12.网络传输层过滤
#define IRP_MN_BUS_RESET 0x87 1394.h
fltKernel.h
#define IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION ((UCHAR)-1)
#define IRP_MJ_RELEASE_FOR_SECTION_SYNCHRONIZATION ((UCHAR)-2)
#define IRP_MJ_ACQUIRE_FOR_MOD_WRITE ((UCHAR)-3)
#define IRP_MJ_RELEASE_FOR_MOD_WRITE ((UCHAR)-4)
#define IRP_MJ_ACQUIRE_FOR_CC_FLUSH ((UCHAR)-5)
#define IRP_MJ_RELEASE_FOR_CC_FLUSH ((UCHAR)-6)
#define IRP_MJ_FAST_IO_CHECK_IF_POSSIBLE ((UCHAR)-13)
#define IRP_MJ_NETWORK_QUERY_OPEN ((UCHAR)-14)
#define IRP_MJ_MDL_READ ((UCHAR)-15)
#define IRP_MJ_MDL_READ_COMPLETE ((UCHAR)-16)
#define IRP_MJ_PREPARE_MDL_WRITE ((UCHAR)-17)
#define IRP_MJ_MDL_WRITE_COMPLETE ((UCHAR)-18)
#define IRP_MJ_VOLUME_MOUNT ((UCHAR)-19)
#define IRP_MJ_VOLUME_DISMOUNT ((UCHAR)-20)
#define IRP_MJ_OPERATION_END ((UCHAR)0x80)
miniport.h
#define IRP_MN_QUERY_ALL_DATA 0x00
#define IRP_MN_QUERY_SINGLE_INSTANCE 0x01
#define IRP_MN_CHANGE_SINGLE_INSTANCE 0x02
#define IRP_MN_CHANGE_SINGLE_ITEM 0x03
#define IRP_MN_ENABLE_EVENTS 0x04
#define IRP_MN_DISABLE_EVENTS 0x05
#define IRP_MN_ENABLE_COLLECTION 0x06
#define IRP_MN_DISABLE_COLLECTION 0x07
#define IRP_MN_REGINFO 0x08
#define IRP_MN_EXECUTE_METHOD 0x09
#define IRP_MN_REGINFO_EX 0x0b
ntddk.h
#define IRP_MN_QUERY_DIRECTORY 0x01
#define IRP_MN_NOTIFY_CHANGE_DIRECTORY 0x02
#define IRP_MN_USER_FS_REQUEST 0x00
#define IRP_MN_MOUNT_VOLUME 0x01
#define IRP_MN_VERIFY_VOLUME 0x02
#define IRP_MN_LOAD_FILE_SYSTEM 0x03
#define IRP_MN_TRACK_LINK 0x04 // To be obsoleted soon
#define IRP_MN_KERNEL_CALL 0x04
#define IRP_MN_LOCK 0x01
#define IRP_MN_UNLOCK_SINGLE 0x02
#define IRP_MN_UNLOCK_ALL 0x03
#define IRP_MN_UNLOCK_ALL_BY_KEY 0x04
#define IRP_MN_FLUSH_AND_PURGE 0x01
#if (NTDDI_VERSION >= NTDDI_WIN8)
#define IRP_MN_FLUSH_DATA_ONLY 0x02 //see FLUSH_FLAGS_FILE_DATA_ONLY for definition of how this works
#define IRP_MN_FLUSH_NO_SYNC 0x03 //see FLUSH_FLAGS_NO_SYNC for definition of how this works
#endif
#define IRP_MN_NORMAL 0x00
#define IRP_MN_DPC 0x01
#define IRP_MN_MDL 0x02
#define IRP_MN_COMPLETE 0x04
#define IRP_MN_COMPRESSED 0x08
