxCeSendDatagram function RxCeSendDatagram sends a transport service data unit (TSDU) along the specified connection on a virtual circuit.
RxCeTearDownAddress function RxCeTearDownAddress deregisters a transport address from a transport binding.
RxCeTearDownConnection function RxCeTearDownConnection tears down a given connection between a local RDBSS connection address and a remote address.
RxCeTearDownTransport function RxCeTearDownTransport unbinds an RDBSS transport object.
RxCeTearDownVC function RxCeTearDownVC deregisters a virtual circuit from a specified RDBSS connection.
RxChangeBufferingState function RxChangeBufferingState is called to process a buffering state change request.
RxCompleteRequest function RxCompleteRequest completes the IRP request associated with an RX_CONTEXT structure.
RxCompleteRequest_Real function RxCompleteRequest_Real completes the IRP request associated with an RX_CONTEXT structure.
RxCreateMidAtlas function RxCreateMidAtlas allocates a new instance of MID_ATLAS data structure and initializes it.
RxCreateNetFcb function RxCreateNetFCB allocates, initializes, and inserts a new FCB structure into the in-memory data structures for a V_NET_ROOT that this FCB is being opened on. The structure allocated has space for a SRV_OPEN and an FOBX structure.
RxCreateNetFobx function RxCreateNetFobx allocates, initializes, and inserts a new file object extension (FOBX) structure into the in-memory data structures for a FCB that this FOBX is being opened on.
RxCreateNetRoot function RxCreateNetRoot allocates and initializes a NET_ROOT structure and inserts the name into the net name table on the associated device object.
RxCreateRxContext function RxCreateRxContext allocates a new RX_CONTEXT structure and initializes the data structure.
RxCreateSrvCall function RxCreateSrvCall builds a SRV_CALL structure and inserts the name into the net name table maintained by RDBSS.
RxCreateSrvOpen function RxCreateSrvOpen allocates, initializes, and inserts a new SRV_OPEN structure into the in-memory data structures used by RDBSS. If a new structure has to be allocated, it has space for an FOBX structure.
RxCreateVNetRoot function RxCreateVNetRoot allocates and initializes a NET_ROOT structure and inserts the name into the net name table on the associated device object.
RxDereference function RxDereference decrements the NodeReferenceCount member of a structure by one for several reference counted data structures used by RDBSS.
RxDereferenceAndDeleteRxContext_Real function RxDereferenceAndDeleteRxContext_Real dereferences an RX_CONTEXT data structure and if the ReferenceCount member goes to zero, then it deallocates and removes the specified RX_CONTEXT structure from the RDBSS in-memory data structures.
RxDestroyMidAtlas function RxDestroyMidAtlas destroys an existing instance of a MID_ATLAS data structure and frees the allocated memory.
RxDispatchToWorkerThread function RxDispatchToWorkerThread invokes a routine in the context of a worker thread. The memory for the WORK_QUEUE_ITEM is allocated by this routine.
RxDriverEntry function RxDriverEntry is called by a monolithic network mini-redirector driver from its DriverEntry routine to initialize the RDBSS static library.
RxFinalizeConnection function RxFinalizeConnection deletes a connection to a share.
RxFinalizeNetFcb function RxFinalizeNetFCB finalizes the given FCB structure. The caller must have an exclusive lock on the NET_ROOT associated with FCB.
RxFinalizeNetFobx function RxFinalizeNetFOBX finalizes the given FOBX structure. The caller must have an exclusive lock on the FCB associated with FOBX structure.
RxFinalizeNetRoot function RxFinalizeNetRoot finalizes the given NET_ROOT structure. The caller must have an exclusive lock on the netname table associated with the device object.
RxFinalizeSrvCall function RxFinalizeSrvCall finalizes the given SRV_CALL structure. The caller must have an exclusive lock on the netname table associated with the device object.
RxFinalizeSrvOpen function RxFinalizeSrvOpen finalizes the given SRV_OPEN structure. The caller must have an exclusive lock on the FCB associated with the SRV_OPEN and either a shared or exclusive lock on the table lock of the NET_ROOT associated with the FCB.
RxFinalizeVNetRoot function RxFinalizeVNetRoot finalizes the given V_NET_ROOT structure. The caller must have an exclusive lock on the netname table associated with the device object.
RxFinishFcbInitialization function RxFinishFcbInitialization is used to finish initializing an FCB after the successful completion of a create operation by the network mini-redirector.
RxForceFinalizeAllVNetRoots function RxForceFinalizeAllVNetRoots force finalizes all the V_NET_ROOT structures associated with a given NET_ROOT structure. The caller must have an exclusive lock on the netname table associated with the device object.
RxFsdDispatch function RxFsdDispatch implements the file system driver (FSD) dispatch for RDBSS to process an I/O request packet (IRP).
RxFsdPostRequest function RxFsdPostRequest queues the I/O request packet (IRP) specified by an RX_CONTEXT structure to the worker queue for processing by the file system process (FSP).
RxGetFileSizeWithLock function RxGetFileSizeWithLock gets the file size in the FCB structure using a lock to ensure that the 64-bit value is read consistently.
RxGetRDBSSProcess function RxGetRDBSSProcess returns a pointer to the process of the main thread used by the RDBSS kernel process.
RxIndicateChangeOfBufferingState function RxIndicateChangeOfBufferingState is called to register a change buffering state request (an oplock break indication, for example) for later processing. If necessary, worker thread routines for further processing are activated.
RxIndicateChangeOfBufferingStateForSrvOpen function RxIndicateChangeOfBufferingStateForSrvOpen is called to register a change buffering state request (an oplock break indication, for example) for later processing. If the necessary preconditions are satisfied, the oplock is processed further.
RxInferFileType function RxInferFileType tries to infer the file type (directory or non-directory) from a member in the RX_CONTEXT structure.
RxInitializeContext function RxInitializeContext initializes an existing RX_CONTEXT data structure.
RxIsThisACscAgentOpen function RxIsThisACscAgentOpen determines if a file open was made by a user-mode client-side caching agent.
RxLockEnumerator function RxLockEnumerator is called from a network mini-redirector to enumerate the file locks on an FCB.
RxLogEventDirect function RxLogEventDirect is called to log an error to the I/O error log. It is recommended that the RXLogEvent macro or the RxLogFailure macro be used instead of calling this routine directly.
RxLogEventWithAnnotation function RxLogEventWithAnnotation allocates an I/O error log structure, fills it in with information, and writes the entry to the I/O error log.
RxLogEventWithBufferDirect function RxLogEventWithBufferDirect allocates an I/O error log structure, fills it in with information, and writes the entry to the I/O error log.
RxLowIoCompletion function RxLowIoCompletion must be called by the network mini-redirector low I/O routines when they complete, if the low I/O routines have initially returned STATUS_PENDING.
RxLowIoGetBufferAddress function RxLowIoGetBufferAddress returns the buffer corresponding to the MDL from LowIoContext structure of an RX_CONTEXT structure.
RxMakeLateDeviceAvailable function RxMakeLateDeviceAvailable modifies the device object to make a "late device" available. A late device is one that is not created in the driver's load routine.
RxMapAndDissociateMidFromContext function RxMapAndDissociateMidFromContext maps a Multiplex ID (MID) to its associated context in a MID_ATLAS structure and then disassociates the MID from the context.
RxMapMidToContext function RxMapMidToContext maps a Multiplex ID (MID) to its associated context in a MID_ATLAS structure.
RxMapSystemBuffer function RxMapSystemBuffer returns the system buffer address from the IRP.
RxNameCacheActivateEntry function RxNameCacheActivateEntry takes a name cache entry and updates the expiration time and the network mini-redirector context. It then puts the name cache entry on the active list.
RxNameCacheCheckEntry function RxNameCacheCheckEntry checks a name cache entry for validity. A valid entry means that the lifetime has not expired and the MRxContext parameter passes the equality check.
RxNameCacheCreateEntry function RxNameCacheCreateEntry allocates and initializes a NAME_CACHE structure with the given name string.
RxNameCacheExpireEntry function RxNameCacheExpireEntry puts a NAME_CACHE entry on the free list for recycling.
RxNameCacheExpireEntryWithShortName function RxNameCacheExpireEntryWithShortName expires all of the name cache entries whose name prefix matches the given short file name.
RxNameCacheFetchEntry function RxNameCacheFetchEntry looks for a match with a specified name string for a NAME_CACHE entry.
RxNameCacheFinalize function RxNameCacheFinalize releases the storage for all of the NAME_CACHE entries associated with a NAME_CACHE_CONTROL structure.
RxNameCacheFreeEntry function RxNameCacheFreeEntry releases the storage for a NAME_CACHE entry and decrements the count of the NAME_CACHE cache entries associated with a NAME_CACHE_CONTROL structure.
RxNameCacheInitialize function RxNameCacheInitialize initializes a name cache (NAME_CACHE_CONTROL structure).
RxPostOneShotTimerRequest function RxPostOneShotTimerRequest initializes a one-shot timer entry. The passed-in pointer to a worker thread routine is called once when the timer expires.
RxPostRecurrentTimerRequest function RxPostRecurrentTimerRequest initializes a recurrent timer request. The passed in pointer to a worker thread routine is called at regular intervals when the recurrent timer fires based on the input parameters to this routine.
RxPostToWorkerThread function RxPostToWorkerThread invokes a routine passed as a parameter in the context of a worker thread. Memory for the WORK_QUEUE_ITEM must be allocated by the caller.
RxPrefixTableLookupName function RxPrefixTableLookupName looks up a name in a prefix table used to catalog SRV_CALL, NET_ROOT, and V_NET_ROOT names and converts the underlying pointer to a structure that contains the name.
RxPrepareContextForReuse function RxPrepareContextForReuse prepares an RX_CONTEXT data structure for reuse by resetting all of the operation-specific allocations and acquisitions that have been made (the ReferenceCount member to the RX_CONTEXT structure is set to zero).
RxPrepareToReparseSymbolicLink function RxPrepareToReparseSymbolicLink sets up the file object name to facilitate a reparse. This routine is used by the network mini-redirectors to traverse symbolic links.
RxPurgeAllFobxs function RxPurgeAllFobxs purges all of the FOBX structures associated with a network mini-redirector.
RxPurgeRelatedFobxs function RxPurgeRelatedFobxs purges all of the FOBX structures associated with a NET_ROOT structure.
RxReassociateMid function RxReassociateMid reassociates a Multiplex ID (MID) with an alternate context.
RxReference function RxReference increments the NodeReferenceCount member of a structure by one for several of the reference counted data structures used by RDBSS.
RxRegisterMinirdr function RxRegisterMinirdr is called by a network mini-redirector driver to register the driver with RDBSS, which adds the registration information to an internal registration table. RDBSS also builds a device object for the network mini-redirector.
RxReleaseFcbResourceForThreadInMRx function RxReleaseFcbResourceForThreadInMRx releases the FCB resource acquired by a network mini-redirector driver with a particular thread ID.
RxReleaseFcbResourceInMRx function RxReleaseFcbResourceInMRx releases the FCB resource acquired by a network mini-redirector driver.
RxResumeBlockedOperations_Serially function RxResumeBlockedOperations_Serially wakes up the next waiting thread, if any, on the serialized blocking I/O queue.
RxScavengeAllFobxs function RxScavengeAllFobxs scavenges all of the FOBX structures associated with a network mini-redirector device object.
RxScavengeFobxsForNetRoot function RxScavengeFobxsForNetRoot scavenges all of the FOBX structures associated with a given NET_ROOT structure.
RxSetDomainForMailslotBroadcast function RxSetDomainForMailslotBroadcast is called by a network mini-redirector driver to set the domain used for mailslot broadcasts if mailslots are supported by the driver.
RxSetMinirdrCancelRoutine function RxSetMinirdrCancelRoutine is called by a network mini-redirector driver to set up a network mini-redirector cancel routine for an RX_CONTEXT structure.
RxSetSrvCallDomainName function RxSetSrvCallDomainName is called by a network mini-redirector driver to set the domain name associated with any given server (SRV_CALL structure).
RxSpinDownMRxDispatcher function RxSpinDownMRxDispatcher tears down the dispatcher context for a network mini-redirector.
RxStartMinirdr function RxStartMinirdr is called to start up a network mini-redirector that has previously called to register with RDBSS.
RxStopMinirdr function RxStopMinirdr is called to stop a network mini-redirector that has previously been started.
RxUnregisterMinirdr function RxUnregisterMinirdr is an inline routine called by a network mini-redirector driver to de-register the driver with RDBSS and remove the registration information from the internal RDBSS registration table.
RxpAcquirePrefixTableLockExclusive function RxpAcquirePrefixTableLockExclusive acquires the prefix table lock exclusively.
RxpAcquirePrefixTableLockShared function RxpAcquirePrefixTableLockShared acquires the prefix table lock shared.
RxpDereferenceAndFinalizeNetFcb function RxpDereferenceAndFinalizeNetFcb decrements the reference count and finalizes an FCB structure.
RxpDereferenceNetFcb function RxpDereferenceNetFcb decrements the reference count on an FCB structure.
RxpReferenceNetFcb function RxpReferenceNetFcb increments the reference count on an FCB.
RxpReleasePrefixTableLock function RxpReleasePrefixTableLock releases a previously acquired shared or exclusive prefix table lock.
RxpTrackDereference function RxpTrackDereference is used in checked builds to track requests to dereference SRV_CALL, NET_ROOT, V_NET_ROOT, FOBX, FCB, and SRV_OPEN structures in checked builds. A log of these dereference requests can be accessed by the logging system and WMI.
RxpTrackReference function RxpTrackReference tracks requests to reference SRV_CALL, NET_ROOT, V_NET_ROOT, FOBX, FCB, and SRV_OPEN structures in checked builds. A log of these reference requests can be accessed by the logging system and WMI.
RxpUnregisterMinirdr function RxpUnregisterMinirdr is called by a network mini-redirector driver to de-register the driver with RDBSS and remove the registration information from the internal RDBSS registration table.
SeAppendPrivileges function The SeAppendPrivileges routine appends additional privileges to the privilege set in an access state structure.
SeAuditHardLinkCreation function Reserved for system use.
SeAuditingFileEvents function The SeAuditingFileEvents routine determines whether file open events are currently being audited.
SeAuditingFileOrGlobalEvents function The SeAuditingFileOrGlobalEvents routine determines whether file or global events are currently being audited.
SeAuditingHardLinkEvents function Reserved for system use.
SeCaptureSubjectContext function The SeCaptureSubjectContext routine captures the security context of the calling thread for access validation and auditing.
SeCreateClientSecurity function The SeCreateClientSecurity routine initializes a security client context structure with the information needed to call SeImpersonateClientEx.
SeCreateClientSecurityFromSubjectContext function The SeCreateClientSecurityFromSubjectContext routine retrieves the access token for a security subject context and uses the result to initialize a security client context with the information needed to call SeImpersonateClientEx.
SeDeleteObjectAuditAlarm function The SeDeleteObjectAuditAlarm routine generates audit and alarm messages for an object that is marked for deletion.
SeFilterToken function The SeFilterToken routine creates a new access token that is a restricted version of an existing access token.
SeImpersonateClient function Obsolete.
SeImpersonateClientEx function The SeImpersonateClientEx routine causes a thread to impersonate a user.
SeLockSubjectContext function The SeLockSubjectContext routine locks the primary and impersonation tokens of a captured subject context.
SeMarkLogonSessionForTerminationNotification function The SeMarkLogonSessionForTerminationNotification routine marks a logon session so that the caller's registered callback routine is called when the logon session terminates.
SeOpenObjectAuditAlarm function The SeOpenObjectAuditAlarm routine generates audit and alarm messages when an attempt is made to open an object.
SeOpenObjectForDeleteAuditAlarm function The SeOpenObjectForDeleteAuditAlarm routine generates audit and alarm messages when an attempt is made to open an object for deletion.
SePrivilegeCheck function The SePrivilegeCheck routine determines whether a specified set of privileges is enabled in the subject's access token.
SeQueryAuthenticationIdToken function The SeQueryAuthenticationIdToken routine retrieves the authentication ID of an access token.
SeQueryInformationToken function The SeQueryInformationToken routine retrieves a specified type of information about an access token. The calling process must have appropriate access rights to obtain the information.
SeQuerySecurityDescriptorInfo function The SeQuerySecurityDescriptorInfo routine retrieves a copy of an object's security descriptor.
SeQuerySessionIdToken function Reserved for system use.
SeRegisterLogonSessionTerminatedRoutine function The SeRegisterLogonSessionTerminatedRoutine routine registers a callback routine to be called when a logon session terminates. A logon session terminates when the last token referencing the logon session is deleted.
SeReleaseSubjectContext function The SeReleaseSubjectContext routine releases a subject security context captured by an earlier call to SeCaptureSubjectContext.
SeSetAccessStateGenericMapping function The SeSetAccessStateGenericMapping routine sets the generic mapping field of an ACCESS_STATE structure.
SeSetSecurityDescriptorInfo function The SeSetSecurityDescriptorInfo routine sets an object's security descriptor.
SeSetSecurityDescriptorInfoEx function The SeSetSecurityDescriptorInfoEx routine modifies an object's security descriptor and specifies whether the object supports automatic inheritance of access control entries (ACE).
SeSetSessionIdToken function Reserved for system use.
SeTokenGetNoChildProcessRestricted function The SeTokenGetNoChildProcessRestricted routine determines the state of the no child process mitigation. It is not possible to be enforced and audit-only at the same time.
SeTokenIsAdmin function The SeTokenIsAdmin routine determines whether a token contains the local administrators group.
SeTokenIsNoChildProcessRestrictionEnforced function The SeTokenIsNoChildProcessRestrictionEnforced routine determines if the token carries the no child process restriction.
SeTokenIsRestricted function The SeTokenIsRestricted routine determines whether a token contains a list of restricting security identifiers (SID).
SeTokenSetNoChildProcessRestricted function The SeTokenSetNoChildProcessRestricted routine sets the TOKEN_AUDIT_NO_CHILD_PROCESS or TOKEN_AUDIT_NO_CHILD_PROCESS flags in the token.
SeTokenType function Reserved for system use.
SeUnlockSubjectContext function The SeUnlockSubjectContext routine unlocks the tokens of a captured subject context that were locked by a call to SeLockSubjectContext.
SeUnregisterLogonSessionTerminatedRoutine function The SeUnregisterLogonSessionTerminatedRoutine routine unregisters a callback routine that was registered by an earlier call to SeRegisterLogonSessionTerminatedRoutine.
SecLookupAccountName function SecLookupAccountName accepts an account as input and retrieves a security identifier (SID) for the account and the name of the domain on which the account was found.
SecLookupAccountSid function SecLookupAccountSid accepts a security identifier (SID) as input. It retrieves the name of the account for this SID and the name of the first domain on which this SID is found.
SecLookupWellKnownSid function SecLookupWellKnownSid accepts a well-known security identifier (SID) type as input and retrieves the local security identifier (SID) for this well known SID.
SecMakeSPN function SecMakeSPN creates a service provider name string that can be used when communicating with specific security service providers.
SecMakeSPNEx function SecMakeSPNEx creates a service provider name string that can be used when communicating with specific security service providers.
SecMakeSPNEx2 function SecMakeSPNEx2 creates a service provider name string that can be used when it communicates with specific security service providers.
_RxLog function "_RxLog takes a format string and variable number of parameters and formats an output string for recording as an I/O error log entry if logging is enabled."
__RxFillAndInstallFastIoDispatch function RxFillAndInstallFastIoDispatch fills out a fast I/O dispatch vector to be identical with the normal dispatch I/O vector and installs it into the driver object associated with the device object passed.
__RxSynchronizeBlockingOperations function "__RxSynchronizeBlockingOperations synchronizes blocking I/O requests to the same work queue."

Callback functions

Title Description
DRIVER_FS_NOTIFICATION callback function A PDRIVER_FS_NOTIFICATION-typed routine is called by the operating system when a file system registers or unregisters itself by using IoRegisterFileSystem or IoUnregisterFileSystem.
PFLT_COMPLETED_ASYNC_IO_CALLBACK callback A minifilter driver that initiates an asynchronous I/O operation can specify a routine of type PFLT_COMPLETED_ASYNC_IO_CALLBACK routine to be called when the operation is completed.
PFLT_COMPLETE_LOCK_CALLBACK_DATA_ROUTINE callback function A minifilter driver can register a routine of type PFLT_COMPLETE_LOCK_CALLBACK_DATA_ROUTINE as the minifilter driver's CompleteLockCallbackDataRoutine callback routine for a FILE_LOCK structure.
PFLT_CONTEXT_ALLOCATE_CALLBACK callback function A minifilter driver can register a routine of type PFLT_CONTEXT_ALLOCATE_CALLBACK as the minifilter driver's ContextAllocateCallback routine.
PFLT_CONTEXT_CLEANUP_CALLBACK callback function A minifilter driver can register a routine of type PFLT_CONTEXT_CLEANUP_CALLBACK as the minifilter driver's ContextCleanupCallback routine.
PFLT_CONTEXT_FREE_CALLBACK callback function A minifilter can register a routine of type PFLT_CONTEXT_FREE_CALLBACK as the minifilter driver's ContextFreeCallback routine.
PFLT_FILTER_UNLOAD_CALLBACK callback function A minifilter driver can register a routine of type PFLT_FILTER_UNLOAD_CALLBACK as the minifilter driver's FilterUnloadCallback routine.
PFLT_GENERATE_FILE_NAME callback function A minifilter driver that provides file names for the filter manager's name cache can register a routine of type PFLT_GENERATE_FILE_NAME as the minifilter driver's GenerateFileNameCallback routine.
PFLT_GET_OPERATION_STATUS_CALLBACK callback function A minifilter driver can register a routine of type PFLT_GET_OPERATION_STATUS_CALLBACK as the minifilter driver's OperationStatusCallback routine.
PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK callback function A minifilter driver can register a routine of type PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK as the minifilter driver's InstanceQueryTeardownCallback routine.
PFLT_INSTANCE_SETUP_CALLBACK callback function A minifilter driver can register a routine of type PFLT_INSTANCE_SETUP_CALLBACK as the minifilter driver's InstanceSetupCallback routine.
PFLT_INSTANCE_TEARDOWN_CALLBACK callback A minifilter driver can register two routines of type PFLT_INSTANCE_TEARDOWN_CALLBACK as the minifilter driver's InstanceTeardownStartCallback and InstanceTeardownCompleteCallback routines.
PFLT_NORMALIZE_CONTEXT_CLEANUP callback function A minifilter driver that provides file names for the filter manager's name cache can register a routine of type PFLT_NORMALIZE_CONTEXT_CLEANUP as the minifilter driver's NormalizeContextCleanupCallback routine.
PFLT_NORMALIZE_NAME_COMPONENT callback function A minifilter driver that provides file names for the filter manager's name cache can register a routine of type PFLT_NORMALIZE_NAME_COMPONENT as the minifilter driver's NormalizeNameComponentCallback routine.
PFLT_NORMALIZE_NAME_COMPONENT_EX callback function A minifilter driver that provides file names for the filter manager's name cache can register a routine of type PFLT_NORMALIZE_NAME_COMPONENT_EX as the minifilter driver's NormalizeNameComponentExCallback callback routine.
PFLT_POST_OPERATION_CALLBACK callback A minifilter driver can register one or more routines of type PFLT_POST_OPERATION_CALLBACK to perform completion processing for I/O operations.
PFLT_PRE_OPERATION_CALLBACK callback A minifilter driver's PFLT_PRE_OPERATION_CALLBACK routine performs pre-operation processing for I/O operations.
PFLT_SECTION_CONFLICT_NOTIFICATION_CALLBACK callback function A minifilter driver can optionally register a routine of type PFLT_CONTEXT_ALLOCATE_CALLBACK as the minifilter driver's SectionNotificationCallback routine.
PFLT_TRANSACTION_NOTIFICATION_CALLBACK callback function A minifilter driver can register a routine of type PFLT_TRANSACTION_NOTIFICATION_CALLBACK as its TransactionNotificationCallback routine.
PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK callback A file system filter driver (legacy filter) or a minifilter driver can register a PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK-typed routine as the filter driver's CleanupCallback callback routine for an extra create parameter (ECP) context structure.
PMRX_CALLDOWN callback function This callback is called by RDBSS to request that the network mini-redirector perform an action based in the supplied IRP.
PMRX_CALLDOWN_CTX callback function TheMRxStart routine is called by RDBSS to start the network mini-redirector.
PMRX_CHANGE_BUFFERING_STATE_CALLDOWN callback function TheMRxCompleteBufferingStateChangeRequest routine is called by RDBSS to notify the network mini-redirector that a buffering state change request has been completed.
PMRX_CHKDIR_CALLDOWN callback function TheMRxIsValidDirectory routine is called by RDBSS to request that a network mini-redirector check for the existence of a remote directory.
PMRX_CHKFCB_CALLDOWN callback function The MRxAreFilesAliased routine is called by RDBSS to request the network mini-redirector to determine if two FCB structures represent the same file.
PMRX_COMPUTE_NEW_BUFFERING_STATE callback function TheMRxComputeNewBufferingState routine is called by RDBSS to request that the network mini-redirector compute a new buffering state change.
PMRX_CREATE_SRVCALL callback function The MRxCreateSrvCall routine is called by RDBSS to request that the network mini-redirector create an SRV_CALL structure and establish connection with a server.
PMRX_CREATE_V_NET_ROOT callback function The MRxCreateVNetRoot routine is called by RDBSS to request that the network mini-redirector create a V_NET_ROOT structure and, in some cases, a NET_ROOT structure.
PMRX_DEALLOCATE_FOR_FCB callback function The MRxDeallocateForFcb routine is called by RDBSS to request that the network mini-redirector deallocate an FCB structure. This call is in response to a request to close a file system object.
PMRX_DEALLOCATE_FOR_FOBX callback function The MRxDeallocateForFobx routine is called by RDBSS to request that the network mini-redirector deallocate an FOBX structure. This call is in response to a request to close a file system object.
PMRX_EXTENDFILE_CALLDOWN callback function The MRxExtendForCache routine is called by RDBSS to request that a network mini-redirector extend a file when the file is being cached by the cache manager.
PMRX_EXTRACT_NETROOT_NAME callback function The MRxExtractNetRootName routine is called by RDBSS to request that a network mini-redirector extract the name of the NET_ROOT structure from a given pathname.
PMRX_FINALIZE_NET_ROOT_CALLDOWN callback function The MRxFinalizeNetRoot routine is called by RDBSS to request that a network mini-redirector finalize a NET_ROOT structure.
PMRX_FINALIZE_SRVCALL_CALLDOWN callback function The MRxFinalizeSrvCall routine is called by RDBSS to request that a network mini-redirector finalize an SRV_CALL structure.
PMRX_FINALIZE_V_NET_ROOT_CALLDOWN callback function The MRxFinalizeVNetRoot routine is called by RDBSS to request that a network mini-redirector finalize a V_NET_ROOT structure.
PMRX_FORCECLOSED_CALLDOWN callback function The MRxForceClosed routine is called by RDBSS to request that a network mini-redirector force a close. This routine is called when the condition of the SRV_OPEN structure is not good or the SRV_OPEN structure is marked as closed.
PMRX_GET_CONNECTION_ID callback function TheMRxGetConnectionId routine is called by RDBSS to request that a network mini-redirector return a connection ID, which can be used for handling multiple sessions.
PMRX_IS_LOCK_REALIZABLE callback function The MRxIsLockRealizable routine is called by RDBSS to request that a network mini-redirector indicate whether a specific byte-range lock is supported on this NET_ROOT structure.
PMRX_PREPARSE_NAME callback function The MRxPreparseName routine is called by RDBSS to give a network mini-redirector the opportunity to preparse a name.
PMRX_SRVCALL_WINNER_NOTIFY callback function The MRxSrvCallWinnerNotify routine is called by RDBSS to notify a network mini-redirector that it was chosen when multiple redirectors could fulfill the request.

