Prefix package types and procedures

NTFSD
1

Hello,
Can anyone point me at any samples, documentation, discussions, etc
covering the ‘Prefix package types and procedures’ in ntifs.h? If not, if
anyone knows how to use this package, and could give me a simple overview of
what it does and for what applications it could be useful, I would be
grateful.

Thanks,
Joel

2

Prefix package types and procedures> Can anyone point me at any
samples, documentation, discussions, etc

covering the ‘Prefix package types and procedures’ in ntifs.h? If not, if
anyone

This package is for maintaining a prefix table (table of some strings) and
to run a highly optimized code which will check whether the string starts
with one of the prefixes in the table - the table can contain huge lots of
prefixes.
MUP uses this table to maintain its (UNC path prefix -> redirector device
name) cache.

Pfxxxx routines are for ANSI/DBCS strings, while RtlxxxUnicodePrefix are for
Unicode strings.
All string comparisons in Pfxxxx version are case sensitive.

NTSYSAPI
VOID
NTAPI
RtlInitializeUnicodePrefix (
PUNICODE_PREFIX_TABLE PrefixTable
);
or
NTSYSAPI
VOID
NTAPI
PfxInitialize (
PPREFIX_TABLE PrefixTable
);

  • initializes the prefix table structure.

NTSYSAPI
BOOLEAN
NTAPI
PfxInsertPrefix (
PPREFIX_TABLE PrefixTable,
PSTRING Prefix,
PPREFIX_TABLE_ENTRY PrefixTableEntry
);
or
NTSYSAPI
BOOLEAN
NTAPI
RtlInsertUnicodePrefix (
PUNICODE_PREFIX_TABLE PrefixTable,
PUNICODE_STRING Prefix,
PUNICODE_PREFIX_TABLE_ENTRY PrefixTableEntry
);

  • add a prefix string Prefix to the table specified by PrefixTable.
    PrefixTableEntry is the entry allocated by the caller (possibly as part of a
    larger structure) and not initialized on call.
    This entry will be put on the prefix table lists.
    Return value is FALSE if this prefix (in this same character case) already
    existed in the table, TRUE otherwise.

NTSYSAPI
VOID
NTAPI
PfxRemovePrefix (
PPREFIX_TABLE PrefixTable,
PPREFIX_TABLE_ENTRY PrefixTableEntry
);
or
NTSYSAPI
VOID
NTAPI
RtlRemoveUnicodePrefix (
PUNICODE_PREFIX_TABLE PrefixTable,
PUNICODE_PREFIX_TABLE_ENTRY PrefixTableEntry
);

  • removes the previously added entry from the prefix table.

NTSYSAPI
PPREFIX_TABLE_ENTRY
NTAPI
PfxFindPrefix (
PPREFIX_TABLE PrefixTable,
PSTRING FullName
);
or
NTSYSAPI
PUNICODE_PREFIX_TABLE_ENTRY
NTAPI
RtlFindUnicodePrefix (
PUNICODE_PREFIX_TABLE PrefixTable,
PUNICODE_STRING FullName,
ULONG CaseInsensitiveIndex
);

  • searches the table to find the best-matching prefix for the given string.
    Returns the table entry or NULL if no prefix found.
    CaseInsensitiveIndex (Unicode version only) means - all characters in the
    string before this index are searched case sensitive, and after this index -
    insensitive. PfxFindPrefix always uses the case sensitive search.

NTSYSAPI
PUNICODE_PREFIX_TABLE_ENTRY
NTAPI
RtlNextUnicodePrefix (
PUNICODE_PREFIX_TABLE PrefixTable,
BOOLEAN Restart
);

  • used to enumerate the prefix table in lexicographical order. Restart is
    TRUE to find the first element, is FALSE to find the next element. Returns
    NULL if no more entries.

Max