fs.c

/*
 * fs.c — File system interception via Minifilter callbacks.
 *
 * Dual purpose:
 *   1. EDR file protection rules (block access/write/delete)
 *   2. Self-file hiding (directory enumeration filtering)
 *
 * Rules are managed via commands from comm.c.
 * Callbacks are routed from core.c's registered IRP handlers.
 */

#include <ntifs.h>
#include <fltKernel.h>
#include <ntstrsafe.h>
#include "edr_shared.h"
#include "core.h"

#define FS_RULE_MAX_PATH    520
#define FS_MAX_RULES        64

#define FS_RULE_BLOCK_READ      0x01
#define FS_RULE_BLOCK_WRITE     0x02
#define FS_RULE_BLOCK_DELETE    0x04
#define FS_RULE_HIDE            0x08

typedef struct _FS_RULE {
    BOOLEAN     Active;
    ULONG       Flags;
    WCHAR       Path[FS_RULE_MAX_PATH];
    USHORT      PathLength;
} FS_RULE, *PFS_RULE;

static FS_RULE      g_FsRules[FS_MAX_RULES] = { 0 };
static EX_PUSH_LOCK g_FsRulesLock;
static volatile LONG g_FsInitialized = 0;

static WCHAR g_SelfFileName[64] = L"";
static USHORT g_SelfFileNameLen = 0;

static PFS_RULE FsFindMatchingRule(
    _In_ PUNICODE_STRING FilePath,
    _In_ ULONG RequiredFlags
);

static BOOLEAN FsIsOurProcess(VOID);
static VOID FsInitSelfFileName(VOID);
static NTSTATUS FsGetNormalizedNameInfo(
    _Inout_ PFLT_CALLBACK_DATA Data,
    _Outptr_ PFLT_FILE_NAME_INFORMATION *NameInfo
);
static ULONG FsGetCreateAccessFlags(_In_ PFLT_CALLBACK_DATA Data);
static BOOLEAN FsIsWindowsPath(_In_ PUNICODE_STRING FilePath);
static BOOLEAN FsEvaluateRuleBlock(
    _In_ PUNICODE_STRING FilePath,
    _In_ ULONG RequiredFlags
);
static NTSTATUS FsEvaluateConfirmDecision(
    _Inout_ PFLT_CALLBACK_DATA Data,
    _In_ ULONG OpType,
    _In_ PUNICODE_STRING FilePath,
    _Out_ BOOLEAN *Block
);
static BOOLEAN FsShouldHideDirectoryEntry(
    _In_reads_bytes_(FileNameLength) PWCHAR FileName,
    _In_ ULONG FileNameLength
);
static NTSTATUS FsGetDirectoryEntryName(
    _In_ ULONG InfoClass,
    _In_ PVOID Entry,
    _Out_ PULONG NextOffset,
    _Outptr_result_bytebuffer_(*FileNameLength) PWCHAR *FileName,
    _Out_ PULONG FileNameLength
);
static VOID FsUnlinkDirectoryEntry(
    _In_ ULONG InfoClass,
    _Inout_opt_ PVOID PreviousEntry,
    _In_ ULONG NextOffset
);

#define FS_MAX_PENDING          32
#define FS_CONFIRM_TIMEOUT      (-5LL * 10 * 1000 * 1000)   /* 5 seconds */
#define FS_MAX_CONFIRM_PATHS    64
#define FS_CONFIRM_PATH_LEN     520

typedef struct _FS_PENDING_OP {
    BOOLEAN     InUse;
    ULONG       RequestId;
    KEVENT      CompletionEvent;
    BOOLEAN     Approved;
} FS_PENDING_OP, *PFS_PENDING_OP;

typedef struct _FS_CONFIRM_PATH {
    BOOLEAN     Active;
    WCHAR       Path[FS_CONFIRM_PATH_LEN];
    USHORT      PathLength;
} FS_CONFIRM_PATH, *PFS_CONFIRM_PATH;

