| 897 | |
| 898 | |
| 899 | NTSTATUS RemoveMiniFilter(MiniFilterData* pData) { |
| 900 | NTSTATUS status = STATUS_SUCCESS; |
| 901 | |
| 902 | WCHAR name[128] = { 0 }; |
| 903 | WCHAR filterName[128] = { 0 }; |
| 904 | if (pData->Length < sizeof(filterName) / sizeof(WCHAR)) { |
| 905 | RtlCopyMemory(name, pData->Name, pData->Length * sizeof(WCHAR)); |
| 906 | name[pData->Length] = L'\0'; |
| 907 | } |
| 908 | |
| 909 | ULONG filtersCount = 0; |
| 910 | ULONG size = 0; |
| 911 | ULONG offset = pData->RundownRefOffset; |
| 912 | PFILTER_FULL_INFORMATION pFullInfo = nullptr; |
| 913 | PFLT_FILTER* ppFltList = nullptr; |
| 914 | status = FltEnumerateFilters(nullptr, 0, &filtersCount); |
| 915 | if ((status == STATUS_BUFFER_TOO_SMALL) && filtersCount) { |
| 916 | size = sizeof(PFLT_FILTER) * filtersCount; |
| 917 | ppFltList = (PFLT_FILTER*)ExAllocatePoolWithTag(NonPagedPool, size, 'tsil'); |
| 918 | if (ppFltList) { |
| 919 | status = FltEnumerateFilters(ppFltList, size, &filtersCount); |
| 920 | for (decltype(filtersCount) i = 0; NT_SUCCESS(status) && (i < filtersCount); i++) { |
| 921 | status = FltGetFilterInformation(ppFltList[i], FilterFullInformation, nullptr, 0, &size); |
| 922 | if ((status == STATUS_BUFFER_TOO_SMALL) && size) { |
| 923 | pFullInfo = (PFILTER_FULL_INFORMATION)ExAllocatePoolWithTag(NonPagedPool, size, 'ofni'); |
| 924 | if (pFullInfo) { |
| 925 | status = FltGetFilterInformation(ppFltList[i], FilterFullInformation, pFullInfo, size, |
| 926 | &size); |
| 927 | if (NT_SUCCESS(status)) { |
| 928 | if (pFullInfo->FilterNameLength < sizeof(filterName) / sizeof(WCHAR)) { |
| 929 | RtlCopyMemory(filterName, pFullInfo->FilterNameBuffer, pFullInfo->FilterNameLength); |
| 930 | filterName[pFullInfo->FilterNameLength / sizeof(WCHAR)] = L'\0'; |
| 931 | } |
| 932 | if (!_wcsicmp(filterName, name)) { |
| 933 | HANDLE hThread; |
| 934 | status = PsCreateSystemThread(&hThread, 0, NULL, NULL, NULL, RemoveFilter, ppFltList[i]); |
| 935 | if (!NT_SUCCESS(status)) { |
| 936 | LogError("PsCreateSystemThread failed!\n"); |
| 937 | break; |
| 938 | } |
| 939 | status = ZwClose(hThread); |
| 940 | break; |
| 941 | } |
| 942 | } |
| 943 | ExFreePool(pFullInfo); |
| 944 | pFullInfo = nullptr; |
| 945 | } |
| 946 | } |
| 947 | } |
| 948 | ExFreePoolWithTag(ppFltList, 'tsil'); |
| 949 | ppFltList = nullptr; |
| 950 | } |
| 951 | } |
| 952 | if (pFullInfo != nullptr) |
| 953 | ExFreePool(pFullInfo); |
| 954 | |
| 955 | if (ppFltList != nullptr) |
| 956 | ExFreePoolWithTag(ppFltList, 'tsil'); |
no test coverage detected