The FwpsAcquireWritableLayerDataPointer0 function returns layer-specific data that can be inspected and changed.
NTSTATUS FwpsAcquireWritableLayerDataPointer0( UINT64 classifyHandle, UINT64 filterId, UINT32 flags, PVOID *writableLayerData, FWPS_CLASSIFY_OUT0 *classifyOut );
A handle for the classify request. This handle is obtained by calling FwpsAcquireClassifyHandle0.
Reserved for future use. Set to zero.
A data buffer that contains the modifiable data for the layer. The supported data types, which are listed in the following Remarks section, are defined as structures. On return, the data can be accessed by casting the void pointer to the appropriate structure type.
Set to the classifyOut parameter of the callout driver's classifyFn function. The classifyOut parameter of classifyFn is listed as an output parameter in the header, but it contains enough information on input to be useful to the engine when passed to FwpsAcquireWritableLayerDataPointer0.
The FwpsAcquireWritableLayerDataPointer0 function returns one of the following NTSTATUS codes.
||The callback function was successfully registered.|
||An error occurred.|
FwpsAcquireWritableLayerDataPointer0 sets the following members of the FWPS_CLASSIFY_OUT0 structure:
- classifyOut->actionType = FWP_ACTION_BLOCK
- classifyOut->rights = ~FWPS_RIGHT_ACTION_WRITE
For every call to this function, you must make a matching call to FwpsApplyModifiedLayerData0 to finalize the changes that were made, even if your callout driver didn't modify any data. If you do not make the call to FwpsApplyModifiedLayerData0, this could result in the classify not completing correctly.
The following structures are defined to contain modifiable layer data. The pointer set on output as the writableLayerData parameter can be cast to one of these types:
|Windows version||Available starting with Windows 7.|
|Header||fwpsk.h (include Fwpsk.h)|