FILTER_AGGREGATE_BASIC_INFORMATION - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
// fltuserstructures.h
typedef struct _FILTER_AGGREGATE_BASIC_INFORMATION {
ULONG NextEntryOffset;
ULONG Flags;
union {
struct {
ULONG FrameID;
ULONG NumberOfInstances;
USHORT FilterNameLength;
USHORT FilterNameBufferOffset;
USHORT FilterAltitudeLength;
USHORT FilterAltitudeBufferOffset;
} MiniFilter;
struct {
USHORT FilterNameLength;
USHORT FilterNameBufferOffset;
} LegacyFilter;
} Type;
} FILTER_AGGREGATE_BASIC_INFORMATION, *PFILTER_AGGREGATE_BASIC_INFORMATION;
View the official Windows Driver Kit DDI referenceNo description available.
The FILTER_AGGREGATE_BASIC_INFORMATION structure contains basic information for a minifilter or legacy filter driver.
NextEntryOffsetByte offset of the next FILTER_AGGREGATE_BASIC_INFORMATION entry, if multiple entries are present in a buffer. This member is zero if no other entries follow this one.
FlagsIndicates whether the filter driver is a legacy filter or a minifilter. This member must be one of the following values.
| Flag | Meaning |
|---|---|
| FLTFL_AGGREGATE_INFO_IS_MINIFILTER | The filter is a minifilter - use the MiniFilter portion of the union. |
| FLTFL_AGGREGATE_INFO_IS_LEGACYFILTER | The filter is a legacy filter - use the LegacyFilter portion of the union. |
TypeType.MiniFilterType.MiniFilter.FrameIDZero-based index of the current frame.
Type.MiniFilter.NumberOfInstancesNumber of instances that currently exist for the minifilter.
Type.MiniFilter.FilterNameLengthLength, in bytes, of the filter name.
Type.MiniFilter.FilterNameBufferOffsetByte offset of the first character of the filter name string.
Type.MiniFilter.FilterAltitudeLengthLength, in bytes, of the minifilter altitude string.
Type.MiniFilter.FilterAltitudeBufferOffsetByte offset of the first character of the minifilter altitude string.
Type.LegacyFilterType.LegacyFilter.FilterNameLengthLength, in bytes, of the filter name.
Type.LegacyFilter.FilterNameBufferOffsetByte offset of the first character of the filter name string.
The FILTER_AGGREGATE_BASIC_INFORMATION structure is passed as a parameter to routines such as FilterFindFirst, FilterFindNext, FilterGetInformation, FltEnumerateFilterInformation, and FltGetFilterInformation.
This structure must be aligned on a LONGLONG (8-byte) boundary. If a buffer contains two or more of these structures, the NextEntryOffset value in each entry, except the last, falls on an 8-byte boundary.
FILTER_AGGREGATE_STANDARD_INFORMATION