C windows system32 disko winfsp x64 dll

winfsp-x64.dll is part of WinFsp and developed by Navimatics Corporation according to the winfsp-x64.dll version information.

winfsp-x64.dll’s description is «Windows File System Proxy«

winfsp-x64.dll is digitally signed by LLC Mail.Ru.

winfsp-x64.dll is usually located in the ‘C:\Windows\system32\disko\’ folder.

None of the anti-virus scanners at VirusTotal reports anything malicious about winfsp-x64.dll.

If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.

VirusTotal report

None of the 69 anti-virus programs at VirusTotal detected the winfsp-x64.dll file.

Sandbox Report

The following information was gathered by executing the file inside Cuckoo Sandbox.

Summary

Successfully executed process in sandbox.

Summary

{
    "dll_loaded": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\199934722e2714785da8d35cc65d7cbd95daa4499fc41f4efaa79bd38ce21dc5.bin.dll"
    ],
    "file_opened": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\199934722e2714785da8d35cc65d7cbd95daa4499fc41f4efaa79bd38ce21dc5.bin.dll"
    ],
    "command_line": [
        "\"C:\\Windows\\System32\\rundll32.exe\" C:\\Users\\cuck\\AppData\\Local\\Temp\\199934722e2714785da8d35cc65d7cbd95daa4499fc41f4efaa79bd38ce21dc5.bin.dll,DllMain"
    ],
    "file_exists": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\199934722e2714785da8d35cc65d7cbd95daa4499fc41f4efaa79bd38ce21dc5.bin.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\199934722e2714785da8d35cc65d7cbd95daa4499fc41f4efaa79bd38ce21dc5.bin.dll.manifest"
    ],
    "file_read": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\199934722e2714785da8d35cc65d7cbd95daa4499fc41f4efaa79bd38ce21dc5.bin.dll"
    ],
    "regkey_read": [
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles"
    ]
}

Generic

[
    {
        "process_path": "C:\\Windows\\SysWOW64\\rundll32.exe",
        "process_name": "rundll32.exe",
        "pid": 2816,
        "summary": {
            "dll_loaded": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\199934722e2714785da8d35cc65d7cbd95daa4499fc41f4efaa79bd38ce21dc5.bin.dll"
            ],
            "file_opened": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\199934722e2714785da8d35cc65d7cbd95daa4499fc41f4efaa79bd38ce21dc5.bin.dll"
            ],
            "command_line": [
                "\"C:\\Windows\\System32\\rundll32.exe\" C:\\Users\\cuck\\AppData\\Local\\Temp\\199934722e2714785da8d35cc65d7cbd95daa4499fc41f4efaa79bd38ce21dc5.bin.dll,DllMain"
            ],
            "file_exists": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\199934722e2714785da8d35cc65d7cbd95daa4499fc41f4efaa79bd38ce21dc5.bin.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\199934722e2714785da8d35cc65d7cbd95daa4499fc41f4efaa79bd38ce21dc5.bin.dll.manifest"
            ],
            "file_read": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\199934722e2714785da8d35cc65d7cbd95daa4499fc41f4efaa79bd38ce21dc5.bin.dll"
            ],
            "regkey_read": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles"
            ]
        },
        "first_seen": 1573066385.6562,
        "ppid": 2016
    },
    {
        "process_path": "C:\\Windows\\System32\\lsass.exe",
        "process_name": "lsass.exe",
        "pid": 476,
        "summary": {},
        "first_seen": 1573066385.3281,
        "ppid": 376
    },
    {
        "process_path": "C:\\Windows\\System32\\rundll32.exe",
        "process_name": "rundll32.exe",
        "pid": 2588,
        "summary": {
            "file_exists": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\199934722e2714785da8d35cc65d7cbd95daa4499fc41f4efaa79bd38ce21dc5.bin.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\199934722e2714785da8d35cc65d7cbd95daa4499fc41f4efaa79bd38ce21dc5.bin.dll.manifest"
            ],
            "regkey_read": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles"
            ],
            "dll_loaded": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\199934722e2714785da8d35cc65d7cbd95daa4499fc41f4efaa79bd38ce21dc5.bin.dll"
            ]
        },
        "first_seen": 1573066385.8438,
        "ppid": 2816
    }
]

Signatures

[
    {
        "markcount": 1,
        "families": [],
        "description": "This executable has a PDB path",
        "severity": 1,
        "marks": [
            {
                "category": "pdb_path",
                "ioc": "C:\\Users\\billziss\\Projects\\winfsp\\build\\VStudio\\build\\Release\\winfsp-x64.dll.pdb",
                "type": "ioc",
                "description": null
            }
        ],
        "references": [],
        "name": "has_pdb"
    }
]

Yara

The Yara rules did not detect anything in the file.

Network

{
    "tls": [],
    "udp": [
        {
            "src": "192.168.56.101",
            "dst": "192.168.56.255",
            "offset": 546,
            "time": 3.0648519992828,
            "dport": 137,
            "sport": 137
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 5074,
            "time": 2.9992949962616,
            "dport": 5355,
            "sport": 51001
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 5402,
            "time": 1.0196077823639,
            "dport": 5355,
            "sport": 53595
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 5730,
            "time": 3.0067179203033,
            "dport": 5355,
            "sport": 53848
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 6058,
            "time": 1.5205459594727,
            "dport": 5355,
            "sport": 54255
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 6386,
            "time": -0.1004331111908,
            "dport": 5355,
            "sport": 55314
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 6714,
            "time": 1.5472569465637,
            "dport": 1900,
            "sport": 1900
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 16512,
            "time": 1.0528337955475,
            "dport": 3702,
            "sport": 49152
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 24896,
            "time": 3.1103749275208,
            "dport": 1900,
            "sport": 53598
        }
    ],
    "dns_servers": [],
    "http": [],
    "icmp": [],
    "smtp": [],
    "tcp": [],
    "smtp_ex": [],
    "mitm": [],
    "hosts": [],
    "pcap_sha256": "75788dc173dc2336e1397220eacbfb30621f7e67bab520a82121f620df672007",
    "dns": [],
    "http_ex": [],
    "domains": [],
    "dead_hosts": [],
    "sorted_pcap_sha256": "932050f798c594554c9a24f76dfee55f14d218ab034aea21f9d0cdb190176cce",
    "irc": [],
    "https_ex": []
}

Screenshots

Malware or legitimate?

If you feel that you need more information to determine if your should keep this file or remove it, please read this guide.

And now some shameless self promotion

Download

WinFsp is released in the form of an MSI installer that includes a signed driver and all files necessary to run and develop user mode file systems on Windows. The installer supports Windows native, FUSE, .NET and Cygwin file systems out of the box. Download the latest version here.

Download WinFsp Installer
Repository · Changelog

Additional Downloads
WinFsp installation required

SSHFS-Win (x64)
SSHFS-Win (x86)
Repository

NFS-Win (x86)
Repository

Quick Start Guide

Картинка с сайта: winfsp.dev

• Download and run the WinFsp installer.

• In the installer select the option to install the developer files. These include the MEMFS sample file system, but also header and library files that let you develop your own user-mode file system.

• You should not need to reboot, unless WinFsp was already running on your system.

Launch WinFsp from the Windows Explorer

Картинка с сайта: winfsp.dev

• Open Windows Explorer

• Select “This PC”. Right-click and select “Map network drive…”

• Map a drive to \\memfs64\share. (Assuming a 64-bit machine. Try \\memfs32\share if you have a 32-bit machine.)

• After a few seconds a new Explorer window will open up for your new drive.

• The file system behind this drive is a case-insensitive in-memory file system (MEMFS).

• When you are done, you can simply right click on the drive from Windows Explorer and select “Disconnect”.

Launch WinFsp from the Command Prompt

Картинка с сайта: winfsp.dev

• Start a non-admin Command Prompt.

• Navigate to the folder where you installed WinFsp: cd C:\Program Files (x86)\WinFsp\bin

• Execute the command: memfs-x64 -u \memfs64\share2 -m *. (Assuming a 64-bit machine. Try memfs-x86 -u \memfs32\share2 -m * if you have a 32-bit machine.)

• Open a second non-admin Command Prompt and navigate to the new drive.

• When you are done, you can just press Ctrl-C to kill the MEMFS process from the first command prompt.

For Cygwin users

Картинка с сайта: winfsp.dev

The installer includes a FUSE package that can be installed on 32-bit or 64-bit Cygwin. This allows software such as SSHFS and FUSEPY to be built and run on Cygwin with minimal changes.

To install the FUSE package to Cygwin perform the following steps:

$ cd opt/cygfuse/       <1>
$ sh ./install.sh       <2>

1. From a Cygwin command prompt change to the subdirectory opt/cygfuse under the WinFsp installation directory.
2. Execute the command sh ./install.sh which will install the necessary FUSE files. This includes FUSE runtime and development files.

To uninstall the FUSE package to Cygwin perform the following steps:

$ cd opt/cygfuse/       <1>
$ sh ./uninstall.sh     <2>

1. From a Cygwin command prompt change to the subdirectory opt/cygfuse under the WinFsp installation directory.
2. Execute the command sh ./uninstall.sh which will uninstall all previously installed FUSE files.

winfsp/winfsp.h

WinFsp User Mode API.

