FsFilterGetCallbacks
VOID __stdcall FsFilterGetCallbacks(
UINT8 Operation,
PDEVICE_OBJECT DeviceObject,
PFS_FILTER_CALLBACK *PreOperationCallback,
PFS_FILTER_COMPLETION_CALLBACK *PostOperationCallback){
_FS_FILTER_CALLBACKS *FsFilterCallbacks;
unsigned int v5;
int(__fastcall *PreReleaseForSectionSynchronization)(_FS_FILTER_CALLBACK_DATA *, void **);
void(__fastcall *PostReleaseForSectionSynchronization)(_FS_FILTER_CALLBACK_DATA *, int, void *);
unsigned int SizeOfFsFilterCallbacks;
int(__fastcall *PreAcquireForSectionSynchronization)(_FS_FILTER_CALLBACK_DATA *, void **);
void(__fastcall *PostAcquireForSectionSynchronization)(_FS_FILTER_CALLBACK_DATA *, int, void *);
unsigned int v11;
int(__fastcall *PreAcquireForModifiedPageWriter)(_FS_FILTER_CALLBACK_DATA *, void **);
void(__fastcall *PostAcquireForModifiedPageWriter)(_FS_FILTER_CALLBACK_DATA *, int, void *);
unsigned int v14;
int(__fastcall *PreAcquireForCcFlush)(_FS_FILTER_CALLBACK_DATA *, void **);
void(__fastcall *PostAcquireForCcFlush)(_FS_FILTER_CALLBACK_DATA *, int, void *);
unsigned int v17;
int(__fastcall *PreReleaseForCcFlush)(_FS_FILTER_CALLBACK_DATA *, void **);
void(__fastcall *PostReleaseForCcFlush)(_FS_FILTER_CALLBACK_DATA *, int, void *);
unsigned int v20;
int(__fastcall *PreReleaseForModifiedPageWriter)(_FS_FILTER_CALLBACK_DATA *, void **);
void(__fastcall *PostReleaseForModifiedPageWriter)(_FS_FILTER_CALLBACK_DATA *, int, void *);
unsigned int v23;
int(__fastcall *PreQueryOpen)(_FS_FILTER_CALLBACK_DATA *, void **);
void(__fastcall *PostQueryOpen)(_FS_FILTER_CALLBACK_DATA *, int, void *);
*PreOperationCallback = 0i64;
*PostOperationCallback = 0i64;
FsFilterCallbacks = DeviceObject->DriverObject->DriverExtension->FsFilterCallbacks;
if( FsFilterCallbacks )
{
switch( Operation )
{
case 0xFFu:
SizeOfFsFilterCallbacks = FsFilterCallbacks->SizeOfFsFilterCallbacks;
if( FsFilterCallbacks->SizeOfFsFilterCallbacks >= 0x10 )
{
PreAcquireForSectionSynchronization = FsFilterCallbacks->PreAcquireForSectionSynchronization;
if( PreAcquireForSectionSynchronization )
*PreOperationCallback = PreAcquireForSectionSynchronization;
}
if( SizeOfFsFilterCallbacks >= 0x18 )
{
PostAcquireForSectionSynchronization = *PostOperationCallback;
if( FsFilterCallbacks->PostAcquireForSectionSynchronization )
PostAcquireForSectionSynchronization = FsFilterCallbacks->PostAcquireForSectionSynchronization;
*PostOperationCallback = PostAcquireForSectionSynchronization;
}
break;
case 0xFEu:
v5 = FsFilterCallbacks->SizeOfFsFilterCallbacks;
if( FsFilterCallbacks->SizeOfFsFilterCallbacks >= 0x20 )
{
PreReleaseForSectionSynchronization = *PreOperationCallback;
if( FsFilterCallbacks->PreReleaseForSectionSynchronization )
PreReleaseForSectionSynchronization = FsFilterCallbacks->PreReleaseForSectionSynchronization;
*PreOperationCallback = PreReleaseForSectionSynchronization;
