FILTER_AGGREGATE_STANDARD_INFORMATION - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
// fltuserstructures.h
typedef struct _FILTER_AGGREGATE_STANDARD_INFORMATION {
ULONG NextEntryOffset;
ULONG Flags;
union {
struct {
ULONG Flags;
ULONG FrameID;
ULONG NumberOfInstances;
USHORT FilterNameLength;
USHORT FilterNameBufferOffset;
USHORT FilterAltitudeLength;
USHORT FilterAltitudeBufferOffset;
} MiniFilter;
struct {
ULONG Flags;
USHORT FilterNameLength;
USHORT FilterNameBufferOffset;
USHORT FilterAltitudeLength;
USHORT FilterAltitudeBufferOffset;
} LegacyFilter;
} Type;
} FILTER_AGGREGATE_STANDARD_INFORMATION, *PFILTER_AGGREGATE_STANDARD_INFORMATION;
View the official Windows Driver Kit DDI referenceNo description available.
The FILTER_AGGREGATE_STANDARD_INFORMATION structure contains information about a minifilter or legacy filter driver.
NextEntryOffsetByte offset of the next FILTER_AGGREGATE_STANDARD_INFORMATION entry, if multiple entries are present in a buffer. This member is zero if no other entries follow this one.
FlagsIndicates whether the filter driver is a legacy filter or a minifilter. This member must be one of the following values.
| Flag | Meaning |
|---|---|
| FLTFL_ASI_IS_MINIFILTER | The filter is a minifilter - use the MiniFilter portion of the union. |
| FLTFL_ASI_IS_LEGACYFILTER | The filter is a legacy filter - use the LegacyFilter portion of the union. |
TypeType.MiniFilterNested structure variable with the following members:
Type.MiniFilter.FlagsThere are currently no flags defined for this member.
Type.MiniFilter.FrameIDZero-based index used to identify the filter manager frame that the minifilter is in.
Type.MiniFilter.NumberOfInstancesNumber of instances that currently exist for the minifilter.
Type.MiniFilter.FilterNameLengthLength, in bytes, of the minifilter name string.
Type.MiniFilter.FilterNameBufferOffsetByte offset (relative to the beginning of the structure) of the first character of the Unicode minifilter name string. The string is not NULL-terminated.
Type.MiniFilter.FilterAltitudeLengthLength, in bytes, of the minifilter altitude string.
Type.MiniFilter.FilterAltitudeBufferOffsetByte offset (relative to the beginning of the structure) of the first character of the Unicode minifilter altitude string. The string is not NULL-terminated.
Type.LegacyFilterNested structure variable with the following members:
Type.LegacyFilter.FlagsThere are currently no flags defined for this member.
Type.LegacyFilter.FilterNameLengthLength, in bytes, of the legacy filter name string.
Type.LegacyFilter.FilterNameBufferOffsetByte offset (relative to the beginning of the structure) of the first character of the Unicode legacy filter name string. The string is not NULL-terminated.
Type.LegacyFilter.FilterAltitudeLengthLength, in bytes, of the legacy filter altitude string.
Type.LegacyFilter.FilterAltitudeBufferOffsetByte offset (relative to the beginning of the structure) of the first character of the Unicode legacy filter altitude string. The string is not NULL-terminated.
Starting with Windows Vista, altitudes are assigned to legacy filter drivers based on the driver's load order group. This ensures that minifilter drivers will layer properly above and below legacy filter drivers even if one or more of the filter drivers are loaded out-of-order.
The FILTER_AGGREGATE_STANDARD_INFORMATION structure can be allocated from paged or nonpaged pool. This structure is passed as a parameter to routines such as:
The FILTER_AGGREGATE_STANDARD_INFORMATION structure must be aligned on a LONGLONG (8-byte) boundary. If a buffer contains two or more of these structures, the NextEntryOffset value in each entry falls on an 8-byte boundary.
FILTER_AGGREGATE_BASIC_INFORMATION