In order to use the WinFsp API the user mode file system must include <winfsp/winfsp.h>
and link with the winfsp_x64.dll (or winfsp_x86.dll) library.

FILE SYSTEM

A user mode file system is a program that uses the WinFsp API to expose a file system to
Windows. The user mode file system must implement the operations in FSP_FILE_SYSTEM_INTERFACE,
create a file system object using FspFileSystemCreate and start its dispatcher using
FspFileSystemStartDispatcher. At that point it will start receiving file system requests on the
FSP_FILE_SYSTEM_INTERFACE operations.

Classes

FSP_FILE_SYSTEM_INTERFACE — File system interface.

Discussion

The operations in this interface must be implemented by the user mode
file system. Not all operations need be implemented. For example,
a user mode file system that does not wish to support reparse points,
need not implement the reparse point operations.

Most of the operations accept a FileContext parameter. This parameter
has different meanings depending on the value of the FSP_FSCTL_VOLUME_PARAMS
flags UmFileContextIsUserContext2 and UmFileContextIsFullContext.

There are three cases to consider:

• When both of these flags are unset (default), the FileContext parameter
  represents the file node. The file node is a void pointer (or an integer
  that can fit in a pointer) that is used to uniquely identify an open file.
  Opening the same file name should always yield the same file node value
  for as long as the file with that name remains open anywhere in the system.

• When the UmFileContextIsUserContext2 is set, the FileContext parameter
  represents the file descriptor. The file descriptor is a void pointer (or
  an integer that can fit in a pointer) that is used to identify an open
  instance of a file. Opening the same file name may yield a different file
  descriptor.

• When the UmFileContextIsFullContext is set, the FileContext parameter
  is a pointer to a FSP_FSCTL_TRANSACT_FULL_CONTEXT. This allows a user mode
  file system to access the low-level UserContext and UserContext2 values.
  The UserContext is used to store the file node and the UserContext2 is
  used to store the file descriptor for an open file.

Member Functions

CanDelete — Determine whether a file or directory can be deleted.

NTSTATUS ( *CanDelete)(
    FSP_FILE_SYSTEM *FileSystem, 
    PVOID FileContext,
    PWSTR FileName);  

Parameters

• FileSystem — The file system on which this request is posted.
• FileContext — The file context of the file or directory to test for deletion.
• FileName — The name of the file or directory to test for deletion.

Return Value

STATUS_SUCCESS or error code.

Discussion

This function tests whether a file or directory can be safely deleted. This function does
not need to perform access checks, but may performs tasks such as check for empty
directories, etc.

This function should NEVER delete the file or directory in question. Deletion should
happen during Cleanup with the FspCleanupDelete flag set.

This function gets called when Win32 API’s such as DeleteFile or RemoveDirectory are used.
It does not get called when a file or directory is opened with FILE_DELETE_ON_CLOSE.

NOTE: If both CanDelete and SetDelete are defined, SetDelete takes precedence. However
most file systems need only implement the CanDelete operation.

See Also

• Cleanup
• SetDelete

Cleanup — Cleanup a file.

VOID ( *Cleanup)(
    FSP_FILE_SYSTEM *FileSystem, 
    PVOID FileContext,
    PWSTR FileName,
    ULONG Flags);  

Parameters

• FileSystem — The file system on which this request is posted.
• FileContext — The file context of the file or directory to cleanup.
• FileName — The name of the file or directory to cleanup. Sent only when a Delete is requested.
• Flags — These flags determine whether the file was modified and whether to delete the file.

Discussion

When CreateFile is used to open or create a file the kernel creates a kernel mode file
object (type FILE_OBJECT) and a handle for it, which it returns to user-mode. The handle may
be duplicated (using DuplicateHandle), but all duplicate handles always refer to the same
file object. When all handles for a particular file object get closed (using CloseHandle)
the system sends a Cleanup request to the file system.

There will be a Cleanup operation for every Create or Open operation posted to the user mode
file system. However the Cleanup operation is not the final close operation on a file.
The file system must be ready to receive additional operations until close time. This is true
even when the file is being deleted!

The Flags parameter contains information about the cleanup operation:

• FspCleanupDelete —
  An important function of the Cleanup operation is to complete a delete operation. Deleting
  a file or directory in Windows is a three-stage process where the file is first opened, then
  tested to see if the delete can proceed and if the answer is positive the file is then
  deleted during Cleanup.

If the file system supports POSIX unlink (FSP_FSCTL_VOLUME_PARAMS ::
SupportsPosixUnlinkRename), then a Cleanup / FspCleanupDelete operation may arrive while
there are other open file handles for this particular file node. If the file system does not
support POSIX unlink, then a Cleanup / FspCleanupDelete operation will always be the last
outstanding cleanup for this particular file node.

• FspCleanupSetAllocationSize —
  The NTFS and FAT file systems reset a file’s allocation size when they receive the last
  outstanding cleanup for a particular file node. User mode file systems that implement
  allocation size and wish to duplicate the NTFS and FAT behavior can use this flag.

• FspCleanupSetArchiveBit —
  File systems that support the archive bit should set the file node’s archive bit when this
  flag is set.

• FspCleanupSetLastAccessTime, FspCleanupSetLastWriteTime, FspCleanupSetChangeTime — File
  systems should set the corresponding file time when each one of these flags is set. Note that
  updating the last access time is expensive and a file system may choose to not implement it.

There is no way to report failure of this operation. This is a Windows limitation.

As an optimization a file system may specify the FSP_FSCTL_VOLUME_PARAMS ::
PostCleanupWhenModifiedOnly flag. In this case the FSD will only post Cleanup requests when
the file was modified/deleted.

See Also

• Close
• CanDelete
• SetDelete

Close — Close a file.

VOID ( *Close)(
    FSP_FILE_SYSTEM *FileSystem, 
    PVOID FileContext);  

Parameters

• FileSystem — The file system on which this request is posted.
• FileContext — The file context of the file or directory to be closed.

Control — Process control code.

NTSTATUS ( *Control)(
    FSP_FILE_SYSTEM *FileSystem, 
    PVOID FileContext,
    UINT32 ControlCode, 
    PVOID InputBuffer,
    ULONG InputBufferLength, 
    PVOID OutputBuffer,
    ULONG OutputBufferLength,
    PULONG PBytesTransferred);  

Parameters

• FileSystem — The file system on which this request is posted.
• FileContext — The file context of the file or directory to be controled.
• ControlCode — The control code for the operation. This code must have a DeviceType with bit
  0x8000 set and must have a TransferType of METHOD_BUFFERED.
• InputBuffer — Pointer to a buffer that contains the input data.
• InputBufferLength — Input data length.
• OutputBuffer — Pointer to a buffer that will receive the output data.
• OutputBufferLength — Output data length.
• PBytesTransferred — [out]
  Pointer to a memory location that will receive the actual number of bytes transferred.

Return Value

STATUS_SUCCESS or error code.

Discussion

This function is called when a program uses the DeviceIoControl API.

Create — Create new file or directory.

NTSTATUS ( *Create)(
    FSP_FILE_SYSTEM *FileSystem, 
    PWSTR FileName,
    UINT32 CreateOptions,
    UINT32 GrantedAccess, 
    UINT32 FileAttributes,
    PSECURITY_DESCRIPTOR SecurityDescriptor,
    UINT64 AllocationSize, 
    PVOID *PFileContext,
    FSP_FSCTL_FILE_INFO *FileInfo);  

Parameters

• FileSystem — The file system on which this request is posted.
• FileName — The name of the file or directory to be created.
• CreateOptions — Create options for this request. This parameter has the same meaning as the
  CreateOptions parameter of the NtCreateFile API. User mode file systems should typically
  only be concerned with the flag FILE_DIRECTORY_FILE, which is an instruction to create a
  directory rather than a file. Some file systems may also want to pay attention to the
  FILE_NO_INTERMEDIATE_BUFFERING and FILE_WRITE_THROUGH flags, although these are
  typically handled by the FSD component.
• GrantedAccess — Determines the specific access rights that have been granted for this request. Upon
  receiving this call all access checks have been performed and the user mode file system
  need not perform any additional checks. However this parameter may be useful to a user
  mode file system; for example the WinFsp-FUSE layer uses this parameter to determine
  which flags to use in its POSIX open() call.
• FileAttributes — File attributes to apply to the newly created file or directory.
• SecurityDescriptor — Security descriptor to apply to the newly created file or directory. This security
  descriptor will always be in self-relative format. Its length can be retrieved using the
  Windows GetSecurityDescriptorLength API. Will be NULL for named streams.
• AllocationSize — Allocation size for the newly created file.
• PFileContext — [out]
  Pointer that will receive the file context on successful return from this call.
• FileInfo — [out]
  Pointer to a structure that will receive the file information on successful return
  from this call. This information includes file attributes, file times, etc.

Return Value

STATUS_SUCCESS or error code.

CreateEx — Create new file or directory.