#define IRP_MN_MDL_DPC (IRP_MN_MDL | IRP_MN_DPC)
#define IRP_MN_COMPLETE_MDL (IRP_MN_COMPLETE | IRP_MN_MDL)
#define IRP_MN_COMPLETE_MDL_DPC (IRP_MN_COMPLETE_MDL | IRP_MN_DPC)
#define IRP_MN_QUERY_LEGACY_BUS_INFORMATION 0x18
portcls.h
#ifndef IRP_MN_FILTER_RESOURCE_REQUIREMENTS
#define IRP_MN_FILTER_RESOURCE_REQUIREMENTS 0x0D
#endif
wdm.h wudfwdm.h
#define IRP_MJ_CREATE 0x00 //创建
#define IRP_MJ_CREATE_NAMED_PIPE 0x01 //创建命名管道
#define IRP_MJ_CLOSE 0x02 //关闭
#define IRP_MJ_READ 0x03 //读
#define IRP_MJ_WRITE 0x04 //写
#define IRP_MJ_QUERY_INFORMATION 0x05 //查询信息
#define IRP_MJ_SET_INFORMATION 0x06 //设置信息
#define IRP_MJ_QUERY_EA 0x07 //查询 EA
#define IRP_MJ_SET_EA 0x08 //设置 EA
#define IRP_MJ_FLUSH_BUFFERS 0x09 //刷新缓冲区
#define IRP_MJ_QUERY_VOLUME_INFORMATION 0x0a //查询卷信息
#define IRP_MJ_SET_VOLUME_INFORMATION 0x0b //设置卷信息
#define IRP_MJ_DIRECTORY_CONTROL 0x0c //目录控制
#define IRP_MJ_FILE_SYSTEM_CONTROL 0x0d //文件系统控制
#define IRP_MJ_DEVICE_CONTROL 0x0e //设备控制
#define IRP_MJ_INTERNAL_DEVICE_CONTROL 0x0f //内部设备控制
#define IRP_MJ_SHUTDOWN 0x10 //关机
#define IRP_MJ_LOCK_CONTROL 0x11 //锁控制
#define IRP_MJ_CLEANUP 0x12 //清理
#define IRP_MJ_CREATE_MAILSLOT 0x13 //创建邮槽
#define IRP_MJ_QUERY_SECURITY 0x14 //查询安全
#define IRP_MJ_SET_SECURITY 0x15 //设置安全
#define IRP_MJ_POWER 0x16 //电源
#define IRP_MJ_SYSTEM_CONTROL 0x17 //系统控制
#define IRP_MJ_DEVICE_CHANGE 0x18 //设备的变化
#define IRP_MJ_QUERY_QUOTA 0x19 //查询定额
#define IRP_MJ_SET_QUOTA 0x1a //设置定额
#define IRP_MJ_PNP 0x1b //即插即用
#define IRP_MJ_PNP_POWER IRP_MJ_PNP //已废弃
#define IRP_MJ_MAXIMUM_FUNCTION 0x1b //最大值函数<--不是请求
//
// Make the Scsi major code the same as internal device control.
//
#define IRP_MJ_SCSI IRP_MJ_INTERNAL_DEVICE_CONTROL
//
// Define the minor function codes for IRPs. The lower 128 codes, from 0x00 to
// 0x7f are reserved to Microsoft. The upper 128 codes, from 0x80 to 0xff, are
// reserved to customers of Microsoft.
//
//
// Device Control Request minor function codes for SCSI support. Note that
// user requests are assumed to be zero.
//
#define IRP_MN_SCSI_CLASS 0x01
//
// PNP minor function codes.