Structures

Title Description
MARK_HANDLE_INFO32 structure Contains information that is used to mark a specified file or directory, and its update sequence number (USN) change journal record with data about changes.
_ACCESS_ALLOWED_ACE structure The ACCESS_ALLOWED_ACE structure defines an access-control entry (ACE) for the discretionary access-control list (DACL) that controls access to an object.
_ACCESS_DENIED_ACE structure The ACCESS_DENIED_ACE structure defines an access-control entry (ACE) for the discretionary access-control list (DACL) controlling access to an object.
_ACE_HEADER structure The ACE_HEADER structure describes the type and size of an access-control entry (ACE).
_ATOMIC_CREATE_ECP_CONTEXT structure This structure allows supplemental operations to be performed on a file atomically during create.
_BOOT_AREA_INFO structure The BOOT_AREA_INFO structure contains the output for the FSCTL_GET_BOOT_AREA_INFO control code.
_ECP_OPEN_PARAMETERS structure The ECP_OPEN_PARAMETERS structure allows a caller to specify the purpose of opening of a file without interfering with existing handles and/or oplocks on the file.
_FILE_ALLOCATION_INFORMATION structure The FILE_ALLOCATION_INFORMATION structure is used to set the allocation size for a file.
_FILE_BOTH_DIR_INFORMATION structure The FILE_BOTH_DIR_INFORMATION structure is used to query detailed information for the files in a directory.
_FILE_COMPLETION_INFORMATION structure The FILE_COMPLETION_INFORMATION structure contains the port handle and key for an I/O completion port created for a file handle.
_FILE_COMPRESSION_INFORMATION structure The FILE_COMPRESSION_INFORMATION structure describes the state of a compressed data buffer.
_FILE_DIRECTORY_INFORMATION structure The FILE_DIRECTORY_INFORMATION structure is used to query detailed information for the files in a directory.
_FILE_FS_ATTRIBUTE_INFORMATION structure The FILE_FS_ATTRIBUTE_INFORMATION structure is used to query attribute information for a file system.
_FILE_FS_CONTROL_INFORMATION structure The FILE_FS_CONTROL_INFORMATION structure is used to query or set control information for the files in a directory.
_FILE_FS_DRIVER_PATH_INFORMATION structure The FILE_FS_DRIVER_PATH_INFORMATION structure is used to query whether a given driver is in the I/O path for a file system volume.
_FILE_FS_PERSISTENT_VOLUME_INFORMATION structure The FILE_FS_PERSISTENT_VOLUME_INFORMATION structure is used to control persistent settings for a file system volume. Persistent settings persist on a file system volume between reboots of the computer.
_FILE_FULL_DIR_INFORMATION structure The FILE_FULL_DIR_INFORMATION structure is used to query detailed information for the files in a directory.
_FILE_GET_EA_INFORMATION structure The FILE_GET_EA_INFORMATION structure is used to query for extended-attribute (EA) information.
_FILE_GET_QUOTA_INFORMATION structure The FILE_GET_QUOTA_INFORMATION structure is used to query for quota information.
_FILE_ID_BOTH_DIR_INFORMATION structure The FILE_ID_BOTH_DIR_INFORMATION structure is used to query file reference number information for the files in a directory.
_FILE_ID_EXTD_BOTH_DIR_INFORMATION structure The FILE_ID_EXTD_BOTH_DIR_INFORMATION structure is used to query file reference number information for the files in a directory.
_FILE_ID_FULL_DIR_INFORMATION structure The FILE_ID_FULL_DIR_INFORMATION structure is used to query detailed information for the files in a directory.
_FILE_ID_GLOBAL_TX_DIR_INFORMATION structure The FILE_ID_GLOBAL_TX_DIR_INFORMATION structure contains information about transactional visibility for the files in a directory.
_FILE_INTERNAL_INFORMATION structure The FILE_INTERNAL_INFORMATION structure is used to query for the file system's 8-byte file reference number for a file.
_FILE_LEVEL_TRIM structure The FILE_LEVEL_TRIM structure contains an array of byte ranges to trim for a file.
_FILE_LEVEL_TRIM_OUTPUT structure The FILE_LEVEL_TRIM_OUTPUT structure contains the results of a trim operation performed by an FSCTL_FILE_LEVEL_TRIM request.
_FILE_LEVEL_TRIM_RANGE structure Contains the offset and length of a trim range for a file.
_FILE_LINKS_INFORMATION structure The FILE_LINKS_INFORMATION structure is used to query NTFS hard links to an existing file.
_FILE_LINK_ENTRY_INFORMATION structure The FILE_LINK_ENTRY_INFORMATION structure describes a single NTFS hard link to an existing file.
_FILE_LINK_INFORMATION structure The FILE_LINK_INFORMATION structure is used to create an NTFS hard link to an existing file.
_FILE_MAILSLOT_QUERY_INFORMATION structure The FILE_MAILSLOT_QUERY_INFORMATION structure contains information about a mailslot.
_FILE_MAILSLOT_SET_INFORMATION structure The FILE_MAILSLOT_SET_INFORMATION structure is used to set a value on a mailslot.
_FILE_NAMES_INFORMATION structure A FILE_NAMES_INFORMATION structure used to query detailed information about the names of files in a directory.
_FILE_NETWORK_PHYSICAL_NAME_INFORMATION structure Contains the full UNC physical pathname for a file or directory on a remote file share.
_FILE_OBJECTID_INFORMATION structure The FILE_OBJECTID_INFORMATION structure is used to query for object ID information for the files in a directory on an NTFS volume.
_FILE_PIPE_INFORMATION structure The FILE_PIPE_INFORMATION structure contains information about a named pipe that is not specific to the local or the remote end of the pipe.
_FILE_PIPE_LOCAL_INFORMATION structure The FILE_PIPE_LOCAL_INFORMATION structure contains information about the local end of a named pipe.
_FILE_PIPE_REMOTE_INFORMATION structure The FILE_PIPE_REMOTE_INFORMATION structure contains information about the remote end of a named pipe.
_FILE_PROVIDER_EXTERNAL_INFO_V0 structure This structure may be altered or unavailable. Instead, use FILE_PROVIDER_EXTERNAL_INFO_V1.
_FILE_PROVIDER_EXTERNAL_INFO_V1 structure The FILE_PROVIDER_EXTERNAL_INFO_V1 structure defines metadata specific to files provided by WOF_PROVIDER_FILE.
_FILE_QUOTA_INFORMATION structure The FILE_QUOTA_INFORMATION structure is used to query or set per-user quota information for each of the files in a directory.
_FILE_RENAME_INFORMATION structure The FILE_RENAME_INFORMATION structure is used to rename a file.
_FILE_REPARSE_POINT_INFORMATION structure The FILE_REPARSE_POINT_INFORMATION structure is used to query for information about a reparse point.
_FILE_STREAM_INFORMATION structure The FILE_STREAM_INFORMATION structure is used to enumerate the streams for a file.
_FILE_TIMESTAMPS structure The FILE_TIMESTAMPS structure specifies the last recorded instance of specific actions on a file.
_FILE_ZERO_DATA_INFORMATION structure Contains a range of a file to set to zeros.
_FILE_ZERO_DATA_INFORMATION_EX structure Contains a range of a file to set to zeros.
_FILTER_AGGREGATE_BASIC_INFORMATION structure The FILTER_AGGREGATE_BASIC_INFORMATION structure contains basic information for a minifilter or legacy filter driver.
_FILTER_AGGREGATE_STANDARD_INFORMATION structure The FILTER_AGGREGATE_STANDARD_INFORMATION structure contains information about a minifilter or legacy filter driver.
_FILTER_FULL_INFORMATION structure The FILTER_FULL_INFORMATION structure contains full information for a minifilter driver.
_FILTER_MESSAGE_HEADER structure The FILTER_MESSAGE_HEADER structure contains message header information.
_FILTER_REPLY_HEADER structure The FILTER_REPLY_HEADER structure contains message reply header information.
_FILTER_VOLUME_BASIC_INFORMATION structure The caller-allocated FILTER_VOLUME_BASIC_INFORMATION structure contains basic information for a volume.
_FILTER_VOLUME_STANDARD_INFORMATION structure The caller-allocated FILTER_VOLUME_STANDARD_INFORMATION structure contains information for a volume.
_FLT_CALLBACK_DATA structure The FLT_CALLBACK_DATA structure represents an I/O operation. The Filter Manager and minifilters use this structure to initiate and process I/O operations.
_FLT_CALLBACK_DATA_QUEUE structure FLT_CALLBACK_DATA_QUEUE is an opaque structure that is used to specify the callback routines for a minifilter's callback data queue. Do not set the members of this structure directly. Use FltCbdqInitialize to initialize this structure.
_FLT_CONTEXT_REGISTRATION structure The FLT_CONTEXT_REGISTRATION structure is used to register context types.
_FLT_CREATEFILE_TARGET_ECP_CONTEXT structure The FLT_CREATEFILE_TARGET_ECP_CONTEXT structure is an extra create parameter (ECP) used to return reparse target information back to the caller of FltCreateFileEx2.
_FLT_FILE_NAME_INFORMATION structure The FLT_FILE_NAME_INFORMATION structure contains file name information.
_FLT_IO_PARAMETER_BLOCK structure The FLT_IO_PARAMETER_BLOCK structure contains the parameters for the I/O operation that is represented by a callback data (FLT_CALLBACK_DATA) structure.
_FLT_NAME_CONTROL structure A minifilter that provides file names for the Filter Manager's name cache can use the FLT_NAME_CONTROL structure to manage its name buffers.
_FLT_OPERATION_REGISTRATION structure The FLT_OPERATION_REGISTRATION structure is used to register operation callback routines.
_FLT_PARAMETERS structure The FLT_PARAMETERS union defines the request-type-specific parameters associated with an I/O operation.
_FLT_REGISTRATION structure The FLT_REGISTRATION structure is passed as a parameter to FltRegisterFilter.
_FLT_RELATED_CONTEXTS structure The FLT_RELATED_CONTEXTS structure contains a minifilter driver's contexts for the objects associated with an I/O operation.
_FLT_RELATED_CONTEXTS_EX structure The FLT_RELATED_CONTEXTS_EX structure contains a minifilter driver's contexts for the objects associated with an I/O operation.
_FLT_RELATED_OBJECTS structure The FLT_RELATED_OBJECTS structure contains opaque pointers for the objects associated with an operation.
_FLT_TAG_DATA_BUFFER structure The FLT_TAG_DATA_BUFFER structure contains information about a reparse point tag.
_FLT_VOLUME_PROPERTIES structure The FLT_VOLUME_PROPERTIES structure is passed as a parameter to FltGetVolumeProperties.
_FSCTL_OFFLOAD_READ_INPUT structure The FSCTL_OFFLOAD_READ_INPUT structure contains the input for the FSCTL_OFFLOAD_READ control code request.
_FSCTL_OFFLOAD_READ_OUTPUT structure The FSCTL_OFFLOAD_READ_OUTPUT structure contains the output for the FSCTL_OFFLOAD_READ control code request.
_FSCTL_OFFLOAD_WRITE_INPUT structure The FSCTL_OFFLOAD_WRITE_INPUT structure contains the input for the FSCTL_OFFLOAD_WRITE control code request.
_FSCTL_OFFLOAD_WRITE_OUTPUT structure The FSCTL_OFFLOAD_WRITE_OUTPUT structure contains the output for the FSCTL_OFFLOAD_WRITE control code request.
_FSCTL_QUERY_VOLUME_NUMA_INFO_OUTPUT structure The FSCTL_QUERY_VOLUME_NUMA_INFO_OUTPUT structure specifies the Non-Uniform Memory Architecture (NUMA) node the volume resides on.
_FSRTL_ADVANCED_FCB_HEADER structure The FSRTL_ADVANCED_FCB_HEADER structure contains context information that a file system maintains about a file.
_FSRTL_COMMON_FCB_HEADER structure Do not use the FSRTL_COMMON_FCB_HEADER structure outside of the FSRTL_ADVANCED_FCB_HEADER structure.
_FSRTL_PER_FILEOBJECT_CONTEXT structure The opaque FSRTL_PER_FILEOBJECT_CONTEXT structure is used by the operating system to track file system filter-driver-defined context information structures for a file object.
_FSRTL_PER_FILE_CONTEXT structure A legacy file system filter driver can use a FSRTL_PER_FILE_CONTEXT structure to associate driver-specific context information to an open file.
_FSRTL_PER_STREAM_CONTEXT structure The FSRTL_PER_STREAM_CONTEXT structure contains context information that a file system filter driver maintains about a file stream.
_FS_FILTER_SECTION_SYNC_OUTPUT structure The FS_FILTER_SECTION_SYNC_OUTPUT structure contains information describing the attributes of the section that is being created.
_INSTANCE_AGGREGATE_STANDARD_INFORMATION structure The caller-allocated INSTANCE_AGGREGATE_STANDARD_INFORMATION structure contains information for either a minifilter driver instance or a legacy filter driver.
_INSTANCE_BASIC_INFORMATION structure The INSTANCE_BASIC_INFORMATION structure contains basic information for a minifilter instance.
_INSTANCE_FULL_INFORMATION structure The INSTANCE_FULL_INFORMATION structure contains full information for a minifilter instance.
_INSTANCE_PARTIAL_INFORMATION structure The INSTANCE_PARTIAL_INFORMATION structure contains partial information for a minifilter instance.
_IO_PRIORITY_INFO structure The IO_PRIORITY_INFO structure is used to hold thread priority information.
_NETWORK_APP_INSTANCE_ECP_CONTEXT structure The NETWORK_APP_INSTANCE_ECP_CONTEXT structure is an Extra Create Parameter (ECP) and contains an application instance identifier to associate with a file.
_NETWORK_OPEN_ECP_CONTEXT structure The NETWORK_OPEN_ECP_CONTEXT structure is used to interpret network ECP contexts on files.
_NETWORK_OPEN_ECP_CONTEXT_V0 structure The NETWORK_OPEN_ECP_CONTEXT_V0 structure is used to interpret network ECP contexts on files.
_NFS_OPEN_ECP_CONTEXT structure The NFS_OPEN_ECP_CONTEXT structure is used by the Network File System (NFS) server to open files in response to client requests.
_OPEN_REPARSE_LIST structure Points to a list of OPEN_REPARSE_LIST_ENTRY structures that specify the tag and possibly GUID that should be opened directly without returning STATUS_REPARSE.
_OPEN_REPARSE_LIST_ENTRY structure This structure supports callers opening specific reparse points without inhibiting reparse behavior for all classes of reparse points.
_PREFETCH_OPEN_ECP_CONTEXT structure The PREFETCH_OPEN_ECP_CONTEXT structure communicates whether the prefetcher performs a given open request on a file.
_PUBLIC_OBJECT_BASIC_INFORMATION structure The PUBLIC_OBJECT_BASIC_INFORMATION structure holds a subset of the full information that is available for an object.
_QUERY_FILE_LAYOUT_INPUT structure The QUERY_FILE_LAYOUT_INPUT structure selects which file layout entries are returned from a FSCTL_QUERY_FILE_LAYOUT request.
_QUERY_FILE_LAYOUT_OUTPUT structure The QUERY_FILE_LAYOUT_OUTPUT structure serves as a header for the file layout entries that are returned from a FSCTL_QUERY_FILE_LAYOUT request.
_REFS_SMR_VOLUME_GC_PARAMETERS structure The REFS_SMR_VOLUME_GC_PARAMETERS structure.
_REFS_SMR_VOLUME_INFO_OUTPUT structure The REFS_SMR_VOLUME_INFO_OUTPUT structure describes a Shingled Magnetic Recording (SMR) volume's current state on space and garbage collection activities.
_REPARSE_DATA_BUFFER structure The REPARSE_DATA_BUFFER structure contains reparse point data for a Microsoft reparse point.
_REPARSE_GUID_DATA_BUFFER structure The REPARSE_GUID_DATA_BUFFER structure contains reparse point data for a reparse point.
_RX_CONTEXT structure The RX_CONTEXT structure encapsulates an IRP for use by RDBSS, network mini-redirectors, and the file system.
_SECURITY_DESCRIPTOR structure The SECURITY_DESCRIPTOR structure contains the security information associated with an object. Drivers use this structure to set and query an object's security status.
_SET_DAX_ALLOC_ALIGNMENT_HINT_INPUT structure This structure is for internal use only and should not be called from your code.
_SE_EXPORTS structure The SeExports structure is a large external static SE_EXPORTS structure that defines a number of well-known security constants for privilege values and security identifiers.
_SE_SID structure The SE_SID union holds the maximum-sized valid Security Identifier (SID). The structure occupies 68-bytes and is suitable for stack allocation.
_SE_TOKEN_USER structure The SE_TOKEN_USER structure holds the maximum-sized valid user SID that can be returned by SeQueryInformationToken, GetTokenInformation, or ZwQueryInformationToken with the TokenUser information class. This structure is suitable for stack allocation.
_SID structure The security identifier (SID) structure is a variable-length structure used to uniquely identify users or groups.
_SID_AND_ATTRIBUTES structure The SID_AND_ATTRIBUTES structure represents a security identifier (SID) and its attributes. SIDs are used to uniquely identify users or groups.
_SID_IDENTIFIER_AUTHORITY structure The SID_IDENTIFIER_AUTHORITY structure represents the top-level authority of a security identifier (SID).
_SRV_OPEN_ECP_CONTEXT structure The SRV_OPEN_ECP_CONTEXT structure is used by a server to conditionally open files in response to client requests.
_SYSTEM_ALARM_ACE structure Reserved for future use.
_SYSTEM_AUDIT_ACE structure The SYSTEM_AUDIT_ACE structure defines an access-control entry (ACE) for the system access-control list (ACL) specifying what types of access cause system-level notifications.
_SYSTEM_PROCESS_TRUST_LABEL_ACE structure Reserved.
_SYSTEM_RESOURCE_ATTRIBUTE_ACE structure The SYSTEM_RESOURCE_ATTRIBUTE_ACE structure defines an access-control entry (ACE) for the system access-control list (ACL) specifying what rights a particular claim has to a resource.
_SYSTEM_SCOPED_POLICY_ID_ACE structure The SYSTEM_SCOPED_POLICY_ID_ACE structure defines an access-control entry (ACE) for the system access-control list (ACL) specifying rights for a scoped policy identifer.
_TOKEN_CONTROL structure The TOKEN_CONTROL structure contains information that identifies an access token.
_TOKEN_DEFAULT_DACL structure The TOKEN_DEFAULT_DACL structure specifies a discretionary access-control list (DACL).
_TOKEN_GROUPS structure TOKEN_GROUPS contains information about the group security identifiers (SID) in an access token.
_TOKEN_GROUPS_AND_PRIVILEGES structure TOKEN_GROUPS_AND_PRIVILEGES contains information about the group security identifiers (SIDs) and privileges in an access token.
_TOKEN_ORIGIN structure The TOKEN_ORIGIN structure contains information about the origin of the logon session.
_TOKEN_OWNER structure TOKEN_OWNER contains the default owner security identifier (SID) that will be applied to newly created objects.
_TOKEN_PRIMARY_GROUP structure TOKEN_PRIMARY_GROUP specifies a group security identifier (SID) for an access token.
_TOKEN_PRIVILEGES structure TOKEN_PRIVILEGES contains information about a set of privileges for an access token.
_TOKEN_SOURCE structure TOKEN_SOURCE identifies the source of an access token.
_TOKEN_STATISTICS structure TOKEN_STATISTICS contains information about an access token. A driver can retrieve this information by calling SeQueryInformationToken or ZwQueryInformationToken.
_TOKEN_USER structure TOKEN_USER identifies the user associated with an access token.
_WIM_PROVIDER_ADD_OVERLAY_INPUT structure A new Windows Image File (WIM) data source is added to the WIM provider with the WIM_PROVIDER_ADD_OVERLAY_INPUT structure.
_WIM_PROVIDER_EXTERNAL_INFO structure The WIM_PROVIDER_EXTERNAL_INFO structure holds the identifier and status information for the Windows Image File (WIM) external backing provider.
_WIM_PROVIDER_OVERLAY_ENTRY structure Contains the a Windows Image Format (WIM) file configuration information for a data source entry. It is used to identify specific WIM file names and indices that supply data to externally backed files on a volume.
_WIM_PROVIDER_REMOVE_OVERLAY_INPUT structure A Windows Image File (WIM) data source to remove from the WIM provider is specified in the WIM_PROVIDER_REMOVE_OVERLAY_INPUT structure.
_WIM_PROVIDER_SUSPEND_OVERLAY_INPUT structure A Windows Image File (WIM) data source to suspend from the WIM provider is specified in the WIM_PROVIDER_SUSPEND_OVERLAY_INPUT structure.
_WIM_PROVIDER_UPDATE_OVERLAY_INPUT structure A current Windows Image File (WIM) data source is updated with a new WIM file using the FSCTL_UPDATE_OVERLAY control request with a WIM_PROVIDER_UPDATE_OVERLAY_INPUT structure.
_WOF_EXTERNAL_FILE_ID structure The WOF_EXTERNAL_FILE_ID structure contains a file ID that is used to open a handle to a mini-filter or driver.
_WOF_EXTERNAL_INFO structure The WOF_EXTERNAL_INFO structure identifies a file backing provider and the overlay service version it supports.
_WOF_VERSION_INFO structure The WOF_VERSION_INFO structure contains the version corresponding to the driver supporting a given provider.
__PUBLIC_OBJECT_TYPE_INFORMATION structure The PUBLIC_OBJECT_TYPE_INFORMATION structure holds the type name of the object.

Enumerations

Title Description
NETWORK_OPEN_INTEGRITY_QUALIFIER enumeration The NETWORK_OPEN_INTEGRITY_QUALIFIER enumeration type contains values that identify the kind of integrity restriction to attach to a file.
NETWORK_OPEN_LOCATION_QUALIFIER enumeration The NETWORK_OPEN_LOCATION_QUALIFIER enumeration type contains values that identify the kind of location restriction to attach to a file.
_FLT_FILESYSTEM_TYPE enumeration The FLT_FILESYSTEM_TYPE enumeration identifies the type of file system being used on a volume.
_FSRTL_CHANGE_BACKING_TYPE enumeration The FSRTL_CHANGE_BACKING_TYPE enumeration specifies the type of cache or control area that a file object designates.
_OBJECT_INFORMATION_CLASS enumeration The OBJECT_INFORMATION_CLASS enumeration type represents the type of information to supply about an object.
_REFS_SMR_VOLUME_GC_ACTION enumeration The REFS_SMR_VOLUME_GC_ACTION enum contains the available garbage collection commands for FSCTL_SET_REFS_SMR_VOLUME_GC_PARAMETERS.
_REFS_SMR_VOLUME_GC_METHOD enumeration The REFS_SMR_VOLUME_GC_METHOD enum specifies the garbage collection method or strategy for FSCTL_SET_REFS_SMR_VOLUME_GC_PARAMETERS.
_REFS_SMR_VOLUME_GC_STATE enumeration The REFS_SMR_VOLUME_GC_STATE enum specifies the garbage collection's current state.
_SID_NAME_USE enumeration The SID_NAME_USE enumeration type contains values that specify the type of a security identifier (SID).
_TOKEN_INFORMATION_CLASS enumeration The TOKEN_INFORMATION_CLASS enumeration type contains values that specify the type of information being assigned to or retrieved from an access token.
_TOKEN_TYPE enumeration The TOKEN_TYPE enumeration type contains values that differentiate between a primary token and an impersonation token.

I/O control codes

Title Description
IOCTL_REDIR_QUERY_PATH IOCTL The IOCTL_REDIR_QUERY_PATH control code is sent by the multiple UNC provider (MUP) to network redirectors to determine which provider can handle a specific UNC path in a name-based operation, typically an IRP_MJ_CREATE request.
IOCTL_REDIR_QUERY_PATH_EX IOCTL The IOCTL_REDIR_QUERY_PATH_EX control code is sent by the multiple UNC provider (MUP) on Windows Vista or later to network redirectors to determine which provider can handle a specific UNC path in a name-based operation, typically an IRP_MJ_CREATE request.
IOCTL_VOLSNAP_FLUSH_AND_HOLD_WRITES IOCTL The IOCTL_VOLSNAP_FLUSH_AND_HOLD_WRITES control code is sent to force a flush of a file system before a volume shadow copy occurs.