NTSTATUS ( *CreateEx)(
    FSP_FILE_SYSTEM *FileSystem, 
    PWSTR FileName,
    UINT32 CreateOptions,
    UINT32 GrantedAccess, 
    UINT32 FileAttributes,
    PSECURITY_DESCRIPTOR SecurityDescriptor,
    UINT64 AllocationSize, 
    PVOID ExtraBuffer,
    ULONG ExtraLength,
    BOOLEAN ExtraBufferIsReparsePoint, 
    PVOID *PFileContext,
    FSP_FSCTL_FILE_INFO *FileInfo);  

Parameters

• FileSystem — The file system on which this request is posted.
• FileName — The name of the file or directory to be created.
• CreateOptions — Create options for this request. This parameter has the same meaning as the
  CreateOptions parameter of the NtCreateFile API. User mode file systems should typically
  only be concerned with the flag FILE_DIRECTORY_FILE, which is an instruction to create a
  directory rather than a file. Some file systems may also want to pay attention to the
  FILE_NO_INTERMEDIATE_BUFFERING and FILE_WRITE_THROUGH flags, although these are
  typically handled by the FSD component.
• GrantedAccess — Determines the specific access rights that have been granted for this request. Upon
  receiving this call all access checks have been performed and the user mode file system
  need not perform any additional checks. However this parameter may be useful to a user
  mode file system; for example the WinFsp-FUSE layer uses this parameter to determine
  which flags to use in its POSIX open() call.
• FileAttributes — File attributes to apply to the newly created file or directory.
• SecurityDescriptor — Security descriptor to apply to the newly created file or directory. This security
  descriptor will always be in self-relative format. Its length can be retrieved using the
  Windows GetSecurityDescriptorLength API. Will be NULL for named streams.
• AllocationSize — Allocation size for the newly created file.
• ExtraBuffer — Extended attributes or reparse point buffer.
• ExtraLength — Extended attributes or reparse point buffer length.
• ExtraBufferIsReparsePoint — FALSE: extra buffer is extended attributes; TRUE: extra buffer is reparse point.
• PFileContext — [out]
  Pointer that will receive the file context on successful return from this call.
• FileInfo — [out]
  Pointer to a structure that will receive the file information on successful return
  from this call. This information includes file attributes, file times, etc.

Return Value

STATUS_SUCCESS or error code.

Discussion

This function works like Create, except that it also accepts an extra buffer that
may contain extended attributes or a reparse point.

NOTE: If both Create and CreateEx are defined, CreateEx takes precedence.

DeleteReparsePoint — Delete reparse point.

NTSTATUS ( *DeleteReparsePoint)(
    FSP_FILE_SYSTEM *FileSystem, 
    PVOID FileContext, 
    PWSTR FileName,
    PVOID Buffer,
    SIZE_T Size);  

Parameters

• FileSystem — The file system on which this request is posted.
• FileContext — The file context of the reparse point.
• FileName — The file name of the reparse point.
• Buffer — Pointer to a buffer that contains the data for this operation.
• Size — Size of data to write.

Return Value

STATUS_SUCCESS or error code.

Flush — Flush a file or volume.

NTSTATUS ( *Flush)(
    FSP_FILE_SYSTEM *FileSystem, 
    PVOID FileContext, 
    FSP_FSCTL_FILE_INFO *FileInfo);  

Parameters

• FileSystem — The file system on which this request is posted.
• FileContext — The file context of the file to be flushed. When NULL the whole volume is being flushed.
• FileInfo — [out]
  Pointer to a structure that will receive the file information on successful return
  from this call. This information includes file attributes, file times, etc. Used when
  flushing file (not volume).

Return Value

STATUS_SUCCESS or error code.

Discussion

Note that the FSD will also flush all file/volume caches prior to invoking this operation.

GetDirInfoByName — Get directory information for a single file or directory within a parent directory.

NTSTATUS ( *GetDirInfoByName)(
    FSP_FILE_SYSTEM *FileSystem, 
    PVOID FileContext,
    PWSTR FileName, 
    FSP_FSCTL_DIR_INFO *DirInfo);  

Parameters

• FileSystem — The file system on which this request is posted.
• FileContext — The file context of the parent directory.
• FileName — The name of the file or directory to get information for. This name is relative
  to the parent directory and is a single path component.
• DirInfo — [out]
  Pointer to a structure that will receive the directory information on successful
  return from this call. This information includes the file name, but also file
  attributes, file times, etc.

Return Value

STATUS_SUCCESS or error code.

GetEa — Get extended attributes.

NTSTATUS ( *GetEa)(
    FSP_FILE_SYSTEM *FileSystem, 
    PVOID FileContext, 
    PFILE_FULL_EA_INFORMATION Ea,
    ULONG EaLength,
    PULONG PBytesTransferred);  

Parameters

• FileSystem — The file system on which this request is posted.
• FileContext — The file context of the file to get extended attributes for.
• Ea — Extended attributes buffer.
• EaLength — Extended attributes buffer length.
• PBytesTransferred — [out]
  Pointer to a memory location that will receive the actual number of bytes transferred.

Return Value

STATUS_SUCCESS or error code.

See Also

• SetEa
• FspFileSystemAddEa

GetFileInfo — Get file or directory information.

NTSTATUS ( *GetFileInfo)(
    FSP_FILE_SYSTEM *FileSystem, 
    PVOID FileContext, 
    FSP_FSCTL_FILE_INFO *FileInfo);  

Parameters

• FileSystem — The file system on which this request is posted.
• FileContext — The file context of the file or directory to get information for.
• FileInfo — [out]
  Pointer to a structure that will receive the file information on successful return
  from this call. This information includes file attributes, file times, etc.

Return Value

STATUS_SUCCESS or error code.

GetReparsePoint — Get reparse point.

NTSTATUS ( *GetReparsePoint)(
    FSP_FILE_SYSTEM *FileSystem, 
    PVOID FileContext, 
    PWSTR FileName,
    PVOID Buffer,
    PSIZE_T PSize);  

Parameters

• FileSystem — The file system on which this request is posted.
• FileContext — The file context of the reparse point.
• FileName — The file name of the reparse point.
• Buffer — Pointer to a buffer that will receive the results of this operation. If
  the function returns a symbolic link path, it should not be NULL terminated.
• PSize — [in,out]
  Pointer to the buffer size. On input it contains the size of the buffer.
  On output it will contain the actual size of data copied.

Return Value

STATUS_SUCCESS or error code.

See Also

• SetReparsePoint

GetSecurity — Get file or directory security descriptor.

NTSTATUS ( *GetSecurity)(
    FSP_FILE_SYSTEM *FileSystem, 
    PVOID FileContext, 
    PSECURITY_DESCRIPTOR SecurityDescriptor,
    SIZE_T *PSecurityDescriptorSize);  

Parameters

• FileSystem — The file system on which this request is posted.
• FileContext — The file context of the file or directory to get the security descriptor for.
• SecurityDescriptor — Pointer to a buffer that will receive the file security descriptor on successful return
  from this call. May be NULL.
• PSecurityDescriptorSize — [in,out]
  Pointer to the security descriptor buffer size. On input it contains the size of the
  security descriptor buffer. On output it will contain the actual size of the security
  descriptor copied into the security descriptor buffer. Cannot be NULL.

Return Value

STATUS_SUCCESS or error code.

GetSecurityByName — Get file or directory attributes and security descriptor given a file name.

NTSTATUS ( *GetSecurityByName)(
    FSP_FILE_SYSTEM *FileSystem, 
    PWSTR FileName,
    PUINT32 PFileAttributes/* or ReparsePointIndex */, 
    PSECURITY_DESCRIPTOR SecurityDescriptor,
    SIZE_T *PSecurityDescriptorSize);  

Parameters

• FileSystem — The file system on which this request is posted.
• FileName — The name of the file or directory to get the attributes and security descriptor for.
• PFileAttributes — Pointer to a memory location that will receive the file attributes on successful return
  from this call. May be NULL.

If this call returns STATUS_REPARSE, the file system MAY place here the index of the
first reparse point within FileName. The file system MAY also leave this at its default
value of 0.

• SecurityDescriptor — Pointer to a buffer that will receive the file security descriptor on successful return
  from this call. May be NULL.
• PSecurityDescriptorSize — [in,out]
  Pointer to the security descriptor buffer size. On input it contains the size of the
  security descriptor buffer. On output it will contain the actual size of the security
  descriptor copied into the security descriptor buffer. May be NULL.

Return Value

STATUS_SUCCESS, STATUS_REPARSE or error code.

STATUS_REPARSE should be returned by file systems that support reparse points when
they encounter a FileName that contains reparse points anywhere but the final path
component.

GetStreamInfo — Get named streams information.

NTSTATUS ( *GetStreamInfo)(
    FSP_FILE_SYSTEM *FileSystem, 
    PVOID FileContext,
    PVOID Buffer,
    ULONG Length, 
    PULONG PBytesTransferred);  

Parameters

• FileSystem — The file system on which this request is posted.
• FileContext — The file context of the file or directory to get stream information for.
• Buffer — Pointer to a buffer that will receive the stream information.
• Length — Length of buffer.
• PBytesTransferred — [out]
  Pointer to a memory location that will receive the actual number of bytes stored.

Return Value

STATUS_SUCCESS or error code.

