BeforeFsctl Event

Fires before an IRP_MJ_FILE_SYSTEM_CONTROL request is processed.

Syntax

public class DefaultCbfilterEventListener implements CbfilterEventListener {
  ...
  public void beforeFsctl(CbfilterBeforeFsctlEvent e) {}
  ...
}

public class CbfilterBeforeFsctlEvent {
  public String fileName;
  public int fsControlCode;
  public ByteBuffer inBuffer;
  public int inBufferLength;
  public int inBufferValidBytes;
  public ByteBuffer outBuffer;
  public int outBufferLength;
  public int outBufferValidBytes;
  public boolean processRequest;
  public int resultCode;
}

Remarks

This event fires before an IRP_MJ_FILE_SYSTEM_CONTROL (FSCTL) request is processed. Such requests are sent using the Windows API's DeviceIoControl function (user mode), or ZwFsControlFile function (kernel mode); please refer to Microsoft's documentation for more information.

Applications may use this event to modify the input data (if there is any) before the request continues onward. Applications that choose to do this must:

1. Copy no more than InBufferLength bytes into InBuffer.
2. Update the InBufferValidBytes parameter's value afterwards so that it correctly reflects the amount of data in InBuffer.

Alternatively, applications may use this event to handle the request (preventing it from continuing onward), in which case they must:

1. Copy no more than OutBufferLength bytes into OutBuffer.
2. Update the OutBufferValidBytes parameter's value afterwards so that it correctly reflects the amount of data in OutBuffer.
3. Set ProcessRequest to false to indicate that the request has been handled and should not continue onward.

(The first two steps are not applicable if the requested operation is not expected to return data.)

Applications only need to handle this event if they've added a standard filter rule that includes the FS_CE_BEFORE_FSCTL flag.

The FileName parameter reflects the file, directory, or volume targeted by the request.

The FsControlCode parameter reflects the requested filesystem control code (FSCTL).

The InBuffer parameter points to a memory buffer that contains the data required to perform the operation. The InBufferLength and InBufferValidBytes parameters reflect the capacity of InBuffer and the length of the data it contains (respectively), in bytes; InBufferValidBytes may be less than InBufferLength (unless the request did not include data, in which case both will be 0).

The OutBuffer parameter points to a memory buffer that receives the data returned by the operation. The OutBufferLength and OutBufferValidBytes parameters reflect the capacity of OutBuffer and the length of the data it contains (respectively), in bytes; OutBufferValidBytes may be less than OutBufferLength (unless the operation is not expected to return data, in which case both will be 0).

Please refer to the Buffer Parameters topic for more information on how to work with memory buffer event parameters.

The ProcessRequest parameter controls whether the request is sent onwards for further processing by subsequent filter drivers and the filesystem; it is true by default.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason (e.g., a resource isn't available, security checks failed, etc.), set it to a non-zero value to report an appropriate error. Please refer to the Error Reporting and Handling topic for more information.

This event is fired synchronously; please refer to the Event Types topic for more information.