}
if( v5 >= 0x28 )
{
PostReleaseForSectionSynchronization = FsFilterCallbacks->PostReleaseForSectionSynchronization;
if( PostReleaseForSectionSynchronization )
*PostOperationCallback = PostReleaseForSectionSynchronization;
}
break;
case 0xF9u:
v23 = FsFilterCallbacks->SizeOfFsFilterCallbacks;
if( FsFilterCallbacks->SizeOfFsFilterCallbacks >= 0x70 )
{
PreQueryOpen = FsFilterCallbacks->PreQueryOpen;
if( PreQueryOpen )
*PreOperationCallback = PreQueryOpen;
}
if( v23 >= 0x78 )
{
PostQueryOpen = FsFilterCallbacks->PostQueryOpen;
if( PostQueryOpen )
*PostOperationCallback = PostQueryOpen;
}
break;
case 0xFAu:
v17 = FsFilterCallbacks->SizeOfFsFilterCallbacks;
if( FsFilterCallbacks->SizeOfFsFilterCallbacks >= 0x40 )
{
PreReleaseForCcFlush = *PreOperationCallback;
if( FsFilterCallbacks->PreReleaseForCcFlush )
PreReleaseForCcFlush = FsFilterCallbacks->PreReleaseForCcFlush;
*PreOperationCallback = PreReleaseForCcFlush;
}
if( v17 >= 0x48 )
{
PostReleaseForCcFlush = FsFilterCallbacks->PostReleaseForCcFlush;
if( PostReleaseForCcFlush )
*PostOperationCallback = PostReleaseForCcFlush;
}
break;
case 0xFBu:
v14 = FsFilterCallbacks->SizeOfFsFilterCallbacks;
if( FsFilterCallbacks->SizeOfFsFilterCallbacks >= 0x30 )
{
PreAcquireForCcFlush = *PreOperationCallback;
if( FsFilterCallbacks->PreAcquireForCcFlush )
PreAcquireForCcFlush = FsFilterCallbacks->PreAcquireForCcFlush;
*PreOperationCallback = PreAcquireForCcFlush;
}
if( v14 >= 0x38 )
{
PostAcquireForCcFlush = FsFilterCallbacks->PostAcquireForCcFlush;
if( PostAcquireForCcFlush )
*PostOperationCallback = PostAcquireForCcFlush;
}
break;
case 0xFCu:
v20 = FsFilterCallbacks->SizeOfFsFilterCallbacks;
if( FsFilterCallbacks->SizeOfFsFilterCallbacks >= 0x60 )
{
PreReleaseForModifiedPageWriter = *PreOperationCallback;
if( FsFilterCallbacks->PreReleaseForModifiedPageWriter )
PreReleaseForModifiedPageWriter = FsFilterCallbacks->PreReleaseForModifiedPageWriter;
*PreOperationCallback = PreReleaseForModifiedPageWriter;
}
if( v20 >= 0x68 )
{
PostReleaseForModifiedPageWriter = FsFilterCallbacks->PostReleaseForModifiedPageWriter;
if( PostReleaseForModifiedPageWriter )
*PostOperationCallback = PostReleaseForModifiedPageWriter;
}
break;
case 0xFDu:
v11 = FsFilterCallbacks->SizeOfFsFilterCallbacks;
if( FsFilterCallbacks->SizeOfFsFilterCallbacks >= 0x50 )
{
PreAcquireForModifiedPageWriter = *PreOperationCallback;
if( FsFilterCallbacks->PreAcquireForModifiedPageWriter )
PreAcquireForModifiedPageWriter = FsFilterCallbacks->PreAcquireForModifiedPageWriter;
*PreOperationCallback = PreAcquireForModifiedPageWriter;
}
if( v11 >= 0x58 )
{
PostAcquireForModifiedPageWriter = FsFilterCallbacks->PostAcquireForModifiedPageWriter;
if( PostAcquireForModifiedPageWriter )
*PostOperationCallback = PostAcquireForModifiedPageWriter;
}
break;
}
}
}Referenced by:
FsFilterPerformCallbacks