See Also

• FspFileSystemAddStreamInfo

GetVolumeInfo — Get volume information.

NTSTATUS ( *GetVolumeInfo)(
    FSP_FILE_SYSTEM *FileSystem, 
    FSP_FSCTL_VOLUME_INFO *VolumeInfo);  

Parameters

• FileSystem — The file system on which this request is posted.
• VolumeInfo — [out]
  Pointer to a structure that will receive the volume information on successful return
  from this call.

Return Value

STATUS_SUCCESS or error code.

Open — Open a file or directory.

NTSTATUS ( *Open)(
    FSP_FILE_SYSTEM *FileSystem, 
    PWSTR FileName,
    UINT32 CreateOptions,
    UINT32 GrantedAccess, 
    PVOID *PFileContext,
    FSP_FSCTL_FILE_INFO *FileInfo);  

Parameters

• FileSystem — The file system on which this request is posted.
• FileName — The name of the file or directory to be opened.
• CreateOptions — Create options for this request. This parameter has the same meaning as the
  CreateOptions parameter of the NtCreateFile API. User mode file systems typically
  do not need to do anything special with respect to this parameter. Some file systems may
  also want to pay attention to the FILE_NO_INTERMEDIATE_BUFFERING and FILE_WRITE_THROUGH
  flags, although these are typically handled by the FSD component.
• GrantedAccess — Determines the specific access rights that have been granted for this request. Upon
  receiving this call all access checks have been performed and the user mode file system
  need not perform any additional checks. However this parameter may be useful to a user
  mode file system; for example the WinFsp-FUSE layer uses this parameter to determine
  which flags to use in its POSIX open() call.
• PFileContext — [out]
  Pointer that will receive the file context on successful return from this call.
• FileInfo — [out]
  Pointer to a structure that will receive the file information on successful return
  from this call. This information includes file attributes, file times, etc.

Return Value

STATUS_SUCCESS or error code.

Overwrite — Overwrite a file.

NTSTATUS ( *Overwrite)(
    FSP_FILE_SYSTEM *FileSystem, 
    PVOID FileContext,
    UINT32 FileAttributes,
    BOOLEAN ReplaceFileAttributes,
    UINT64 AllocationSize, 
    FSP_FSCTL_FILE_INFO *FileInfo);  

Parameters

• FileSystem — The file system on which this request is posted.
• FileContext — The file context of the file to overwrite.
• FileAttributes — File attributes to apply to the overwritten file.
• ReplaceFileAttributes — When TRUE the existing file attributes should be replaced with the new ones.
  When FALSE the existing file attributes should be merged (or’ed) with the new ones.
• AllocationSize — Allocation size for the overwritten file.
• FileInfo — [out]
  Pointer to a structure that will receive the file information on successful return
  from this call. This information includes file attributes, file times, etc.

Return Value

STATUS_SUCCESS or error code.

OverwriteEx — Overwrite a file.

NTSTATUS ( *OverwriteEx)(
    FSP_FILE_SYSTEM *FileSystem, 
    PVOID FileContext,
    UINT32 FileAttributes,
    BOOLEAN ReplaceFileAttributes,
    UINT64 AllocationSize, 
    PFILE_FULL_EA_INFORMATION Ea,
    ULONG EaLength, 
    FSP_FSCTL_FILE_INFO *FileInfo);  

Parameters

• FileSystem — The file system on which this request is posted.
• FileContext — The file context of the file to overwrite.
• FileAttributes — File attributes to apply to the overwritten file.
• ReplaceFileAttributes — When TRUE the existing file attributes should be replaced with the new ones.
  When FALSE the existing file attributes should be merged (or’ed) with the new ones.
• AllocationSize — Allocation size for the overwritten file.
• Ea — Extended attributes buffer.
• EaLength — Extended attributes buffer length.
• FileInfo — [out]
  Pointer to a structure that will receive the file information on successful return
  from this call. This information includes file attributes, file times, etc.

Return Value

STATUS_SUCCESS or error code.

Discussion

This function works like Overwrite, except that it also accepts EA (extended attributes).

NOTE: If both Overwrite and OverwriteEx are defined, OverwriteEx takes precedence.

Read — Read a file.

NTSTATUS ( *Read)(
    FSP_FILE_SYSTEM *FileSystem, 
    PVOID FileContext,
    PVOID Buffer,
    UINT64 Offset,
    ULONG Length, 
    PULONG PBytesTransferred);  

Parameters

• FileSystem — The file system on which this request is posted.
• FileContext — The file context of the file to be read.
• Buffer — Pointer to a buffer that will receive the results of the read operation.
• Offset — Offset within the file to read from.
• Length — Length of data to read.
• PBytesTransferred — [out]
  Pointer to a memory location that will receive the actual number of bytes read.

Return Value

STATUS_SUCCESS or error code. STATUS_PENDING is supported allowing for asynchronous
operation.

ReadDirectory — Read a directory.

NTSTATUS ( *ReadDirectory)(
    FSP_FILE_SYSTEM *FileSystem, 
    PVOID FileContext,
    PWSTR Pattern,
    PWSTR Marker, 
    PVOID Buffer,
    ULONG Length,
    PULONG PBytesTransferred);  

Parameters

• FileSystem — The file system on which this request is posted.
• FileContext — The file context of the directory to be read.
• Pattern — The pattern to match against files in this directory. Can be NULL. The file system
  can choose to ignore this parameter as the FSD will always perform its own pattern
  matching on the returned results.
• Marker — A file name that marks where in the directory to start reading. Files with names
  that are greater than (not equal to) this marker (in the directory order determined
  by the file system) should be returned. Can be NULL.
• Buffer — Pointer to a buffer that will receive the results of the read operation.
• Length — Length of data to read.
• PBytesTransferred — [out]
  Pointer to a memory location that will receive the actual number of bytes read.

Return Value

STATUS_SUCCESS or error code. STATUS_PENDING is supported allowing for asynchronous
operation.

See Also

• FspFileSystemAddDirInfo

Rename — Renames a file or directory.

NTSTATUS ( *Rename)(
    FSP_FILE_SYSTEM *FileSystem, 
    PVOID FileContext, 
    PWSTR FileName,
    PWSTR NewFileName,
    BOOLEAN ReplaceIfExists);  

Parameters

• FileSystem — The file system on which this request is posted.
• FileContext — The file context of the file or directory to be renamed.
• FileName — The current name of the file or directory to rename.
• NewFileName — The new name for the file or directory.
• ReplaceIfExists — Whether to replace a file that already exists at NewFileName.

Return Value

STATUS_SUCCESS or error code.

Discussion

The kernel mode FSD provides certain guarantees prior to posting a rename operation:

• A file cannot be renamed if a file with the same name exists and has open handles.

• A directory cannot be renamed if it or any of its subdirectories contains a file that
  has open handles.

ResolveReparsePoints — Resolve reparse points.

NTSTATUS ( *ResolveReparsePoints)(
    FSP_FILE_SYSTEM *FileSystem, 
    PWSTR FileName,
    UINT32 ReparsePointIndex,
    BOOLEAN ResolveLastPathComponent, 
    PIO_STATUS_BLOCK PIoStatus,
    PVOID Buffer,
    PSIZE_T PSize);  

Parameters

• FileSystem — The file system on which this request is posted.
• FileName — The name of the file or directory to have its reparse points resolved.
• ReparsePointIndex — The index of the first reparse point within FileName.
• ResolveLastPathComponent — If FALSE, the last path component of FileName should not be resolved, even
  if it is a reparse point that can be resolved. If TRUE, all path components
  should be resolved if possible.
• PIoStatus — Pointer to storage that will receive the status to return to the FSD. When
  this function succeeds it must set PIoStatus->Status to STATUS_REPARSE and
  PIoStatus->Information to either IO_REPARSE or the reparse tag.
• Buffer — Pointer to a buffer that will receive the resolved file name (IO_REPARSE) or
  reparse data (reparse tag). If the function returns a file name, it should
  not be NULL terminated.
• PSize — [in,out]
  Pointer to the buffer size. On input it contains the size of the buffer.
  On output it will contain the actual size of data copied.

Return Value

STATUS_REPARSE or error code.

Discussion

Reparse points are a general mechanism for attaching special behavior to files.
A file or directory can contain a reparse point. A reparse point is data that has
special meaning to the file system, Windows or user applications. For example, NTFS
and Windows use reparse points to implement symbolic links. As another example,
a particular file system may use reparse points to emulate UNIX FIFO’s.

This function is expected to resolve as many reparse points as possible. If a reparse
point is encountered that is not understood by the file system further reparse point
resolution should stop; the reparse point data should be returned to the FSD with status
STATUS_REPARSE/reparse-tag. If a reparse point (symbolic link) is encountered that is
understood by the file system but points outside it, the reparse point should be
resolved, but further reparse point resolution should stop; the resolved file name
should be returned to the FSD with status STATUS_REPARSE/IO_REPARSE.

SetBasicInfo — Set file or directory basic information.

