// Auto-generated script #include static main(void) { auto i, ea, fcttype; Message("Started\n"); for(i = 0; i < GetEntryPointQty(); i++) { ea = GetEntryPoint(GetEntryOrdinal(i)); if((ea != BADADDR) && (GetFunctionName(ea) == "_FltAcquirePushLockExclusive@4")) { fcttype = "void FltAcquirePushLockExclusive(PVOID PushLock);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltAcquirePushLockShared@4")) { fcttype = "void FltAcquirePushLockShared(PVOID PushLock);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltAcquireResourceExclusive@4")) { fcttype = "void FltAcquireResourceExclusive(PERESOURCE Resource);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltAcquireResourceShared@4")) { fcttype = "void FltAcquireResourceShared(PERESOURCE Resource);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltAllocateCallbackData@12")) { fcttype = "NTSTATUS __stdcall FltAllocateCallbackData(PVOID Instance, PFILE_OBJECT FileObject, PVOID *RetNewCallbackData);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltAllocateContext@20")) { fcttype = "NTSTATUS __stdcall FltAllocateContext(PVOID Filter, USHORT ContextType, SIZE_T ContextSize, POOL_TYPE PoolType, PVOID *ReturnedContext);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltAllocateDeferredIoWorkItem@0")) { fcttype = "PVOID __stdcall FltAllocateDeferredIoWorkItem();"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltAllocateFileLock@8")) { fcttype = "PVOID __stdcall FltAllocateFileLock(PVOID CompleteLockCallbackDataRoutine, PVOID UnlockRoutine);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltAllocateGenericWorkItem@0")) { fcttype = "PVOID __stdcall FltAllocateGenericWorkItem();"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltAllocatePoolAlignedWithTag@16")) { fcttype = "PVOID __stdcall FltAllocatePoolAlignedWithTag(PVOID Instance, POOL_TYPE PoolType, SIZE_T NumberOfBytes, ULONG Tag);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltAttachVolume@16")) { fcttype = "NTSTATUS __stdcall FltAttachVolume(PVOID Filter, PVOID Volume, PUNICODE_STRING InstanceName, PVOID *RetInstance);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltAttachVolumeAtAltitude@20")) { fcttype = "NTSTATUS __stdcall FltAttachVolumeAtAltitude(PVOID Filter, PVOID Volume, PUNICODE_STRING Altitude, PUNICODE_STRING InstanceName, PVOID *RetInstance);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltBuildDefaultSecurityDescriptor@8")) { fcttype = "NTSTATUS __stdcall FltBuildDefaultSecurityDescriptor(PVOID *SecurityDescriptor, ACCESS_MASK DesiredAccess);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltCancelFileOpen@8")) { fcttype = "void __stdcall FltCancelFileOpen(PVOID Instance, PFILE_OBJECT FileObject);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltCancelIo@4")) { fcttype = "BOOLEAN __stdcall FltCancelIo(PVOID CallbackData);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltCbdqDisable@4")) { fcttype = "void FltCbdqDisable(PVOID Cbdq);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltCbdqEnable@4")) { fcttype = "void FltCbdqEnable(PVOID Cbdq);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltCbdqInitialize@32")) { fcttype = "NTSTATUS __stdcall FltCbdqInitialize(PVOID Instance, PVOID Cbdq, PVOID CbdqInsertIo, PVOID CbdqRemoveIo, PVOID CbdqPeekNextIo, PVOID CbdqAcquire, PVOID CbdqRelease, PVOID CbdqCompleteCanceledIo);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltCbdqInsertIo@16")) { fcttype = "NTSTATUS __stdcall FltCbdqInsertIo(PVOID Cbdq, PVOID Cbd, PVOID Context, PVOID InsertContext);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltCbdqRemoveIo@8")) { fcttype = "PVOID __stdcall FltCbdqRemoveIo(PVOID Cbdq, PVOID Context);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltCbdqRemoveNextIo@8")) { fcttype = "PVOID __stdcall FltCbdqRemoveNextIo(PVOID Cbdq, PVOID PeekContext);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltCheckAndGrowNameControl@8")) { fcttype = "NTSTATUS __stdcall FltCheckAndGrowNameControl(PVOID NameCtrl, USHORT NewSize);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltCheckLockForReadAccess@8")) { fcttype = "BOOLEAN __stdcall FltCheckLockForReadAccess(PVOID FileLock, PVOID CallbackData);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltCheckLockForWriteAccess@8")) { fcttype = "BOOLEAN __stdcall