ntifs.h

一个过滤层文件系统驱动的完整代码,实现了文件的加密,操作截获等

          ZwRequestPort
          ZwUnlockFile
          ZwWriteRequestData

    24. 2001-03-08
        Corrected:
          EPROCESS
          ETHREAD
          FAST_IO_POSSIBLE
          QueryEa in EXTENDED_IO_STACK_LOCATION
        Added:
          Defines:
            Some more flags for FileSystemAttributes
          Data types:
            EXCEPTION_REGISTRATION_RECORD
            FILE_FS_FULL_SIZE_INFORMATION
            FILE_FS_OBJECT_ID_INFORMATION
            HANDLE_TABLE_ENTRY
            IO_CLIENT_EXTENSION
            PS_IMPERSONATION_INFORMATION
            SetEa and SetQuota in EXTENDED_IO_STACK_LOCATION
          Function prototypes:
            IoPageRead
            KeStackAttachProcess
            KeUnstackDetachProcess
            MmMapViewOfSection
            RtlSelfRelativeToAbsoluteSD
            SeCreateAccessState

    23. 2001-01-29
        Corrected:
          FSCTL_GET_VOLUME_INFORMATION
          FSCTL_READ_MFT_RECORD
          HARDWARE_PTE
          EPROCESS
          ETHREAD
          KAPC_STATE
          KPROCESS
          KTHREAD
          MMSUPPORT
        Added:
          Data types:
            KGDTENTRY
            KIDTENTRY
            MMSUPPORT_FLAGS

    22. 2000-12-23
        Corrected:
          EPROCESS
          KPROCESS
        Added:
          Data types:
            HARDWARE_PTE
            MMSUPPORT

    21. 2000-12-12
        Added:
          Defines:
            IO_TYPE_XXX
            OB_TYPE_XXX
            THREAD_STATE_XXX
          Data types:
            EPROCESS
            ETHREAD
            KAPC_STATE
            KEVENT_PAIR
            KPROCESS
            KTHREAD
            KQUEUE
            SERVICE_DESCRIPTOR_TABLE
            TEB

    20. 2000-12-03
        Added:
          Data types:
            OBJECT_TYPE
          Function prototypes:
            ObCreateObject
            ObInsertObject
            ObReferenceObjectByName

    19. 2000-11-25
        Removed a name from credits since the person want to be anonymous.

    18. 2000-10-13
        Corrected:
          PsReferenceImpersonationToken
        Added:
          Defines:
            FILE_PIPE_XXX
            LPC_XXX
            MAILSLOT_XXX
            PORT_XXX
            FSCTL_GET_VOLUME_INFORMATION
            FSCTL_READ_MFT_RECORD
            FSCTL_MAILSLOT_PEEK
            FSCTL_PIPE_XXX
          Data types:
            PORT_INFORMATION_CLASS
            BITMAP_DESCRIPTOR
            FILE_MAILSLOT_XXX
            FILE_PIPE_XXX
            MAPPING_PAIR
            GET_RETRIEVAL_DESCRIPTOR
            LPC_XXX
            MOVEFILE_DESCRIPTOR
          Function prototypes:
            InitializeMessageHeader
            MmForceSectionClosed
            ZwAcceptConnectPort
            ZwCompleteConnectPort
            ZwConnectPort
            ZwCreateEvent
            ZwCreatePort
            ZwImpersonateClientOfPort
            ZwListenPort
            ZwQueryInformationPort
            ZwReadRequestData
            ZwReplyPort
            ZwReplyWaitReceivePort
            ZwReplyWaitReplyPort
            ZwRequestPort
            ZwRequestWaitReplyPort
            ZwWriteRequestData

    17. 2000-05-21
        Added:
          Function prototypes:
            PsRevertToSelf
            SeCreateClientSecurity
            SeImpersonateClient
            ZwDuplicateObject

    16. 2000-03-28
        Added:
          Defines:
            FILE_STORAGE_TYPE_XXX
            FILE_VC_XXX
            IO_CHECK_CREATE_PARAMETERS
            IO_ATTACH_DEVICE
            IO_ATTACH_DEVICE_API
            IO_COMPLETION_XXX
          Data types:
            IO_COMPLETION_INFORMATION_CLASS
            OBJECT_INFO_CLASS
            SYSTEM_INFORMATION_CLASS
            FILE_LOCK_ANCHOR
            IO_COMPLETION_BASIC_INFORMATION
            OBJECT_BASIC_INFO
            OBJECT_NAME_INFO
            OBJECT_PROTECTION_INFO
            OBJECT_TYPE_INFO
            OBJECT_ALL_TYPES_INFO
            SYSTEM_CACHE_INFORMATION
          Function prototypes:
            FsRtlAllocatePool
            FsRtlAllocatePoolWithQuota
            FsRtlAllocatePoolWithQuotaTag
            FsRtlAllocatePoolWithTag
            FsRtlAreNamesEqual
            FsRtlFastCheckLockForRead
            FsRtlFastCheckLockForWrite
            FsRtlMdlReadComplete
            FsRtlMdlWriteComplete
            FsRtlNormalizeNtstatus
            RtlAllocateHeap
            RtlCreateHeap
            RtlDestroyHeap
            RtlFreeHeap
            RtlImageNtHeader
            ZwQueryObject
            ZwQuerySystemInformation
            ZwSetSystemInformation

    15. 2000-03-15
        Corrected:
          Renamed IoQueryFileVolumeInformation to IoQueryVolumeInformation
        Comment on:
          CcZeroEndOfLastPage

