FLT_TAG_DATA_BUFFER - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
// fltkernel.h
typedef struct _FLT_TAG_DATA_BUFFER {
ULONG FileTag;
USHORT TagDataLength;
USHORT UnparsedNameLength;
union {
struct {
USHORT SubstituteNameOffset;
USHORT SubstituteNameLength;
USHORT PrintNameOffset;
USHORT PrintNameLength;
ULONG Flags;
WCHAR PathBuffer[1];
} SymbolicLinkReparseBuffer;
struct {
USHORT SubstituteNameOffset;
USHORT SubstituteNameLength;
USHORT PrintNameOffset;
USHORT PrintNameLength;
WCHAR PathBuffer[1];
} MountPointReparseBuffer;
struct {
UCHAR DataBuffer[1];
} GenericReparseBuffer;
struct {
GUID TagGuid;
UCHAR DataBuffer[1];
} GenericGUIDReparseBuffer;
};
} FLT_TAG_DATA_BUFFER, *PFLT_TAG_DATA_BUFFER;
View the official Windows Driver Kit DDI referenceNo description available.
The FLT_TAG_DATA_BUFFER structure contains information about a reparse point tag.
FileTagTag that uniquely identifies the reparse point. Can be one of the Microsoft-defined IO_REPARSE_TAG_*XXX* values defined in ntifs.h, or an ISV-defined value.
TagDataLengthSize, in bytes, of the reparse data pointed to by the DataBuffer member.
UnparsedNameLengthLength, in bytes, of the unparsed portion of the file name pointed to by the FileName member of the associated file object. For more information about the FileName member, see FILE_OBJECT.
SymbolicLinkReparseBufferWhen FileTag is IO_REPARSE_TAG_SYMLINK, you can use this structure to interpret the payload.
SymbolicLinkReparseBuffer.SubstituteNameOffsetOffset, in bytes, of the substitute name string in the PathBuffer array. Note that this offset must be divided by sizeof(WCHAR) to get the array index.
SymbolicLinkReparseBuffer.SubstituteNameLengthLength, in bytes, of the substitute name string. If this string is NULL_terminated, SubstituteNameLength does not include space for the UNICODE_NULL terminator.
SymbolicLinkReparseBuffer.PrintNameOffsetOffset, in bytes, of the print name string in the PathBuffer array. Note that this offset must be divided by sizeof(WCHAR) to get the array index.
SymbolicLinkReparseBuffer.PrintNameLengthLength, in bytes, of the print name string. If this string is NULL_terminated, PrintNameLength does not include space for the UNICODE_NULL terminator.
SymbolicLinkReparseBuffer.FlagsIndicates whether the symbolic link is absolute or relative. If Flags contains SYMLINK_FLAG_RELATIVE, the symbolic link contained in PathBuffer (at offset SubstituteNameOffset) is processed as a relative link; otherwise, it is processed as an absolute link.
SymbolicLinkReparseBuffer.PathBufferFirst character of the path string. This character is followed in memory by the remainder of the string. The path string contains the substitute name string and print name string. The substitute name and print name strings can appear in any order in the PathBuffer. To locate the substitute name and print name strings in the PathBuffer, use the SubstituteNameOffset, SubstituteNameLength, PrintNameOffset, and PrintNameLength members.
MountPointReparseBufferWhen FileTag is IO_REPARSE_TAG_MOUNT_POINT, you can use this structure to interpret the payload.
MountPointReparseBuffer.SubstituteNameOffsetOffset, in bytes, of the substitute name string in the PathBuffer array. Note that this offset must be divided by sizeof(WCHAR) to get the array index.
MountPointReparseBuffer.SubstituteNameLengthLength, in bytes, of the substitute name string. If this string is NULL_terminated, SubstituteNameLength does not include space for the UNICODE_NULL terminator.
MountPointReparseBuffer.PrintNameOffsetOffset, in bytes, of the print name string in the PathBuffer array. Note that this offset must be divided by sizeof(WCHAR) to get the array index.
MountPointReparseBuffer.PrintNameLengthLength, in bytes, of the print name string. If this string is NULL_terminated, PrintNameLength does not include space for the UNICODE_NULL terminator.
MountPointReparseBuffer.PathBufferFirst character of the path string. This character is followed in memory by the remainder of the string. The path string contains the substitute name string and print name string. The substitute name and print name strings can appear in any order in the PathBuffer. To locate the substitute name and print name strings in the PathBuffer, use the SubstituteNameOffset, SubstituteNameLength, PrintNameOffset, and PrintNameLength members.
GenericReparseBufferYou can use this structure to interpret the payload for any Microsoft-defined IO_REPARSE_TAG_*XXX* tag.
GenericReparseBuffer.DataBufferPointer to a buffer that contains user-defined data for the reparse point.
GenericGUIDReparseBufferYou can use this structure to interpret the payload for any IO_REPARSE_TAG_*XXX* tag.
GenericGUIDReparseBuffer.TagGuidGlobally unique identifier (GUID) that identifies the type of reparse point. If FileTag is not a Microsoft tag, this member cannot be NULL.
GenericGUIDReparseBuffer.DataBufferPointer to a buffer that contains user-defined data for the reparse point.
A minifilter can use the FLT_TAG_DATA_BUFFER structure to store information about a reparse point tag.
From the union, you can use the GenericGUIDReparseBuffer structure to interpret the payload for any IO_REPARSE_TAG_*XXX* tag, or optionally use one of the other structures within the union as follows:
Use the GenericReparseBuffer structure for any Microsoft-defined IO_REPARSE_TAG_*XXX* tag.
Use the SymbolicLinkReparseBuffer structure when FileTag is IO_REPARSE_TAG_SYMLINK.
Use the MountPointReparseBuffer structure when FileTag is IO_REPARSE_TAG_MOUNT_POINT.
A pointer to an FLT_TAG_DATA_BUFFER structure that contains reparse point tag data for an operation is stored in the TagData member of the FLT_CALLBACK_DATA structure for the operation.
The FLT_TAG_DATA_BUFFER_HEADER_SIZE macro returns the size of the fixed portion of the FLT_TAG_DATA_BUFFER structure.