Macros

Title Description
FltAcquirePushLockExclusive macro The FltAcquirePushLockExclusive routine acquires the given push lock for exclusive access by the calling thread.
FltAcquirePushLockShared macro The FltAcquirePushLockShared routine acquires the given push lock for shared access by the calling thread.
FltReleasePushLock macro The FltReleasePushLock routine releases a specified push lock owned by the current thread.
FsRtlAllocatePoolWithQuotaTag macro The FsRtlAllocatePoolWithQuotaTag routine allocates pool memory, charging quota against the current process.
FsRtlAllocatePoolWithTag macro The FsRtlAllocatePoolWithTag routine allocates pool memory.
FsRtlAreThereCurrentFileLocks macro The FsRtlAreThereCurrentFileLocks macro checks whether any byte range locks exist for the specified file.
FsRtlCheckOplock macro The FsRtlCheckOplock routine synchronizes the IRP for a file I/O operation with the file's current opportunistic lock (oplock) state.
FsRtlCompleteRequest macro The FsRtlCompleteRequest macro completes an IRP with the specified status.
FsRtlFastLock macro The FsRtlFastLock macro is used by file systems and filter drivers to request a byte-range lock for a file stream.
FsRtlGetPerStreamContextPointer macro The FsRtlGetPerStreamContextPointer macro returns the file system's stream context for a file stream.
FsRtlInitPerStreamContext macro The FsRtlInitPerStreamContext macro initializes a filter driver context structure.
FsRtlIsAnsiCharacterLegal macro The FsRtlIsAnsiCharacterLegal macro determines whether a character is a legal ANSI character.
FsRtlIsAnsiCharacterLegalFat macro The FsRtlIsAnsiCharacterLegalFat macro determines whether an ANSI character is legal for FAT file names.
FsRtlIsAnsiCharacterLegalHpfs macro The FsRtlIsAnsiCharacterLegalHpfs macro determines whether an ANSI character is legal for HPFS file names.
FsRtlIsAnsiCharacterLegalNtfs macro The FsRtlIsAnsiCharacterLegalNtfs macro determines whether an ANSI character is legal for NTFS file names.
FsRtlIsAnsiCharacterLegalNtfsStream macro The FsRtlIsAnsiCharacterLegalNtfsStream macro determines whether an ANSI character is legal for NTFS stream names.
FsRtlIsAnsiCharacterWild macro The FsRtlIsAnsiCharacterWild macro determines whether an ANSI character is a wildcard character.
FsRtlIsLeadDbcsCharacter macro The FsRtlIsLeadDbcsCharacter macro determines whether a character is a lead byte (the first byte of a character) in a double-byte character set (DBCS).
FsRtlIsUnicodeCharacterWild macro The FsRtlIsUnicodeCharacterWild macro determines whether a Unicode character is a wildcard character.
FsRtlLookupPerStreamContext macro The FsRtlLookupPerStreamContext macro retrieves a per-stream context structure for a file stream.
FsRtlNotifyFullChangeDirectory macro The FsRtlNotifyFullChangeDirectory routine creates a notify structure for a notification request and adds it to the specified notify list.
FsRtlOplockIsFastIoPossible macro FsRtlOplockIsFastIoPossible checks a file's opportunistic lock (oplock) state to determine whether fast I/O can be performed on the file.
FsRtlSetupAdvancedHeaderEx macro The FsRtlSetupAdvancedHeaderEx macro is used by file systems to initialize an FSRTL_ADVANCED_FCB_HEADER structure for use with both stream and file contexts.
FsRtlSupportsPerFileContexts macro The FsRtlSupportsPerFileContexts macro checks if per file context information is supported by the file system that is associated with a specified FILE_OBJECT.
FsRtlTestAnsiCharacter macro The FsRtlTestAnsiCharacter macro determines whether an ANSI or double-byte character set (DBCS) character meets the specified criteria.
IoIsFileOpenedExclusively macro Reserved for system use.
IoSetTopLevelIrp macro The IoSetTopLevelIrp routine sets the value of the TopLevelIrp field of the current thread.
IsReparseTagMicrosoft macro The IsReparseTagMicrosoft macro determines whether a reparse point tag indicates a Microsoft reparse point.
IsReparseTagNameSurrogate macro The IsReparseTagNameSurrogate macro determines whether a tag's associated reparse point is a surrogate for another named entity, such as a volume mount point.
IsReparseTagValid macro Reserved for system use.
RtlFillMemoryUlonglong macro The RtlFillMemoryUlonglong routine fills a given range of memory with one or more repetitions of a given ULONGLONG value.
RtlOemStringToCountedUnicodeSize macro The RtlOemStringToCountedUnicodeSize routine determines the size, in bytes, that a given OEM string will be after it is translated into a counted Unicode string.
RtlOemStringToUnicodeSize macro The RtlOemStringToUnicodeSize routine determines the size, in bytes, that a given OEM string will be after it is translated into a null-terminated Unicode string.
RtlUnicodeStringToOemSize macro The RtlUnicodeStringToOemSize routine determines the size, in bytes, that a given Unicode string will be after it is translated into an OEM string.
SeDeleteClientSecurity macro The SeDeleteClientSecurity routine deletes a client security context.
SeLengthSid macro Obsolete.
SeQuerySubjectContextToken macro The SeQuerySubjectContextToken macro retrieves the access token for a security subject context.

IOCTLs

Title Description
IOCTL_REDIR_QUERY_PATH The IOCTL_REDIR_QUERY_PATH control code is sent by the multiple UNC provider (MUP) to network redirectors to determine which provider can handle a specific UNC path in a name-based operation, typically an IRP_MJ_CREATE request.
IOCTL_REDIR_QUERY_PATH_EX The IOCTL_REDIR_QUERY_PATH_EX control code is sent by the multiple UNC provider (MUP) on Windows Vista or later to network redirectors to determine which provider can handle a specific UNC path in a name-based operation, typically an IRP_MJ_CREATE request.
IOCTL_VOLSNAP_FLUSH_AND_HOLD_WRITES The IOCTL_VOLSNAP_FLUSH_AND_HOLD_WRITES control code is sent to force a flush of a file system before a volume shadow copy occurs.

Enumerations

Title Description
_FLT_FILESYSTEM_TYPE The FLT_FILESYSTEM_TYPE enumeration identifies the type of file system being used on a volume.
_FSRTL_CHANGE_BACKING_TYPE The FSRTL_CHANGE_BACKING_TYPE enumeration specifies the type of cache or control area that a file object designates.
_OBJECT_INFORMATION_CLASS The OBJECT_INFORMATION_CLASS enumeration type represents the type of information to supply about an object.
_REFS_SMR_VOLUME_GC_ACTION The REFS_SMR_VOLUME_GC_ACTION enum contains the available garbage collection commands for FSCTL_SET_REFS_SMR_VOLUME_GC_PARAMETERS.
_REFS_SMR_VOLUME_GC_METHOD The REFS_SMR_VOLUME_GC_METHOD enum specifies the garbage collection method or strategy for FSCTL_SET_REFS_SMR_VOLUME_GC_PARAMETERS.
_REFS_SMR_VOLUME_GC_STATE The REFS_SMR_VOLUME_GC_STATE enum specifies the garbage collection's current state.
_SID_NAME_USE The SID_NAME_USE enumeration type contains values that specify the type of a security identifier (SID).
_TOKEN_INFORMATION_CLASS The TOKEN_INFORMATION_CLASS enumeration type contains values that specify the type of information being assigned to or retrieved from an access token.
_TOKEN_TYPE The TOKEN_TYPE enumeration type contains values that differentiate between a primary token and an impersonation token.
NETWORK_OPEN_INTEGRITY_QUALIFIER The NETWORK_OPEN_INTEGRITY_QUALIFIER enumeration type contains values that identify the kind of integrity restriction to attach to a file.
NETWORK_OPEN_LOCATION_QUALIFIER The NETWORK_OPEN_LOCATION_QUALIFIER enumeration type contains values that identify the kind of location restriction to attach to a file.
_DIRECTORY_NOTIFY_INFORMATION_CLASS A value that specifies which structure to use to query or set information for a files in a directory.
_FILE_INFORMATION_CLASS A value that specifies which structure to use to query or set information for a file object.
_FSINFOCLASS The FS_INFORMATION_CLASS enumeration contains the information class constants that specify what type of information structure is present for a set or a query operation.
_LOCK_OPERATION The LOCK_OPERATION enumeration specifies the type of access that is appropriate for a type of I/O operation.
_SECURITY_IMPERSONATION_LEVEL The SECURITY_IMPERSONATION_LEVEL enumeration type contains values that specify security impersonation levels. Security impersonation levels govern the degree to which a server process can act on behalf of a client process.