FltCheckLockForWriteAccess(PVOID FileLock, PVOID CallbackData);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltCheckOplock@20")) { fcttype = "ULONG __stdcall FltCheckOplock(PVOID Oplock, PVOID CallbackData, PVOID Context, PVOID WaitCompletionRoutine, PVOID PrePostCallbackDataRoutine);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltClearCallbackDataDirty@4")) { fcttype = "void __stdcall FltClearCallbackDataDirty(PVOID Data);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltClearCancelCompletion@4")) { fcttype = "NTSTATUS __stdcall FltClearCancelCompletion(PVOID CallbackData);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltClose@4")) { fcttype = "NTSTATUS __stdcall FltClose(HANDLE FileHandle);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltCloseClientPort@8")) { fcttype = "void __stdcall FltCloseClientPort(PVOID Filter, PVOID *ClientPort);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltCloseCommunicationPort@4")) { fcttype = "void __stdcall FltCloseCommunicationPort(PVOID ServerPort);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltCompareInstanceAltitudes@8")) { fcttype = "LONG __stdcall FltCompareInstanceAltitudes(PVOID Instance1, PVOID Instance2);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltCompletePendedPostOperation@4")) { fcttype = "void __stdcall FltCompletePendedPostOperation(PVOID CallbackData);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltCompletePendedPreOperation@12")) { fcttype = "void __stdcall FltCompletePendedPreOperation(PVOID CallbackData, ULONG CallbackStatus, PVOID Context);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltCreateCommunicationPort@32")) { fcttype = "NTSTATUS __stdcall FltCreateCommunicationPort(PVOID Filter, PVOID *ServerPort, POBJECT_ATTRIBUTES ObjectAttributes, PVOID ServerPortCookie, PVOID ConnectNotifyCallback, PVOID DisconnectNotifyCallback, PVOID MessageNotifyCallback, LONG MaxConnections);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltCreateFile@56")) { fcttype = "NTSTATUS __stdcall FltCreateFile(PVOID Filter, PVOID Instance, PHANDLE FileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PIO_STATUS_BLOCK IoStatusBlock, PLARGE_INTEGER AllocationSize, ULONG FileAttributes, ULONG ShareAccess, ULONG CreateDisposition, ULONG CreateOptions, PVOID EaBuffer, ULONG EaLength, ULONG Flags);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltCreateSystemVolumeInformationFolder@4")) { fcttype = "NTSTATUS __stdcall FltCreateSystemVolumeInformationFolder(PVOID Instance);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltCurrentBatchOplock@4")) { fcttype = "BOOLEAN __stdcall FltCurrentBatchOplock(PVOID Oplock);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltDecodeParameters@20")) { fcttype = "NTSTATUS __stdcall FltDecodeParameters(PVOID CallbackData, PMDL **MdlAddressPointer, PVOID **Buffer, PULONG *Length, LOCK_OPERATION *DesiredAcces);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltDeleteContext@4")) { fcttype = "void __stdcall FltDeleteContext(PVOID Context);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltDeleteFileContext@12")) { fcttype = "NTSTATUS __stdcall FltDeleteFileContext(PVOID Instance, PFILE_OBJECT FileObject, PVOID *OldContext);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltDeleteInstanceContext@8")) { fcttype = "NTSTATUS __stdcall FltDeleteInstanceContext(PVOID Instance, PVOID *OldContext);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltDeletePushLock@4")) { fcttype = "void FltDeletePushLock(PVOID PushLock);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltDeleteStreamContext@12")) { fcttype = "NTSTATUS __stdcall FltDeleteStreamContext(PVOID Instance, PFILE_OBJECT FileObject, PVOID *OldContext);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltDeleteStreamHandleContext@12")) { fcttype = "NTSTATUS __stdcall FltDeleteStreamHandleContext(PVOID Instance, PFILE_OBJECT FileObject, PVOID *OldContext);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltDeleteVolumeContext@12")) { fcttype = "NTSTATUS __stdcall FltDeleteVolumeContext(PVOID Filter, PVOID Volume, PVOID *OldContext);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltDetachVolume@12")) { fcttype = "NTSTATUS __stdcall FltDetachVolume(PVOID Filter, PVOID Volume, PUNICODE_STRING