static FS_PENDING_OP    g_PendingOps[FS_MAX_PENDING] = { 0 };
static KSPIN_LOCK       g_PendingLock;
static volatile LONG    g_NextRequestId = 1;
static FS_CONFIRM_PATH  g_ConfirmPaths[FS_MAX_CONFIRM_PATHS] = { 0 };
static EX_PUSH_LOCK     g_ConfirmPathsLock;

static PFS_PENDING_OP FsAllocPendingOp(_Out_ PULONG RequestId);
static VOID FsFreePendingOp(_In_ PFS_PENDING_OP Op);
static ULONG FsClassifyOperation(_In_ PFLT_CALLBACK_DATA Data);
static BOOLEAN FsMatchesConfirmPath(_In_ PUNICODE_STRING FilePath);
static BOOLEAN FsPathMatchesPattern(
    _In_ PUNICODE_STRING Pattern,
    _In_ PUNICODE_STRING Path
);
static NTSTATUS FsAddConfirmPathLocked(
    _In_reads_(PathChars) PWCHAR Path,
    _In_ USHORT PathChars
);
static NTSTATUS FsRemoveConfirmPathLocked(
    _In_reads_(PathChars) PWCHAR Path,
    _In_ USHORT PathChars
);
static NTSTATUS FsApplyConfirmPathBatchLocked(
    _In_reads_bytes_(DataLength) PUCHAR Data,
    _In_ ULONG DataLength,
    _In_ BOOLEAN Add
);
static NTSTATUS FsWaitForConfirm(
    _In_ PFLT_CALLBACK_DATA Data,
    _In_ ULONG OpType,
    _In_ PUNICODE_STRING FilePath,
    _Out_ BOOLEAN *Approved
);

static BOOLEAN FsIsExemptProcessId(_In_ ULONG ProcessId);

NTSTATUS FsModuleInitialize(VOID)
{
    ExInitializePushLock(&g_FsRulesLock);
    RtlZeroMemory(g_FsRules, sizeof(g_FsRules));

    KeInitializeSpinLock(&g_PendingLock);
    RtlZeroMemory(g_PendingOps, sizeof(g_PendingOps));
    g_NextRequestId = 1;

    ExInitializePushLock(&g_ConfirmPathsLock);
    RtlZeroMemory(g_ConfirmPaths, sizeof(g_ConfirmPaths));

    FsInitSelfFileName();

    InterlockedExchange(&g_FsInitialized, 1);
    return STATUS_SUCCESS;
}

VOID FsModuleUninitialize(VOID)
{
    InterlockedExchange(&g_FsInitialized, 0);

    KIRQL oldIrql;
    KeAcquireSpinLock(&g_PendingLock, &oldIrql);
    for (ULONG i = 0; i < FS_MAX_PENDING; i++) {
        if (g_PendingOps[i].InUse) {
            g_PendingOps[i].Approved = FALSE;
            KeSetEvent(&g_PendingOps[i].CompletionEvent,
                       IO_NO_INCREMENT, FALSE);
        }
    }
    KeReleaseSpinLock(&g_PendingLock, oldIrql);
}

static VOID FsInitSelfFileName(VOID)
{
    g_SelfFileName[0] = L'\0';
    g_SelfFileNameLen = 0;

    if (g_DriverObject) {
        UNICODE_STRING fullPath = { 0 };
        NTSTATUS status = IoQueryFullDriverPath(g_DriverObject, &fullPath);

        if (NT_SUCCESS(status) &&
            fullPath.Buffer &&
            fullPath.Length >= sizeof(WCHAR)) {
            USHORT totalChars = (USHORT)(fullPath.Length / sizeof(WCHAR));
            USHORT startIndex = 0;

            for (USHORT i = totalChars; i > 0; i--) {
                if (fullPath.Buffer[i - 1] == L'\\') {
                    startIndex = i;
                    break;
                }
            }