//
#define IRP_MN_START_DEVICE 0x00
#define IRP_MN_QUERY_REMOVE_DEVICE 0x01
#define IRP_MN_REMOVE_DEVICE 0x02
#define IRP_MN_CANCEL_REMOVE_DEVICE 0x03
#define IRP_MN_STOP_DEVICE 0x04
#define IRP_MN_QUERY_STOP_DEVICE 0x05
#define IRP_MN_CANCEL_STOP_DEVICE 0x06
#define IRP_MN_QUERY_DEVICE_RELATIONS 0x07
#define IRP_MN_QUERY_INTERFACE 0x08
#define IRP_MN_QUERY_CAPABILITIES 0x09
#define IRP_MN_QUERY_RESOURCES 0x0A
#define IRP_MN_QUERY_RESOURCE_REQUIREMENTS 0x0B
#define IRP_MN_QUERY_DEVICE_TEXT 0x0C
#define IRP_MN_FILTER_RESOURCE_REQUIREMENTS 0x0D
#define IRP_MN_READ_CONFIG 0x0F
#define IRP_MN_WRITE_CONFIG 0x10
#define IRP_MN_EJECT 0x11
#define IRP_MN_SET_LOCK 0x12
#define IRP_MN_QUERY_ID 0x13
#define IRP_MN_QUERY_PNP_DEVICE_STATE 0x14
#define IRP_MN_QUERY_BUS_INFORMATION 0x15
#define IRP_MN_DEVICE_USAGE_NOTIFICATION 0x16
#define IRP_MN_SURPRISE_REMOVAL 0x17
#if (NTDDI_VERSION >= NTDDI_WIN7)
#define IRP_MN_DEVICE_ENUMERATED 0x19
#endif
//
// POWER minor function codes
//
#define IRP_MN_WAIT_WAKE 0x00
#define IRP_MN_POWER_SEQUENCE 0x01
#define IRP_MN_SET_POWER 0x02
#define IRP_MN_QUERY_POWER 0x03
//
// WMI minor function codes under IRP_MJ_SYSTEM_CONTROL
//
#define IRP_MN_QUERY_ALL_DATA 0x00
#define IRP_MN_QUERY_SINGLE_INSTANCE 0x01
#define IRP_MN_CHANGE_SINGLE_INSTANCE 0x02
#define IRP_MN_CHANGE_SINGLE_ITEM 0x03
#define IRP_MN_ENABLE_EVENTS 0x04
#define IRP_MN_DISABLE_EVENTS 0x05
#define IRP_MN_ENABLE_COLLECTION 0x06
#define IRP_MN_DISABLE_COLLECTION 0x07
#define IRP_MN_REGINFO 0x08
#define IRP_MN_EXECUTE_METHOD 0x09
// Minor code 0x0a is reserved
#define IRP_MN_REGINFO_EX 0x0b
#define IRP_NOCACHE 0x00000001
#define IRP_PAGING_IO 0x00000002
#define IRP_MOUNT_COMPLETION 0x00000002
#define IRP_SYNCHRONOUS_API 0x00000004
#define IRP_ASSOCIATED_IRP 0x00000008
#define IRP_BUFFERED_IO 0x00000010
#define IRP_DEALLOCATE_BUFFER 0x00000020
#define IRP_INPUT_OPERATION 0x00000040
#define IRP_SYNCHRONOUS_PAGING_IO 0x00000040
#define IRP_CREATE_OPERATION 0x00000080
#define IRP_READ_OPERATION 0x00000100
#define IRP_WRITE_OPERATION 0x00000200
#define IRP_CLOSE_OPERATION 0x00000400
#define IRP_DEFER_IO_COMPLETION 0x00000800
#define IRP_OB_QUERY_NAME 0x00001000
#define IRP_HOLD_DEVICE_QUEUE 0x00002000
#define IRP_UM_DRIVER_INITIATED_IO 0x00400000
//
// Define I/O request packet (IRP) alternate flags for allocation control.
//
#define IRP_QUOTA_CHARGED 0x01
#define IRP_ALLOCATED_MUST_SUCCEED 0x02
#define IRP_ALLOCATED_FIXED_SIZE 0x04
#define IRP_LOOKASIDE_ALLOCATION 0x08
wudfwdm.h
#define IRP_MJ_SCSI IRP_MJ_INTERNAL_DEVICE_CONTROL