NTSTATUS ( *SetBasicInfo)(
    FSP_FILE_SYSTEM *FileSystem, 
    PVOID FileContext,
    UINT32 FileAttributes, 
    UINT64 CreationTime,
    UINT64 LastAccessTime,
    UINT64 LastWriteTime,
    UINT64 ChangeTime, 
    FSP_FSCTL_FILE_INFO *FileInfo);  

Parameters

• FileSystem — The file system on which this request is posted.
• FileContext — The file context of the file or directory to set information for.
• FileAttributes — File attributes to apply to the file or directory. If the value INVALID_FILE_ATTRIBUTES
  is sent, the file attributes should not be changed.
• CreationTime — Creation time to apply to the file or directory. If the value 0 is sent, the creation
  time should not be changed.
• LastAccessTime — Last access time to apply to the file or directory. If the value 0 is sent, the last
  access time should not be changed.
• LastWriteTime — Last write time to apply to the file or directory. If the value 0 is sent, the last
  write time should not be changed.
• ChangeTime — Change time to apply to the file or directory. If the value 0 is sent, the change time
  should not be changed.
• FileInfo — [out]
  Pointer to a structure that will receive the file information on successful return
  from this call. This information includes file attributes, file times, etc.

Return Value

STATUS_SUCCESS or error code.

SetDelete — Set the file delete flag.

NTSTATUS ( *SetDelete)(
    FSP_FILE_SYSTEM *FileSystem, 
    PVOID FileContext,
    PWSTR FileName,
    BOOLEAN DeleteFile);  

Parameters

• FileSystem — The file system on which this request is posted.
• FileContext — The file context of the file or directory to set the delete flag for.
• FileName — The name of the file or directory to set the delete flag for.
• DeleteFile — If set to TRUE the FSD indicates that the file will be deleted on Cleanup; otherwise
  it will not be deleted. It is legal to receive multiple SetDelete calls for the same
  file with different DeleteFile parameters.

Return Value

STATUS_SUCCESS or error code.

Discussion

This function sets a flag to indicates whether the FSD file should delete a file
when it is closed. This function does not need to perform access checks, but may
performs tasks such as check for empty directories, etc.

This function should NEVER delete the file or directory in question. Deletion should
happen during Cleanup with the FspCleanupDelete flag set.

This function gets called when Win32 API’s such as DeleteFile or RemoveDirectory are used.
It does not get called when a file or directory is opened with FILE_DELETE_ON_CLOSE.

NOTE: If both CanDelete and SetDelete are defined, SetDelete takes precedence. However
most file systems need only implement the CanDelete operation.

See Also

• Cleanup
• CanDelete

SetEa — Set extended attributes.

NTSTATUS ( *SetEa)(
    FSP_FILE_SYSTEM *FileSystem, 
    PVOID FileContext, 
    PFILE_FULL_EA_INFORMATION Ea,
    ULONG EaLength, 
    FSP_FSCTL_FILE_INFO *FileInfo);  

Parameters

• FileSystem — The file system on which this request is posted.
• FileContext — The file context of the file to set extended attributes for.
• Ea — Extended attributes buffer.
• EaLength — Extended attributes buffer length.
• FileInfo — [out]
  Pointer to a structure that will receive the file information on successful return
  from this call. This information includes file attributes, file times, etc.

Return Value

STATUS_SUCCESS or error code.

See Also

• GetEa

SetFileSize — Set file/allocation size.

NTSTATUS ( *SetFileSize)(
    FSP_FILE_SYSTEM *FileSystem, 
    PVOID FileContext,
    UINT64 NewSize,
    BOOLEAN SetAllocationSize, 
    FSP_FSCTL_FILE_INFO *FileInfo);  

Parameters

• FileSystem — The file system on which this request is posted.
• FileContext — The file context of the file to set the file/allocation size for.
• NewSize — New file/allocation size to apply to the file.
• SetAllocationSize — If TRUE, then the allocation size is being set. if FALSE, then the file size is being set.
• FileInfo — [out]
  Pointer to a structure that will receive the file information on successful return
  from this call. This information includes file attributes, file times, etc.

Return Value

STATUS_SUCCESS or error code.

Discussion

This function is used to change a file’s sizes. Windows file systems maintain two kinds
of sizes: the file size is where the End Of File (EOF) is, and the allocation size is the
actual size that a file takes up on the “disk”.

The rules regarding file/allocation size are:

• Allocation size must always be aligned to the allocation unit boundary. The allocation
  unit is the product (UINT64)SectorSize \* (UINT64)SectorsPerAllocationUnit from
  the FSP_FSCTL_VOLUME_PARAMS structure. The FSD will always send properly aligned allocation
  sizes when setting the allocation size.

• Allocation size is always greater or equal to the file size.

• A file size of more than the current allocation size will also extend the allocation
  size to the next allocation unit boundary.

• An allocation size of less than the current file size should also truncate the current
  file size.

SetReparsePoint — Set reparse point.

NTSTATUS ( *SetReparsePoint)(
    FSP_FILE_SYSTEM *FileSystem, 
    PVOID FileContext, 
    PWSTR FileName,
    PVOID Buffer,
    SIZE_T Size);  

Parameters

• FileSystem — The file system on which this request is posted.
• FileContext — The file context of the reparse point.
• FileName — The file name of the reparse point.
• Buffer — Pointer to a buffer that contains the data for this operation. If this buffer
  contains a symbolic link path, it should not be assumed to be NULL terminated.
• Size — Size of data to write.

Return Value

STATUS_SUCCESS or error code.

See Also

• GetReparsePoint

SetSecurity — Set file or directory security descriptor.

NTSTATUS ( *SetSecurity)(
    FSP_FILE_SYSTEM *FileSystem, 
    PVOID FileContext, 
    SECURITY_INFORMATION SecurityInformation,
    PSECURITY_DESCRIPTOR ModificationDescriptor);  

Parameters

• FileSystem — The file system on which this request is posted.
• FileContext — The file context of the file or directory to set the security descriptor for.
• SecurityInformation — Describes what parts of the file or directory security descriptor should
  be modified.
• ModificationDescriptor — Describes the modifications to apply to the file or directory security descriptor.

Return Value

STATUS_SUCCESS or error code.

See Also

• FspSetSecurityDescriptor
• FspDeleteSecurityDescriptor

SetVolumeLabel — Set volume label.

NTSTATUS ( *SetVolumeLabel)(
    FSP_FILE_SYSTEM *FileSystem, 
    PWSTR VolumeLabel, 
    FSP_FSCTL_VOLUME_INFO *VolumeInfo);  

Parameters

• FileSystem — The file system on which this request is posted.
• VolumeLabel — The new label for the volume.
• VolumeInfo — [out]
  Pointer to a structure that will receive the volume information on successful return
  from this call.

Return Value

STATUS_SUCCESS or error code.

Write — Write a file.

NTSTATUS ( *Write)(
    FSP_FILE_SYSTEM *FileSystem, 
    PVOID FileContext,
    PVOID Buffer,
    UINT64 Offset,
    ULONG Length, 
    BOOLEAN WriteToEndOfFile,
    BOOLEAN ConstrainedIo, 
    PULONG PBytesTransferred,
    FSP_FSCTL_FILE_INFO *FileInfo);  

Parameters

• FileSystem — The file system on which this request is posted.
• FileContext — The file context of the file to be written.
• Buffer — Pointer to a buffer that contains the data to write.
• Offset — Offset within the file to write to.
• Length — Length of data to write.
• WriteToEndOfFile — When TRUE the file system must write to the current end of file. In this case the Offset
  parameter will contain the value -1.
• ConstrainedIo — When TRUE the file system must not extend the file (i.e. change the file size).
• PBytesTransferred — [out]
  Pointer to a memory location that will receive the actual number of bytes written.
• FileInfo — [out]
  Pointer to a structure that will receive the file information on successful return
  from this call. This information includes file attributes, file times, etc.

Return Value

STATUS_SUCCESS or error code. STATUS_PENDING is supported allowing for asynchronous
operation.

Functions

FspDeleteSecurityDescriptor — Delete security descriptor.

FSP_API VOID FspDeleteSecurityDescriptor(
    PSECURITY_DESCRIPTOR SecurityDescriptor, 
    NTSTATUS (*CreateFunc)());  

Parameters

• SecurityDescriptor — The security descriptor to be deleted.
• CreateFunc — Function used to create the security descriptor. This parameter should be
  set to FspSetSecurityDescriptor for the public API.

Return Value

STATUS_SUCCESS or error code.

Discussion

This is a helper for implementing the SetSecurity operation.

See Also

• SetSecurity
• FspSetSecurityDescriptor

FspFileSystemAddDirInfo — Add directory information to a buffer.

FSP_API BOOLEAN FspFileSystemAddDirInfo(
    FSP_FSCTL_DIR_INFO *DirInfo, 
    PVOID Buffer,
    ULONG Length,
    PULONG PBytesTransferred);  

Parameters

• DirInfo — The directory information to add. A value of NULL acts as an EOF marker for a ReadDirectory
  operation.
• Buffer — Pointer to a buffer that will receive the results of the read operation. This should contain
  the same value passed to the ReadDirectory Buffer parameter.
• Length — Length of data to read. This should contain the same value passed to the ReadDirectory
  Length parameter.
• PBytesTransferred — [out]
  Pointer to a memory location that will receive the actual number of bytes read. This should
  contain the same value passed to the ReadDirectory PBytesTransferred parameter.
  FspFileSystemAddDirInfo uses the value pointed by this parameter to track how much of the
  buffer has been used so far.