            if (startIndex < totalChars) {
                USHORT nameChars = (USHORT)(totalChars - startIndex);
                USHORT copyChars = (USHORT)min(
                    (ULONG)nameChars,
                    (ULONG)(ARRAYSIZE(g_SelfFileName) - 1)
                );

                if (copyChars > 0) {
                    RtlCopyMemory(
                        g_SelfFileName,
                        &fullPath.Buffer[startIndex],
                        copyChars * sizeof(WCHAR)
                    );
                    g_SelfFileName[copyChars] = L'\0';
                    g_SelfFileNameLen = (USHORT)(copyChars * sizeof(WCHAR));
                }
            }
        }

        if (fullPath.Buffer) {
            ExFreePool(fullPath.Buffer);
        }
    }

    if (g_SelfFileNameLen == 0) {
        RtlStringCbCopyW(
            g_SelfFileName,
            sizeof(g_SelfFileName),
            L"UserDrivenKernelAgent.sys"
        );
        g_SelfFileNameLen = (USHORT)(wcslen(g_SelfFileName) * sizeof(WCHAR));
    }
}

static NTSTATUS FsGetNormalizedNameInfo(
    _Inout_ PFLT_CALLBACK_DATA Data,
    _Outptr_ PFLT_FILE_NAME_INFORMATION *NameInfo
)
{
    NTSTATUS status;

    *NameInfo = NULL;

    status = FltGetFileNameInformation(
        Data,
        FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT,
        NameInfo
    );
    if (!NT_SUCCESS(status)) {
        return status;
    }

    status = FltParseFileNameInformation(*NameInfo);
    if (!NT_SUCCESS(status)) {
        FltReleaseFileNameInformation(*NameInfo);
        *NameInfo = NULL;
    }

    return status;
}

static ULONG FsGetCreateAccessFlags(_In_ PFLT_CALLBACK_DATA Data)
{
    ULONG accessFlags = 0;
    ACCESS_MASK desiredAccess = Data->Iopb->Parameters.Create.SecurityContext
        ? Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess
        : 0;

    if (desiredAccess & (FILE_READ_DATA | FILE_EXECUTE)) {
        accessFlags |= FS_RULE_BLOCK_READ;
    }
    if (desiredAccess & (FILE_WRITE_DATA | FILE_APPEND_DATA)) {
        accessFlags |= FS_RULE_BLOCK_WRITE;
    }
    if (Data->Iopb->Parameters.Create.Options & FILE_DELETE_ON_CLOSE) {
        accessFlags |= FS_RULE_BLOCK_DELETE;
    }

    return accessFlags;
}

static BOOLEAN FsIsWindowsPath(_In_ PUNICODE_STRING FilePath)
{
    UNICODE_STRING winPrefix = RTL_CONSTANT_STRING(L"\\Windows\\");

    if (!FilePath || FilePath->Length < winPrefix.Length) {
        return FALSE;
    }

    PWCHAR pathChars = FilePath->Buffer;
    ULONG charCount = FilePath->Length / sizeof(WCHAR);
    for (ULONG i = 0; i + 9 <= charCount; i++) {
        if (_wcsnicmp(&pathChars[i], L"\\Windows\\", 9) == 0) {
            return TRUE;
        }
    }

    return FALSE;
}

static BOOLEAN FsEvaluateRuleBlock(
    _In_ PUNICODE_STRING FilePath,
    _In_ ULONG RequiredFlags
)
{
    BOOLEAN block = FALSE;

    if (RequiredFlags == 0) {
        return FALSE;
    }

    KeEnterCriticalRegion();
    ExAcquirePushLockShared(&g_FsRulesLock);

    if (FsFindMatchingRule(FilePath, RequiredFlags) != NULL) {
        block = TRUE;
        CommPostEvent(EVT_FS_BLOCKED,
            (ULONG)(ULONG_PTR)PsGetCurrentProcessId(),
            FilePath->Buffer,
            (ULONG)min(FilePath->Length, RING_DATA_SIZE));
    }