    14. 2000-03-12
        Corrected:
          IoCreateFile
        Added:
          #if (_WIN32_WINNT < 0x0500)/#endif around stuff that is included in
          the Windows 2000 DDK but is missing in the Windows NT 4.0 DDK.
          ZwOpenEvent

    13. 2000-02-08
        Corrected:
          PsReferenceImpersonationToken
        Comment on:
          RtlAllocateAndInitializeSid

    12. 1999-10-18
        Corrected:
          FILE_COMPRESSION_INFORMATION
        Added:
          Defines:
            ACCESS_ALLOWED_ACE_TYPE
            ACCESS_DENIED_ACE_TYPE
            SYSTEM_AUDIT_ACE_TYPE
            SYSTEM_ALARM_ACE_TYPE
            ANSI_DOS_STAR/QM/DOT
            DOS_STAR/QM/DOT
            FILE_EA_TYPE_XXX
            FILE_NEED_EA
            FILE_OPBATCH_BREAK_UNDERWAY
            SECURITY_WORLD_SID_AUTHORITY
            SECURITY_WORLD_RID
          Data types:
            POBJECT
            FILE_STORAGE_TYPE
            FILE_COMPLETION_INFORMATION
            FILE_COPY_ON_WRITE_INFORMATION
            FILE_FS_CONTROL_INFORMATION
            FILE_GET_EA_INFORMATION
            FILE_GET_QUOTA_INFORMATION
            FILE_OBJECTID_INFORMATION
            FILE_OLE_CLASSID_INFORMATION
            FILE_OLE_ALL_INFORMATION
            FILE_OLE_DIR_INFORMATION
            FILE_OLE_INFORMATION
            FILE_OLE_STATE_BITS_INFORMATION
            FILE_QUOTA_INFORMATION
          Function prototypes:
            HalDisplayString
            HalMakeBeep
            IoGetRequestorProcess
            ObQueryNameString
            ProbeForWrite
            RtlAbsoluteToSelfRelativeSD
            RtlGetDaclSecurityDescriptor
            RtlGetGroupSecurityDescriptor
            RtlGetOwnerSecurityDescriptor
            RtlInitializeSid
            RtlSetGroupSecurityDescriptor
            RtlSetOwnerSecurityDescriptor
            RtlSetSaclSecurityDescriptor
            ZwDeleteValueKey
            ZwDisplayString
            ZwQueryDirectoryObject

    11. 1999-10-13
        Corrected:
          ZwOpenProcessToken
          ZwOpenThreadToken
        Added:
          Function prototypes:
            RtlAllocateAndInitializeSid
            RtlCopySid
            RtlEqualSid
            RtlFillMemoryUlong
            RtlIsNameLegalDOS8Dot3
            RtlLengthRequiredSid
            RtlLengthSid
            RtlNtStatusToDosError
            RtlSubAuthorityCountSid
            RtlSubAuthoritySid
            RtlValidSid

    10. 1999-07-15
        Corrected:
          RtlConvertSidToUnicodeString
        Added:
          Externals:
            FsRtlLegalAnsiCharacterArray
            NtBuildNumber
          Defines:
            FSRTL_WILD_CHARACTER
            FlagOn
            FsRtlIsUnicodeCharacterWild
          Structures:
            FILE_ACCESS_INFORMATION
            FILE_MODE_INFORMATION
            GENERATE_NAME_CONTEXT
          Function prototypes:
            FsRtlDoesNameContainWildCards
            FsRtlIsNameInExpression
            IoSetInformation
            RtlGenerate8dot3Name
            ZwQuerySecurityObject

    9. 1999-07-12
       Corrected:
         EXTENDED_IO_STACK_LOCATION
         QueryDirectory in EXTENDED_IO_STACK_LOCATION
         ZwCreateThread
       Added:
         Structures:
           INITIAL_TEB
         Function prototypes:
           ZwQuerySymbolicLinkObject

    8. 1999-06-07
       Corrected:
         ZwOpenProcessToken
         ZwOpenThreadToken
       Added:
         Defines:
           FILE_OPLOCK_BROKEN_TO_LEVEL_2
           FILE_OPLOCK_BROKEN_TO_NONE
           FILE_CASE_SENSITIVE_SEARCH
           FILE_CASE_PRESERVED_NAMES
           FILE_UNICODE_ON_DISK
           FILE_PERSISTENT_ACLS
           FILE_FILE_COMPRESSION
           FILE_VOLUME_IS_COMPRESSED
           FSRTL_FLAG_ACQUIRE_MAIN_RSRC_EX
           FSRTL_FLAG_ACQUIRE_MAIN_RSRC_SH
           IOCTL_REDIR_QUERY_PATH
         Structures:
           FILE_FS_LABEL_INFORMATION
           PATHNAME_BUFFER
         In IO_STACK_LOCATION:
           FileSystemControl
           LockControl
           SetVolume
         Function prototypes:
           FsRtlCopyRead
           FsRtlCopyWrite
           IoVerifyVolume

    7. 1999-06-05
       Added:
         defines for TOKEN_XXX
         SID_NAME_USE
         TOKEN_INFORMATION_CLASS
         TOKEN_TYPE
         FILE_FS_ATTRIBUTE_INFORMATION
         FILE_FS_SIZE_INFORMATION
         SID_IDENTIFIER_AUTHORITY
         SID
         SID_AND_ATTRIBUTES
         TOKEN_CONTROL
         TOKEN_DEFAULT_DACL
         TOKEN_GROUPS
         TOKEN_OWNER