FwpsApplyModifiedLayerData0 - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
// fwpsk.h
void FwpsApplyModifiedLayerData0(
[in] UINT64 classifyHandle,
[in] PVOID modifiedLayerData,
[in] UINT32 flags
);
View the official Windows Driver Kit DDI referenceNo description available.
The FwpsApplyModifiedLayerData0 function applies changes to layer-specific data made after a call to FwpsAcquireWritableLayerDataPointer0.
[!Note] FwpsApplyModifiedLayerData0 is a specific version of FwpsApplyModifiedLayerData. See WFP Version-Independent Names and Targeting Specific Versions of Windows for more information.
classifyHandle [in]The classification handle that identifies the callout driver's processing at the current layer. This handle is obtained by calling FwpsAcquireClassifyHandle0.
modifiedLayerData [in]The data buffer obtained by calling FwpsAcquireWritableLayerDataPointer0 with members modified by the callout driver. Supported data types are defined as structures.
flags [in]The options to use with this function call. This flag can have the following value.
| Value | Meaning |
|---|---|
| FWPS_CLASSIFY_FLAG_REAUTHORIZE_IF_MODIFIED_BY_OTHERS | When set, this flag specifies that data at the layer of the pended classify action should be reauthorized if another callout driver modifies the data before the classification is completed. Use this flag only with pended classify and not inline classify, as its use with inline classify can lead to indeterminate results. If you do call this API for inline classify, set flags to zero. |
FwpsApplyModifiedLayerData0 should be called once for every call made toFwpsAcquireWritableLayerDataPointer0, even if the callout driver didn't modify any data.
FwpsAcquireWritableLayerDataPointer0