FSCTL_UPDATE_OVERLAY - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
// ntifs.h
// CTL_CODE(0x0009, 0x0ce, METHOD_BUFFERED, FILE_WRITE_ACCESS)
#define FSCTL_UPDATE_OVERLAY 0x00098338
View the official Windows hardware development documentationNo description available.
The FSCTL_UPDATE_OVERLAY control code updates a new data source identifier for a backing source attached to a volume.
To perform this operation, call FltFsControlFile or ZwFsControlFile with the following parameters.
Instance [in]: FltFsControlFile only. An opaque instance pointer for the caller. This parameter is required and cannot be NULL.
FileObject [in]: FltFsControlFile only. The file pointer object of the volume for which the overlay is updated. This parameter is required and cannot be NULL.
FileHandle [in]: ZwFsControlFile only. The handle of the volume for which the overlay is updated. This parameter is required and cannot be NULL.
FsControlCode [in]: The control code for the operation. Use FSCTL_UPDATE_OVERLAY for this operation.
InputBuffer [in]: A pointer to the input buffer, which must contain a WOF_EXTERNAL_INFO structure. When required, additional provider specific data is included immediately after WOF_EXTERNAL_INFO. If the provider is a WIM file, a WIM_PROVIDER_UPDATE_OVERLAY_INPUT structure is included after WOF_EXTERNAL_INFO.
InputBufferLength [in]: Set to sizeof(WOF_EXTERNAL_INFO) plus the size of any additional provider input data.
OutputBuffer [out]: Not used. Set to NULL.
OutputBufferLength [in]: Set to 0.
FltFsControlFile or ZwFsControlFile returns STATUS_SUCCESS if the operation succeeds. Otherwise, the appropriate function might return one of the following NTSTATUS values.
| Code | Meaning |
|---|---|
| STATUS_ACCESS_DENIED | The requester does not have administrative privileges. |
| STATUS_BUFFER_TOO_SMALL | The length of the input buffer pointed to by InputBuffer, and specified by InputBufferLength, is too small. |
| STATUS_INTERNAL_ERROR | The requested volume is not accessible. |
| STATUS_INVALID_DEVICE_REQUEST | The backing service is not present or not started. |
When the data source to update is a Windows Imaging Format (WIM) file, the input buffer will contain a WOF_EXTERNAL_INFO structure followed by a WIM_PROVIDER_UPDATE_OVERLAY_INPUT structure. The InputBufferLength in this case will be sizeof(WOF_EXTERNAL_INFO) + sizeof(WIM_PROVIDER_UPDATE_OVERLAY_INPUT). The DataSourceId value in WIM_PROVIDER_UPDATE_OVERLAY_INPUT must be for a WIM file previously added in an FSCTL_ADD_OVERLAY request.
Other backing providers will define their own specific input parameter structures.
| Requirement type | Requirement |
|---|---|
| Minimum supported client | Windows 8.1 Update |
| Header | Ntifs.h (include Ntifs.h or Fltkernel.h) |