Functions

Title Description
RxCreateNetFcb RxCreateNetFCB allocates, initializes, and inserts a new FCB structure into the in-memory data structures for a V_NET_ROOT that this FCB is being opened on. The structure allocated has space for a SRV_OPEN and an FOBX structure.
RxCreateNetFobx RxCreateNetFobx allocates, initializes, and inserts a new file object extension (FOBX) structure into the in-memory data structures for a FCB that this FOBX is being opened on.
RxCreateNetRoot RxCreateNetRoot allocates and initializes a NET_ROOT structure and inserts the name into the net name table on the associated device object.
RxCreateSrvCall RxCreateSrvCall builds a SRV_CALL structure and inserts the name into the net name table maintained by RDBSS.
RxCreateSrvOpen RxCreateSrvOpen allocates, initializes, and inserts a new SRV_OPEN structure into the in-memory data structures used by RDBSS. If a new structure has to be allocated, it has space for an FOBX structure.
RxCreateVNetRoot RxCreateVNetRoot allocates and initializes a NET_ROOT structure and inserts the name into the net name table on the associated device object.
RxFinalizeNetFobx RxFinalizeNetFOBX finalizes the given FOBX structure. The caller must have an exclusive lock on the FCB associated with FOBX structure.
RxFinalizeNetRoot RxFinalizeNetRoot finalizes the given NET_ROOT structure. The caller must have an exclusive lock on the netname table associated with the device object.
RxFinalizeSrvCall RxFinalizeSrvCall finalizes the given SRV_CALL structure. The caller must have an exclusive lock on the netname table associated with the device object.
RxFinalizeSrvOpen RxFinalizeSrvOpen finalizes the given SRV_OPEN structure. The caller must have an exclusive lock on the FCB associated with the SRV_OPEN and either a shared or exclusive lock on the table lock of the NET_ROOT associated with the FCB.
RxFinalizeVNetRoot RxFinalizeVNetRoot finalizes the given V_NET_ROOT structure. The caller must have an exclusive lock on the netname table associated with the device object.
RxFinishFcbInitialization RxFinishFcbInitialization is used to finish initializing an FCB after the successful completion of a create operation by the network mini-redirector.
RxGetFileSizeWithLock RxGetFileSizeWithLock gets the file size in the FCB structure using a lock to ensure that the 64-bit value is read consistently.
RxInferFileType RxInferFileType tries to infer the file type (directory or non-directory) from a member in the RX_CONTEXT structure.
RxpDereferenceAndFinalizeNetFcb RxpDereferenceAndFinalizeNetFcb decrements the reference count and finalizes an FCB structure.
RxpDereferenceNetFcb RxpDereferenceNetFcb decrements the reference count on an FCB structure.
RxpReferenceNetFcb RxpReferenceNetFcb increments the reference count on an FCB.
RxpTrackDereference RxpTrackDereference is used in checked builds to track requests to dereference SRV_CALL, NET_ROOT, V_NET_ROOT, FOBX, FCB, and SRV_OPEN structures in checked builds. A log of these dereference requests can be accessed by the logging system and WMI.
RxpTrackReference RxpTrackReference tracks requests to reference SRV_CALL, NET_ROOT, V_NET_ROOT, FOBX, FCB, and SRV_OPEN structures in checked builds. A log of these reference requests can be accessed by the logging system and WMI.
FltAcknowledgeEcp The FltAcknowledgeEcp routine is used to mark an extra create parameter context structure (ECP) as acknowledged.
FltAcquirePushLockExclusive The FltAcquirePushLockExclusive routine acquires the given push lock for exclusive access by the calling thread.
FltAcquirePushLockShared The FltAcquirePushLockShared routine acquires the given push lock for shared access by the calling thread.
FltAddOpenReparseEntry This routine adds a caller allocated open reparse structure, OPEN_REPARSE_LIST_ENTRY, into a create operation.
FltAdjustDeviceStackSizeForIoRedirection The FltAdjustDeviceStackSizeForIoRedirection routine increases the size of the source device stack to allow a minifilter to redirect I/O from a specified source instance to a specified target instance when the target stack is deeper than the source stack.
FltAllocateCallbackData FltAllocateCallbackData allocates a callback data structure that a minifilter driver can use to initiate an I/O request.
FltAllocateCallbackDataEx The FltAllocateCallbackDataEx routine allocates a callback data structure and can preallocate memory for additional structures that a minifilter driver can use to initiate an I/O request.
FltAllocateContext The FltAllocateContext routine allocates a context structure for a specified context type.
FltAllocateDeferredIoWorkItem FltAllocateDeferredIoWorkItem allocates a deferred-I/O work item.
FltAllocateExtraCreateParameter The FltAllocateExtraCreateParameter routine allocates paged memory pool for a user-defined extra create parameter (ECP) context structure and generates a pointer to that structure.
FltAllocateExtraCreateParameterFromLookasideList The FltAllocateExtraCreateParameterFromLookasideList routine allocates memory pool from a given lookaside list for an extra create parameter (ECP) context structure and generates a pointer to that structure.
FltAllocateExtraCreateParameterList The FltAllocateExtraCreateParameterList routine allocates paged pool memory for an extra create parameter (ECP) list structure and generates a pointer to that structure.
FltAllocateFileLock The FltAllocateFileLock routine allocates and initializes a new FILE_LOCK structure.
FltAllocateGenericWorkItem FltAllocateGenericWorkItem allocates a generic work item.
FltAllocatePoolAlignedWithTag FltAllocatePoolAlignedWithTag allocates a device-aligned buffer for use in a noncached I/O operation.
FltApplyPriorityInfoThread The FltApplyPriorityInfoThread routine is used by a minifilter driver to apply priority information to a thread.
FltAttachVolume FltAttachVolume creates a new minifilter driver instance and attaches it to the given volume.
FltAttachVolumeAtAltitude FltAttachVolumeAtAltitude is a debugging support routine that attaches a minifilter driver instance to a volume at a specified altitude, overriding any settings in the minifilter driver's INF file.
FltBuildDefaultSecurityDescriptor FltBuildDefaultSecurityDescriptor builds a default security descriptor for use with FltCreateCommunicationPort.
FltCancelFileOpen A minifilter driver can use the FltCancelFileOpen routine to close a newly opened or created file.
FltCancelIo The FltCancelIo routine cancels an I/O operation.
FltCancellableWaitForMultipleObjects The FltCancellableWaitForMultipleObjects executes a cancelable wait operation (a wait that can be terminated) on one or more dispatcher objects.
FltCancellableWaitForSingleObject The FltCancellableWaitForSingleObject routine executes a cancelable wait operation (a wait that can be terminated) on a dispatcher object.
FltCbdqDisable FltCbdqDisable disables a minifilter driver's callback data queue.
FltCbdqEnable FltCbdqEnable enables a callback data queue that was disabled by a previous call to FltCbdqDisable.
FltCbdqInitialize FltCbdqInitialize initializes a minifilter driver's callback data queue dispatch table.
FltCbdqInsertIo FltCbdqInsertIo inserts the callback data structure for an I/O operation into a minifilter driver's callback data queue.
FltCbdqRemoveIo FltCbdqRemoveIo removes a particular item from a minifilter driver's callback data queue.
FltCbdqRemoveNextIo FltCbdqRemoveNextIo removes the next matching item in a minifilter driver's callback data queue.
FltCheckAndGrowNameControl The FltCheckAndGrowNameControl routine checks whether the buffer in a FLT_NAME_CONTROL structure is large enough to hold the specified number of bytes. If not, FltCheckAndGrowNameControl replaces it with a larger system-allocated buffer.
FltCheckLockForReadAccess The FltCheckLockForReadAccess routine determines whether the caller has read access to a locked byte range of a file.
FltCheckLockForWriteAccess The FltCheckLockForWriteAccess routine determines whether the caller has write access to a locked byte range of a file.
FltCheckOplock A minifilter driver calls FltCheckOplock to synchronize the callback data structure for an IRP-based file I/O operation with the file's current opportunistic lock (oplock) state.
FltCheckOplockEx A minifilter driver calls the FltCheckOplockEx routine to synchronize the callback data structure for an IRP-based file I/O operation that has the current opportunistic lock (oplock) state of the file.
FltClearCallbackDataDirty The FltClearCallbackDataDirty routine clears the callback dirty flag in a callback data structure.
FltClearCancelCompletion FltClearCancelCompletion clears a cancel routine that was specified for an I/O operation.
FltClose FltClose closes a file handle that was opened by FltCreateFile or FltCreateFileEx.
FltCloseClientPort FltCloseClientPort closes a communication client port.
FltCloseCommunicationPort FltCloseCommunicationPort closes a minifilter driver's communication server port.
FltCloseSectionForDataScan The FltCloseSectionForDataScan routine closes a section object associated with a file stream.
FltCommitComplete The FltCommitComplete routine acknowledges a TRANSACTION_NOTIFY_COMMIT notification.
FltCommitFinalizeComplete The FltCommitFinalizeComplete routine acknowledges a TRANSACTION_NOTIFY_COMMIT_FINALIZE notification.
FltCompareInstanceAltitudes FltCompareInstanceAltitudes compares the altitudes of two minifilter driver instances.
FltCompletePendedPostOperation FltCompletePendedPostOperation resumes completion processing for an I/O operation that was pended in a minifilter driver's postoperation callback routine.
FltCompletePendedPreOperation FltCompletePendedPreOperation resumes processing for an I/O operation that was pended in a minifilter driver's preoperation callback (PFLT_PRE_OPERATION_CALLBACK) routine.
FltCopyOpenReparseList This routine copies any open reparse information from a previous create into a new ECP list that can be used to issue a second create.
FltCreateCommunicationPort FltCreateCommunicationPort creates a communication server port on which a minifilter driver can receive connection requests from user-mode applications.
FltCreateFile Minifilter drivers call FltCreateFile to create a new file or open an existing file.
FltCreateFileEx Minifilter drivers call FltCreateFileEx to create a new file or open an existing file.
FltCreateFileEx2 Minifilter drivers call FltCreateFileEx2 to create a new file or open an existing file. This routine also includes an optional create context parameter.
FltCreateMailslotFile Minifilter drivers call FltCreateMailslotFile to create a new pipe or open an existing mailslot.
FltCreateNamedPipeFile Minifilter drivers call FltCreateNamedPipeFile to create a new pipe or open an existing pipe.
FltCreateSectionForDataScan The FltCreateSectionForDataScan routine creates a section object for a file. The filter manager can optionally synchronize I/O with the section created.
FltCreateSystemVolumeInformationFolder FltCreateSystemVolumeInformationFolder verifies the existence of the "System Volume Information" folder on a file system volume. If the folder is not present, then the folder is created.
FltCurrentBatchOplock A minifilter driver calls FltCurrentBatchOplock to determine whether there are any batch or filter opportunistic locks (oplocks) on a file.
FltCurrentOplock A minifilter driver calls the FltCurrentOplock routine to determine whether there are any opportunistic locks (oplocks) on a file.
FltCurrentOplockH A minifilter driver calls the FltCurrentOplockH routine to determine whether there are any CACHE_HANDLE_LEVEL opportunistic locks (oplocks) on a file.
FltDecodeParameters FltDecodeParameters returns pointers to the memory descriptor list (MDL) address, buffer pointer, buffer length, and desired access parameters for an I/O operation.
FltDeleteContext FltDeleteContext marks a specified context for deletion.
FltDeleteExtraCreateParameterLookasideList The FltDeleteExtraCreateParameterLookasideList routine frees an extra create parameter (ECP) lookaside list.
FltDeleteFileContext The FltDeleteFileContext routine retrieves and deletes a file context that a given minifilter driver has set for a given file.
FltDeleteInstanceContext FltDeleteInstanceContext removes a context from a given instance and marks the context for deletion.
FltDeletePushLock The FltDeletePushLock routine deletes a given push lock.
FltDeleteStreamContext FltDeleteStreamContext removes a context that a given minifilter driver instance has set for a given stream and marks the context for deletion.
FltDeleteStreamHandleContext FltDeleteStreamHandleContext removes a context that a given minifilter driver instance has set for a given stream handle and marks the context for deletion.
FltDeleteTransactionContext The FltDeleteTransactionContext routine removes a context from a given transaction and marks the context for deletion.
FltDeleteVolumeContext FltDeleteVolumeContext removes a context that a given minifilter driver has set for a given volume and marks the context for deletion.
FltDetachVolume FltDetachVolume detaches a minifilter driver instance from a volume.
FltDeviceIoControlFile FltDeviceIoControlFile sends a control code directly to a specified device driver, causing the corresponding driver to perform the specified action.
FltDoCompletionProcessingWhenSafe If it is safe to do so, the FltDoCompletionProcessingWhenSafe function executes a minifilter driver postoperation callback routine.
FltEnlistInTransaction The FltEnlistInTransaction routine enlists a minifilter driver in a given transaction.
FltEnumerateFilterInformation The FltEnumerateFilterInformation routine provides information about all the registered filter drivers (including minifilter and legacy filter drivers) in the system.
FltEnumerateFilters The FltEnumerateFilters routine enumerates all registered minifilter drivers in the system.
FltEnumerateInstanceInformationByDeviceObject The FltEnumerateInstanceInformationByDeviceObject routine provides information about minifilter driver instances and legacy filter drivers that are attached to the volume related to a specified device object.
FltEnumerateInstanceInformationByFilter The FltEnumerateInstanceInformationByFilter routine provides information about instances of a given minifilter driver.
FltEnumerateInstanceInformationByVolume The FltEnumerateInstanceInformationByVolume routine provides information about minifilter driver instances and legacy filter drivers (Windows Vista only) that are attached to a given volume.
FltEnumerateInstanceInformationByVolumeName The FltEnumerateInstanceInformationByVolumeName routine provides information about minifilter driver instances and legacy filter drivers that are attached to the volume with the specified name.
FltEnumerateInstances The FltEnumerateInstances routine enumerates minifilter driver instances for a given minifilter driver or volume.
FltEnumerateVolumeInformation The FltEnumerateVolumeInformation routine provides information about volumes that are known to the filter manager.
FltEnumerateVolumes The FltEnumerateVolumes routine enumerates all volumes in the system.
FltFastIoMdlRead The FltFastIoMdlRead routine returns a memory descriptor list (MDL) that points directly to the specified byte range in the file cache.
FltFastIoMdlReadComplete The FltFastIoMdlReadComplete routine completes the read operation that the FltFastIoMdlRead routine initiated.
FltFastIoMdlWriteComplete The FltFastIoMdlWriteComplete routine frees the resources that FltFastIoPrepareMdlWrite allocated.
FltFastIoPrepareMdlWrite The FltFastIoPrepareMdlWrite routine returns a linked list of memory descriptor lists (MDLs) that point to the specified range of cached file data to write data directly to the cache.
FltFindExtraCreateParameter The FltFindExtraCreateParameter routine searches a given ECP list for an ECP context structure of a given type and returns a pointer to this structure if it is found.
FltFlushBuffers The FltFlushBuffers routine is used by the minifilter driver to send a flush request for a given file to the file system.
FltFreeCallbackData The FltFreeCallbackData routine frees a callback data structure allocated by the FltAllocateCallbackData routine.
FltFreeDeferredIoWorkItem The FltFreeDeferredIoWorkItem routine frees a work item allocated by the FltAllocateDeferredIoWorkItem routine.
FltFreeExtraCreateParameter The FltFreeExtraCreateParameter routine frees the memory for an ECP context structure.
FltFreeExtraCreateParameterList The FltFreeExtraCreateParameterList routine frees an extra create parameter (ECP) list structure.
FltFreeFileLock The FltFreeFileLock routine uninitializes and frees an initialized FILE_LOCK structure.
FltFreeGenericWorkItem The FltFreeGenericWorkItem routine frees a work item allocated by the FltAllocateGenericWorkItem routine.
FltFreeOpenReparseList This routine deallocates any information copied into a create operation by a previous call to FltCopyOpenReparseList.
FltFreePoolAlignedWithTag The FltFreePoolAlignedWithTag routine frees a cache-aligned buffer that was allocated by a previous call to FltAllocatePoolAlignedWithTag.
FltFreeSecurityDescriptor FltFreeSecurityDescriptor frees a security descriptor allocated by the FltBuildDefaultSecurityDescriptor routine.
FltFsControlFile The FltFsControlFile routine sends a control code directly to a specified file system or file system filter driver, causing the corresponding driver to perform the specified action.
FltGetActivityIdCallbackData The FltGetActivityIdCallbackData routine retrieves the current activity ID associated with a request in a minifilter's callback data.
FltGetBottomInstance FltGetBottomInstance returns an opaque instance pointer for the minifilter driver instance, if there is one, that is attached at the bottom of the instance stack for a given volume.
FltGetContexts The FltGetContexts routine retrieves a minifilter driver's contexts for the objects related to the current operation.
FltGetContextsEx The FltGetContextsEx routine retrieves a minifilter driver's contexts for the objects related to the current operation.
FltGetDestinationFileNameInformation The FltGetDestinationFileNameInformation routine constructs a full destination path name for a file or directory that is being renamed or for which an NTFS hard link is being created.
FltGetDeviceObject The FltGetDeviceObject routine returns a pointer to the Filter Manager's volume device object (VDO) for a given volume.
FltGetDiskDeviceObject The FltGetDiskDeviceObject routine returns a pointer to the disk device object associated with a given volume.
FltGetEcpListFromCallbackData The FltGetEcpListFromCallbackData routine returns a pointer to an extra create parameter context structure (ECP) list that is associated with a given create operation callback-data object.
FltGetFileContext The FltGetFileContext routine retrieves a context that was set for a file by a given minifilter driver instance.
FltGetFileNameInformation The FltGetFileNameInformation routine returns name information for a file or directory.
FltGetFileNameInformationUnsafe The FltGetFileNameInformationUnsafe routine returns name information for an open file or directory.
FltGetFileSystemType The FltGetFileSystemType function takes a volume or instance object and provides the file system type of the volume.
FltGetFilterFromInstance The FltGetFilterFromInstance routine returns an opaque filter pointer for the minifilter driver that created the given instance.
FltGetFilterFromName The FltGetFilterFromName routine returns an opaque filter pointer for a registered minifilter driver whose name matches the value in the FilterName parameter.
FltGetFilterInformation The FltGetFilterInformation routine provides information about a minifilter driver.
FltGetInstanceContext The FltGetInstanceContext routine retrieves a context that was set for an instance by a given minifilter driver.
FltGetInstanceInformation The FltGetInstanceInformation routine returns information about a minifilter driver instance.
FltGetIoPriorityHint The FltGetIoPriorityHint routine is used by a minifilter driver to get IO priority information from Callback Data.
FltGetIoPriorityHintFromCallbackData The FltGetIoPriorityHintFromCallbackData routine is used by a minifilter driver to get IO priority information from callback data.
FltGetIoPriorityHintFromFileObject The FltGetIoPriorityHintFromFileObject routine is used by a minifilter driver to get IO priority information from a file object.
FltGetIoPriorityHintFromThread The FltGetIoPriorityHintFromThread routine is used by a minifilter driver to get IO priority information from a thread.
FltGetIrpName The FltGetIrpName routine returns the name for a major function code as a printable string.
FltGetLowerInstance The FltGetLowerInstance routine returns an opaque instance pointer for the next lower minifilter driver instance, if there is one, that is attached below a given minifilter driver instance on the same volume.
FltGetNewSystemBufferAddress The FltGetNewSystemBufferAddress function retrieves the AssociatedIrp.SystemBuffer buffer, which the file system has allocated. A minifilter driver's post-callback routine calls this function.
FltGetNextExtraCreateParameter The FltGetNextExtraCreateParameter routine returns a pointer to the next (or first) extra create parameter context structure (ECP) in a given ECP list.
FltGetRequestorProcess The FltGetRequestorProcess routine returns a process pointer for the thread that requested a given I/O operation.
FltGetRequestorProcessId The FltGetRequestorProcessId routine returns the unique 32-bit process ID for the process associated with the thread that requested a given I/O operation.
FltGetRequestorProcessIdEx The FltGetRequestorProcessIdEx routine returns the kernel-mode handle for the process that is associated with the thread that requested a given I/O operation.
FltGetRequestorSessionId The FltGetRequestorSessionId routine returns the session ID of the process that originally requested the specified I/O operation.
FltGetRoutineAddress The FltGetRoutineAddress routine returns a pointer to a routine specified by the FltMgrRoutineName parameter.
FltGetSectionContext The FltGetSectionContext routine retrieves a section context that was created for a file stream by a specified minifilter driver instance.
FltGetStreamContext The FltGetStreamContext routine retrieves a context that was set for a file stream by a given minifilter driver instance.
FltGetStreamHandleContext The FltGetStreamHandleContext routine retrieves a context that was set for a stream handle by a given minifilter driver instance.
FltGetSwappedBufferMdlAddress The FltGetSwappedBufferMdlAddress routine returns the memory descriptor list (MDL) address for a buffer that was swapped in by a minifilter driver.
FltGetTopInstance The FltGetTopInstance routine returns an opaque instance pointer for the minifilter driver instance that is attached at the top of the instance stack for a given volume.
FltGetTransactionContext The FltGetTransactionContext routine retrieves a context that was set for a transaction by a given minifilter driver.
FltGetTunneledName The FltGetTunneledName routine retrieves the tunneled name for a file, given the normalized name returned for the file by a previous call to FltGetFileNameInformation, FltGetFileNameInformationUnsafe, or FltGetDestinationFileNameInformation.
FltGetUpperInstance The FltGetUpperInstance routine returns an opaque instance pointer for the next higher minifilter driver instance, if there is one, that is attached above a given minifilter driver instance on the same volume.
FltGetVolumeContext The FltGetVolumeContext routine retrieves a context that was set for a volume by a given minifilter driver.
FltGetVolumeFromDeviceObject The FltGetVolumeFromDeviceObject routine returns an opaque pointer for the volume represented by a volume device object (VDO).
FltGetVolumeFromFileObject The FltGetVolumeFromFileObject routine returns an opaque pointer for the volume that a given file stream resides on.
FltGetVolumeFromInstance The FltGetVolumeFromInstance routine returns an opaque pointer for the volume that a given minifilter driver instance is attached to.
FltGetVolumeFromName The FltGetVolumeFromName routine returns an opaque pointer for the volume whose name matches the value of the VolumeName parameter.
FltGetVolumeGuidName The FltGetVolumeGuidName routine returns the volume name for a given volume, in volume globally unique identifier (GUID) format.
FltGetVolumeInformation The FltGetVolumeInformation routine provides information about a given volume.
FltGetVolumeInstanceFromName The FltGetVolumeInstanceFromName routine returns an opaque instance pointer for the given minifilter driver instance on the given volume.
FltGetVolumeName The FltGetVolumeName routine gets the volume name for a given volume.
FltGetVolumeProperties The FltGetVolumeProperties routine returns volume property information for the given volume.
FltInitExtraCreateParameterLookasideList The FltInitExtraCreateParameterLookasideList routine initializes a paged or non-paged pool lookaside list used for the allocation of one or more extra create parameter context structures (ECPs) of fixed size.
FltInitializeFileLock The FltInitializeFileLock routine initializes an opaque FILE_LOCK structure that the caller has allocated from paged pool.
FltInitializeOplock The FltInitializeOplock routine initializes an opportunistic lock (oplock) pointer.
FltInitializePushLock The FltInitializePushLock routine initializes a push lock variable.
FltInsertExtraCreateParameter The FltInsertExtraCreateParameter routine inserts an extra create parameter (ECP) context structure into an ECP list.
FltIs32bitProcess The FltIs32bitProcess routine checks whether the originator of the current I/O operation is a 32-bit user-mode application.
FltIsCallbackDataDirty The FltIsCallbackDataDirty routine tests the FLTFL_CALLBACK_DATA_DIRTY flag in a callback data structure.
FltIsDirectory A minifilter driver calls the FltIsDirectory routine to determine whether a given file object represents a directory.
FltIsEcpAcknowledged The FltIsEcpAcknowledged routine is used to determine if a given extra create parameter context structure (ECP) has been marked as acknowledged.
FltIsEcpFromUserMode The FltIsEcpFromUserMode routine is used to determine if an extra create parameter context structure (ECP) originated from user mode.
FltIsFltMgrVolumeDeviceObject The FltIsFltMgrVolumeDeviceObject routine determines whether the given device object belongs to filter manager and if the device object is a volume device object.
FltIsIoCanceled The FltIsIoCanceled routine checks if an IRP-based operation has been canceled.
FltIsIoRedirectionAllowed The FltIsIoRedirectionAllowed routine determines whether I/O can be redirected from the specified source filter instance to another specified filter instance.
FltIsIoRedirectionAllowedForOperation The FltIsIoRedirectionAllowedForOperation routine determines whether I/O can be redirected from the filter instance associated with the specified FLT_CALLBACK_DATA structure to the specified filter instance.
FltIsOperationSynchronous The FltIsOperationSynchronous routine determines whether a given callback data structure (FLT_CALLBACK_DATA) represents a synchronous or asynchronous I/O operation.
FltIsVolumeSnapshot The FltIsVolumeSnapshot routine determines whether a volume or minifilter driver instance is attached to a snapshot volume.
FltIsVolumeWritable The FltIsVolumeWritable routine determines whether the disk device that corresponds to a volume or minifilter driver instance is writable.
FltLoadFilter The FltLoadFilter routine dynamically loads a minifilter driver into the currently running system.
FltLockUserBuffer The FltLockUserBuffer routine locks the user buffer for a given I/O operation.
FltNotifyFilterChangeDirectory The FltNotifyFilterChangeDirectory routine creates a notify structure for an IRP_MN_NOTIFY_CHANGE_DIRECTORY operation and adds it to the specified notify list.
FltObjectDereference The FltObjectDereference routine removes a rundown reference from an opaque filter, instance, or volume pointer.
FltObjectReference The FltObjectReference routine adds a rundown reference to an opaque filter, instance, or volume pointer.
FltOpenVolume The FltOpenVolume routine returns a handle and a file object pointer for the file system volume that a given minifilter driver instance is attached to.
FltOplockBreakH The FltOplockBreakH routine breaks CACHE_HANDLE_LEVEL opportunistic locks (oplocks).
FltOplockBreakToNone The FltOplockBreakToNone routine breaks all opportunistic locks (oplocks) immediately without regard for any oplock key.
FltOplockBreakToNoneEx The FltOplockBreakToNoneEx routine breaks all opportunistic locks (oplocks) immediately without regard for any oplock key.
FltOplockFsctrl The FltOplockFsctrl routine performs various opportunistic lock (oplock) operations on behalf of a minifilter driver.
FltOplockFsctrlEx The FltOplockFsctrlEx routine performs various opportunistic lock (oplock) operations on behalf of a minifilter driver.
FltOplockIsFastIoPossible The FltOplockIsFastIoPossible routine checks a file's opportunistic lock (oplock) state to determine whether fast I/O can be performed on the file.
FltOplockIsSharedRequest The FltOplockIsSharedRequest routine determines if a request for an opportunistic lock (oplock) wants a shared oplock.
FltOplockKeysEqual The FltOplockKeysEqual routine compares the opportunistic lock (oplock) keys that are stored in the file object extensions of two file objects.
FltParseFileName FltParseFileName parses the extension, stream, and final component from a file name string.
FltParseFileNameInformation FltParseFileNameInformation parses the contents of a FLT_FILE_NAME_INFORMATION structure.
FltPerformAsynchronousIo A minifilter driver calls FltPerformAsynchronousIo to initiate an asynchronous I/O operation.
FltPerformSynchronousIo A minifilter driver calls FltPerformSynchronousIo to initiate a synchronous I/O operation after calling FltAllocateCallbackData to allocate a callback data structure for the operation.
FltPrepareComplete The FltPrepareComplete routine acknowledges a TRANSACTION_NOTIFY_PREPARE notification.
FltPrepareToReuseEcp The FltPrepareToReuseEcp routine resets an extra create parameter (ECP) context structure, which prepares it for reuse.
FltPrePrepareComplete The FltPrePrepareComplete routine acknowledges a TRANSACTION_NOTIFY_PREPREPARE notification.
FltProcessFileLock The FltProcessFileLock routine processes and completes a file lock operation.
FltPropagateActivityIdToThread The FltPropagateActivityIdToThread routine associates the activity ID from the IRP in the minifilter's callback data with the current thread.
FltPurgeFileNameInformationCache FltPurgeFileNameInformationCache purges from the Filter Manager's name cache all file name information structures that were generated from names provided by the given minifilter driver instance.
FltQueryDirectoryFile The FltQueryDirectoryFile routine returns various kinds of information about files in the directory specified by a given file object.
FltQueryEaFile FltQueryEaFile returns information about extended-attribute (EA) values for a file.
FltQueryInformationFile FltQueryInformationFile retrieves information for a given file.
FltQueryQuotaInformationFile The FltQueryQuotaInformationFile routine retrieves quota entries associated with a file object.
FltQuerySecurityObject FltQuerySecurityObject retrieves a copy of an object's security descriptor.
FltQueryVolumeInformation The FltQueryVolumeInformation routine retrieves information about the volume that the given instance is attached to.
FltQueryVolumeInformationFile FltQueryVolumeInformationFile retrieves volume information for a given file, directory, storage device, or volume.
FltQueueDeferredIoWorkItem The FltQueueDeferredIoWorkItem routine posts an IRP-based I/O operation to a work queue.
FltQueueGenericWorkItem FltQueueGenericWorkItem posts a work item that is not associated with a specific I/O operation to a work queue.
FltReadFile FltReadFile reads data from an open file, stream, or device.
FltReadFileEx FltReadFileEx reads data from an open file, stream, or device. This function extends FltReadFile to allow the optional use of an MDL for read data instead of a mapped buffer address.
FltReferenceContext FltReferenceContext increments the reference count on a context structure.
FltReferenceFileNameInformation FltReferenceFileNameInformation increments the reference count on a file name information structure.
FltRegisterFilter FltRegisterFilter registers a minifilter driver.
FltRegisterForDataScan The FltRegisterForDataScan routine enables data scanning for the volume attached to the minifilter instance.
FltReissueSynchronousIo FltReissueSynchronousIo initiates a new synchronous I/O operation that uses the parameters from a previously synchronized I/O operation.
