Method SaveFilters

PeaceMaker Kernel/StringFilters.cpp:371–456

Save the current filters to the registry for persistence. @return Whether or not the save was successful. */

	@return Whether or not the save was successful.
*/
BOOLEAN
StringFilters::SaveFilters (
	VOID
	)
{
	PFILTER_STORE filterStore;
	PFILTER_INFO_LINKED currentFilter;
	ULONG i;
	OBJECT_ATTRIBUTES driverRegistryAttributes;
	NTSTATUS status;
	HANDLE driverRegistryKey;
	BOOLEAN result;

	result = FALSE;
	driverRegistryKey = NULL;
	i = 0;

	//
	// Allocate space for the filter store.
	//
	filterStore = RCAST<PFILTER_STORE>(ExAllocatePoolWithTag(NonPagedPool, FILTER_STORE_SIZE(this->filtersCount), FILTER_INFO_TAG));
	if (filterStore == NULL)
	{
		DBGPRINT("StringFilters!SaveFilters: Failed to allocate space for the filter store with size %i.", this->filtersCount);
		goto Exit;
	}
	memset(filterStore, 0, sizeof(filterStore));

	//
	// Initialize basic members.
	//
	filterStore->FilterCount = this->filtersCount;

	//
	// Acquire a shared lock to iterate filters.
	//
	FltAcquirePushLockShared(&this->filtersLock);

	//
	// Iterate filters for a match.
	//
	if (this->filtersHead)
	{
		currentFilter = RCAST<PFILTER_INFO_LINKED>(this->filtersHead->ListEntry.Flink);
		while (currentFilter && currentFilter != this->filtersHead)
		{
			memcpy_s(&filterStore->Filters[i], sizeof(FILTER_INFO), &currentFilter->Filter, sizeof(FILTER_INFO));
			i++;
			currentFilter = RCAST<PFILTER_INFO_LINKED>(currentFilter->ListEntry.Flink);
		}
	}

	FltReleasePushLock(&this->filtersLock);

	//
	// Open the driver's registry key.
	//
	InitializeObjectAttributes(&driverRegistryAttributes, &this->driverRegistryPath, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);