Return Value

TRUE if the directory information was added, FALSE if there was not enough space to add it.

Discussion

This is a helper for implementing the ReadDirectory operation.

See Also

• ReadDirectory

FspFileSystemAddEa — Add extended attribute to a buffer.

FSP_API BOOLEAN FspFileSystemAddEa(
    PFILE_FULL_EA_INFORMATION SingleEa, 
    PFILE_FULL_EA_INFORMATION Ea,
    ULONG EaLength,
    PULONG PBytesTransferred);  

Parameters

• SingleEa — The extended attribute to add. A value of NULL acts as an EOF marker for a GetEa
  operation.
• Ea — Pointer to a buffer that will receive the extended attribute. This should contain
  the same value passed to the GetEa Ea parameter.
• EaLength — Length of buffer. This should contain the same value passed to the GetEa
  EaLength parameter.
• PBytesTransferred — [out]
  Pointer to a memory location that will receive the actual number of bytes stored. This should
  contain the same value passed to the GetEa PBytesTransferred parameter.

Return Value

TRUE if the extended attribute was added, FALSE if there was not enough space to add it.

Discussion

This is a helper for implementing the GetEa operation.

See Also

• GetEa

FspFileSystemAddNotifyInfo — Add notify information to a buffer.

FSP_API BOOLEAN FspFileSystemAddNotifyInfo(
    FSP_FSCTL_NOTIFY_INFO *NotifyInfo, 
    PVOID Buffer,
    ULONG Length,
    PULONG PBytesTransferred);  

Parameters

• NotifyInfo — The notify information to add.
• Buffer — Pointer to a buffer that will receive the notify information.
• Length — Length of buffer.
• PBytesTransferred — [out]
  Pointer to a memory location that will receive the actual number of bytes stored. This should
  be initialized to 0 prior to the first call to FspFileSystemAddNotifyInfo for a particular
  buffer.

Return Value

TRUE if the notify information was added, FALSE if there was not enough space to add it.

Discussion

This is a helper for filling a buffer to use with FspFileSystemNotify.

See Also

• FspFileSystemNotify

FspFileSystemAddStreamInfo — Add named stream information to a buffer.

FSP_API BOOLEAN FspFileSystemAddStreamInfo(
    FSP_FSCTL_STREAM_INFO *StreamInfo, 
    PVOID Buffer,
    ULONG Length,
    PULONG PBytesTransferred);  

Parameters

• StreamInfo — The stream information to add. A value of NULL acts as an EOF marker for a GetStreamInfo
  operation.
• Buffer — Pointer to a buffer that will receive the stream information. This should contain
  the same value passed to the GetStreamInfo Buffer parameter.
• Length — Length of buffer. This should contain the same value passed to the GetStreamInfo
  Length parameter.
• PBytesTransferred — [out]
  Pointer to a memory location that will receive the actual number of bytes stored. This should
  contain the same value passed to the GetStreamInfo PBytesTransferred parameter.

Return Value

TRUE if the stream information was added, FALSE if there was not enough space to add it.

Discussion

This is a helper for implementing the GetStreamInfo operation.

See Also

• GetStreamInfo

FspFileSystemCanReplaceReparsePoint — Test whether reparse data can be replaced.

FSP_API NTSTATUS FspFileSystemCanReplaceReparsePoint( 
    PVOID CurrentReparseData,
    SIZE_T CurrentReparseDataSize, 
    PVOID ReplaceReparseData,
    SIZE_T ReplaceReparseDataSize);  

Parameters

• CurrentReparseData — Pointer to the current reparse data.
• CurrentReparseDataSize — Pointer to the current reparse data size.
• ReplaceReparseData — Pointer to the replacement reparse data.
• ReplaceReparseDataSize — Pointer to the replacement reparse data size.

Return Value

STATUS_SUCCESS or error code.

Discussion

This is a helper for implementing the SetReparsePoint/DeleteReparsePoint operation
in file systems that support reparse points.

See Also

• SetReparsePoint
• DeleteReparsePoint

FspFileSystemCreate — Create a file system object.

FSP_API NTSTATUS FspFileSystemCreate(
    PWSTR DevicePath, 
    const FSP_FSCTL_VOLUME_PARAMS *VolumeParams, 
    const FSP_FILE_SYSTEM_INTERFACE *Interface, 
    FSP_FILE_SYSTEM **PFileSystem);  

Parameters

• DevicePath — The name of the control device for this file system. This must be either
  FSP_FSCTL_DISK_DEVICE_NAME or FSP_FSCTL_NET_DEVICE_NAME.
• VolumeParams — Volume parameters for the newly created file system.
• Interface — A pointer to the actual operations that actually implement this user mode file system.
• PFileSystem — [out]
  Pointer that will receive the file system object created on successful return from this
  call.

Return Value

STATUS_SUCCESS or error code.

FspFileSystemDelete — Delete a file system object.

FSP_API VOID FspFileSystemDelete(
    FSP_FILE_SYSTEM *FileSystem);  

Parameters

• FileSystem — The file system object.

FspFileSystemEnumerateEa — Enumerate extended attributes in a buffer.

FSP_API NTSTATUS FspFileSystemEnumerateEa(
    FSP_FILE_SYSTEM *FileSystem, 
    NTSTATUS (*EnumerateEa)( 
        FSP_FILE_SYSTEM *FileSystem,
        PVOID Context, 
        PFILE_FULL_EA_INFORMATION SingleEa), 
    PVOID Context, 
    PFILE_FULL_EA_INFORMATION Ea,
    ULONG EaLength);  

Parameters

• FileSystem — The file system object.
• EnumerateEa — Pointer to function that receives a single extended attribute. The function
  should return STATUS_SUCCESS or an error code if unsuccessful.
• Context — User context to supply to EnumEa.
• Ea — Extended attributes buffer.
• EaLength — Extended attributes buffer length.

Return Value

STATUS_SUCCESS or error code from EnumerateEa.

Discussion

This is a helper for implementing the CreateEx and SetEa operations in file systems
that support extended attributes.

FspFileSystemFindReparsePoint — Find reparse point in file name.

FSP_API BOOLEAN FspFileSystemFindReparsePoint(
    FSP_FILE_SYSTEM *FileSystem, 
    NTSTATUS (*GetReparsePointByName)( 
        FSP_FILE_SYSTEM *FileSystem,
        PVOID Context, 
        PWSTR FileName,
        BOOLEAN IsDirectory,
        PVOID Buffer,
        PSIZE_T PSize), 
    PVOID Context, 
    PWSTR FileName,
    PUINT32 PReparsePointIndex);  

Parameters

• FileSystem — The file system object.
• GetReparsePointByName — Pointer to function that can retrieve reparse point information by name. The
  FspFileSystemFindReparsePoint will call this function with the Buffer and PSize
  arguments set to NULL. The function should return STATUS_SUCCESS if the passed
  FileName is a reparse point or STATUS_NOT_A_REPARSE_POINT (or other error code)
  otherwise.
• Context — User context to supply to GetReparsePointByName.
• FileName — The name of the file or directory.
• PReparsePointIndex — Pointer to a memory location that will receive the index of the first reparse point
  within FileName. A value is only placed in this memory location if the function returns
  TRUE. May be NULL.

Return Value

TRUE if a reparse point was found, FALSE otherwise.

Discussion

Given a file name this function returns an index to the first path component that is a reparse
point. The function will call the supplied GetReparsePointByName function for every path
component until it finds a reparse point or the whole path is processed.

This is a helper for implementing the GetSecurityByName operation in file systems
that support reparse points.

See Also

• GetSecurityByName

FspFileSystemGetEaPackedSize — Get extended attribute «packed» size. This computation matches what NTFS reports.

static inline UINT32 FspFileSystemGetEaPackedSize(
    PFILE_FULL_EA_INFORMATION SingleEa) 

Parameters

• SingleEa — The extended attribute to get the size for.

Return Value

The packed size of the extended attribute.

FspFileSystemGetOpenFileInfo — Get open information buffer.

static inline FSP_FSCTL_OPEN_FILE_INFO *FspFileSystemGetOpenFileInfo(
    FSP_FSCTL_FILE_INFO *FileInfo) 

Parameters

• FileInfo — The FileInfo parameter as passed to Create or Open operation.

Return Value

A pointer to the open information buffer for this Create or Open operation.

Discussion

This is a helper for implementing the Create and Open operations. It cannot be used with
any other operations.

The FileInfo parameter to Create and Open is typed as pointer to FSP_FSCTL_FILE_INFO. The
true type of this parameter is pointer to FSP_FSCTL_OPEN_FILE_INFO. This simple function
converts from one type to the other.

The FSP_FSCTL_OPEN_FILE_INFO type contains a FSP_FSCTL_FILE_INFO as well as the fields
NormalizedName and NormalizedNameSize. These fields can be used for file name normalization.
File name normalization is used to ensure that the FSD and the OS know the correct case
of a newly opened file name.