FltReleaseContext FltReleaseContext decrements the reference count on a context.
FltReleaseContexts FltReleaseContexts releases each context in a given FLT_RELATED_CONTEXTS structure.
FltReleaseContextsEx FltReleaseContextsEx releases each context in a given FLT_RELATED_CONTEXTS_EX structure.
FltReleaseFileNameInformation FltReleaseFileNameInformation releases a file name information structure.
FltReleasePushLock The FltReleasePushLock routine releases a specified push lock owned by the current thread.
FltRemoveExtraCreateParameter The FltRemoveExtraCreateParameter routine searches an ECP list for an ECP context structure and, if found, detaches it from the ECP list.
FltRemoveOpenReparseEntry This routine removes an OPEN_REPARSE_LIST_ENTRY structure (added by FltAddOpenReparseEntry) from a create operation.
FltRequestOperationStatusCallback FltRequestOperationStatusCallback returns status information for the given I/O operation.
FltRetainSwappedBufferMdlAddress FltRetainSwappedBufferMdlAddress prevents the Filter Manager from freeing the memory descriptor list (MDL) for a buffer that was swapped in by a minifilter driver.
FltRetrieveIoPriorityInfo The FltRetrieveIoPriorityInfo routine is used by a minifilter driver to retrieve priority information from a thread.
FltReuseCallbackData The FltReuseCallbackData routine reinitializes a callback data structure so that it can be reused.
FltRollbackComplete The FltRollbackComplete routine acknowledges a TRANSACTION_NOTIFY_ROLLBACK notification.
FltRollbackEnlistment The FltRollbackEnlistment routine rolls back or aborts a transaction on behalf of a minifilter driver.
FltSendMessage FltSendMessage sends a message to a waiting user-mode application on behalf of a minifilter driver or a minifilter driver instance.
FltSetActivityIdCallbackData The FltSetActivityIdCallbackData routine sets the a activity ID for an IRP in a minifilter's callback data.
FltSetCallbackDataDirty A minifilter driver's preoperation or postoperation callback routine calls FltSetCallbackDataDirty to indicate that it has modified the contents of the callback data structure.
FltSetCancelCompletion A minifilter driver calls FltSetCancelCompletion to specify a cancel routine to be called if a given I/O operation is canceled.
FltSetEaFile FltSetEaFile sets extended-attribute (EA) values for a file.
FltSetEcpListIntoCallbackData The FltSetEcpListIntoCallbackData routine attaches an extra create parameter context structure (ECP) list to a create operation callback-data object.
FltSetFileContext The FltSetFileContext routine sets a context for a file.
FltSetInformationFile FltSetInformationFile sets information for a given file.
FltSetInstanceContext FltSetInstanceContext sets a context for a minifilter driver instance.
FltSetIoPriorityHintIntoCallbackData The FltSetIoPriorityHintIntoCallbackData routine is used by a minifilter driver to set the I/O priority information in callback data.
FltSetIoPriorityHintIntoFileObject The FltSetIoPriorityHintIntoFileObject routine is used by a minifilter driver to set the I/O priority information in a file object.
FltSetIoPriorityHintIntoThread The FltSetIoPriorityHintIntoThread routine is used by a minifilter driver to set the IO priority information in a thread.
FltSetQuotaInformationFile The FltSetQuotaInformationFile routine modifies quota entries for a file object.
FltSetSecurityObject FltSetSecurityObject sets an object's security state.
FltSetStreamContext The FltSetStreamContext routine sets a context for a file stream.
FltSetStreamHandleContext The FltSetStreamHandleContext routine sets a context for a stream handle.
FltSetTransactionContext The FltSetTransactionContext routine sets a context on a transaction.
FltSetVolumeContext FltSetVolumeContext sets a context for a volume.
FltSetVolumeInformation FltSetVolumeInformation changes various kinds of information about the volume that the given instance is attached to.
FltStartFiltering FltStartFiltering starts filtering for a registered minifilter driver.
FltSupportsFileContexts The FltSupportsFileContexts routine determines whether the file system supports file contexts for a given file.
FltSupportsFileContextsEx The FltSupportsFileContextsEx routine determines whether the file system or the filter manager support file contexts for a given file.
FltSupportsStreamContexts FltSupportsStreamContexts determines whether stream contexts are supported on a given file object.
FltSupportsStreamHandleContexts FltSupportsStreamHandleContexts determines whether stream handle contexts are supported on a given file object.
FltTagFile FltTagFile sets a reparse tag on a file or directory.
FltUninitializeFileLock The FltUninitializeFileLock routine uninitializes a FILE_LOCK structure.
FltUninitializeOplock FltUninitializeOplock uninitializes an opportunistic lock (oplock) pointer.
FltUnloadFilter A minifilter driver that has loaded a supporting minifilter driver by calling FltLoadFilter can unload the minifilter driver by calling FltUnloadFilter.
FltUnregisterFilter A registered minifilter driver calls FltUnregisterFilter to unregister itself so that the Filter Manager no longer calls it to process I/O operations.
FltUntagFile FltUntagFile removes a reparse point from a file or directory.
FltWriteFile FltWriteFile is used to write data to an open file, stream, or device.
FltWriteFileEx FltWriteFileEx is used to write data to an open file, stream, or device. This function extends FltWriteFile to allow the optional use of an MDL for write data instead of a mapped buffer address.
PFLT_COMPLETE_LOCK_CALLBACK_DATA_ROUTINE A minifilter driver can register a routine of type PFLT_COMPLETE_LOCK_CALLBACK_DATA_ROUTINE as the minifilter driver's CompleteLockCallbackDataRoutine callback routine for a FILE_LOCK structure.
PFLT_COMPLETED_ASYNC_IO_CALLBACK A minifilter driver that initiates an asynchronous I/O operation can specify a routine of type PFLT_COMPLETED_ASYNC_IO_CALLBACK routine to be called when the operation is completed.
PFLT_CONTEXT_ALLOCATE_CALLBACK A minifilter driver can register a routine of type PFLT_CONTEXT_ALLOCATE_CALLBACK as the minifilter driver's ContextAllocateCallback routine.
PFLT_CONTEXT_CLEANUP_CALLBACK A minifilter driver can register a routine of type PFLT_CONTEXT_CLEANUP_CALLBACK as the minifilter driver's ContextCleanupCallback routine.
PFLT_CONTEXT_FREE_CALLBACK A minifilter can register a routine of type PFLT_CONTEXT_FREE_CALLBACK as the minifilter driver's ContextFreeCallback routine.
PFLT_FILTER_UNLOAD_CALLBACK A minifilter driver can register a routine of type PFLT_FILTER_UNLOAD_CALLBACK as the minifilter driver's FilterUnloadCallback routine.
PFLT_GENERATE_FILE_NAME A minifilter driver that provides file names for the filter manager's name cache can register a routine of type PFLT_GENERATE_FILE_NAME as the minifilter driver's GenerateFileNameCallback routine.
PFLT_GET_OPERATION_STATUS_CALLBACK A minifilter driver can register a routine of type PFLT_GET_OPERATION_STATUS_CALLBACK as the minifilter driver's OperationStatusCallback routine.
PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK A minifilter driver can register a routine of type PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK as the minifilter driver's InstanceQueryTeardownCallback routine.
PFLT_INSTANCE_SETUP_CALLBACK A minifilter driver can register a routine of type PFLT_INSTANCE_SETUP_CALLBACK as the minifilter driver's InstanceSetupCallback routine.
PFLT_INSTANCE_TEARDOWN_CALLBACK A minifilter driver can register two routines of type PFLT_INSTANCE_TEARDOWN_CALLBACK as the minifilter driver's InstanceTeardownStartCallback and InstanceTeardownCompleteCallback routines.
PFLT_NORMALIZE_CONTEXT_CLEANUP A minifilter driver that provides file names for the filter manager's name cache can register a routine of type PFLT_NORMALIZE_CONTEXT_CLEANUP as the minifilter driver's NormalizeContextCleanupCallback routine.
PFLT_NORMALIZE_NAME_COMPONENT A minifilter driver that provides file names for the filter manager's name cache can register a routine of type PFLT_NORMALIZE_NAME_COMPONENT as the minifilter driver's NormalizeNameComponentCallback routine.
PFLT_NORMALIZE_NAME_COMPONENT_EX A minifilter driver that provides file names for the filter manager's name cache can register a routine of type PFLT_NORMALIZE_NAME_COMPONENT_EX as the minifilter driver's NormalizeNameComponentExCallback callback routine.
PFLT_POST_OPERATION_CALLBACK A minifilter driver can register one or more routines of type PFLT_POST_OPERATION_CALLBACK to perform completion processing for I/O operations.
PFLT_PRE_OPERATION_CALLBACK A minifilter driver's PFLT_PRE_OPERATION_CALLBACK routine performs pre-operation processing for I/O operations.
PFLT_SECTION_CONFLICT_NOTIFICATION_CALLBACK A minifilter driver can optionally register a routine of type PFLT_CONTEXT_ALLOCATE_CALLBACK as the minifilter driver's SectionNotificationCallback routine.
PFLT_TRANSACTION_NOTIFICATION_CALLBACK A minifilter driver can register a routine of type PFLT_TRANSACTION_NOTIFICATION_CALLBACK as its TransactionNotificationCallback routine.
RxLowIoCompletion RxLowIoCompletion must be called by the network mini-redirector low I/O routines when they complete, if the low I/O routines have initially returned STATUS_PENDING.
RxLowIoGetBufferAddress RxLowIoGetBufferAddress returns the buffer corresponding to the MDL from LowIoContext structure of an RX_CONTEXT structure.
RxAssociateContextWithMid RxAssociateContextWithMid associates the supplied opaque context with an available multiplex ID (MID) from a MID_ATLAS.
RxCreateMidAtlas RxCreateMidAtlas allocates a new instance of MID_ATLAS data structure and initializes it.
RxDestroyMidAtlas RxDestroyMidAtlas destroys an existing instance of a MID_ATLAS data structure and frees the allocated memory.
RxMapAndDissociateMidFromContext RxMapAndDissociateMidFromContext maps a Multiplex ID (MID) to its associated context in a MID_ATLAS structure and then disassociates the MID from the context.
RxMapMidToContext RxMapMidToContext maps a Multiplex ID (MID) to its associated context in a MID_ATLAS structure.
RxReassociateMid RxReassociateMid reassociates a Multiplex ID (MID) with an alternate context.
__RxFillAndInstallFastIoDispatch RxFillAndInstallFastIoDispatch fills out a fast I/O dispatch vector to be identical with the normal dispatch I/O vector and installs it into the driver object associated with the device object passed.
PMRX_CALLDOWN This callback is called by RDBSS to request that the network mini-redirector perform an action based in the supplied IRP.
PMRX_CALLDOWN_CTX TheMRxStart routine is called by RDBSS to start the network mini-redirector.
PMRX_CHANGE_BUFFERING_STATE_CALLDOWN TheMRxCompleteBufferingStateChangeRequest routine is called by RDBSS to notify the network mini-redirector that a buffering state change request has been completed.
PMRX_CHKDIR_CALLDOWN TheMRxIsValidDirectory routine is called by RDBSS to request that a network mini-redirector check for the existence of a remote directory.
PMRX_CHKFCB_CALLDOWN The MRxAreFilesAliased routine is called by RDBSS to request the network mini-redirector to determine if two FCB structures represent the same file.
PMRX_COMPUTE_NEW_BUFFERING_STATE TheMRxComputeNewBufferingState routine is called by RDBSS to request that the network mini-redirector compute a new buffering state change.
PMRX_CREATE_SRVCALL The MRxCreateSrvCall routine is called by RDBSS to request that the network mini-redirector create an SRV_CALL structure and establish connection with a server.
PMRX_CREATE_V_NET_ROOT The MRxCreateVNetRoot routine is called by RDBSS to request that the network mini-redirector create a V_NET_ROOT structure and, in some cases, a NET_ROOT structure.
PMRX_DEALLOCATE_FOR_FCB The MRxDeallocateForFcb routine is called by RDBSS to request that the network mini-redirector deallocate an FCB structure. This call is in response to a request to close a file system object.
PMRX_DEALLOCATE_FOR_FOBX The MRxDeallocateForFobx routine is called by RDBSS to request that the network mini-redirector deallocate an FOBX structure. This call is in response to a request to close a file system object.
PMRX_EXTENDFILE_CALLDOWN The MRxExtendForCache routine is called by RDBSS to request that a network mini-redirector extend a file when the file is being cached by the cache manager.
PMRX_EXTRACT_NETROOT_NAME The MRxExtractNetRootName routine is called by RDBSS to request that a network mini-redirector extract the name of the NET_ROOT structure from a given pathname.
PMRX_FINALIZE_NET_ROOT_CALLDOWN The MRxFinalizeNetRoot routine is called by RDBSS to request that a network mini-redirector finalize a NET_ROOT structure.
PMRX_FINALIZE_SRVCALL_CALLDOWN The MRxFinalizeSrvCall routine is called by RDBSS to request that a network mini-redirector finalize an SRV_CALL structure.
PMRX_FINALIZE_V_NET_ROOT_CALLDOWN The MRxFinalizeVNetRoot routine is called by RDBSS to request that a network mini-redirector finalize a V_NET_ROOT structure.
PMRX_FORCECLOSED_CALLDOWN The MRxForceClosed routine is called by RDBSS to request that a network mini-redirector force a close. This routine is called when the condition of the SRV_OPEN structure is not good or the SRV_OPEN structure is marked as closed.
PMRX_GET_CONNECTION_ID TheMRxGetConnectionId routine is called by RDBSS to request that a network mini-redirector return a connection ID, which can be used for handling multiple sessions.
PMRX_IS_LOCK_REALIZABLE The MRxIsLockRealizable routine is called by RDBSS to request that a network mini-redirector indicate whether a specific byte-range lock is supported on this NET_ROOT structure.
PMRX_PREPARSE_NAME The MRxPreparseName routine is called by RDBSS to give a network mini-redirector the opportunity to preparse a name.
PMRX_SRVCALL_WINNER_NOTIFY The MRxSrvCallWinnerNotify routine is called by RDBSS to notify a network mini-redirector that it was chosen when multiple redirectors could fulfill the request.
RxFsdDispatch RxFsdDispatch implements the file system driver (FSD) dispatch for RDBSS to process an I/O request packet (IRP).
RxMakeLateDeviceAvailable RxMakeLateDeviceAvailable modifies the device object to make a "late device" available. A late device is one that is not created in the driver's load routine.
RxpUnregisterMinirdr RxpUnregisterMinirdr is called by a network mini-redirector driver to de-register the driver with RDBSS and remove the registration information from the internal RDBSS registration table.
RxRegisterMinirdr RxRegisterMinirdr is called by a network mini-redirector driver to register the driver with RDBSS, which adds the registration information to an internal registration table. RDBSS also builds a device object for the network mini-redirector.
RxSetDomainForMailslotBroadcast RxSetDomainForMailslotBroadcast is called by a network mini-redirector driver to set the domain used for mailslot broadcasts if mailslots are supported by the driver.
RxStartMinirdr RxStartMinirdr is called to start up a network mini-redirector that has previously called to register with RDBSS.
RxStopMinirdr RxStopMinirdr is called to stop a network mini-redirector that has previously been started.
RxAcquireExclusiveFcbResourceInMRx RxAcquireExclusiveFcbResourceInMRx acquires the FCB resource for a network mini-redirector driver in exclusive mode.
RxAcquireSharedFcbResourceInMRx RxAcquireSharedFcbResourceInMRx acquires the FCB resource for a network mini-redirector driver in shared mode.
RxAcquireSharedFcbResourceInMRxEx RxAcquireSharedFcbResourceInMRxEx acquires the FCB resource for a network mini-redirector driver in shared mode.
RxReleaseFcbResourceForThreadInMRx RxReleaseFcbResourceForThreadInMRx releases the FCB resource acquired by a network mini-redirector driver with a particular thread ID.
RxReleaseFcbResourceInMRx RxReleaseFcbResourceInMRx releases the FCB resource acquired by a network mini-redirector driver.
RxNameCacheActivateEntry RxNameCacheActivateEntry takes a name cache entry and updates the expiration time and the network mini-redirector context. It then puts the name cache entry on the active list.
RxNameCacheCheckEntry RxNameCacheCheckEntry checks a name cache entry for validity. A valid entry means that the lifetime has not expired and the MRxContext parameter passes the equality check.
RxNameCacheCreateEntry RxNameCacheCreateEntry allocates and initializes a NAME_CACHE structure with the given name string.
RxNameCacheExpireEntry RxNameCacheExpireEntry puts a NAME_CACHE entry on the free list for recycling.
RxNameCacheExpireEntryWithShortName RxNameCacheExpireEntryWithShortName expires all of the name cache entries whose name prefix matches the given short file name.
RxNameCacheFetchEntry RxNameCacheFetchEntry looks for a match with a specified name string for a NAME_CACHE entry.
RxNameCacheFinalize RxNameCacheFinalize releases the storage for all of the NAME_CACHE entries associated with a NAME_CACHE_CONTROL structure.
RxNameCacheFreeEntry RxNameCacheFreeEntry releases the storage for a NAME_CACHE entry and decrements the count of the NAME_CACHE cache entries associated with a NAME_CACHE_CONTROL structure.
RxNameCacheInitialize RxNameCacheInitialize initializes a name cache (NAME_CACHE_CONTROL structure).
FsRtlIsTotalDeviceFailure The FsRtlIsTotalDeviceFailure routine determines whether a media or other hardware failure has occurred.
IoAttachDeviceToDeviceStackSafe The IoAttachDeviceToDeviceStackSafe routine attaches the caller's device object to the topmost device object in a driver stack.
IoCancelFileOpen The IoCancelFileOpen routine can be used by a file system filter driver to close a file that has been opened by a file system driver in the filter driver's device stack.
IoCreateFileEx The IoCreateFileEx routine either causes a new file or directory to be created, or opens an existing file, device, directory, or volume and gives the caller a handle for the file object.
IoCreateFileSpecifyDeviceObjectHint The IoCreateFileSpecifyDeviceObjectHint routine is used by file system filter drivers to send a create request only to the filters below a specified device object and to the file system.
IoGetOplockKeyContext The IoGetOplockKeyContext routine returns a target oplock key context for a file object.
IoGetOplockKeyContextEx The IoGetOplockKeyContext routine returns a target oplock key context for a file object.
IoGetSiloParameters This routine indicates if a file is within a Container context.
IoGetTransactionParameterBlock The IoGetTransactionParameterBlock routine returns the transaction parameter block for a transacted file operation.
IoInitializeDriverCreateContext The IoInitializeDriverCreateContext routine initializes a caller-allocated variable of type IO_DRIVER_CREATE_CONTEXT.
IoIsFileObjectIgnoringSharing The IoIsFileObjectIgnoringSharing routine determines if a file object is set with the option to ignore file sharing access checks.
IoIsFileOriginRemote The IoIsFileOriginRemote routine determines whether a given file object is for a remote create request.
IoSetFileObjectIgnoreSharing The IoSetFileObjectIgnoreSharing routine sets a file object to ignore file sharing access checks.
IoSetFileOrigin The IoSetFileOrigin routine specifies whether a given file object is for a remote create request.
RtlDelete The RtlDelete routine deletes the specified node from the splay link tree.
RtlDeleteElementGenericTable The RtlDeleteElementGenericTable routine deletes an element from a generic table.
RtlDeleteElementGenericTableAvl The RtlDeleteElementGenericTableAvl routine deletes an element from a generic table.
RtlDeleteNoSplay The RtlDeleteNoSplay routine deletes the specified node from the splay link tree.
RtlDrainNonVolatileFlush The routine RtlDrainNonVolatileFlush waits for the flushes initiated by RtlFlushNonVolatileMemory to finish.
RtlEnumerateGenericTable The RtlEnumerateGenericTable routine is used to enumerate the elements in a generic table.
RtlEnumerateGenericTableAvl The RtlEnumerateGenericTableAvl routine is used to enumerate the elements in a generic table.
RtlEnumerateGenericTableLikeADirectory The RtlEnumerateGenericTableLikeADirectory routine returns the elements of a generic table, one-by-one, in collation order.
RtlEnumerateGenericTableWithoutSplaying The RtlEnumerateGenericTableWithoutSplaying routine is used to enumerate the elements in a generic table.
RtlEnumerateGenericTableWithoutSplayingAvl The RtlEnumerateGenericTableWithoutSplayingAvl routine is used to enumerate the elements in a generic table.
RtlFlushNonVolatileMemory The routine RtlFlushNonVolatileMemory optimally flushes the given non-volatile memory region.
RtlFlushNonVolatileMemoryRanges The routine RtlFlushNonVolatileMemoryRanges optimally flushes the given non-volatile memory regions.
RtlFreeNonVolatileToken The routine RtlFreeNonVolatileToken is a cleanup function for the opaque NvToken which is given by a successful call to RtlGetNonVolatileToken.
RtlGetElementGenericTable The RtlGetElementGenericTable routine returns a pointer to the caller-supplied data for a particular generic table element.
RtlGetElementGenericTableAvl The RtlGetElementGenericTableAvl routine returns a pointer to the caller-supplied data for a particular generic Adelson-Velsky/Landis (AVL) table element.
RtlGetNonVolatileToken The routine, RtlGetNonVolatileToken, gets various properties about a non-volatile memory buffer and stores them in the variable NvToken.
RtlInitializeGenericTable The RtlInitializeGenericTable routine initializes a generic table.
RtlInitializeGenericTableAvl The RtlInitializeGenericTableAvl routine initializes a generic table using Adelson-Velsky/Landis (AVL) trees.
RtlInitializeSplayLinks The RtlInitializeSplayLinks routine initializes a splay link node.
RtlInsertAsLeftChild The RtlInsertAsLeftChild routine inserts a splay link node into the tree as the left child of the specified node.
RtlInsertAsRightChild The RtlInsertAsRightChild routine inserts a given splay link into the tree as the right child of a given node in that tree.
RtlInsertElementGenericTable The RtlInsertElementGenericTable routine adds a new element to a generic table.
RtlInsertElementGenericTableAvl The RtlInsertElementGenericTableAvl routine adds a new entry to a generic table.
RtlInsertElementGenericTableFullAvl The RtlInsertElementGenericTableFullAvl routine adds a new entry to a generic table.
RtlIsGenericTableEmpty The RtlIsGenericTableEmpty routine determines if a generic table is empty.
RtlIsGenericTableEmptyAvl The RtlIsGenericTableEmptyAvl routine determines if a generic table is empty.
RtlIsLeftChild The RtlIsLeftChild routine determines whether a given splay link is the left child of a node in a splay link tree.
RtlIsRightChild The RtlIsRightChild routine determines whether a given splay link is the right child of a node in a splay link tree.
RtlIsRoot The RtlIsRoot routine determines whether the specified node is the root node of a splay link tree.
RtlLeftChild The RtlLeftChild routine returns a pointer to the left child of the specified splay link node.
RtlLookupElementGenericTable The RtlLookupElementGenericTable routine searches a generic table for an element that matches the specified data.
RtlLookupElementGenericTableAvl The RtlLookupElementGenericTableAvl routine searches a generic table for an element that matches the specified data.
RtlLookupElementGenericTableFullAvl The RtlLookupElementGenericTableFullAvl routine searches a generic table for an element that matches the specified data.
RtlLookupFirstMatchingElementGenericTableAvl The RtlLookupFirstMatchingElementGenericTableAvl routine finds the left-most element in the tree that matches the indicated data.
RtlNumberGenericTableElements The RtlNumberGenericTableElements routine returns the number of elements in a generic table.
RtlNumberGenericTableElementsAvl The RtlNumberGenericTableElementsAvl routine returns the number of elements in a generic table.
RtlParent The RtlParent routine returns a pointer to the parent of the specified node in a splay link tree.
RtlRealPredecessor The RtlRealPredecessor routine returns a pointer to the predecessor of the specified node in the splay link tree.
RtlRealSuccessor The RtlRealSuccessor routine returns a pointer to the successor of the specified node in the splay link tree.
RtlRightChild The RtlRightChild routine returns a pointer to the right child of the specified splay link node.
RtlSplay The RtlSplay routine rebalances, or "splays," a splay link tree around the specified splay link, making that link the new root of the tree.
RtlSubtreePredecessor The RtlSubtreePredecessor routine returns a pointer to the predecessor of the specified node within the subtree that is rooted at that node.
RtlSubtreeSuccessor The RtlSubtreeSuccessor routine returns a pointer to the successor of the specified node within the subtree that is rooted at that node.
RtlWriteNonVolatileMemory The routine RtlWriteNonVolatileMemory copies the contents of a source buffer to a non-volatile destination memory buffer.
FsRtlAcquireFileExclusive Reserved for system use.
FsRtlAddLargeMcbEntry The FsRtlAddLargeMcbEntry routine adds a new mapping to an existing map control block (MCB).
FsRtlAddMcbEntry Obsolete.
FsRtlAddToTunnelCache The FsRtlAddToTunnelCache routine caches a file name that is removed from a directory when a file is renamed or deleted.
FsRtlAllocateFileLock The FsRtlAllocateFileLock routine allocates and initializes a new FILE_LOCK structure.
FsRtlAllocateResource Obsolete.
FsRtlAreNamesEqual The FsRtlAreNamesEqual routine determines whether two Unicode strings are equal.
FsRtlAreThereCurrentOrInProgressFileLocks TheFsRtlAreThereCurrentOrInProgressFileLocks routine determines if there are byte range locks assigned to a file or any lock operations in progress for that file.
FsRtlAreThereWaitingFileLocks The FsRtlAreThereWaitingFileLocks routine checks a file lock queue for any waiting file locks.
FsRtlBalanceReads The FsRtlBalanceReads routine signals to a fault-tolerant disk driver that it is now safe to start balancing reads from a mirrored drive.
FsRtlCheckLockForOplockRequest The FsRtlCheckLockForOplockRequest routine checks for locks within the allocation size of a file. The file lock object is checked for the presence of byte range locks that would prevent an oplock request from being granted.
FsRtlCheckLockForReadAccess The FsRtlCheckLockForReadAccess routine determines whether the process associated with a given IRP has read access to a locked region of a file.
FsRtlCheckLockForWriteAccess The FsRtlCheckLockForWriteAccess routine determines whether the process associated with a given IRP has write access to a locked region of a file.
FsRtlCheckOplock The FsRtlCheckOplock routine synchronizes the IRP for a file I/O operation with the file's current opportunistic lock (oplock) state.
FsRtlCheckOplockEx The FsRtlCheckOplockEx routine synchronizes the IRP for a file I/O operation with the current opportunistic lock (oplock) state of the file.
FsRtlCheckUpperOplock The FsRtlCheckUpperOplock routine provides opportunistic lock (oplock) checking in secondary, or layered, file systems when the oplocks they hold change state.
FsRtlCopyRead The FsRtlCopyRead routine copies data from a cached file to a user buffer.
FsRtlCopyWrite The FsRtlCopyWrite routine copies data from a user buffer to a cached file.
FsRtlCurrentBatchOplock A file system or filter driver calls FsRtlCurrentBatchOplock to determine whether there are any batch or filter opportunistic locks (oplocks) on a file.
FsRtlCurrentOplock A file system or filter driver calls FsRtlCurrentOplock to determine whether there are any opportunistic locks (oplocks) on a file.
FsRtlCurrentOplockH A file system or filter driver calls FsRtlCurrentOplockH to determine whether there are any CACHE_HANDLE_LEVEL opportunistic locks (oplocks) on a file.
FsRtlDeleteKeyFromTunnelCache The FsRtlDeleteKeyFromTunnelCache routine deletes any tunnel cache entries for files in a directory that is being deleted.
FsRtlDeleteTunnelCache The FsRtlDeleteTunnelCache routine deletes a tunnel cache.
FsRtlDissectDbcs Given an ANSI or double-byte character set (DBCS) pathname string, the FsRtlDissectDbcs routine returns two strings:_one containing the first file name found in the string, the other containing the remaining unparsed portion of the pathname string.
FsRtlDissectName Given a Unicode pathname string, the FsRtlDissectName routine returns two strings, one containing the first file name found in the string, the other containing the remaining unparsed portion of the pathname string.
FsRtlDoesDbcsContainWildCards The FsRtlDoesDbcsContainWildCards routine determines whether an ANSI or double-byte character set (DBCS) string contains wildcard characters.
FsRtlDoesNameContainWildCards The FsRtlDoesNameContainWildCards routine determines whether a Unicode string contains wildcard characters.
FsRtlFastCheckLockForRead The FsRtlFastCheckLockForRead routine determines whether the specified process has read access to a locked byte range of a file.
FsRtlFastCheckLockForWrite The FsRtlFastCheckLockForWrite routine determines whether the specified process has write access to a locked byte range of a file.
FsRtlFastUnlockAll The FsRtlFastUnlockAll routine releases all byte-range locks that were acquired by the specified process for a file.
FsRtlFastUnlockAllByKey The FsRtlFastUnlockAllByKey routine releases all byte-range locks that were acquired by the specified process, with the specified key value, for a file.
FsRtlFastUnlockSingle The FsRtlFastUnlockSingle routine releases a byte-range lock that was acquired by the specified process, with the specified key value, file offset, and length, for a file.
FsRtlFindInTunnelCache The FsRtlFindInTunnelCache routine searches for a matching entry in the tunnel cache that matches the specified name.
FsRtlFreeFileLock The FsRtlFreeFileLock routine uninitializes and frees a file lock structure.
FsRtlGetFileSize The FsRtlGetFileSize routine is used to get the size of a file.
FsRtlGetNextFileLock The FsRtlGetNextFileLock routine is used to enumerate the byte-range locks that currently exist for a specified file.
FsRtlGetNextLargeMcbEntry The FsRtlGetNextLargeMcbEntry routine retrieves a mapping run from a map control block (MCB).
FsRtlGetNextMcbEntry Obsolete.
FsRtlInitializeFileLock The FsRtlInitializeFileLock routine initializes a FILE_LOCK structure.
FsRtlInitializeLargeMcb The FsRtlInitializeLargeMcb routine initializes a map control block (MCB) structure.
FsRtlInitializeMcb Obsolete.
FsRtlInitializeOplock FsRtlInitializeOplock initializes an opportunistic lock (oplock) pointer.
FsRtlInitializeTunnelCache The FsRtlInitializeTunnelCache routine initializes a new tunnel cache for a volume.
FsRtlIsDbcsInExpression The FsRtlIsDbcsInExpression routine determines whether an ANSI or double-byte character set (DBCS) string matches the specified pattern.
FsRtlIsFatDbcsLegal The FsRtlIsFatDbcsLegal routine determines whether the specified ANSI or double-byte character set (DBCS) string is a legal FAT file name.
FsRtlIsHpfsDbcsLegal The FsRtlIsHpfsDbcsLegal routine determines whether the specified ANSI or double-byte character set (DBCS) string is a legal HPFS file name.
FsRtlIsNameInExpression The FsRtlIsNameInExpression routine determines whether a Unicode string matches the specified pattern.
FsRtlIsNtstatusExpected The FsRtlIsNtstatusExpected routine determines whether the specified exception is handled by the exception filter.
FsRtlIsTotalDeviceFailure The FsRtlIsTotalDeviceFailure routine determines whether a media or other hardware failure has occurred.
FsRtlLookupLargeMcbEntry Given a virtual block number (VBN) and a map control block (MCB), the FsRtlLookupLargeMcbEntry routine searches the MCB for mapping information corresponding to the specified VBN.
FsRtlLookupLastLargeMcbEntry The FsRtlLookupLastLargeMcbEntry routine retrieves the last mapping entry stored in the map control block (MCB).
FsRtlLookupLastLargeMcbEntryAndIndex The FsRtlLookupLastLargeMcbEntryAndIndex routine retrieves the last mapping entry stored in a given map control block (MCB).
FsRtlLookupLastMcbEntry Obsolete.
FsRtlLookupMcbEntry Obsolete.
FsRtlMdlReadCompleteDev The FltFastIoMdlReadComplete routine completes the read operation that the FltFastIoMdlRead routine initiated.
FsRtlMdlReadDev The FltFastIoMdlRead routine returns a memory descriptor list (MDL) that points directly to the specified byte range in the file cache.
FsRtlMdlReadEx The FsRtlMdlReadEx routine performs a fast cached MDL read. If the requested data is not cached, the routine reverts to an IRP based MDL read operation.
FsRtlMdlWriteCompleteDev The FltFastIoMdlWriteComplete routine frees the resources that FltFastIoPrepareMdlWrite allocated.
FsRtlNormalizeNtstatus The FsRtlNormalizeNtstatus routine translates an arbitrary exception into a status value that is handled by the exception filter.
