NTSTATUS InstanceSetupCallback()

in Silhouette/Filter_Main.cpp [229:278]

• 37 lines of code
• 3 McCabe index (conditional complexity)

NTSTATUS InstanceSetupCallback(
    PCFLT_RELATED_OBJECTS FltObjects,
    FLT_INSTANCE_SETUP_FLAGS Flags,
    DEVICE_TYPE VolumeDeviceType,
    FLT_FILESYSTEM_TYPE VolumeFilesystemType
)
{
    UNREFERENCED_PARAMETER(FltObjects);
    UNREFERENCED_PARAMETER(Flags);
    UNREFERENCED_PARAMETER(VolumeDeviceType);
    UNREFERENCED_PARAMETER(VolumeFilesystemType);

    NTSTATUS ntStatus = STATUS_SUCCESS;
    UNICODE_STRING volumeName = { 0, };
    PWCHAR pBuffer = NULL;
    ULONG volumeNameLength = 0;

    ntStatus = FltGetVolumeName(FltObjects->Volume, NULL, &volumeNameLength);
    pBuffer = (PWCHAR)ExAllocatePoolWithTag(PagedPool, volumeNameLength, POOL_TAG);
    if (!pBuffer)
    {
        ntStatus = STATUS_INSUFFICIENT_RESOURCES;
        goto Cleanup;
    }

    RtlInitEmptyUnicodeString(&volumeName, pBuffer, (USHORT)volumeNameLength);
    ntStatus = FltGetVolumeName(FltObjects->Volume, &volumeName, &volumeNameLength);
    if (!NT_SUCCESS(ntStatus))
    {
        goto Cleanup;
    }
    
    // Volume Reads
    // Flags == FLTFL_INSTANCE_SETUP_AUTOMATIC_ATTACHMENT
    // VolumeDeviceType == FILE_DEVICE_DISK_FILE_SYSTEM
    // VolumeFilesystemType == FLT_FSTYPE_NTFS

    // TODO: Raw disk reads

#if 0
    DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, 
        "Silhouette: InstanceSetupCallback for Flags: 0x%x DevType: %u FS: %u for %wZ\n",
        Flags, VolumeDeviceType, VolumeFilesystemType, &volumeName);
#endif

Cleanup:
    PoolDeleteWithTag(pBuffer, POOL_TAG);

    return STATUS_SUCCESS;
}