    ExReleasePushLockShared(&g_FsRulesLock);
    KeLeaveCriticalRegion();
    return block;
}

static NTSTATUS FsEvaluateConfirmDecision(
    _Inout_ PFLT_CALLBACK_DATA Data,
    _In_ ULONG OpType,
    _In_ PUNICODE_STRING FilePath,
    _Out_ BOOLEAN *Block
)
{
    NTSTATUS status;
    BOOLEAN approved = FALSE;

    *Block = FALSE;

    if (OpType == 0 || FsIsWindowsPath(FilePath) ||
        !FsMatchesConfirmPath(FilePath)) {
        return STATUS_SUCCESS;
    }

    status = FsWaitForConfirm(Data, OpType, FilePath, &approved);
    if (!NT_SUCCESS(status) || !approved) {
        *Block = TRUE;
    }

    return status;
}

static BOOLEAN FsShouldHideDirectoryEntry(
    _In_reads_bytes_(FileNameLength) PWCHAR FileName,
    _In_ ULONG FileNameLength
)
{
    if (!FileName || FileNameLength != g_SelfFileNameLen) {
        return FALSE;
    }

    UNICODE_STRING entryName = {
        (USHORT)FileNameLength,
        (USHORT)FileNameLength,
        FileName
    };
    UNICODE_STRING selfName = {
        g_SelfFileNameLen,
        g_SelfFileNameLen,
        g_SelfFileName
    };

    return RtlEqualUnicodeString(&entryName, &selfName, TRUE);
}

static NTSTATUS FsGetDirectoryEntryName(
    _In_ ULONG InfoClass,
    _In_ PVOID Entry,
    _Out_ PULONG NextOffset,
    _Outptr_result_bytebuffer_(*FileNameLength) PWCHAR *FileName,
    _Out_ PULONG FileNameLength
)
{
    *NextOffset = 0;
    *FileName = NULL;
    *FileNameLength = 0;

    switch (InfoClass) {
    case FileBothDirectoryInformation: {
        PFILE_BOTH_DIR_INFORMATION info = (PFILE_BOTH_DIR_INFORMATION)Entry;
        *NextOffset = info->NextEntryOffset;
        *FileName = info->FileName;
        *FileNameLength = info->FileNameLength;
        return STATUS_SUCCESS;
    }
    case FileDirectoryInformation: {
        PFILE_DIRECTORY_INFORMATION info = (PFILE_DIRECTORY_INFORMATION)Entry;
        *NextOffset = info->NextEntryOffset;
        *FileName = info->FileName;
        *FileNameLength = info->FileNameLength;
        return STATUS_SUCCESS;
    }
    case FileFullDirectoryInformation: {
        PFILE_FULL_DIR_INFORMATION info = (PFILE_FULL_DIR_INFORMATION)Entry;
        *NextOffset = info->NextEntryOffset;
        *FileName = info->FileName;
        *FileNameLength = info->FileNameLength;
        return STATUS_SUCCESS;
    }
    case FileIdBothDirectoryInformation: {
        PFILE_ID_BOTH_DIR_INFORMATION info = (PFILE_ID_BOTH_DIR_INFORMATION)Entry;
        *NextOffset = info->NextEntryOffset;
        *FileName = info->FileName;
        *FileNameLength = info->FileNameLength;
        return STATUS_SUCCESS;
    }
    default:
        return STATUS_NOT_SUPPORTED;
    }
}