FsRtlNotifyCleanup When the last handle to a file object is released, the FsRtlNotifyCleanup routine removes the file object's notify structure, if present, from the specified notify list.
FsRtlNotifyCleanupAll The FsRtlNotifyCleanupAll routine removes all members of the specified notification list.
FsRtlNotifyFilterChangeDirectory The FsRtlNotifyFilterChangeDirectory routine creates a notify structure for an IRP_MN_NOTIFY_CHANGE_DIRECTORY request and adds it to the specified notify list.
FsRtlNotifyFilterReportChange FsRtlNotifyFilterReportChange completes IRP_MN_NOTIFY_CHANGE_DIRECTORY requests that are pending in the specified notify list.
FsRtlNotifyFullChangeDirectory The FsRtlNotifyFullChangeDirectory routine creates a notify structure for a notification request and adds it to the specified notify list.
FsRtlNotifyFullReportChange The FsRtlNotifyFullReportChange routine completes pending notify change IRPs.
FsRtlNotifyInitializeSync The FsRtlNotifyInitializeSync routine allocates and initializes a synchronization object for a notify list.
FsRtlNotifyUninitializeSync The FsRtlNotifyUninitializeSync routine deallocates the synchronization object for a notify list.
FsRtlNotifyVolumeEvent The FsRtlNotifyVolumeEvent routine notifies any registered applications that a volume event is occurring.
FsRtlNotifyVolumeEventEx The FsRtlNotifyVolumeEventEx routine notifies any registered applications that a volume event is occurring. Volume events include the volume being locked, unlocked, mounted, or made read-only.
FsRtlNumberOfRunsInLargeMcb The FsRtlNumberOfRunsInLargeMcb routine returns the number of runs in a map control block (MCB).
FsRtlNumberOfRunsInMcb Obsolete.
FsRtlOplockBreakH The FsRtlOplockBreakH routine breaks CACHE_HANDLE_LEVEL opportunistic locks (oplocks).
FsRtlOplockBreakToNone Obsolete.
FsRtlOplockBreakToNoneEx The FsRtlOplockBreakToNoneEx routine breaks all opportunistic locks (oplocks) immediately without regard for any oplock key.
FsRtlOplockFsctrl FsRtlOplockFsctrl performs various opportunistic lock (oplock) operations on behalf of a file system or filter driver.
FsRtlOplockFsctrlEx The FsRtlOplockFsctrlEx routine performs various opportunistic lock (oplock) operations on behalf of a file system or filter driver.
FsRtlOplockIsFastIoPossible FsRtlOplockIsFastIoPossible checks a file's opportunistic lock (oplock) state to determine whether fast I/O can be performed on the file.
FsRtlOplockIsSharedRequest The FsRtlOplockIsSharedRequest routine determines if a request for an opportunistic lock (oplock) wants a shared oplock.
FsRtlOplockKeysEqual The FsRtlOplockKeysEqual routine compares the opportunistic lock (oplock) keys that are stored in the file object extensions of two file objects.
FsRtlPostPagingFileStackOverflow The FsRtlPostPagingFileStackOverflow routine posts a paging file stack overflow item to the stack overflow thread.
FsRtlPostStackOverflow The FsRtlPostStackOverflow routine posts a stack overflow item to the stack overflow thread.
FsRtlPrepareMdlWriteDev The FltFastIoPrepareMdlWrite routine returns a linked list of memory descriptor lists (MDLs) that point to the specified range of cached file data to write data directly to the cache.
FsRtlPrepareMdlWriteEx The FsRtlPrepareMdlWriteEx routine returns a linked list of memory descriptor lists (MDLs) that point to the specified range of cached file data to write data directly to the cache.
FsRtlPrivateLock Obsolete.
FsRtlProcessFileLock The FsRtlProcessFileLock routine processes and completes an IRP for a file lock operation.
FsRtlRegisterUncProvider The FsRtlRegisterUncProvider routine registers a network redirector as a universal naming convention (UNC) provider with the system multiple UNC provider (MUP).
FsRtlRegisterUncProviderEx The FsRtlRegisterUncProviderEx routine registers a network redirector as a universal naming convention (UNC) provider with the system multiple UNC provider (MUP).
FsRtlReleaseFile Reserved for system use.
FsRtlRemoveLargeMcbEntry The FsRtlRemoveLargeMcbEntry routine removes one or more mappings from a map control block (MCB).
FsRtlRemoveMcbEntry Obsolete.
FsRtlResetLargeMcb The FsRtlResetLargeMcb routine truncates a map control block (MCB) structure to contain zero mapping pairs. It does not shrink the mapping pairs array.
FsRtlSplitLargeMcb The FsRtlSplitLargeMcb routine inserts a hole into the mappings in a map control block (MCB).
FsRtlTruncateLargeMcb The FsRtlTruncateLargeMcb routine truncates a large map control block (MCB).
FsRtlTruncateMcb Obsolete.
FsRtlUninitializeFileLock The FsRtlUninitializeFileLock routine uninitializes a FILE_LOCK structure.
FsRtlUninitializeLargeMcb The FsRtlUninitializeLargeMcb routine uninitializes a large map-control block (MCB).
FsRtlUninitializeMcb Obsolete.
FsRtlUninitializeOplock FsRtlUninitializeOplock uninitializes an opportunistic lock (oplock) pointer.
FsRtlUpperOplockFsctrl The FsRtlUpperOplockFsctrl routine processes opportunistic lock (oplock) requests and acknowledgments for secondary, or layered, file systems.
CcCanIWrite The CcCanIWrite routine determines whether the caller can write to a cached file.
CcCoherencyFlushAndPurgeCache The CcCoherencyFlushAndPurgeCache routine flushes and/or purges the cache to ensure cache coherency.
CcCopyRead The CcCopyRead routine copies data from a cached file to a user buffer.
CcCopyReadEx The CcCopyReadEx routine copies data from a cached file to a user buffer. The I/O byte count for the operation is charged to the issuing thread.
CcCopyWrite The CcCopyWrite routine copies data from a user buffer to a cached file.
CcCopyWriteEx The CcCopyWriteEx routine copies data from a user buffer to a cached file. The I/O byte count for the operation is charged to the issuing thread.
CcCopyWriteWontFlush The CcCopyWriteWontFlush macro determines whether the amount of data to be copied in a call to CcCopyWrite is small enough not to require immediate flushing to disk if CcCopyWrite is called with Wait set to FALSE.
CcDeferWrite The CcDeferWrite routine defers writing to a cached file.
CcFastCopyRead The CcFastCopyRead routine performs a fast copy read from a cached file to a buffer in memory.
CcFastCopyWrite The CcFastCopyWrite routine performs a fast copy write from a buffer in memory to a cached file.
CcFlushCache The CcFlushCache routine flushes all or a portion of a cached file to disk.
CcGetDirtyPages The CcGetDirtyPages routine searches for dirty pages in all files that match a given log handle.
CcGetFileObjectFromBcb Given a pointer to a pinned buffer control block (BCB) for a file, the CcGetFileObjectFromBcb routine returns a pointer to the file object that the cache manager is using for that file.
CcGetFileObjectFromSectionPtrs Given a pointer to the section object pointers for a cached file, the CcGetFileObjectFromSectionPtrs routine returns a pointer to the file object that the cache manager is using for the file.
CcGetFileObjectFromSectionPtrsRef When passed a pointer to a SECTION_OBJECT_POINTERS structure for a cached file, the CcGetFileObjectFromSectionPtrsRef routine returns a pointer to the file object that the cache manager is using for the cached file.
CcGetFlushedValidData The CcGetFlushedValidData routine determines how much of a cached file has been flushed to disk.
CcInitializeCacheMap File systems call the CcInitializeCacheMap routine to cache a file.
CcIsThereDirtyData The CcIsThereDirtyData routine determines whether a mounted volume contains any files that have dirty data in the system cache.
CcIsThereDirtyDataEx The CcIsThereDirtyDataEx routine determines whether a volume contains any files that have dirty data in the system cache.
CcMapData The CcMapData routine maps a specified byte range of a cached file to a buffer in memory.
CcMdlReadComplete The CcMdlReadComplete routine frees the memory descriptor lists (MDL) created by CcMdlRead for a cached file.
CcMdlWriteAbort The CcMdlWriteAbort routine frees memory descriptor lists (MDL) created by an earlier call to CcPrepareMdlWrite.
CcMdlWriteComplete The CcMdlWriteComplete routine frees the memory descriptor lists (MDL) created by CcPrepareMdlWrite for a cached file.
CcPinMappedData The CcPinMappedData routine pins the specified byte range of a cached file.
CcPinRead The CcPinRead routine pins the specified byte range of a cached file and reads the pinned data into a buffer in memory.
CcPrepareMdlWrite The CcPrepareMdlWrite routine provides direct access to cached file memory so that the caller can write data to the file.
CcPreparePinWrite The CcPreparePinWrite routine pins the specified byte range of a cached file for write access.
CcPurgeCacheSection The CcPurgeCacheSection routine purges all or a portion of a cached file from the system cache.
CcRemapBcb The CcRemapBcb routine maps a buffer control block (BCB) an additional time to preserve it through several calls that perform additional maps and unpins.
CcRepinBcb The CcRepinBcb routine pins a buffer control block (BCB) an additional time to prevent it from being freed by a subsequent call to CcUnpinData.
CcScheduleReadAhead The CcScheduleReadAhead routine performs read-ahead (also called "lazy read") on a cached file. CcScheduleReadAhead should never be called directly. The CcReadAhead macro should be called instead.
CcScheduleReadAheadEx The CcScheduleReadAheadEx routine performs read-ahead (also called "lazy read") on a cached file. The I/O byte count for the operation is charged to the issuing thread.
CcSetAdditionalCacheAttributes Call the CcSetAdditionalCacheAttributes routine to enable or disable read-ahead (also called "lazy read") or write-behind (also called "lazy write") on a cached file.
CcSetAdditionalCacheAttributesEx Call the CcSetAdditionalCacheAttributesEx routine to enable extended cache behavior on a cached file.
CcSetBcbOwnerPointer The CcSetBcbOwnerPointer routine sets the owner thread pointer for a pinned buffer control block (BCB).
CcSetDirtyPageThreshold The CcSetDirtyPageThreshold routine sets a per-file dirty page threshold on a cached file.
CcSetDirtyPinnedData The CcSetDirtyPinnedData routine marks as dirty the buffer control block (BCB) for a pinned buffer whose contents have been modified.
CcSetFileSizes The CcSetFileSizes routine updates the cache maps and section object for a cached file whose size has changed.
CcSetLogHandleForFile The CcSetLogHandleForFile routine sets a log handle for a file.
CcSetReadAheadGranularity The CcSetReadAheadGranularity routine sets the read-ahead granularity for a cached file.
CcUninitializeCacheMap The CcUninitializeCacheMap routine stops the caching of a cached file.
CcUnpinData The CcUnpinData routine releases cached file data that was mapped or pinned by an earlier call to CcMapData, CcPinRead, or CcPreparePinWrite.
CcUnpinDataForThread The CcUnpinDataForThread routine releases pages of a cached file whose buffer control block (BCB) was modified by an earlier call to CcSetBcbOwnerPointer.
CcUnpinRepinnedBcb The CcUnpinRepinnedBcb routine unpins a repinned buffer control block (BCB).
CcWaitForCurrentLazyWriterActivity The CcWaitForCurrentLazyWriterActivity routine puts the caller into a wait state until the current batch of lazy writer activity is completed.
CcZeroData The CcZeroData routine zeros the specified range of bytes in a cached or noncached file.
DRIVER_FS_NOTIFICATION A PDRIVER_FS_NOTIFICATION-typed routine is called by the operating system when a file system registers or unregisters itself by using IoRegisterFileSystem or IoUnregisterFileSystem.
ExAdjustLookasideDepth Reserved for system use.
ExDisableResourceBoostLite Reserved for system use.
ExQueryPoolBlockSize Obsolete.
FsRtlAcknowledgeEcp The FsRtlAcknowledgeEcp routine marks an extra create parameter (ECP) context structure as acknowledged.
FsRtlAllocateExtraCreateParameter The FsRtlAllocateExtraCreateParameter routine allocates memory for a user-defined extra create parameter (ECP) context structure and generates a pointer to that structure.
FsRtlAllocateExtraCreateParameterFromLookasideList The FsRtlAllocateExtraCreateParameterFromLookasideList routine allocates memory pool from a given lookaside list for an extra create parameter (ECP) context structure, and generates a pointer to that structure.
FsRtlAllocateExtraCreateParameterList The FsRtlAllocateExtraCreateParameterList routine allocates paged pool memory for an ECP_LIST structure and generates a pointer to that structure.
FsRtlAllocatePoolWithQuotaTag The FsRtlAllocatePoolWithQuotaTag routine allocates pool memory, charging quota against the current process.
FsRtlAllocatePoolWithTag The FsRtlAllocatePoolWithTag routine allocates pool memory.
FsRtlAreThereCurrentFileLocks The FsRtlAreThereCurrentFileLocks macro checks whether any byte range locks exist for the specified file.
FsRtlAreVolumeStartupApplicationsComplete The FsRtlAreVolumeStartupApplicationsComplete function determines whether volume startup applications have completed processing.
FsRtlCancellableWaitForMultipleObjects The FsRtlCancellableWaitForMultipleObjects routine executes a cancelable wait operation (a wait that can be terminated) on one or more dispatcher objects.
FsRtlCancellableWaitForSingleObject The FsRtlCancellableWaitForSingleObject routine executes a cancelable wait operation (a wait that can be terminated) on a dispatcher object.
FsRtlChangeBackingFileObject The FsRtlChangeBackingFileObject routine replaces the current file object with a new file object.
FsRtlCompleteRequest The FsRtlCompleteRequest macro completes an IRP with the specified status.
FsRtlCreateSectionForDataScan The FsRtlCreateSectionForDataScan routine creates a section object.
FsRtlDeleteExtraCreateParameterLookasideList The FsRtlDeleteExtraCreateParameterLookasideList routine frees an extra create parameter (ECP) lookaside list.
FsRtlDeregisterUncProvider The FsRtlDeregisterUncProvider routine deregisters a redirector that was registered as a Universal Naming Convention (UNC) provider with the multiple UNC provider (MUP).
FsRtlFastLock The FsRtlFastLock macro is used by file systems and filter drivers to request a byte-range lock for a file stream.
FsRtlFindExtraCreateParameter The FsRtlFindExtraCreateParameter routine searches a given ECP list for an ECP context structure of a given type and returns a pointer to this structure if it is found.
FsRtlFreeExtraCreateParameter The FsRtlFreeExtraCreateParameter routine frees the memory for an ECP context structure.
FsRtlFreeExtraCreateParameterList The FsRtlFreeExtraCreateParameterList routine frees an extra create parameter (ECP) list structure.
FsRtlGetEcpListFromIrp The FsRtlGetEcpListFromIrp routine returns a pointer to an extra create parameter (ECP) context structure list that is associated with a given IRP_MJ_CREATE operation.
FsRtlGetNextExtraCreateParameter The FsRtlGetNextExtraCreateParameter routine returns a pointer to the next (or first) extra create parameter (ECP) context structure in a given ECP list.
FsRtlGetPerStreamContextPointer The FsRtlGetPerStreamContextPointer macro returns the file system's stream context for a file stream.
FsRtlGetSectorSizeInformation The FsRtlGetSectorSizeInformation routine retrieves the physical and logical sector size information for a storage volume.
FsRtlGetSupportedFeatures The FsRtlGetSupportedFeatures routine returns the supported features of a volume attached to the specified device object.
FsRtlIncrementCcFastMdlReadWait The FsRtlIncrementCcFastMdlReadWait routine increments the cache manager's CcFastMdlReadWait performance counter member in a processor control block (PRCB) object.
FsRtlIncrementCcFastReadNotPossible The FsRtlIncrementCcFastReadNotPossible routine increments the CcFastReadNotPossible performance counter in a per processor control block of cache manager system counters.
FsRtlIncrementCcFastReadNoWait The FsRtlIncrementCcFastReadNoWait routine increments the CcFastReadNoWait performance counter in a per processor control block of cache manager system counters.
FsRtlIncrementCcFastReadResourceMiss The FsRtlIncrementCcFastReadResourceMiss routine increments the CcFastReadNotPossible performance counter in a per processor control block of cache manager system counters.
FsRtlIncrementCcFastReadWait The FsRtlIncrementCcFastReadWait routine increments the CcFastReadWait performance counter in a per processor control block of cache manager system counters.
FsRtlInitExtraCreateParameterLookasideList The FsRtlInitExtraCreateParameterLookasideList routine initializes a paged or nonpaged pool lookaside list used for the allocation of one or more extra create parameter context structures (ECPs) of fixed size.
FsRtlInitializeExtraCreateParameter The FsRtlInitializeExtraCreateParameter routine initializes an extra create parameter (ECP) context structure.
FsRtlInitializeExtraCreateParameterList The FsRtlInitializeExtraCreateParameterList routine initializes an extra create parameter (ECP) context structure list.
FsRtlInitPerStreamContext The FsRtlInitPerStreamContext macro initializes a filter driver context structure.
FsRtlInsertExtraCreateParameter The FsRtlInsertExtraCreateParameter routine inserts an extra create parameter (ECP) context structure into an ECP list.
FsRtlInsertPerFileContext The FsRtlInsertPerFileContext routine associates a FSRTL_PER_FILE_CONTEXT object with a driver-specified context object for a file.
FsRtlInsertPerFileObjectContext For a "legacy" file system filter driver, the FsRtlInsertPerFileObjectContext function associates context information with a file object.
FsRtlInsertPerStreamContext The FsRtlInsertPerStreamContext routine associates a file system filter driver's per-stream context structure with a file stream.
FsRtlIsAnsiCharacterLegal The FsRtlIsAnsiCharacterLegal macro determines whether a character is a legal ANSI character.
FsRtlIsAnsiCharacterLegalFat The FsRtlIsAnsiCharacterLegalFat macro determines whether an ANSI character is legal for FAT file names.
FsRtlIsAnsiCharacterLegalHpfs The FsRtlIsAnsiCharacterLegalHpfs macro determines whether an ANSI character is legal for HPFS file names.
FsRtlIsAnsiCharacterLegalNtfs The FsRtlIsAnsiCharacterLegalNtfs macro determines whether an ANSI character is legal for NTFS file names.
FsRtlIsAnsiCharacterLegalNtfsStream The FsRtlIsAnsiCharacterLegalNtfsStream macro determines whether an ANSI character is legal for NTFS stream names.
FsRtlIsAnsiCharacterWild The FsRtlIsAnsiCharacterWild macro determines whether an ANSI character is a wildcard character.
FsRtlIsDaxVolume This routine queries if the specified file is on a direct access (DAX) volume.
FsRtlIsEcpAcknowledged The FsRtlIsEcpAcknowledged routine is used to determine if a given extra create parameter (ECP) context structure has been marked as acknowledged.
FsRtlIsEcpFromUserMode The FsRtlIsEcpFromUserMode routine determines whether an extra create parameter (ECP) context structure originated from user mode.
FsRtlIsLeadDbcsCharacter The FsRtlIsLeadDbcsCharacter macro determines whether a character is a lead byte (the first byte of a character) in a double-byte character set (DBCS).
FsRtlIsPagingFile The FsRtlIsPagingFile routine determines whether a given file is a paging file.
FsRtlIssueDeviceIoControl The FsRtlIssueDeviceIoControl routine sends a synchronous device I/O control request to a target device object.
FsRtlIsSystemPagingFile The FsRtlIsSystemPagingFile routine determines whether a given file is currently a system paging file.
FsRtlIsUnicodeCharacterWild The FsRtlIsUnicodeCharacterWild macro determines whether a Unicode character is a wildcard character.
FsRtlLogCcFlushError The FsRtlLogCcFlushError routine logs a lost delayed-write error and displays a dialog box to the user.
FsRtlLookupPerFileContext The FsRtlLookupPerFileContext routine returns a pointer to a FSRTL_PER_FILE_CONTEXT object that is associated with a specified file.
FsRtlLookupPerFileObjectContext For a "legacy" file system filter driver, the FsRtlLookupPerFileObjectContext function retrieves context information previously associated with a file object.
FsRtlLookupPerStreamContext The FsRtlLookupPerStreamContext macro retrieves a per-stream context structure for a file stream.
FsRtlLookupPerStreamContextInternal Reserved for system use.
FsRtlMupGetProviderIdFromName The FsRtlMupGetProviderIdFromName routine gets the provider identifier of a network redirector that is registered with the multiple UNC provider (MUP) from the device name of the network redirector.
FsRtlMupGetProviderInfoFromFileObject The FsRtlMupGetProviderInfoFromFileObject routine gets information about a network redirector that is registered with the multiple UNC provider (MUP) from a file object for a file that is located on a remote file system.
FsRtlPrepareToReuseEcp The FsRtlPrepareToReuseEcp routine resets an extra create parameter (ECP) context structure, which prepares it for reuse.
FsRtlQueryCachedVdl The current valid data length (VDL) for a cached file is retrieved with the FsRtlQueryCachedVdl routine.
FsRtlQueryKernelEaFile The routine FsRtlQueryKernelEaFile is used to build an explicit QueryEA request and synchronously wait for it to complete, returning the result. This allows the caller to do this by FileObject instead of a handle.
FsRtlRegisterFileSystemFilterCallbacks File system filter drivers and file systems call the FsRtlRegisterFileSystemFilterCallbacks routine to register notification callback routines to be invoked when the underlying file system performs certain operations.
FsRtlRemoveDotsFromPath The FsRtlRemoveDotsFromPath routine removes unnecessary occurrences of '.' and '..' from the specified path.
FsRtlRemoveExtraCreateParameter The FsRtlRemoveExtraCreateParameter routine searches an ECP list for an ECP context structure and, if found, detaches it from the ECP list.
FsRtlRemovePerFileContext The FsRtlRemovePerFileContext routine returns a pointer to a FSRTL_PER_FILE_CONTEXT object that is associated with a file.
FsRtlRemovePerFileObjectContext For a "legacy" file system filter driver, the FsRtlRemovePerFileObjectContext function unlinks a per-file-object context information structure from the list of per-file-object contexts previously associated with a file object.
FsRtlRemovePerStreamContext FsRtlRemovePerStreamContext removes a per-stream context structure from the list of per-stream contexts associated with a file stream.
FsRtlSetEcpListIntoIrp The FsRtlSetEcpListIntoIrp routine attaches an extra create parameter (ECP) context structure list to an IRP_MJ_CREATE operation.
FsRtlSetKernelEaFile The routine FsRtlQueryKernelEaFile is used to set, modify and/or delete extended attribute (EA) values for a file and synchronously wait for it to complete, returning a result.
FsRtlSetupAdvancedHeader The FsRtlSetupAdvancedHeader macro is used by file systems to initialize an FSRTL_ADVANCED_FCB_HEADER structure for use with filter contexts.
FsRtlSetupAdvancedHeaderEx The FsRtlSetupAdvancedHeaderEx macro is used by file systems to initialize an FSRTL_ADVANCED_FCB_HEADER structure for use with both stream and file contexts.
FsRtlSupportsPerFileContexts The FsRtlSupportsPerFileContexts macro checks if per file context information is supported by the file system that is associated with a specified FILE_OBJECT.
FsRtlTeardownPerFileContexts File systems call theFsRtlTeardownPerFileContexts routine to free FSRTL_PER_FILE_CONTEXT objects that are associated with a file control block (FCB) structure.
FsRtlTeardownPerStreamContexts The FsRtlTeardownPerStreamContexts routine frees all per-stream context structures associated with a given FSRTL_ADVANCED_FCB_HEADER structure.
FsRtlTestAnsiCharacter The FsRtlTestAnsiCharacter macro determines whether an ANSI or double-byte character set (DBCS) character meets the specified criteria.
FsRtlValidateReparsePointBuffer The FsRtlValidateReparsePointBuffer routine verifies that the specified reparse point buffer is valid.
GetSecurityUserInfo The GetSecurityUserInfo function retrieves information about a logon session.
IoAcquireVpbSpinLock The IoAcquireVpbSpinLock routine acquires the Volume Parameter Block (VPB) spin lock.
IoCheckDesiredAccess Reserved for system use.
IoCheckEaBufferValidity The IoCheckEaBufferValidity routine checks whether the specified extended attribute (EA) buffer is valid.
IoCheckFunctionAccess Reserved for system use.
IoCheckQuerySetFileInformation Reserved for system use.
IoCheckQuerySetVolumeInformation Reserved for system use.
IoCheckQuotaBufferValidity The IoCheckQuotaBufferValidity routine checks whether the specified quota buffer is valid.
IoCreateStreamFileObject The IoCreateStreamFileObject routine creates a new stream file object.
IoCreateStreamFileObjectEx The IoCreateStreamFileObjectEx routine creates a new stream file object.
IoCreateStreamFileObjectEx2 The IoCreateStreamFileObjectEx2 routine creates a new stream file object with create options for a target device object.
IoCreateStreamFileObjectLite The IoCreateStreamFileObjectLite routine creates a new stream file object, but does not cause an IRP_MJ_CLEANUP request to be sent to the file system driver stack.
IoEnumerateDeviceObjectList The IoEnumerateDeviceObjectList routine enumerates a driver's device object list.
IoEnumerateRegisteredFiltersList The IoEnumerateRegisteredFiltersList routine enumerates the file system filter drivers that have registered with the system.
IoFastQueryNetworkAttributes Reserved for system use.
IoGetAttachedDevice The IoGetAttachedDevice routine returns a pointer to the highest-level device object associated with the specified device.
IoGetBaseFileSystemDeviceObject Reserved for system use.
IoGetDeviceAttachmentBaseRef The IoGetDeviceAttachmentBaseRef routine returns a pointer to the lowest-level device object in a file system or device driver stack.
IoGetDeviceToVerify The IoGetDeviceToVerify routine returns a pointer to the device object, representing a removable-media device, that is the target of the given thread's I/O request.
IoGetDiskDeviceObject The IoGetDiskDeviceObject routine retrieves a pointer to the disk device object associated with a given file system volume device object.
IoGetLowerDeviceObject The IoGetLowerDeviceObject routine returns a pointer to the next-lower-level device object on the driver stack.
IoGetRequestorProcess The IoGetRequestorProcess routine returns a process pointer for the thread that originally requested a given I/O operation.
IoGetRequestorProcessId The IoGetRequestorProcessId routine returns the unique 32-bit process ID for the thread that originally requested a given I/O operation.
IoGetRequestorSessionId The IoGetRequestorSessionId routine returns the session ID for the process that originally requested a given I/O operation.
IoGetTopLevelIrp The IoGetTopLevelIrp routine returns the value of the TopLevelIrp field of the current thread.
IoInitializePriorityInfo The IoInitializePriorityInfo routine initializes a structure of type IO_PRIORITY_INFO.
IoIsFileOpenedExclusively Reserved for system use.
IoIsOperationSynchronous The IoIsOperationSynchronous routine determines whether a given IRP represents a synchronous or asynchronous I/O request.
IoIsSystemThread The IoIsSystemThread routine checks whether a given thread is a system thread.
IoIsValidNameGraftingBuffer Reserved for system use.
IoPageRead Reserved for system use.
IoQueryFileDosDeviceName The IoQueryFileDosDeviceName routine retrieves an MS-DOS device name for a file.
IoQueryFileInformation Reserved for system use.
IoQueryVolumeInformation Reserved for system use.
IoQueueThreadIrp Reserved for system use.
IoRegisterFileSystem The IoRegisterFileSystem routine adds a file system's control device object to the global file system queue.
IoRegisterFsRegistrationChange The IoRegisterFsRegistrationChange routine registers a file system filter driver's notification routine to be called whenever a file system registers or unregisters itself as an active file system.
IoRegisterFsRegistrationChangeEx The IoRegisterFsRegistrationChangeEx routine registers a file system filter driver's notification routine to be called whenever a file system registers or unregisters itself as an active file system.
IoRegisterFsRegistrationChangeMountAware The IoRegisterFsRegistrationChangeMountAware routine registers a file system filter driver's notification routine. This notification routine is called whenever a file system registers or unregisters itself as an active file system.
IoReleaseVpbSpinLock The IoReleaseVpbSpinLock routine releases the Volume Parameter Block (VPB) spin lock.
IoReplaceFileObjectName The IoReplaceFileObjectName routine replaces the name of a file object.
IoSetDeviceToVerify The IoSetDeviceToVerify routine specifies a device object to be verified. The specified device object represents a removable media device.
IoSetInformation Reserved for system use.
IoSetTopLevelIrp The IoSetTopLevelIrp routine sets the value of the TopLevelIrp field of the current thread.
IoSynchronousPageWrite Reserved for system use.
IoThreadToProcess The IoThreadToProcess routine returns a pointer to the process for the specified thread.
IoUnregisterFileSystem The IoUnregisterFileSystem routine removes a file system's control device object from the global file system queue.
IoUnregisterFsRegistrationChange The IoUnregisterFsRegistrationChange routine unregisters file system filter driver's file system registration change notification routine.
IoVerifyVolume The IoVerifyVolume routine sends a volume verify request to the given removable-media device.
IsReparseTagMicrosoft The IsReparseTagMicrosoft macro determines whether a reparse point tag indicates a Microsoft reparse point.
IsReparseTagNameSurrogate The IsReparseTagNameSurrogate macro determines whether a tag's associated reparse point is a surrogate for another named entity, such as a volume mount point.
IsReparseTagValid Reserved for system use.
KeAttachProcess Obsolete.
KeDetachProcess Obsolete.
KeInitializeMutant Reserved for system use.
KeInitializeQueue The KeInitializeQueue routine initializes a queue object on which threads can wait for entries.
KeInsertHeadQueue The KeInsertHeadQueue routine inserts an entry at the head of the given queue if it cannot immediately use the entry to satisfy a thread wait.
KeInsertQueue The KeInsertQueue routine inserts an entry at the tail of the given queue if it cannot immediately use the entry to satisfy a thread wait.
KeReadStateMutant Reserved for system use.
KeReadStateQueue Reserved for system use.
KeReleaseMutant Reserved for system use.
KeReleaseQueuedSpinLock Reserved for system use.
KeRemoveQueue The KeRemoveQueue routine gives the calling thread a pointer to a dequeued entry from the given queue object or allows the caller to wait, up to an optional timeout interval, on the queue object.
KeRundownQueue The KeRundownQueue routine cleans up a queue object, flushing any queued entries.
KeSetIdealProcessorThread Reserved for system use.
KeStackAttachProcess The KeStackAttachProcess routine attaches the current thread to the address space of the target process.
KeTryToAcquireQueuedSpinLock Reserved for system use.
KeUnstackDetachProcess The KeUnstackDetachProcess routine detaches the current thread from the address space of a process and restores the previous attach state.
MapSecurityError The MapSecurityError function maps a security interface SECURITY_STATUS status code to a corresponding NSTATUS status code.
MmCanFileBeTruncated The MmCanFileBeTruncated routine checks whether a file can be truncated.
MmDoesFileHaveUserWritableReferences The MmDoesFileHaveUserWritableReferences function returns the number of writable references for a file object.
MmFlushImageSection The MmFlushImageSection routine flushes the image section for a file.
MmForceSectionClosed The MmForceSectionClosed routine deletes the data and image sections for a file that is no longer in use.
MmGetMaximumFileSectionSize The MmGetMaximumFileSectionSize returns the maximum possible size of a file section for the current version of Windows.
MmIsRecursiveIoFault The MmIsRecursiveIoFault routine determines whether the current page fault is occurring during an I/O operation.
MmPrefetchPages The MmPrefetchPages routine reads groups of pages from secondary storage in the optimal fashion.
MmSetAddressRangeModified The MmSetAddressRangeModified routine marks currently valid pages in the specified range of the system cache as modified.
ObInsertObject Reserved for system use.
ObIsKernelHandle The ObIsKernelHandle routine determines whether the specified handle is a kernel handle.
ObMakeTemporaryObject Reserved for system use.
ObOpenObjectByPointer The ObOpenObjectByPointer function opens an object referenced by a pointer and returns a handle to the object.
ObQueryNameString The ObQueryNameString routine supplies the name, if there is one, of a given object to which the caller has a pointer.
ObQueryObjectAuditingByHandle Reserved for system use.
PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK A file system filter driver (legacy filter) or a minifilter driver can register a PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK-typed routine as the filter driver's CleanupCallback callback routine for an extra create parameter (ECP) context structure.
PsChargePoolQuota The PsChargePoolQuota routine charges pool quota of the specified pool type to the specified process.
PsDereferenceImpersonationToken The PsDereferenceImpersonationToken routine decrements the reference count of an impersonation token.
PsDereferencePrimaryToken The PsDereferencePrimaryToken routine decrements the reference count of a primary token.
PsGetProcessExitTime The PsGetProcessExitTime routine returns the exit time for the current process.
PsImpersonateClient The PsImpersonateClient routine causes a server thread to impersonate a client.
PsIsDiskCountersEnabled The enabled state of the per process disk I/O counters is returned by the PsIsDiskCountersEnabled routine.
PsIsThreadTerminating The PsIsThreadTerminating routine checks whether a thread is terminating.
PsLookupProcessByProcessId The PsLookupProcessByProcessId routine accepts the process ID of a process and returns a referenced pointer to EPROCESS structure of the process.
PsLookupThreadByThreadId The PsLookupThreadByThreadId routine accepts the thread ID of a thread and returns a referenced pointer to the ETHREAD structure of the thread.
PsReferenceImpersonationToken The PsReferenceImpersonationToken routine increments the reference count of the impersonation token for the specified thread.
PsReferencePrimaryToken The PsReferencePrimaryToken routine increments the reference count of the primary token for the specified process.
PsReturnPoolQuota The PsReturnPoolQuota routine returns pool quota of the specified pool type to the specified process.
PsRevertToSelf The PsRevertToSelf routine ends the calling thread's impersonation of a client.
PsUpdateDiskCounters The PsUpdateDiskCounters routine updates the disk I/O counters of a given process.
RtlAbsoluteToSelfRelativeSD The RtlAbsoluteToSelfRelativeSD routine creates a new security descriptor in self-relative format by using a security descriptor in absolute format as a template.
RtlAddAccessAllowedAce The RtlAddAccessAllowedAce routine adds an access-allowed access control entry (ACE) to an access control list (ACL). The access is granted to the specified security identifier (SID).
RtlAddAccessAllowedAceEx The RtlAddAccessAllowedAceEx routine adds an access-allowed access control entry (ACE) with inheritance ACE flags to an access control list (ACL). The access is granted to the specified security identifier (SID).
RtlAddAce The RtlAddAce routine adds one or more access control entries (ACEs) to a specified access control list (ACL).
RtlAllocateAndInitializeSid Reserved for system use.
RtlAllocateHeap The RtlAllocateHeap routine allocates a block of memory from a heap.
RtlAppendStringToString The RtlAppendStringToString routine concatenates two counted strings. It copies bytes from the source up to the length of the destination buffer.
RtlCaptureContext The RtlCaptureContext function retrieves a context record in the context of the caller.
RtlCaptureStackBackTrace The RtlCaptureStackBackTrace routine captures a stack back trace by walking up the stack and recording the information for each frame.
RtlCompareMemoryUlong The RtlCompareMemoryUlong routine returns how many bytes in a block of memory match a specified pattern.
RtlCompressBuffer The RtlCompressBuffer function compresses a buffer and can be used by a file system driver to facilitate the implementation of file compression.
RtlCompressChunks Reserved for system use.
RtlConvertSidToUnicodeString The RtlConvertSidToUnicodeString routine generates a printable Unicode string representation of a security identifier (SID).
RtlCopyLuid The RtlCopyLuid routine copies a locally unique identifier (LUID) to a buffer.
RtlCopySid The RtlCopySid routine copies the value of a security identifier (SID) to a buffer.
RtlCreateAcl The RtlCreateAcl routine creates and initializes an access control list (ACL).
RtlCreateHeap The RtlCreateHeap routine creates a heap object that can be used by the calling process. This routine reserves space in the virtual address space of the process and allocates physical storage for a specified initial portion of this block.
RtlCreateSecurityDescriptorRelative The RtlCreateSecurityDescriptorRelative routine initializes a new security descriptor in self-relative format.
RtlCreateSystemVolumeInformationFolder The RtlCreateSystemVolumeInformationFolder routine verifies the existence of the "System Volume Information" folder on a file system volume. If the folder is not present, then the folder is created.
RtlCreateUnicodeString The RtlCreateUnicodeString routine creates a new counted Unicode string.
RtlCustomCPToUnicodeN Reserved for system use.
RtlDecompressBuffer The RtlDecompressBuffer function decompresses an entire compressed buffer.
RtlDecompressBufferEx The RtlDecompressBufferEx function decompresses an entire compressed buffer.
RtlDecompressBufferEx2 The RtlDecompressBufferEx2 function decompresses an entire compressed buffer, using multiple processors where possible. Multiple processor support is only implemented for kernel mode callers.
RtlDecompressChunks Reserved for system use.
RtlDecompressFragment The RtlDecompressFragment function is used to decompress part of a compressed buffer (that is, a buffer "fragment").
RtlDecompressFragmentEx The RtlDecompressFragmentEx function is used to decompress part of a compressed buffer (that is, a buffer "fragment"), using multiple processors where possible.
RtlDeleteAce The RtlDeleteAce routine deletes an access control entry (ACE) from a specified access control list (ACL).
RtlDescribeChunk Reserved for system use.
RtlDestroyHeap The RtlDestroyHeap routine destroys the specified heap object. RtlDestroyHeap decommits and releases all the pages of a private heap object, and it invalidates the handle to the heap.
RtlDowncaseUnicodeString The RtlDowncaseUnicodeString routine converts the specified Unicode source string to lowercase. The translation conforms to the current system locale information.
RtlEqualPrefixSid The RtlEqualPrefixSid routine determines whether two security-identifier (SID) prefixes are equal. An SID prefix is the entire SID except for the last subauthority value.
RtlEqualSid The RtlEqualSid routine determines whether two security identifier (SID) values are equal. Two SIDs must match exactly to be considered equal.
RtlFillMemoryUlong The RtlFillMemoryUlong routine fills the specified range of memory with one or more repetitions of a ULONG value.
RtlFillMemoryUlonglong The RtlFillMemoryUlonglong routine fills a given range of memory with one or more repetitions of a given ULONGLONG value.
RtlFindUnicodePrefix The RtlFindUnicodePrefix routine searches for the best match for a given Unicode file name in a prefix table.
RtlFreeHeap The RtlFreeHeap routine frees a memory block that was allocated from a heap by RtlAllocateHeap.
RtlFreeOemString The RtlFreeOemString routine releases storage that was allocated by any of the Rtl..ToOemString routines.
RtlFreeSid Reserved for system use.
RtlGenerate8dot3Name The RtlGenerate8dot3Name routine generates a short (8.3) name for the specified long file name.
RtlGetAce The RtlGetAce routine obtains a pointer to an access control entry (ACE) in an access control list (ACL).
RtlGetCompressionWorkSpaceSize The RtlGetCompressionWorkSpaceSize function is used to determine the correct size of the WorkSpace buffer for the RtlCompressBuffer and RtlDecompressFragment functions.
RtlGetDaclSecurityDescriptor The RtlGetDaclSecurityDescriptor routine returns a pointer to the discretionary ACL (DACL) for a security descriptor.
RtlGetGroupSecurityDescriptor The RtlGetGroupSecurityDescriptor routine returns the primary group information for a given security descriptor.
RtlGetOwnerSecurityDescriptor The RtlGetOwnerSecurityDescriptor routine returns the owner information for a given security descriptor.
RtlGetSaclSecurityDescriptor The RtlGetSaclSecurityDescriptor routine returns a pointer to the system ACL (SACL) for a security descriptor.
RtlIdentifierAuthoritySid Reserved for system use.
RtlInitCodePageTable Reserved for system use.
RtlInitializeSid The RtlInitializeSid routine initializes a security identifier (SID) structure.
RtlInitializeSidEx The RtlInitializeSidEx routine initializes a pre-allocated security identifier (SID) structure.
RtlInitializeUnicodePrefix The RtlInitializeUnicodePrefix routine initializes a prefix table.
RtlInsertUnicodePrefix The RtlInsertUnicodePrefix routine inserts a new element into a Unicode prefix table.
RtlIsCloudFilesPlaceholder The RtlIsCloudFilesPlaceholder routine determines if a file or a directory is a CloudFiles placeholder, based on the FileAttributes and ReparseTag values of the file.
RtlIsNameLegalDOS8Dot3 The RtlIsNameLegalDOS8Dot3 routine determines whether a given name represents a valid short (8.3) file name.
RtlIsPartialPlaceholder The RtlIsPartialPlaceholder routine determines if a file or a directory is a CloudFiles placeholder, based on the FileAttributes and ReparseTag values of the file.
RtlIsPartialPlaceholderFileHandle The RtlIsPartialPlaceholderFileHandle routine determines if a file is a known type of placeholder, based on a file handle.
RtlIsPartialPlaceholderFileInfo The RtlIsPartialPlaceholderFileInfo routine determines if a file is a known type of placeholder, based on the information returned by NtQueryInformationFile or NtQueryDirectoryFile.
RtlIsValidOemCharacter The RtlIsValidOemCharacter routine determines if the specified Unicode character can be mapped to a valid OEM character.
RtlLengthRequiredSid The RtlLengthRequiredSid routine returns the length, in bytes, of the buffer required to store a security identifier (SID) with a specified number of subauthorities.
RtlLengthSid The RtlLengthSid routine returns the length, in bytes, of a valid security identifier (SID).
RtlMultiByteToUnicodeN The RtlMultiByteToUnicodeN routine translates the specified source string into a Unicode string, using the current system ANSI code page (ACP). The source string is not necessarily from a multibyte character set.
RtlMultiByteToUnicodeSize The RtlMultiByteToUnicodeSize routine determines the number of bytes that are required to store the Unicode translation for the specified source string.
RtlNextUnicodePrefix The RtlNextUnicodePrefix routine is used to enumerate the elements in a Unicode prefix table.
RtlNtStatusToDosError The RtlNtStatusToDosError routine converts the specified NTSTATUS code to its equivalent system error code.
RtlNtStatusToDosErrorNoTeb Reserved for system use.
RtlOemStringToCountedUnicodeSize The RtlOemStringToCountedUnicodeSize routine determines the size, in bytes, that a given OEM string will be after it is translated into a counted Unicode string.
RtlOemStringToCountedUnicodeString The RtlOemStringToCountedUnicodeString routine translates the specified source string into a Unicode string using the current system OEM code page.
RtlOemStringToUnicodeSize The RtlOemStringToUnicodeSize routine determines the size, in bytes, that a given OEM string will be after it is translated into a null-terminated Unicode string.
RtlOemStringToUnicodeString The RtlOemStringToUnicodeString routine translates a given source string into a null-terminated Unicode string using the current system OEM code page.
RtlOemToUnicodeN The RtlOemToUnicodeN routine translates the specified source string into a Unicode string, using the current system OEM code page.
RtlQueryThreadPlaceholderCompatibilityMode RtlQueryThreadPlaceholderCompatibilityMode is a routine which returns the placeholder compatibility mode for the current thread.
RtlRandom The RtlRandom routine returns a random number that was generated from a given seed value.
RtlRandomEx The RtlRandomEx routine returns a random number that was generated from a given seed value.
RtlRemoveUnicodePrefix The RtlRemoveUnicodePrefix routine removes an element from a prefix table.
RtlReserveChunk Reserved for system use.
RtlSecondsSince1970ToTime The RtlSecondsSince1970ToTime routine converts the elapsed time, in seconds, since the beginning of 1970 to an absolute system time value.
RtlSecondsSince1980ToTime The RtlSecondsSince1980ToTime routine converts the elapsed time, in seconds, since the beginning of 1980 to an absolute system time value.
RtlSelfRelativeToAbsoluteSD The RtlSelfRelativeToAbsoluteSD routine creates a new security descriptor in absolute format by using a security descriptor in self-relative format as a template.
RtlSetGroupSecurityDescriptor The RtlSetGroupSecurityDescriptor routine sets the primary group information of an absolute-format security descriptor. It replaces any primary group information that is already present in the security descriptor.
RtlSetOwnerSecurityDescriptor The RtlSetOwnerSecurityDescriptor routine sets the owner information of an absolute-format security descriptor. It replaces any owner information that is already present in the security descriptor.
RtlSetThreadPlaceholderCompatibilityMode RtlSetThreadPlaceholderCompatibilityMode is a routine which sets the placeholder compatibility mode for the current thread.
RtlSubAuthorityCountSid Reserved for system use.
RtlSubAuthoritySid The RtlSubAuthoritySid routine returns a pointer to a specified subauthority of a security identifier (SID).
RtlTimeToSecondsSince1970 The RtlTimeToSecondsSince1970 routine converts a given absolute system time value to the elapsed time, in seconds, since the beginning of 1970.
RtlTimeToSecondsSince1980 The RtlTimeToSecondsSince1980 routine converts a given absolute system time value to the elapsed time, in seconds, since the beginning of 1980.
RtlUnicodeStringToCountedOemString The RtlUnicodeStringToCountedOemString routine translates the specified Unicode source string into a counted OEM string using the current system OEM code page.
RtlUnicodeStringToOemSize The RtlUnicodeStringToOemSize routine determines the size, in bytes, that a given Unicode string will be after it is translated into an OEM string.
RtlUnicodeStringToOemString The RtlUnicodeStringToOemString routine translates a given Unicode source string into an OEM string using the current system OEM code page.
RtlUnicodeToCustomCPN Reserved for system use.
RtlUnicodeToMultiByteN The RtlUnicodeToMultiByteN routine translates the specified Unicode string into a new character string, using the current system ANSI code page (ACP). The translated string is not necessarily from a multibyte character set.
RtlUnicodeToMultiByteSize The RtlUnicodeToMultiByteSize routine determines the number of bytes that are required to store the multibyte translation for the specified Unicode string. The translation is assumed to use the current system ANSI code page (ACP).
RtlUnicodeToOemN The RtlUnicodeToOemN routine translates a given Unicode string to an OEM string, using the current system OEM code page.
RtlUpcaseUnicodeStringToCountedOemString The RtlUpcaseUnicodeStringToCountedOemString routine translates a given Unicode source string into an uppercase counted OEM string using the current system OEM code page.
RtlUpcaseUnicodeStringToOemString The RtlUpcaseUnicodeStringToOemString routine translates a given Unicode source string into an uppercase OEM string using the current system OEM code page.
RtlUpcaseUnicodeToCustomCPN Reserved for system use.
RtlUpcaseUnicodeToMultiByteN The RtlUpcaseUnicodeToMultiByteN routine translates the specified Unicode string into a new uppercase character string, using the current system ANSI code page (ACP). The translated string is not necessarily from a multibyte character set.
RtlUpcaseUnicodeToOemN The RtlUpcaseUnicodeToOemN routine translates a given Unicode string into an uppercase OEM string, using the current system OEM code page.
RtlValidSid The RtlValidSid routine validates a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum.
RtlxOemStringToUnicodeSize Reserved for system use.
RtlxUnicodeStringToOemSize Reserved for system use.
SeAppendPrivileges The SeAppendPrivileges routine appends additional privileges to the privilege set in an access state structure.
SeAuditHardLinkCreation Reserved for system use.
SeAuditingFileEvents The SeAuditingFileEvents routine determines whether file open events are currently being audited.
SeAuditingFileOrGlobalEvents The SeAuditingFileOrGlobalEvents routine determines whether file or global events are currently being audited.
SeAuditingHardLinkEvents Reserved for system use.
SeCaptureSubjectContext The SeCaptureSubjectContext routine captures the security context of the calling thread for access validation and auditing.
SecLookupAccountName SecLookupAccountName accepts an account as input and retrieves a security identifier (SID) for the account and the name of the domain on which the account was found.
SecLookupAccountSid SecLookupAccountSid accepts a security identifier (SID) as input. It retrieves the name of the account for this SID and the name of the first domain on which this SID is found.
SecLookupWellKnownSid SecLookupWellKnownSid accepts a well-known security identifier (SID) type as input and retrieves the local security identifier (SID) for this well known SID.
SecMakeSPN SecMakeSPN creates a service provider name string that can be used when communicating with specific security service providers.
SecMakeSPNEx SecMakeSPNEx creates a service provider name string that can be used when communicating with specific security service providers.
SecMakeSPNEx2 SecMakeSPNEx2 creates a service provider name string that can be used when it communicates with specific security service providers.
SeCreateClientSecurity The SeCreateClientSecurity routine initializes a security client context structure with the information needed to call SeImpersonateClientEx.
SeCreateClientSecurityFromSubjectContext The SeCreateClientSecurityFromSubjectContext routine retrieves the access token for a security subject context and uses the result to initialize a security client context with the information needed to call SeImpersonateClientEx.
SeDeleteClientSecurity The SeDeleteClientSecurity routine deletes a client security context.
SeDeleteObjectAuditAlarm The SeDeleteObjectAuditAlarm routine generates audit and alarm messages for an object that is marked for deletion.
SeFilterToken The SeFilterToken routine creates a new access token that is a restricted version of an existing access token.
SeImpersonateClient Obsolete.
SeImpersonateClientEx The SeImpersonateClientEx routine causes a thread to impersonate a user.
SeLengthSid Obsolete.
SeLockSubjectContext The SeLockSubjectContext routine locks the primary and impersonation tokens of a captured subject context.
SeMarkLogonSessionForTerminationNotification The SeMarkLogonSessionForTerminationNotification routine marks a logon session so that the caller's registered callback routine is called when the logon session terminates.
SeOpenObjectAuditAlarm The SeOpenObjectAuditAlarm routine generates audit and alarm messages when an attempt is made to open an object.
SeOpenObjectForDeleteAuditAlarm The SeOpenObjectForDeleteAuditAlarm routine generates audit and alarm messages when an attempt is made to open an object for deletion.
SePrivilegeCheck The SePrivilegeCheck routine determines whether a specified set of privileges is enabled in the subject's access token.
SeQueryAuthenticationIdToken The SeQueryAuthenticationIdToken routine retrieves the authentication ID of an access token.
SeQueryInformationToken The SeQueryInformationToken routine retrieves a specified type of information about an access token. The calling process must have appropriate access rights to obtain the information.
SeQuerySecurityDescriptorInfo The SeQuerySecurityDescriptorInfo routine retrieves a copy of an object's security descriptor.
SeQuerySessionIdToken Reserved for system use.
SeQuerySubjectContextToken The SeQuerySubjectContextToken macro retrieves the access token for a security subject context.
SeRegisterLogonSessionTerminatedRoutine The SeRegisterLogonSessionTerminatedRoutine routine registers a callback routine to be called when a logon session terminates. A logon session terminates when the last token referencing the logon session is deleted.
SeReleaseSubjectContext The SeReleaseSubjectContext routine releases a subject security context captured by an earlier call to SeCaptureSubjectContext.
SeSetAccessStateGenericMapping The SeSetAccessStateGenericMapping routine sets the generic mapping field of an ACCESS_STATE structure.
SeSetSecurityDescriptorInfo The SeSetSecurityDescriptorInfo routine sets an object's security descriptor.
SeSetSecurityDescriptorInfoEx The SeSetSecurityDescriptorInfoEx routine modifies an object's security descriptor and specifies whether the object supports automatic inheritance of access control entries (ACE).
SeSetSessionIdToken Reserved for system use.
SeTokenGetNoChildProcessRestricted The SeTokenGetNoChildProcessRestricted routine determines the state of the no child process mitigation. It is not possible to be enforced and audit-only at the same time.
SeTokenIsAdmin The SeTokenIsAdmin routine determines whether a token contains the local administrators group.
SeTokenIsNoChildProcessRestrictionEnforced The SeTokenIsNoChildProcessRestrictionEnforced routine determines if the token carries the no child process restriction.
SeTokenIsRestricted The SeTokenIsRestricted routine determines whether a token contains a list of restricting security identifiers (SID).
SeTokenSetNoChildProcessRestricted The SeTokenSetNoChildProcessRestricted routine sets the TOKEN_AUDIT_NO_CHILD_PROCESS or TOKEN_AUDIT_NO_CHILD_PROCESS flags in the token.
SeTokenType Reserved for system use.
SeUnlockSubjectContext The SeUnlockSubjectContext routine unlocks the tokens of a captured subject context that were locked by a call to SeLockSubjectContext.
SeUnregisterLogonSessionTerminatedRoutine The SeUnregisterLogonSessionTerminatedRoutine routine unregisters a callback routine that was registered by an earlier call to SeRegisterLogonSessionTerminatedRoutine.
RxpAcquirePrefixTableLockExclusive RxpAcquirePrefixTableLockExclusive acquires the prefix table lock exclusively.
RxpAcquirePrefixTableLockShared RxpAcquirePrefixTableLockShared acquires the prefix table lock shared.
RxPrefixTableLookupName RxPrefixTableLookupName looks up a name in a prefix table used to catalog SRV_CALL, NET_ROOT, and V_NET_ROOT names and converts the underlying pointer to a structure that contains the name.
RxpReleasePrefixTableLock RxpReleasePrefixTableLock releases a previously acquired shared or exclusive prefix table lock.
IoSetTopLevelIrp The IoSetTopLevelIrp routine sets the value of the TopLevelIrp field of the current thread.
RxCeAllocateIrpWithMDL RxCeAllocateIrpWithMDL allocates an IRP and associates it with an existing memory descriptor list.
RxCeBuildAddress RxCeBuildAddress associates a transport address with a transport binding.
RxCeBuildConnection RxCeBuildConnection establishes a connection between a local RDBSS connection address and a given remote address.
RxCeBuildConnectionOverMultipleTransports RxCeBuildConnectionOverMultipleTransports establishes a connection between a local RDBSS connection address and a given remote address and supports multiple transports.
RxCeBuildTransport RxCeBuildTransport binds an RDBSS transport object to a specified transport name.
RxCeBuildVC RxCeBuildVC adds a virtual circuit to a specified RDBSS connection..
RxCeCancelConnectRequest RxCeCancelConnectRequest cancels a previously issued connection request. Note that this routine is not currently implemented.
RxCeFreeIrp RxCeFreeIrp frees an IRP.
RxCeInitiateVCDisconnect RxCeInitiateVCDisconnect initiates a disconnect on the virtual circuit.
RxCeQueryAdapterStatus RxCeQueryAdapterStatus returns the ADAPTER_STATUS structure for a given transport in a caller-allocated buffer.
RxCeQueryInformation RxCeQueryInformation queries information about a connection in a caller-allocated buffer.
RxCeQueryTransportInformation RxCeQueryTransportInformation queries transport information for a given transport.
RxCeSend RxCeSend sends a transport service data unit (TSDU) along the specified connection on a virtual circuit.
RxCeSendDatagram RxCeSendDatagram sends a transport service data unit (TSDU) along the specified connection on a virtual circuit.
RxCeTearDownAddress RxCeTearDownAddress deregisters a transport address from a transport binding.
RxCeTearDownConnection RxCeTearDownConnection tears down a given connection between a local RDBSS connection address and a remote address.
RxCeTearDownTransport RxCeTearDownTransport unbinds an RDBSS transport object.
RxCeTearDownVC RxCeTearDownVC deregisters a virtual circuit from a specified RDBSS connection.
__RxSynchronizeBlockingOperations "__RxSynchronizeBlockingOperations synchronizes blocking I/O requests to the same work queue."
RxCreateRxContext RxCreateRxContext allocates a new RX_CONTEXT structure and initializes the data structure.
RxDereferenceAndDeleteRxContext_Real RxDereferenceAndDeleteRxContext_Real dereferences an RX_CONTEXT data structure and if the ReferenceCount member goes to zero, then it deallocates and removes the specified RX_CONTEXT structure from the RDBSS in-memory data structures.
RxInitializeContext RxInitializeContext initializes an existing RX_CONTEXT data structure.
RxPrepareContextForReuse RxPrepareContextForReuse prepares an RX_CONTEXT data structure for reuse by resetting all of the operation-specific allocations and acquisitions that have been made (the ReferenceCount member to the RX_CONTEXT structure is set to zero).
RxResumeBlockedOperations_Serially RxResumeBlockedOperations_Serially wakes up the next waiting thread, if any, on the serialized blocking I/O queue.
RxSetMinirdrCancelRoutine RxSetMinirdrCancelRoutine is called by a network mini-redirector driver to set up a network mini-redirector cancel routine for an RX_CONTEXT structure.
_RxLog "_RxLog takes a format string and variable number of parameters and formats an output string for recording as an I/O error log entry if logging is enabled."
FsRtlCheckOplock The FsRtlCheckOplock routine synchronizes the IRP for a file I/O operation with the file's current opportunistic lock (oplock) state.
FsRtlNotifyFullChangeDirectory The FsRtlNotifyFullChangeDirectory routine creates a notify structure for a notification request and adds it to the specified notify list.
FsRtlOplockIsFastIoPossible FsRtlOplockIsFastIoPossible checks a file's opportunistic lock (oplock) state to determine whether fast I/O can be performed on the file.
RxChangeBufferingState RxChangeBufferingState is called to process a buffering state change request.
RxCompleteRequest RxCompleteRequest completes the IRP request associated with an RX_CONTEXT structure.
RxCompleteRequest_Real RxCompleteRequest_Real completes the IRP request associated with an RX_CONTEXT structure.
RxDereference RxDereference decrements the NodeReferenceCount member of a structure by one for several reference counted data structures used by RDBSS.
RxDriverEntry RxDriverEntry is called by a monolithic network mini-redirector driver from its DriverEntry routine to initialize the RDBSS static library.
RxFinalizeConnection RxFinalizeConnection deletes a connection to a share.
RxFinalizeNetFcb RxFinalizeNetFCB finalizes the given FCB structure. The caller must have an exclusive lock on the NET_ROOT associated with FCB.
RxForceFinalizeAllVNetRoots RxForceFinalizeAllVNetRoots force finalizes all the V_NET_ROOT structures associated with a given NET_ROOT structure. The caller must have an exclusive lock on the netname table associated with the device object.
RxFsdPostRequest RxFsdPostRequest queues the I/O request packet (IRP) specified by an RX_CONTEXT structure to the worker queue for processing by the file system process (FSP).
RxIndicateChangeOfBufferingState RxIndicateChangeOfBufferingState is called to register a change buffering state request (an oplock break indication, for example) for later processing. If necessary, worker thread routines for further processing are activated.
RxIndicateChangeOfBufferingStateForSrvOpen RxIndicateChangeOfBufferingStateForSrvOpen is called to register a change buffering state request (an oplock break indication, for example) for later processing. If the necessary preconditions are satisfied, the oplock is processed further.
RxIsThisACscAgentOpen RxIsThisACscAgentOpen determines if a file open was made by a user-mode client-side caching agent.
RxLockEnumerator RxLockEnumerator is called from a network mini-redirector to enumerate the file locks on an FCB.
RxLogEventDirect RxLogEventDirect is called to log an error to the I/O error log. It is recommended that the RXLogEvent macro or the RxLogFailure macro be used instead of calling this routine directly.
RxLogEventWithAnnotation RxLogEventWithAnnotation allocates an I/O error log structure, fills it in with information, and writes the entry to the I/O error log.
RxLogEventWithBufferDirect RxLogEventWithBufferDirect allocates an I/O error log structure, fills it in with information, and writes the entry to the I/O error log.
RxMapSystemBuffer RxMapSystemBuffer returns the system buffer address from the IRP.
RxPrepareToReparseSymbolicLink RxPrepareToReparseSymbolicLink sets up the file object name to facilitate a reparse. This routine is used by the network mini-redirectors to traverse symbolic links.
RxPurgeAllFobxs RxPurgeAllFobxs purges all of the FOBX structures associated with a network mini-redirector.
RxReference RxReference increments the NodeReferenceCount member of a structure by one for several of the reference counted data structures used by RDBSS.
RxScavengeAllFobxs RxScavengeAllFobxs scavenges all of the FOBX structures associated with a network mini-redirector device object.
RxSetSrvCallDomainName RxSetSrvCallDomainName is called by a network mini-redirector driver to set the domain name associated with any given server (SRV_CALL structure).
RxGetRDBSSProcess RxGetRDBSSProcess returns a pointer to the process of the main thread used by the RDBSS kernel process.
RxUnregisterMinirdr RxUnregisterMinirdr is an inline routine called by a network mini-redirector driver to de-register the driver with RDBSS and remove the registration information from the internal RDBSS registration table.
RxCancelTimerRequest RxCancelTimerRequest cancels a recurrent timer request. The request to be canceled is identified by the worker thread routine and associated context.
RxPostOneShotTimerRequest RxPostOneShotTimerRequest initializes a one-shot timer entry. The passed-in pointer to a worker thread routine is called once when the timer expires.
RxPostRecurrentTimerRequest RxPostRecurrentTimerRequest initializes a recurrent timer request. The passed in pointer to a worker thread routine is called at regular intervals when the recurrent timer fires based on the input parameters to this routine.
RxDispatchToWorkerThread RxDispatchToWorkerThread invokes a routine in the context of a worker thread. The memory for the WORK_QUEUE_ITEM is allocated by this routine.
RxPostToWorkerThread RxPostToWorkerThread invokes a routine passed as a parameter in the context of a worker thread. Memory for the WORK_QUEUE_ITEM must be allocated by the caller.
RxSpinDownMRxDispatcher RxSpinDownMRxDispatcher tears down the dispatcher context for a network mini-redirector.
RxPurgeRelatedFobxs RxPurgeRelatedFobxs purges all of the FOBX structures associated with a NET_ROOT structure.
RxScavengeFobxsForNetRoot RxScavengeFobxsForNetRoot scavenges all of the FOBX structures associated with a given NET_ROOT structure.
ExInitializeWorkItem ExInitializeWorkItem initializes a work-queue item with a caller-supplied context and callback routine to be queued for execution when a system worker thread is given control.
ExQueueWorkItem ExQueueWorkItem inserts a given work item into a queue from which a system worker thread removes the item and gives control to the routine that the caller supplied to ExInitializeWorkItem.
IoGetTopLevelIrp The IoGetTopLevelIrp routine returns the value of the TopLevelIrp field of the current thread.
IoSetTopLevelIrp The IoSetTopLevelIrp routine sets the value of the TopLevelIrp field of the current thread.
SeCaptureSubjectContext The SeCaptureSubjectContext routine captures the security context of the calling thread for access validation and auditing.
SeLockSubjectContext The SeLockSubjectContext routine locks the primary and impersonation tokens of a captured subject context.
SeReleaseSubjectContext The SeReleaseSubjectContext routine releases a subject security context captured by an earlier call to SeCaptureSubjectContext.
SeUnlockSubjectContext The SeUnlockSubjectContext routine unlocks the tokens of a captured subject context that were locked by a call to SeLockSubjectContext.