For case-sensitive file systems this functionality should be ignored. The FSD will always
assume that the normalized file name is the same as the file name used to open the file.

For case-insensitive file systems this functionality may be ignored. In this case the FSD
will assume that the normalized file name is the upper case version of the file name used
to open the file. The file system will work correctly and the only way an application will
be able to tell that the file system does not preserve case in normalized file names is by
issuing a GetFinalPathNameByHandle API call (or NtQueryInformationFile with
FileNameInformation/FileNormalizedNameInformation).

For case-insensitive file systems this functionality may also be used. In this case the
user mode file system may use the NormalizedName and NormalizedNameSize parameters to
report to the FSD the normalized file name. It should be noted that the normalized file
name may only differ in case from the file name used to open the file. The NormalizedName
field will point to a buffer that can receive the normalized file name. The
NormalizedNameSize field will contain the size of the normalized file name buffer. On
completion of the Create or Open operation it should contain the actual size of the
normalized file name copied into the normalized file name buffer. The normalized file name
should not contain a terminating zero.

See Also

• Create
• Open

FspFileSystemGetOperationContext — Get the current operation context.

FSP_API FSP_FILE_SYSTEM_OPERATION_CONTEXT *FspFileSystemGetOperationContext(
    VOID);  

Return Value

The current operation context.

Discussion

This function may be used only when servicing one of the FSP_FILE_SYSTEM_INTERFACE operations.
The current operation context is stored in thread local storage. It allows access to the
Request and Response associated with this operation.

FspFileSystemNotify — Notify Windows that the file system has file changes.

FSP_API NTSTATUS FspFileSystemNotify(
    FSP_FILE_SYSTEM *FileSystem, 
    FSP_FSCTL_NOTIFY_INFO *NotifyInfo,
    SIZE_T Size);  

Parameters

• FileSystem — The file system object.
• NotifyInfo — Buffer containing information about file changes.
• Size — Size of buffer.

Return Value

STATUS_SUCCESS or error code.

Discussion

A file system that wishes to notify Windows about file changes must
first issue an FspFileSystemBegin call, followed by 0 or more
FspFileSystemNotify calls, followed by an FspFileSystemNotifyEnd call.

Note that FspFileSystemNotify requires file names to be normalized. A
normalized file name is one that contains the correct case of all characters
in the file name.

For case-sensitive file systems all file names are normalized by definition.
For case-insensitive file systems that implement file name normalization,
a normalized file name is the one that the file system specifies in the
response to Create or Open (see also FspFileSystemGetOpenFileInfo). For
case-insensitive file systems that do not implement file name normalization
a normalized file name is the upper case version of the file name used
to open the file.

FspFileSystemNotifyBegin — Begin notifying Windows that the file system has file changes.

FSP_API NTSTATUS FspFileSystemNotifyBegin(
    FSP_FILE_SYSTEM *FileSystem,
    ULONG Timeout);  

Parameters

• FileSystem — The file system object.

Return Value

STATUS_SUCCESS or error code. The error code STATUS_CANT_WAIT means that
a file rename operation is currently in progress and the operation must be
retried at a later time.

Discussion

A file system that wishes to notify Windows about file changes must
first issue an FspFileSystemBegin call, followed by 0 or more
FspFileSystemNotify calls, followed by an FspFileSystemNotifyEnd call.

This operation blocks concurrent file rename operations. File rename
operations may interfere with file notification, because a file being
notified may also be concurrently renamed. After all file change
notifications have been issued, you must make sure to call
FspFileSystemNotifyEnd to allow file rename operations to proceed.

FspFileSystemNotifyEnd — End notifying Windows that the file system has file changes.

FSP_API NTSTATUS FspFileSystemNotifyEnd(
    FSP_FILE_SYSTEM *FileSystem);  

Parameters

• FileSystem — The file system object.

Return Value

STATUS_SUCCESS or error code.

Discussion

A file system that wishes to notify Windows about file changes must
first issue an FspFileSystemBegin call, followed by 0 or more
FspFileSystemNotify calls, followed by an FspFileSystemNotifyEnd call.

This operation allows any blocked file rename operations to proceed.

FspFileSystemOperationProcessId — Gets the originating process ID.

static inline UINT32 FspFileSystemOperationProcessId(
    VOID) 

Discussion

Valid only during Create, Open and Rename requests when the target exists.

FspFileSystemPreflight — Check whether creating a file system object is possible.

FSP_API NTSTATUS FspFileSystemPreflight(
    PWSTR DevicePath, 
    PWSTR MountPoint);  

Parameters

• DevicePath — The name of the control device for this file system. This must be either
  FSP_FSCTL_DISK_DEVICE_NAME or FSP_FSCTL_NET_DEVICE_NAME.
• MountPoint — The mount point for the new file system. A value of NULL means that the file system should
  use the next available drive letter counting downwards from Z: as its mount point.

Return Value

STATUS_SUCCESS or error code.

FspFileSystemRemoveMountPoint — Remove the mount point for a file system.

FSP_API VOID FspFileSystemRemoveMountPoint(
    FSP_FILE_SYSTEM *FileSystem);  

Parameters

• FileSystem — The file system object.

FspFileSystemResolveReparsePoints — Resolve reparse points.

FSP_API NTSTATUS FspFileSystemResolveReparsePoints(
    FSP_FILE_SYSTEM *FileSystem, 
    NTSTATUS (*GetReparsePointByName)( 
        FSP_FILE_SYSTEM *FileSystem,
        PVOID Context, 
        PWSTR FileName,
        BOOLEAN IsDirectory,
        PVOID Buffer,
        PSIZE_T PSize), 
    PVOID Context, 
    PWSTR FileName,
    UINT32 ReparsePointIndex,
    BOOLEAN ResolveLastPathComponent, 
    PIO_STATUS_BLOCK PIoStatus,
    PVOID Buffer,
    PSIZE_T PSize);  

Parameters

• FileSystem — The file system object.
• GetReparsePointByName — Pointer to function that can retrieve reparse point information by name. The function
  should return STATUS_SUCCESS if the passed FileName is a reparse point or
  STATUS_NOT_A_REPARSE_POINT (or other error code) otherwise.
• Context — User context to supply to GetReparsePointByName.
• FileName — The name of the file or directory to have its reparse points resolved.
• ReparsePointIndex — The index of the first reparse point within FileName.
• ResolveLastPathComponent — If FALSE, the last path component of FileName should not be resolved, even
  if it is a reparse point that can be resolved. If TRUE, all path components
  should be resolved if possible.
• PIoStatus — Pointer to storage that will receive the status to return to the FSD. When
  this function succeeds it must set PIoStatus->Status to STATUS_REPARSE and
  PIoStatus->Information to either IO_REPARSE or the reparse tag.
• Buffer — Pointer to a buffer that will receive the resolved file name (IO_REPARSE) or
  reparse data (reparse tag). If the function returns a file name, it should
  not be NULL terminated.
• PSize — [in,out]
  Pointer to the buffer size. On input it contains the size of the buffer.
  On output it will contain the actual size of data copied.

Return Value

STATUS_REPARSE or error code.

Discussion

Given a file name (and an index where to start resolving) this function will attempt to
resolve as many reparse points as possible. The function will call the supplied
GetReparsePointByName function for every path component until it resolves the reparse points
or the whole path is processed.

This is a helper for implementing the ResolveReparsePoints operation in file systems
that support reparse points.

See Also

• ResolveReparsePoints

FspFileSystemSendResponse — Send a response to the FSD.

FSP_API VOID FspFileSystemSendResponse(
    FSP_FILE_SYSTEM *FileSystem, 
    FSP_FSCTL_TRANSACT_RSP *Response);  

Parameters

• FileSystem — The file system object.
• Response — The response buffer.

Discussion

This call is not required when the user mode file system performs synchronous processing of
requests. It is possible however for the following FSP_FILE_SYSTEM_INTERFACE operations to be
processed asynchronously:

• Read

• Write

• ReadDirectory

These operations are allowed to return STATUS_PENDING to postpone sending a response to the FSD.
At a later time the file system can use FspFileSystemSendResponse to send the response.

FspFileSystemSetMountPoint — Set the mount point for a file system.

FSP_API NTSTATUS FspFileSystemSetMountPoint(
    FSP_FILE_SYSTEM *FileSystem,
    PWSTR MountPoint);  

Parameters

• FileSystem — The file system object.
• MountPoint — The mount point for the new file system. A value of NULL means that the file system should
  use the next available drive letter counting downwards from Z: as its mount point.

Return Value

STATUS_SUCCESS or error code.

Discussion

This function supports drive letters (X:) or directories as mount points:

• Drive letters: Refer to the documentation of the DefineDosDevice Windows API
  to better understand how they are created.

• Directories: They can be used as mount points for disk based file systems. They cannot
  be used for network file systems. This is a limitation that Windows imposes on junctions.

FspFileSystemSetOperationGuardStrategy — Set file system locking strategy.

static inline VOID FspFileSystemSetOperationGuardStrategy(
    FSP_FILE_SYSTEM *FileSystem, 
    FSP_FILE_SYSTEM_OPERATION_GUARD_STRATEGY GuardStrategy) 

Parameters

• FileSystem — The file system object.
• GuardStrategy — The locking (guard) strategy.