static VOID FsUnlinkDirectoryEntry(
    _In_ ULONG InfoClass,
    _Inout_opt_ PVOID PreviousEntry,
    _In_ ULONG NextOffset
)
{
    switch (InfoClass) {
    case FileBothDirectoryInformation:
        ((PFILE_BOTH_DIR_INFORMATION)PreviousEntry)->NextEntryOffset = NextOffset
            ? ((PFILE_BOTH_DIR_INFORMATION)PreviousEntry)->NextEntryOffset + NextOffset
            : 0;
        break;
    case FileDirectoryInformation:
        ((PFILE_DIRECTORY_INFORMATION)PreviousEntry)->NextEntryOffset = NextOffset
            ? ((PFILE_DIRECTORY_INFORMATION)PreviousEntry)->NextEntryOffset + NextOffset
            : 0;
        break;
    case FileFullDirectoryInformation:
        ((PFILE_FULL_DIR_INFORMATION)PreviousEntry)->NextEntryOffset = NextOffset
            ? ((PFILE_FULL_DIR_INFORMATION)PreviousEntry)->NextEntryOffset + NextOffset
            : 0;
        break;
    case FileIdBothDirectoryInformation:
        ((PFILE_ID_BOTH_DIR_INFORMATION)PreviousEntry)->NextEntryOffset = NextOffset
            ? ((PFILE_ID_BOTH_DIR_INFORMATION)PreviousEntry)->NextEntryOffset + NextOffset
            : 0;
        break;
    }
}

NTSTATUS FsPreCreate(
    _Inout_ PFLT_CALLBACK_DATA Data,
    _Out_   BOOLEAN *Block
)
{
    NTSTATUS status;
    PFLT_FILE_NAME_INFORMATION nameInfo = NULL;
    ULONG accessFlags;
    BOOLEAN confirmBlock = FALSE;

    *Block = FALSE;

    if (!g_FsInitialized) return STATUS_SUCCESS;
    if (FsIsOurProcess()) return STATUS_SUCCESS;

    status = FsGetNormalizedNameInfo(Data, &nameInfo);
    if (!NT_SUCCESS(status)) return STATUS_SUCCESS;

    accessFlags = FsGetCreateAccessFlags(Data);
    *Block = FsEvaluateRuleBlock(&nameInfo->Name, accessFlags);

    if (!(*Block)) {
        status = FsEvaluateConfirmDecision(
            Data,
            FsClassifyOperation(Data),
            &nameInfo->Name,
            &confirmBlock
        );
        *Block = confirmBlock;
    }

    FltReleaseFileNameInformation(nameInfo);
    return STATUS_SUCCESS;
}

static NTSTATUS FsConfirmCheck(
    _Inout_ PFLT_CALLBACK_DATA Data,
    _In_    ULONG OpType,
    _Out_   BOOLEAN *Block
)
{
    NTSTATUS status;
    PFLT_FILE_NAME_INFORMATION nameInfo = NULL;

    *Block = FALSE;

    if (!g_FsInitialized) return STATUS_SUCCESS;
    if (FsIsOurProcess()) return STATUS_SUCCESS;

    status = FsGetNormalizedNameInfo(Data, &nameInfo);
    if (!NT_SUCCESS(status)) return STATUS_SUCCESS;

    status = FsEvaluateConfirmDecision(Data, OpType, &nameInfo->Name, Block);

    FltReleaseFileNameInformation(nameInfo);
    return STATUS_SUCCESS;
}

NTSTATUS FsPreWrite(
    _Inout_ PFLT_CALLBACK_DATA Data,
    _Out_   BOOLEAN *Block
)
{
    return FsConfirmCheck(Data, FS_OP_WRITE, Block);
}

NTSTATUS FsPreSetInfo(
    _Inout_ PFLT_CALLBACK_DATA Data,
    _Out_   BOOLEAN *Block
)
{
    ULONG fileInfoClass =
        Data->Iopb->Parameters.SetFileInformation.FileInformationClass;

    /* Only care about rename/move and delete */
    if (fileInfoClass == FileRenameInformation ||
        fileInfoClass == FileRenameInformationEx) {
        return FsConfirmCheck(Data, FS_OP_RENAME, Block);
    }
    if (fileInfoClass == FileDispositionInformation ||
        fileInfoClass == FileDispositionInformationEx) {
        return FsConfirmCheck(Data, FS_OP_DELETE, Block);
    }