InstanceName);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltDeviceIoControlFile@32")) { fcttype = "NTSTATUS __stdcall FltDeviceIoControlFile(PVOID Instance, PFILE_OBJECT FileObject, ULONG IoControlCode, PVOID InputBuffer, ULONG InputBufferLength, PVOID OutputBuffer, ULONG OutputBufferLength, PULONG LengthReturned);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltDoCompletionProcessingWhenSafe@24")) { fcttype = "BOOLEAN __stdcall FltDoCompletionProcessingWhenSafe(PVOID Data, PVOID FltObjects, PVOID CompletionContext, ULONG Flags, PVOID SafePostCallback, PVOID RetPostOperationStatus);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltEnumerateFilterInformation@20")) { fcttype = "NTSTATUS __stdcall FltEnumerateFilterInformation(ULONG Index, ULONG InformationClass, PVOID Buffer, ULONG BufferSize, PULONG BytesReturned);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltEnumerateFilters@12")) { fcttype = "NTSTATUS __stdcall FltEnumerateFilters(PVOID *FilterList, ULONG FilterListSize, PULONG NumberFiltersReturned);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltEnumerateInstanceInformationByFilter@24")) { fcttype = "NTSTATUS __stdcall FltEnumerateInstanceInformationByFilter(PVOID Filter, ULONG Index, ULONG InformationClass, PVOID Buffer, ULONG BufferSize, PULONG BytesReturned);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltEnumerateInstanceInformationByVolume@24")) { fcttype = "NTSTATUS __stdcall FltEnumerateInstanceInformationByVolume(PVOID Volume, ULONG Index, ULONG InformationClass, PVOID Buffer, ULONG BufferSize, PULONG BytesReturned);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltEnumerateInstances@20")) { fcttype = "NTSTATUS __stdcall FltEnumerateInstances(PVOID Volume, PVOID Filter, PVOID *InstanceList, ULONG InstanceListSize, PULONG NumberInstancesReturned);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltEnumerateVolumeInformation@24")) { fcttype = "NTSTATUS __stdcall FltEnumerateVolumeInformation(PVOID Filter, ULONG Index, ULONG InformationClass, PVOID Buffer, ULONG BufferSize, PULONG BytesReturned);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltEnumerateVolumes@16")) { fcttype = "NTSTATUS __stdcall FltEnumerateVolumes(PVOID Filter, PVOID *VolumeList, ULONG VolumeListSize, PULONG NumberVolumesReturned);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltFlushBuffers@8")) { fcttype = "NTSTATUS __stdcall FltFlushBuffers(PVOID Instance, PFILE_OBJECT FileObject);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltFreeCallbackData@4")) { fcttype = "void __stdcall FltFreeCallbackData(PVOID CallbackData);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltFreeDeferredIoWorkItem@4")) { fcttype = "void __stdcall FltFreeDeferredIoWorkItem(PVOID FltWorkItem);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltFreeFileLock@4")) { fcttype = "void FltFreeFileLock(PVOID FileLock);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltFreeGenericWorkItem@4")) { fcttype = "void __stdcall FltFreeGenericWorkItem(PVOID FltWorkItem);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltFreePoolAlignedWithTag@12")) { fcttype = "void __stdcall FltFreePoolAlignedWithTag(PVOID Instance, PVOID Buffer, ULONG Tag);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltFreeSecurityDescriptor@4")) { fcttype = "void __stdcall FltFreeSecurityDescriptor(PVOID SecurityDescriptor);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltFsControlFile@32")) { fcttype = "NTSTATUS __stdcall FltFsControlFile(PVOID Instance, PFILE_OBJECT FileObject, ULONG FsControlCode, PVOID InputBuffer, ULONG InputBufferLength, PVOID OutputBuffer, ULONG OutputBufferLength, PULONG LengthReturned);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltGetBottomInstance@8")) { fcttype = "NTSTATUS __stdcall FltGetBottomInstance(PVOID Volume, PVOID *Instance);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltGetContexts@12")) { fcttype = "void __stdcall FltGetContexts(PVOID FltObjects, USHORT DesiredContexts, PVOID Contexts);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltGetDestinationFileNameInformation@28")) { fcttype = "NTSTATUS __stdcall FltGetDestinationFileNameInformation(PVOID Instance, PFILE_OBJECT FileObject, HANDLE RootDirectory, PWSTR FileName, ULONG FileNameLength, ULONG NameOptions, PVOID *RetFileNameInformation);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltGetDeviceObject@8")) { fcttype = "NTSTATUS __stdcall FltGetDeviceObject(PVOID Volume, PDEVICE_OBJECT *DeviceObject);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltGetDiskDeviceObject@8")) { fcttype = "NTSTATUS __stdcall FltGetDiskDeviceObject(PVOID Volume, PDEVICE_OBJECT *DiskDeviceObject);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltGetFileContext@12")) { fcttype = "NTSTATUS __stdcall FltGetFileContext(PVOID Instance, PFILE_OBJECT FileObject, PVOID *Context);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltGetFileNameInformation@12")) { fcttype = "NTSTATUS __stdcall FltGetFileNameInformation(PVOID CallbackData, ULONG NameOptions, PVOID *FileNameInformation);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltGetFileNameInformationUnsafe@16")) { fcttype = "NTSTATUS __stdcall FltGetFileNameInformationUnsafe(PFILE_OBJECT FileObject, PVOID Instance, ULONG NameOptions, PVOID *FileNameInformation);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltGetFilterFromInstance@8")) { fcttype = "NTSTATUS __stdcall FltGetFilterFromInstance(PVOID Instance, PVOID *RetFilter);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltGetFilterFromName@8")) { fcttype = "NTSTATUS __stdcall FltGetFilterFromName(PUNICODE_STRING FilterName, PVOID *RetFilter);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltGetFilterInformation@20")) { fcttype = "NTSTATUS __stdcall FltGetFilterInformation(PVOID Filter, ULONG InformationClass, PVOID Buffer, ULONG BufferSize, PULONG BytesReturned);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltGetInstanceContext@8")) { fcttype = "NTSTATUS __stdcall FltGetInstanceContext(PVOID Instance, PVOID *Context);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltGetInstanceInformation@20")) { fcttype = "NTSTATUS __stdcall FltGetInstanceInformation(PVOID Instance, ULONG InformationClass, PVOID Buffer, ULONG BufferSize, PULONG BytesReturned);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltGetIrpName@4")) { fcttype = "PCHAR __stdcall FltGetIrpName(UCHAR IrpMajorCode);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltGetLowerInstance@8")) { fcttype = "NTSTATUS __stdcall FltGetLowerInstance(PVOID CurrentInstance, PVOID *LowerInstance);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltGetRequestorProcess@4")) { fcttype = "PEPROCESS __stdcall FltGetRequestorProcess(PVOID CallbackData);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltGetRequestorProcessId@4")) { fcttype = "ULONG __stdcall FltGetRequestorProcessId(PVOID CallbackData);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltGetRoutineAddress@4")) { fcttype = "PVOID __stdcall FltGetRoutineAddress(PCSTR FltMgrRoutineName);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltGetStreamContext@12")) { fcttype = "NTSTATUS __stdcall FltGetStreamContext(PVOID Instance, PFILE_OBJECT FileObject, PVOID *Context);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltGetStreamHandleContext@12")) { fcttype = "NTSTATUS __stdcall FltGetStreamHandleContext(PVOID Instance, PFILE_OBJECT FileObject, PVOID *Context);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltGetTopInstance@8")) { fcttype = "NTSTATUS __stdcall FltGetTopInstance(PVOID Volume, PVOID *Instance);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltGetTunneledName@12")) { fcttype = "NTSTATUS __stdcall FltGetTunneledName(PVOID CallbackData, PVOID FileNameInformation, PVOID *RetTunneledFileNameInformation);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltGetUpperInstance@8")) { fcttype = "NTSTATUS __stdcall FltGetUpperInstance(PVOID CurrentInstance, PVOID *UpperInstance);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltGetVolumeContext@12")) { fcttype = "NTSTATUS __stdcall FltGetVolumeContext(PVOID Filter, PVOID Volume, PVOID *Context);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltGetVolumeFromDeviceObject@12")) { fcttype = "NTSTATUS __stdcall FltGetVolumeFromDeviceObject(PVOID Filter, PDEVICE_OBJECT DeviceObject, PVOID *RetVolume);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltGetVolumeFromFileObject@12")) { fcttype = "NTSTATUS __stdcall FltGetVolumeFromFileObject(PVOID Filter, PFILE_OBJECT FileObject, PVOID *RetVolume);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltGetVolumeFromInstance@8")) { fcttype = "NTSTATUS __stdcall FltGetVolumeFromInstance(PVOID Instance, PVOID *RetVolume);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltGetVolumeFromName@12")) { fcttype = "NTSTATUS __stdcall FltGetVolumeFromName(PVOID Filter, PUNICODE_STRING VolumeName, PVOID *RetVolume);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltGetVolumeGuidName@12")) { fcttype = "NTSTATUS __stdcall FltGetVolumeGuidName(PVOID Volume, PUNICODE_STRING VolumeGuidName, PULONG BufferSizeNeeded);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltGetVolumeInstanceFromName@16")) { fcttype = "NTSTATUS __stdcall FltGetVolumeInstanceFromName(PVOID Filter, PVOID Volume, PUNICODE_STRING InstanceName, PVOID *RetInstance);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltGetVolumeName@12")) { fcttype = "NTSTATUS __stdcall FltGetVolumeName(PVOID Volume, PUNICODE_STRING VolumeName, PULONG BufferSizeNeeded);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltGetVolumeProperties@16")) { fcttype = "NTSTATUS __stdcall FltGetVolumeProperties(PVOID Volume, PVOID VolumeProperties, ULONG VolumePropertiesLength, PULONG LengthReturned);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltInitializeFileLock@4")) { fcttype = "void __stdcall FltInitializeFileLock(PVOID FileLock);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltInitializeOplock@4")) { fcttype = "void __stdcall FltInitializeOplock(PVOID Oplock);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltInitializePushLock@4")) { fcttype = "void FltInitializePushLock(PVOID PushLock);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltIs32bitProcess@4")) { fcttype = "BOOLEAN __stdcall FltIs32bitProcess(PVOID CallbackData);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltIsCallbackDataDirty@4")) { fcttype = "BOOLEAN __stdcall FltIsCallbackDataDirty(PVOID Data);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltIsDirectory@12")) { fcttype = "NTSTATUS __stdcall FltIsDirectory(PFILE_OBJECT FileObject, PVOID Instance, PBOOLEAN IsDirectory);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltIsIoCanceled@4")) { fcttype = "BOOLEAN __stdcall FltIsIoCanceled(PVOID CallbackData);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltIsOperationSynchronous@4")) { fcttype = "BOOLEAN __stdcall FltIsOperationSynchronous(PVOID CallbackData);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltIsVolumeWritable@8")) { fcttype = "NTSTATUS __stdcall FltIsVolumeWritable(PVOID Volume, PBOOLEAN IsWritable);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltLoadFilter@4")) { fcttype = "NTSTATUS __stdcall FltLoadFilter(PUNICODE_STRING FilterName);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltLockUserBuffer@4")) { fcttype = "NTSTATUS __stdcall FltLockUserBuffer(PVOID CallbackData);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltNotifyFilterChangeDirectory@44")) { fcttype = "void __stdcall FltNotifyFilterChangeDirectory(PVOID NotifySync, PLIST_ENTRY NotifyList, PVOID FsContext, PSTRING FullDirectoryName, BOOLEAN WatchTree, BOOLEAN IgnoreBuffer, ULONG CompletionFilter, PVOID NotifyCallbackData, PVOID TraverseCallback, PVOID SubjectContext, PVOID* FilterCallback);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltObjectDereference@4")) { fcttype = "void __stdcall FltObjectDereference(PVOID FltObject);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltObjectReference@4")) { fcttype = "NTSTATUS __stdcall FltObjectReference(PVOID FltObject);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltOplockFsctrl@12")) { fcttype = "ULONG __stdcall FltOplockFsctrl(PVOID Oplock, PVOID CallbackData, ULONG OpenCount);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltOplockIsFastIoPossible@4")) { fcttype = "BOOLEAN __stdcall FltOplockIsFastIoPossible(PVOID Oplock);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltParseFileName@16")) { fcttype = "NTSTATUS __stdcall FltParseFileName(PUNICODE_STRING FileName, PUNICODE_STRING Extension, PUNICODE_STRING Stream, PUNICODE_STRING FinalComponent);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltParseFileNameInformation@4")) { fcttype = "NTSTATUS __stdcall FltParseFileNameInformation(PVOID FileNameInformation);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltPerformAsynchronousIo@12")) { fcttype = "NTSTATUS __stdcall FltPerformAsynchronousIo(PVOID CallbackData, PVOID CallbackRoutine, PVOID CallbackContext);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltPerformSynchronousIo@4")) { fcttype = "void __stdcall FltPerformSynchronousIo(PVOID CallbackData);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltProcessFileLock@12")) { fcttype = "ULONG __stdcall FltProcessFileLock(PVOID FileLock, PVOID CallbackData, PVOID Context);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltPurgeFileNameInformationCache@8")) { fcttype = "NTSTATUS __stdcall FltPurgeFileNameInformationCache(PVOID Instance, PFILE_OBJECT FileObject);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltQueryInformationFile@24")) { fcttype = "NTSTATUS __stdcall FltQueryInformationFile(PVOID Instance, PFILE_OBJECT FileObject, PVOID FileInformation, ULONG Length, FILE_INFORMATION_CLASS FileInformationClass, PULONG LengthReturned);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltQuerySecurityObject@24")) { fcttype = "NTSTATUS __stdcall FltQuerySecurityObject(PVOID Instance, PFILE_OBJECT FileObject, SECURITY_INFORMATION SecurityInformation, PVOID SecurityDescriptor, ULONG Length, PULONG LengthNeeded);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltQueryVolumeInformation@20")) { fcttype = "NTSTATUS __stdcall FltQueryVolumeInformation(PVOID Instance, PIO_STATUS_BLOCK Iosb, PVOID FsInformation, ULONG Length, FS_INFORMATION_CLASS FsInformationClass);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltQueryVolumeInformationFile@24")) { fcttype = "NTSTATUS __stdcall FltQueryVolumeInformationFile(PVOID Instance, PFILE_OBJECT FileObject, PVOID FsInformation, ULONG Length, FS_INFORMATION_CLASS FsInformationClass, PULONG LengthReturned);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltQueueDeferredIoWorkItem@20")) { fcttype = "NTSTATUS __stdcall FltQueueDeferredIoWorkItem(PVOID FltWorkItem, PVOID Data, PVOID WorkerRoutine, WORK_QUEUE_TYPE QueueType, PVOID Context);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltQueueGenericWorkItem@20")) { fcttype = "NTSTATUS __stdcall FltQueueGenericWorkItem(PVOID FltWorkItem, PVOID FltObject, PVOID WorkerRoutine, WORK_QUEUE_TYPE QueueType, PVOID Context);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltReadFile@36")) { fcttype = "NTSTATUS __stdcall FltReadFile(PVOID InitiatingInstance, PFILE_OBJECT FileObject, PLARGE_INTEGER ByteOffset, ULONG Length, PVOID Buffer, ULONG Flags, PULONG BytesRead, PVOID CallbackRoutine, PVOID CallbackContext);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltReferenceContext@4")) { fcttype = "void __stdcall FltReferenceContext(PVOID Context);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltReferenceFileNameInformation@4")) { fcttype = "void __stdcall FltReferenceFileNameInformation(PVOID FileNameInformation);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltRegisterFilter@12")) { fcttype = "NTSTATUS __stdcall FltRegisterFilter(PDRIVER_OBJECT Driver,PVOID Registration, PVOID *RetFilter);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltReissueSynchronousIo@8")) { fcttype = "void __stdcall FltReissueSynchronousIo(PVOID InitiatingInstance, PVOID CallbackData);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltReleaseContext@4")) { fcttype = "void __stdcall FltReleaseContext(PVOID Context);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltReleaseContexts@4")) { fcttype = "void __stdcall FltReleaseContexts(PVOID Contexts);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltReleaseFileNameInformation@4")) { fcttype = "void __stdcall FltReleaseFileNameInformation(PVOID FileNameInformation);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltReleasePushLock@4")) { fcttype = "void FltReleasePushLock(PVOID PushLock);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltReleaseResource@4")) { fcttype = "void FltReleaseResource(PERESOURCE Resource);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltRequestOperationStatusCallback@12")) { fcttype = "NTSTATUS __stdcall FltRequestOperationStatusCallback(PVOID Data, PVOID CallbackRoutine, PVOID RequesterContext);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltReuseCallbackData@4")) { fcttype = "void __stdcall FltReuseCallbackData(PVOID CallbackData);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltSendMessage@28")) { fcttype = "NTSTATUS __stdcall FltSendMessage(PVOID Filter, PVOID *ClientPort, PVOID SenderBuffer, ULONG SenderBufferLength, PVOID ReplyBuffer, PULONG ReplyLength, PLARGE_INTEGER Timeout);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltSetCallbackDataDirty@4")) { fcttype = "void __stdcall FltSetCallbackDataDirty(PVOID Data);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltSetCancelCompletion@8")) { fcttype = "NTSTATUS __stdcall FltSetCancelCompletion(PVOID CallbackData, PVOID CanceledCallback);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltSetFileContext@20")) { fcttype = "NTSTATUS __stdcall FltSetFileContext(PVOID Instance, PFILE_OBJECT FileObject, ULONG Operation, PVOID NewContext, PVOID *OldContext);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltSetInformationFile@20")) { fcttype = "NTSTATUS __stdcall FltSetInformationFile(PVOID Instance, PFILE_OBJECT FileObject, PVOID FileInformation, ULONG Length, FILE_INFORMATION_CLASS FileInformationClass);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltSetInstanceContext@16")) { fcttype = "NTSTATUS __stdcall FltSetInstanceContext(PVOID Instance, ULONG Operation, PVOID NewContext, PVOID *OldContext);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltSetSecurityObject@16")) { fcttype = "NTSTATUS __stdcall FltSetSecurityObject(PVOID Instance, PFILE_OBJECT FileObject, SECURITY_INFORMATION SecurityInformation, PVOID SecurityDescriptor);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltSetStreamContext@20")) { fcttype = "NTSTATUS __stdcall FltSetStreamContext(PVOID Instance, PFILE_OBJECT FileObject, ULONG Operation, PVOID NewContext, PVOID *OldContext);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltSetStreamHandleContext@20")) { fcttype = "NTSTATUS __stdcall FltSetStreamHandleContext(PVOID Instance, PFILE_OBJECT FileObject, ULONG Operation, PVOID NewContext, PVOID *OldContext);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltSetVolumeContext@16")) { fcttype = "NTSTATUS __stdcall FltSetVolumeContext(PVOID Volume, ULONG Operation, PVOID NewContext, PVOID *OldContext);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltSetVolumeInformation@20")) { fcttype = "NTSTATUS __stdcall FltSetVolumeInformation(PVOID Instance, PIO_STATUS_BLOCK Iosb, PVOID FsInformation, ULONG Length, FS_INFORMATION_CLASS FsInformationClass);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltStartFiltering@4")) { fcttype = "NTSTATUS __stdcall FltStartFiltering(PVOID Filter);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltSupportsFileContexts@4")) { fcttype = "BOOLEAN __stdcall FltSupportsFileContexts(PFILE_OBJECT FileObject);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltSupportsStreamHandleContexts@4")) { fcttype = "BOOLEAN __stdcall FltSupportsStreamHandleContexts(PFILE_OBJECT FileObject);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltTagFile@24")) { fcttype = "NTSTATUS __stdcall FltTagFile(PVOID InitiatingInstance, PFILE_OBJECT FileObject, ULONG FileTag, GUID *Guid, PVOID DataBuffer, USHORT DataBufferLength);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltUninitializeFileLock@4")) { fcttype = "void FltUninitializeFileLock(PVOID FileLock);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltUninitializeOplock@4")) { fcttype = "void __stdcall FltUninitializeOplock(PVOID Oplock);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltUnloadFilter@4")) { fcttype = "NTSTATUS __stdcall FltUnloadFilter(PUNICODE_STRING FilterName);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltUnregisterFilter@4")) { fcttype = "void __stdcall FltUnregisterFilter(PVOID Filter);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltUntagFile@16")) { fcttype = "NTSTATUS __stdcall FltUntagFile(PVOID InitiatingInstance, PFILE_OBJECT FileObject, ULONG FileTag, GUID *Guid);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } if((ea != BADADDR) && (GetFunctionName(ea) == "_FltWriteFile@36")) { fcttype = "NTSTATUS __stdcall FltWriteFile(PVOID InitiatingInstance, PFILE_OBJECT FileObject, PLARGE_INTEGER ByteOffset, ULONG Length, PVOID Buffer, ULONG Flags, PULONG BytesWritten, PVOID CallbackRoutine, PVOID CallbackContext);"; if(!SetType(ea, fcttype)) Message("Failed %s\n", fcttype); continue; } } Message("Finished\n"); }