Structures

Title Description
_FLT_CALLBACK_DATA The FLT_CALLBACK_DATA structure represents an I/O operation. The Filter Manager and minifilters use this structure to initiate and process I/O operations.
_FLT_CALLBACK_DATA_QUEUE FLT_CALLBACK_DATA_QUEUE is an opaque structure that is used to specify the callback routines for a minifilter's callback data queue. Do not set the members of this structure directly. Use FltCbdqInitialize to initialize this structure.
_FLT_CONTEXT_REGISTRATION The FLT_CONTEXT_REGISTRATION structure is used to register context types.
_FLT_CREATEFILE_TARGET_ECP_CONTEXT The FLT_CREATEFILE_TARGET_ECP_CONTEXT structure is an extra create parameter (ECP) used to return reparse target information back to the caller of FltCreateFileEx2.
_FLT_FILE_NAME_INFORMATION The FLT_FILE_NAME_INFORMATION structure contains file name information.
_FLT_IO_PARAMETER_BLOCK The FLT_IO_PARAMETER_BLOCK structure contains the parameters for the I/O operation that is represented by a callback data (FLT_CALLBACK_DATA) structure.
_FLT_NAME_CONTROL A minifilter that provides file names for the Filter Manager's name cache can use the FLT_NAME_CONTROL structure to manage its name buffers.
_FLT_OPERATION_REGISTRATION The FLT_OPERATION_REGISTRATION structure is used to register operation callback routines.
_FLT_PARAMETERS The FLT_PARAMETERS union defines the request-type-specific parameters associated with an I/O operation.
_FLT_REGISTRATION The FLT_REGISTRATION structure is passed as a parameter to FltRegisterFilter.
_FLT_RELATED_CONTEXTS The FLT_RELATED_CONTEXTS structure contains a minifilter driver's contexts for the objects associated with an I/O operation.
_FLT_RELATED_CONTEXTS_EX The FLT_RELATED_CONTEXTS_EX structure contains a minifilter driver's contexts for the objects associated with an I/O operation.
_FLT_RELATED_OBJECTS The FLT_RELATED_OBJECTS structure contains opaque pointers for the objects associated with an operation.
_FLT_TAG_DATA_BUFFER The FLT_TAG_DATA_BUFFER structure contains information about a reparse point tag.
_FLT_VOLUME_PROPERTIES The FLT_VOLUME_PROPERTIES structure is passed as a parameter to FltGetVolumeProperties.
_FILTER_AGGREGATE_BASIC_INFORMATION The FILTER_AGGREGATE_BASIC_INFORMATION structure contains basic information for a minifilter or legacy filter driver.
_FILTER_AGGREGATE_STANDARD_INFORMATION The FILTER_AGGREGATE_STANDARD_INFORMATION structure contains information about a minifilter or legacy filter driver.
_FILTER_FULL_INFORMATION The FILTER_FULL_INFORMATION structure contains full information for a minifilter driver.
_FILTER_MESSAGE_HEADER The FILTER_MESSAGE_HEADER structure contains message header information.
_FILTER_REPLY_HEADER The FILTER_REPLY_HEADER structure contains message reply header information.
_FILTER_VOLUME_BASIC_INFORMATION The caller-allocated FILTER_VOLUME_BASIC_INFORMATION structure contains basic information for a volume.
_FILTER_VOLUME_STANDARD_INFORMATION The caller-allocated FILTER_VOLUME_STANDARD_INFORMATION structure contains information for a volume.
_INSTANCE_AGGREGATE_STANDARD_INFORMATION The caller-allocated INSTANCE_AGGREGATE_STANDARD_INFORMATION structure contains information for either a minifilter driver instance or a legacy filter driver.
_INSTANCE_BASIC_INFORMATION The INSTANCE_BASIC_INFORMATION structure contains basic information for a minifilter instance.
_INSTANCE_FULL_INFORMATION The INSTANCE_FULL_INFORMATION structure contains full information for a minifilter instance.
_INSTANCE_PARTIAL_INFORMATION The INSTANCE_PARTIAL_INFORMATION structure contains partial information for a minifilter instance.
_FILE_DISPOSITION_INFORMATION_EX The FILE_DISPOSITION_INFORMATION_EX structure is used as an argument to the ZwSetInformationFileEx routine and indicates how the operating system should delete a file.
_FILE_FS_FULL_SIZE_INFORMATION The FILE_FS_FULL_SIZE_INFORMATION structure is used to query sector size information for a file system volume.
_FILE_FS_LABEL_INFORMATION The FILE_FS_LABEL_INFORMATION structure is used to set the label for a file system volume.
_FILE_FS_OBJECTID_INFORMATION The FILE_FS_OBJECTID_INFORMATION structure is used to query or set the object ID for a file system volume.
_FILE_FS_SECTOR_SIZE_INFORMATION The FILE_FS_SECTOR_SIZE_INFORMATION structure is used to query physical and logical sector size information for a file system volume.
_FILE_FS_SIZE_INFORMATION The FILE_FS_SIZE_INFORMATION structure is used to query sector size information for a file system volume.
_FILE_FS_VOLUME_INFORMATION The FILE_FS_VOLUME_INFORMATION structure is used to query information about a volume on which a file system is mounted.
_IO_DRIVER_CREATE_CONTEXT The IO_DRIVER_CREATE_CONTEXT structure is used to pass additional parameters to the IoCreateFileEx and FltCreateFileEx2 routines.
_IO_FOEXT_SILO_PARAMETERS This structure describes the Container context that's identified by the IoGetSiloParameters routine.
_OPLOCK_KEY_CONTEXT The OPLOCK_KEY_CONTEXT structure is returned from IoGetOplockKeyContextEx. This structure contains oplock keys for a specific file object.
_RTL_AVL_TABLE The RTL_AVL_TABLE structure contains file system-specific data for an Adelson-Velsky/Landis (AVL) tree.
_RTL_GENERIC_TABLE The RTL_GENERIC_TABLE structure contains file system-specific data for a splay tree.
_RTL_SPLAY_LINKS The RTL_SPLAY_LINKS structure is an opaque structure and is used by the system to represent a splay link tree node.
_TXN_PARAMETER_BLOCK The TXN_PARAMETER_BLOCK structure contains information about a transacted file operation.
__PUBLIC_OBJECT_TYPE_INFORMATION The PUBLIC_OBJECT_TYPE_INFORMATION structure holds the type name of the object.
_ACCESS_ALLOWED_ACE The ACCESS_ALLOWED_ACE structure defines an access-control entry (ACE) for the discretionary access-control list (DACL) that controls access to an object.
_ACCESS_DENIED_ACE The ACCESS_DENIED_ACE structure defines an access-control entry (ACE) for the discretionary access-control list (DACL) controlling access to an object.
_ACE_HEADER The ACE_HEADER structure describes the type and size of an access-control entry (ACE).
_ATOMIC_CREATE_ECP_CONTEXT This structure allows supplemental operations to be performed on a file atomically during create.
_BOOT_AREA_INFO The BOOT_AREA_INFO structure contains the output for the FSCTL_GET_BOOT_AREA_INFO control code.
_ECP_OPEN_PARAMETERS The ECP_OPEN_PARAMETERS structure allows a caller to specify the purpose of opening of a file without interfering with existing handles and/or oplocks on the file.
_FILE_ALLOCATION_INFORMATION The FILE_ALLOCATION_INFORMATION structure is used to set the allocation size for a file.
_FILE_BOTH_DIR_INFORMATION The FILE_BOTH_DIR_INFORMATION structure is used to query detailed information for the files in a directory.
_FILE_COMPLETION_INFORMATION The FILE_COMPLETION_INFORMATION structure contains the port handle and key for an I/O completion port created for a file handle.
_FILE_COMPRESSION_INFORMATION The FILE_COMPRESSION_INFORMATION structure describes the state of a compressed data buffer.
_FILE_DIRECTORY_INFORMATION The FILE_DIRECTORY_INFORMATION structure is used to query detailed information for the files in a directory.
_FILE_FS_ATTRIBUTE_INFORMATION The FILE_FS_ATTRIBUTE_INFORMATION structure is used to query attribute information for a file system.
_FILE_FS_CONTROL_INFORMATION The FILE_FS_CONTROL_INFORMATION structure is used to query or set control information for the files in a directory.
_FILE_FS_DRIVER_PATH_INFORMATION The FILE_FS_DRIVER_PATH_INFORMATION structure is used to query whether a given driver is in the I/O path for a file system volume.
_FILE_FS_PERSISTENT_VOLUME_INFORMATION The FILE_FS_PERSISTENT_VOLUME_INFORMATION structure is used to control persistent settings for a file system volume. Persistent settings persist on a file system volume between reboots of the computer.
_FILE_FULL_DIR_INFORMATION The FILE_FULL_DIR_INFORMATION structure is used to query detailed information for the files in a directory.
_FILE_GET_EA_INFORMATION The FILE_GET_EA_INFORMATION structure is used to query for extended-attribute (EA) information.
_FILE_GET_QUOTA_INFORMATION The FILE_GET_QUOTA_INFORMATION structure is used to query for quota information.
_FILE_ID_BOTH_DIR_INFORMATION The FILE_ID_BOTH_DIR_INFORMATION structure is used to query file reference number information for the files in a directory.
_FILE_ID_EXTD_BOTH_DIR_INFORMATION The FILE_ID_EXTD_BOTH_DIR_INFORMATION structure is used to query file reference number information for the files in a directory.
_FILE_ID_FULL_DIR_INFORMATION The FILE_ID_FULL_DIR_INFORMATION structure is used to query detailed information for the files in a directory.
_FILE_ID_GLOBAL_TX_DIR_INFORMATION The FILE_ID_GLOBAL_TX_DIR_INFORMATION structure contains information about transactional visibility for the files in a directory.
_FILE_INTERNAL_INFORMATION The FILE_INTERNAL_INFORMATION structure is used to query for the file system's 8-byte file reference number for a file.
_FILE_LEVEL_TRIM The FILE_LEVEL_TRIM structure contains an array of byte ranges to trim for a file.
_FILE_LEVEL_TRIM_OUTPUT The FILE_LEVEL_TRIM_OUTPUT structure contains the results of a trim operation performed by an FSCTL_FILE_LEVEL_TRIM request.
_FILE_LEVEL_TRIM_RANGE Contains the offset and length of a trim range for a file.
_FILE_LINK_ENTRY_INFORMATION The FILE_LINK_ENTRY_INFORMATION structure describes a single NTFS hard link to an existing file.
_FILE_LINK_INFORMATION The FILE_LINK_INFORMATION structure is used to create an NTFS hard link to an existing file.
_FILE_LINKS_INFORMATION The FILE_LINKS_INFORMATION structure is used to query NTFS hard links to an existing file.
_FILE_MAILSLOT_QUERY_INFORMATION The FILE_MAILSLOT_QUERY_INFORMATION structure contains information about a mailslot.
_FILE_MAILSLOT_SET_INFORMATION The FILE_MAILSLOT_SET_INFORMATION structure is used to set a value on a mailslot.
_FILE_NAMES_INFORMATION A FILE_NAMES_INFORMATION structure used to query detailed information about the names of files in a directory.
_FILE_NETWORK_PHYSICAL_NAME_INFORMATION Contains the full UNC physical pathname for a file or directory on a remote file share.
_FILE_OBJECTID_INFORMATION The FILE_OBJECTID_INFORMATION structure is used to query for object ID information for the files in a directory on an NTFS volume.
_FILE_PIPE_INFORMATION The FILE_PIPE_INFORMATION structure contains information about a named pipe that is not specific to the local or the remote end of the pipe.
_FILE_PIPE_LOCAL_INFORMATION The FILE_PIPE_LOCAL_INFORMATION structure contains information about the local end of a named pipe.
_FILE_PIPE_REMOTE_INFORMATION The FILE_PIPE_REMOTE_INFORMATION structure contains information about the remote end of a named pipe.
_FILE_PROVIDER_EXTERNAL_INFO_V0 This structure may be altered or unavailable. Instead, use FILE_PROVIDER_EXTERNAL_INFO_V1.
_FILE_PROVIDER_EXTERNAL_INFO_V1 The FILE_PROVIDER_EXTERNAL_INFO_V1 structure defines metadata specific to files provided by WOF_PROVIDER_FILE.
_FILE_QUOTA_INFORMATION The FILE_QUOTA_INFORMATION structure is used to query or set per-user quota information for each of the files in a directory.
_FILE_RENAME_INFORMATION The FILE_RENAME_INFORMATION structure is used to rename a file.
_FILE_REPARSE_POINT_INFORMATION The FILE_REPARSE_POINT_INFORMATION structure is used to query for information about a reparse point.
_FILE_STREAM_INFORMATION The FILE_STREAM_INFORMATION structure is used to enumerate the streams for a file.
_FILE_TIMESTAMPS The FILE_TIMESTAMPS structure specifies the last recorded instance of specific actions on a file.
_FILE_ZERO_DATA_INFORMATION Contains a range of a file to set to zeros.
_FILE_ZERO_DATA_INFORMATION_EX Contains a range of a file to set to zeros.
_FS_FILTER_SECTION_SYNC_OUTPUT The FS_FILTER_SECTION_SYNC_OUTPUT structure contains information describing the attributes of the section that is being created.
_FSCTL_OFFLOAD_READ_INPUT The FSCTL_OFFLOAD_READ_INPUT structure contains the input for the FSCTL_OFFLOAD_READ control code request.
_FSCTL_OFFLOAD_READ_OUTPUT The FSCTL_OFFLOAD_READ_OUTPUT structure contains the output for the FSCTL_OFFLOAD_READ control code request.
_FSCTL_OFFLOAD_WRITE_INPUT The FSCTL_OFFLOAD_WRITE_INPUT structure contains the input for the FSCTL_OFFLOAD_WRITE control code request.
_FSCTL_OFFLOAD_WRITE_OUTPUT The FSCTL_OFFLOAD_WRITE_OUTPUT structure contains the output for the FSCTL_OFFLOAD_WRITE control code request.
_FSCTL_QUERY_VOLUME_NUMA_INFO_OUTPUT The FSCTL_QUERY_VOLUME_NUMA_INFO_OUTPUT structure specifies the Non-Uniform Memory Architecture (NUMA) node the volume resides on.
_FSRTL_ADVANCED_FCB_HEADER The FSRTL_ADVANCED_FCB_HEADER structure contains context information that a file system maintains about a file.
_FSRTL_COMMON_FCB_HEADER Do not use the FSRTL_COMMON_FCB_HEADER structure outside of the FSRTL_ADVANCED_FCB_HEADER structure.
_FSRTL_PER_FILE_CONTEXT A legacy file system filter driver can use a FSRTL_PER_FILE_CONTEXT structure to associate driver-specific context information to an open file.
_FSRTL_PER_FILEOBJECT_CONTEXT The opaque FSRTL_PER_FILEOBJECT_CONTEXT structure is used by the operating system to track file system filter-driver-defined context information structures for a file object.
_FSRTL_PER_STREAM_CONTEXT The FSRTL_PER_STREAM_CONTEXT structure contains context information that a file system filter driver maintains about a file stream.
_IO_PRIORITY_INFO The IO_PRIORITY_INFO structure is used to hold thread priority information.
_NETWORK_APP_INSTANCE_ECP_CONTEXT The NETWORK_APP_INSTANCE_ECP_CONTEXT structure is an Extra Create Parameter (ECP) and contains an application instance identifier to associate with a file.
_NETWORK_OPEN_ECP_CONTEXT The NETWORK_OPEN_ECP_CONTEXT structure is used to interpret network ECP contexts on files.
_NETWORK_OPEN_ECP_CONTEXT_V0 The NETWORK_OPEN_ECP_CONTEXT_V0 structure is used to interpret network ECP contexts on files.
_NFS_OPEN_ECP_CONTEXT The NFS_OPEN_ECP_CONTEXT structure is used by the Network File System (NFS) server to open files in response to client requests.
_OPEN_REPARSE_LIST Points to a list of OPEN_REPARSE_LIST_ENTRY structures that specify the tag and possibly GUID that should be opened directly without returning STATUS_REPARSE.
_OPEN_REPARSE_LIST_ENTRY This structure supports callers opening specific reparse points without inhibiting reparse behavior for all classes of reparse points.
_PREFETCH_OPEN_ECP_CONTEXT The PREFETCH_OPEN_ECP_CONTEXT structure communicates whether the prefetcher performs a given open request on a file.
_PUBLIC_OBJECT_BASIC_INFORMATION The PUBLIC_OBJECT_BASIC_INFORMATION structure holds a subset of the full information that is available for an object.
_QUERY_FILE_LAYOUT_INPUT The QUERY_FILE_LAYOUT_INPUT structure selects which file layout entries are returned from a FSCTL_QUERY_FILE_LAYOUT request.
_QUERY_FILE_LAYOUT_OUTPUT The QUERY_FILE_LAYOUT_OUTPUT structure serves as a header for the file layout entries that are returned from a FSCTL_QUERY_FILE_LAYOUT request.
_REFS_SMR_VOLUME_GC_PARAMETERS The REFS_SMR_VOLUME_GC_PARAMETERS structure.
_REFS_SMR_VOLUME_INFO_OUTPUT The REFS_SMR_VOLUME_INFO_OUTPUT structure describes a Shingled Magnetic Recording (SMR) volume's current state on space and garbage collection activities.
_REPARSE_DATA_BUFFER The REPARSE_DATA_BUFFER structure contains reparse point data for a Microsoft reparse point.
_REPARSE_GUID_DATA_BUFFER The REPARSE_GUID_DATA_BUFFER structure contains reparse point data for a reparse point.
_SE_EXPORTS The SeExports structure is a large external static SE_EXPORTS structure that defines a number of well-known security constants for privilege values and security identifiers.
_SE_SID The SE_SID union holds the maximum-sized valid Security Identifier (SID). The structure occupies 68-bytes and is suitable for stack allocation.
_SE_TOKEN_USER The SE_TOKEN_USER structure holds the maximum-sized valid user SID that can be returned by SeQueryInformationToken, GetTokenInformation, or ZwQueryInformationToken with the TokenUser information class. This structure is suitable for stack allocation.
_SECURITY_DESCRIPTOR The SECURITY_DESCRIPTOR structure contains the security information associated with an object. Drivers use this structure to set and query an object's security status.
_SET_DAX_ALLOC_ALIGNMENT_HINT_INPUT This structure is for internal use only and should not be called from your code.
_SID The security identifier (SID) structure is a variable-length structure used to uniquely identify users or groups.
_SID_AND_ATTRIBUTES The SID_AND_ATTRIBUTES structure represents a security identifier (SID) and its attributes. SIDs are used to uniquely identify users or groups.
_SID_IDENTIFIER_AUTHORITY The SID_IDENTIFIER_AUTHORITY structure represents the top-level authority of a security identifier (SID).
_SRV_OPEN_ECP_CONTEXT The SRV_OPEN_ECP_CONTEXT structure is used by a server to conditionally open files in response to client requests.
_SYSTEM_ALARM_ACE Reserved for future use.
_SYSTEM_AUDIT_ACE The SYSTEM_AUDIT_ACE structure defines an access-control entry (ACE) for the system access-control list (ACL) specifying what types of access cause system-level notifications.
_SYSTEM_PROCESS_TRUST_LABEL_ACE Reserved.
_SYSTEM_RESOURCE_ATTRIBUTE_ACE The SYSTEM_RESOURCE_ATTRIBUTE_ACE structure defines an access-control entry (ACE) for the system access-control list (ACL) specifying what rights a particular claim has to a resource.
_SYSTEM_SCOPED_POLICY_ID_ACE The SYSTEM_SCOPED_POLICY_ID_ACE structure defines an access-control entry (ACE) for the system access-control list (ACL) specifying rights for a scoped policy identifer.
_TOKEN_CONTROL The TOKEN_CONTROL structure contains information that identifies an access token.
_TOKEN_DEFAULT_DACL The TOKEN_DEFAULT_DACL structure specifies a discretionary access-control list (DACL).
_TOKEN_GROUPS TOKEN_GROUPS contains information about the group security identifiers (SID) in an access token.
_TOKEN_GROUPS_AND_PRIVILEGES TOKEN_GROUPS_AND_PRIVILEGES contains information about the group security identifiers (SIDs) and privileges in an access token.
_TOKEN_ORIGIN The TOKEN_ORIGIN structure contains information about the origin of the logon session.
_TOKEN_OWNER TOKEN_OWNER contains the default owner security identifier (SID) that will be applied to newly created objects.
_TOKEN_PRIMARY_GROUP TOKEN_PRIMARY_GROUP specifies a group security identifier (SID) for an access token.
_TOKEN_PRIVILEGES TOKEN_PRIVILEGES contains information about a set of privileges for an access token.
_TOKEN_SOURCE TOKEN_SOURCE identifies the source of an access token.
_TOKEN_STATISTICS TOKEN_STATISTICS contains information about an access token. A driver can retrieve this information by calling SeQueryInformationToken or ZwQueryInformationToken.
_TOKEN_USER TOKEN_USER identifies the user associated with an access token.
_WIM_PROVIDER_ADD_OVERLAY_INPUT A new Windows Image File (WIM) data source is added to the WIM provider with the WIM_PROVIDER_ADD_OVERLAY_INPUT structure.
_WIM_PROVIDER_EXTERNAL_INFO The WIM_PROVIDER_EXTERNAL_INFO structure holds the identifier and status information for the Windows Image File (WIM) external backing provider.
_WIM_PROVIDER_OVERLAY_ENTRY Contains the a Windows Image Format (WIM) file configuration information for a data source entry. It is used to identify specific WIM file names and indices that supply data to externally backed files on a volume.
_WIM_PROVIDER_REMOVE_OVERLAY_INPUT A Windows Image File (WIM) data source to remove from the WIM provider is specified in the WIM_PROVIDER_REMOVE_OVERLAY_INPUT structure.
_WIM_PROVIDER_SUSPEND_OVERLAY_INPUT A Windows Image File (WIM) data source to suspend from the WIM provider is specified in the WIM_PROVIDER_SUSPEND_OVERLAY_INPUT structure.
_WIM_PROVIDER_UPDATE_OVERLAY_INPUT A current Windows Image File (WIM) data source is updated with a new WIM file using the FSCTL_UPDATE_OVERLAY control request with a WIM_PROVIDER_UPDATE_OVERLAY_INPUT structure.
_WOF_EXTERNAL_FILE_ID The WOF_EXTERNAL_FILE_ID structure contains a file ID that is used to open a handle to a mini-filter or driver.
_WOF_EXTERNAL_INFO The WOF_EXTERNAL_INFO structure identifies a file backing provider and the overlay service version it supports.
_WOF_VERSION_INFO The WOF_VERSION_INFO structure contains the version corresponding to the driver supporting a given provider.
MARK_HANDLE_INFO32 Contains information that is used to mark a specified file or directory, and its update sequence number (USN) change journal record with data about changes.
_RX_CONTEXT The RX_CONTEXT structure encapsulates an IRP for use by RDBSS, network mini-redirectors, and the file system.
_ACCESS_STATE The ACCESS_STATE structure describes the state of an access in progress.
_ACL The ACL structure is the header of an access-control list (ACL). A complete ACL consists of an ACL structure followed by an ordered list of zero or more access-control entries (ACE).
_FAST_IO_DISPATCH Contains a set of callback routines that a file system driver or file system filter driver (legacy) provides for fast I/O processing.
_FILE_MEMORY_PARTITION_INFORMATION Stores information about memory partition. This structure is used by the ZwSetInformationFile function.
_LUID_AND_ATTRIBUTES LUID_AND_ATTRIBUTES represents a locally unique identifier (LUID) and its attributes.
_SECURITY_SUBJECT_CONTEXT The SECURITY_SUBJECT_CONTEXT structure is used to capture subject security context for access validation and auditing.
_VPB The volume parameter block (VPB) structure is used to map a device object that represents a mounted file system volume to a device object that represents a physical or virtual disk device.
_WORK_QUEUE_ITEM The WORK_QUEUE_ITEM structure is used to post a work items to a system work queue.