See Also

• FSP_FILE_SYSTEM_OPERATION_GUARD_STRATEGY

FspFileSystemStartDispatcher — Start the file system dispatcher.

FSP_API NTSTATUS FspFileSystemStartDispatcher(
    FSP_FILE_SYSTEM *FileSystem,
    ULONG ThreadCount);  

Parameters

• FileSystem — The file system object.
• ThreadCount — The number of threads for the file system dispatcher. A value of 0 will create a default
  number of threads and should be chosen in most cases.

Return Value

STATUS_SUCCESS or error code.

Discussion

The file system dispatcher is used to dispatch operations posted by the FSD to the user mode
file system. Once this call starts executing the user mode file system will start receiving
file system requests from the kernel.

FspFileSystemStopDispatcher — Stop the file system dispatcher.

FSP_API VOID FspFileSystemStopDispatcher(
    FSP_FILE_SYSTEM *FileSystem);  

Parameters

• FileSystem — The file system object.

FspSetSecurityDescriptor — Modify security descriptor.

FSP_API NTSTATUS FspSetSecurityDescriptor( 
    PSECURITY_DESCRIPTOR InputDescriptor, 
    SECURITY_INFORMATION SecurityInformation, 
    PSECURITY_DESCRIPTOR ModificationDescriptor, 
    PSECURITY_DESCRIPTOR *PSecurityDescriptor);  

Parameters

• InputDescriptor — The input security descriptor to be modified.
• SecurityInformation — Describes what parts of the InputDescriptor should be modified. This should contain
  the same value passed to the SetSecurity SecurityInformation parameter.
• ModificationDescriptor — Describes the modifications to apply to the InputDescriptor. This should contain
  the same value passed to the SetSecurity ModificationDescriptor parameter.
• PSecurityDescriptor — [out]
  Pointer to a memory location that will receive the resulting security descriptor.
  This security descriptor can be later freed using FspDeleteSecurityDescriptor.

Return Value

STATUS_SUCCESS or error code.

Discussion

This is a helper for implementing the SetSecurity operation.

See Also

• SetSecurity
• FspDeleteSecurityDescriptor

Typedefs

FSP_FILE_SYSTEM_OPERATION_GUARD_STRATEGY — User mode file system locking strategy.

typedef enum { 
    FSP_FILE_SYSTEM_OPERATION_GUARD_STRATEGY_FINE = 0, 
    FSP_FILE_SYSTEM_OPERATION_GUARD_STRATEGY_COARSE, 
} FSP_FILE_SYSTEM_OPERATION_GUARD_STRATEGY;  

Discussion

Two concurrency models are provided:

1. A fine-grained concurrency model where file system NAMESPACE accesses
   are guarded using an exclusive-shared (read-write) lock. File I/O is not
   guarded and concurrent reads/writes/etc. are possible. [Note that the FSD
   will still apply an exclusive-shared lock PER INDIVIDUAL FILE, but it will
   not limit I/O operations for different files.]
   The fine-grained concurrency model applies the exclusive-shared lock as
   follows:

• EXCL: SetVolumeLabel, Flush(Volume),
  Create, Cleanup(Delete), SetInformation(Rename)

• SHRD: GetVolumeInfo, Open, SetInformation(Disposition), ReadDirectory

• NONE: all other operations

1. A coarse-grained concurrency model where all file system accesses are
   guarded by a mutually exclusive lock.

See Also

• FspFileSystemSetOperationGuardStrategy

SERVICE FRAMEWORK

User mode file systems typically are run as Windows services. WinFsp provides an API to make
the creation of Windows services easier. This API is provided for convenience and is not
necessary to expose a user mode file system to Windows.

Functions

FspServiceAcceptControl — Configure the control codes that a service accepts.

FSP_API VOID FspServiceAcceptControl(
    FSP_SERVICE *Service,
    ULONG Control);  

Parameters

• Service — The service object.
• Control — The control codes to accept. Note that the SERVICE_ACCEPT_PAUSE_CONTINUE code is silently
  ignored.

Discussion

This API should be used prior to Start operations.

FspServiceAllowConsoleMode — Allow a service to run in console mode.

FSP_API VOID FspServiceAllowConsoleMode(
    FSP_SERVICE *Service);  

Parameters

• Service — The service object.

Discussion

A service that is run in console mode runs with a console attached and outside the control of
the Service Control Manager. This is useful for debugging and testing a service during
development.

User mode file systems that wish to use the WinFsp Launcher functionality must also use this
call. The WinFsp Launcher is a Windows service that can be configured to launch and manage
multiple instances of a user mode file system.

FspServiceContextCheck — Check if the supplied token is from the service context.

FSP_API NTSTATUS FspServiceContextCheck(
    HANDLE Token,
    PBOOLEAN PIsLocalSystem);  

Parameters

• Token — Token to check. Pass NULL to check the current process token.
• PIsLocalSystem — Pointer to a boolean that will receive a TRUE value if the token belongs to LocalSystem
  and FALSE otherwise. May be NULL.

Return Value

STATUS_SUCCESS if the token is from the service context. STATUS_ACCESS_DENIED if it is not.
Other error codes are possible.

FspServiceCreate — Create a service object.

FSP_API NTSTATUS FspServiceCreate(
    PWSTR ServiceName, 
    FSP_SERVICE_START *OnStart, 
    FSP_SERVICE_STOP *OnStop, 
    FSP_SERVICE_CONTROL *OnControl, 
    FSP_SERVICE **PService);  

Parameters

• ServiceName — The name of the service.
• OnStart — Function to call when the service starts.
• OnStop — Function to call when the service stops.
• OnControl — Function to call when the service receives a service control code.
• PService — [out]
  Pointer that will receive the service object created on successful return from this
  call.

Return Value

STATUS_SUCCESS or error code.

FspServiceDelete — Delete a service object.

FSP_API VOID FspServiceDelete(
    FSP_SERVICE *Service);  

Parameters

• Service — The service object.

FspServiceGetExitCode — Get the service process exit code.

FSP_API ULONG FspServiceGetExitCode(
    FSP_SERVICE *Service);  

Parameters

• Service — The service object.

Return Value

Service process exit code.

FspServiceIsInteractive — Determine if the current process is running in user interactive mode.

FSP_API BOOLEAN FspServiceIsInteractive(
    VOID);  

Return Value

TRUE if the process is running in running user interactive mode.

FspServiceLog — Log a service message.

FSP_API VOID FspServiceLog(
    ULONG Type,
    PWSTR Format,
    ...);  

Parameters

• Type — One of EVENTLOG_INFORMATION_TYPE, EVENTLOG_WARNING_TYPE, EVENTLOG_ERROR_TYPE.
• Format — Format specification. This function uses the Windows wsprintf API for formatting. Refer to
  that API’s documentation for details on the format specification.

Discussion

This function can be used to log an arbitrary message to the Windows Event Log or to the current
console if running in user interactive mode.

FspServiceLoop — Run a service main loop.

FSP_API NTSTATUS FspServiceLoop(
    FSP_SERVICE *Service);  

Parameters

• Service — The service object.

Return Value

STATUS_SUCCESS or error code.

Discussion

This function starts and runs a service. It executes the Windows StartServiceCtrlDispatcher API
to connect the service process to the Service Control Manager. If the Service Control Manager is
not available (and console mode is allowed) it will enter console mode.

FspServiceRequestTime — Request additional time from the Service Control Manager.

FSP_API VOID FspServiceRequestTime(
    FSP_SERVICE *Service,
    ULONG Time);  

Parameters

• Service — The service object.
• Time — Additional time (in milliseconds).

Discussion

This API should be used during Start and Stop operations only.

FspServiceRunEx — Run a service.

FSP_API ULONG FspServiceRunEx(
    PWSTR ServiceName, 
    FSP_SERVICE_START *OnStart, 
    FSP_SERVICE_STOP *OnStop, 
    FSP_SERVICE_CONTROL *OnControl, 
    PVOID UserContext);  

Parameters

• ServiceName — The name of the service.
• OnStart — Function to call when the service starts.
• OnStop — Function to call when the service stops.
• OnControl — Function to call when the service receives a service control code.

Return Value

Service process exit code.

Discussion

This function wraps calls to FspServiceCreate, FspServiceLoop and FspServiceDelete to create,
run and delete a service. It is intended to be used from a service’s main/wmain function.

This function runs a service with console mode allowed.

FspServiceSetExitCode — Set the service process exit code.

FSP_API VOID FspServiceSetExitCode(
    FSP_SERVICE *Service,
    ULONG ExitCode);  

Parameters

• Service — The service object.
• ExitCode — Service process exit code.

FspServiceStop — Stops a running service.

FSP_API VOID FspServiceStop(
    FSP_SERVICE *Service);  

Parameters

• Service — The service object.

Return Value

STATUS_SUCCESS or error code.

Discussion

Stopping a service usually happens when the Service Control Manager instructs the service to
stop. In some situations (e.g. fatal errors) the service may wish to stop itself. It can do so
in a clean manner by calling this function.

<sub>Copyright © 2015-2021 Bill Zissimopoulos

Generated with prettydoc</sub>