    *Block = FALSE;
    return STATUS_SUCCESS;
}

NTSTATUS FsPostDirControl(
    _Inout_ PFLT_CALLBACK_DATA Data,
    _In_    FLT_POST_OPERATION_FLAGS Flags
)
{
    if (!g_FsInitialized) return STATUS_SUCCESS;
    if (g_SelfFileNameLen == 0) return STATUS_SUCCESS;
    if (FlagOn(Flags, FLTFL_POST_OPERATION_DRAINING)) return STATUS_SUCCESS;

    /* Only filter directory queries */
    if (Data->Iopb->MinorFunction != IRP_MN_QUERY_DIRECTORY) {
        return STATUS_SUCCESS;
    }

    if (!NT_SUCCESS(Data->IoStatus.Status) || Data->IoStatus.Information == 0) {
        return STATUS_SUCCESS;
    }

    PVOID buf = Data->Iopb->Parameters.DirectoryControl.QueryDirectory.DirectoryBuffer;
    if (!buf) return STATUS_SUCCESS;

    ULONG infoClass = Data->Iopb->Parameters.DirectoryControl.QueryDirectory.FileInformationClass;

    PVOID prev = NULL;
    PVOID curr = buf;
    BOOLEAN modified = FALSE;

    while (TRUE) {
        ULONG nextOffset = 0;
        PWCHAR fileName = NULL;
        ULONG fileNameLen = 0;
        BOOLEAN match;

        if (!NT_SUCCESS(FsGetDirectoryEntryName(
                infoClass,
                curr,
                &nextOffset,
                &fileName,
                &fileNameLen))) {
            return STATUS_SUCCESS;
        }

        match = FsShouldHideDirectoryEntry(fileName, fileNameLen);

        if (match) {
            if (prev == NULL && nextOffset == 0) {
                Data->IoStatus.Status = STATUS_NO_MORE_FILES;
                Data->IoStatus.Information = 0;
                modified = TRUE;
                break;
            } else if (prev == NULL) {
                RtlMoveMemory(buf, (PUCHAR)curr + nextOffset,
                    Data->IoStatus.Information - nextOffset);
                modified = TRUE;
                continue;  /* re-check at same position */
            } else {
                FsUnlinkDirectoryEntry(infoClass, prev, nextOffset);
                modified = TRUE;
            }
        }

        if (nextOffset == 0) break;
        if (!match) prev = curr;
        curr = (PUCHAR)curr + nextOffset;
    }

    if (modified) {
        FltSetCallbackDataDirty(Data);
    }

    return STATUS_SUCCESS;
}

NTSTATUS FsHandleCommand(_Inout_ PRING_MESSAGE Msg)
{
    switch (Msg->Command) {

    case CMD_FS_ADD_RULE: {
        /* Data contains: ULONG Flags + WCHAR Path[] */
        if (Msg->DataLength < sizeof(ULONG) + sizeof(WCHAR)) {
            return STATUS_INVALID_PARAMETER;
        }

        ULONG flags = *(PULONG)Msg->Data;
        PWCHAR path = (PWCHAR)(Msg->Data + sizeof(ULONG));
        ULONG pathBytes = Msg->DataLength - sizeof(ULONG);

        if (pathBytes > (FS_RULE_MAX_PATH - 1) * sizeof(WCHAR)) {
            return STATUS_BUFFER_OVERFLOW;
        }

        KeEnterCriticalRegion();
        ExAcquirePushLockExclusive(&g_FsRulesLock);

        NTSTATUS st = STATUS_INSUFFICIENT_RESOURCES;
        for (ULONG i = 0; i < FS_MAX_RULES; i++) {
            if (!g_FsRules[i].Active) {
                g_FsRules[i].Flags = flags;
                RtlZeroMemory(g_FsRules[i].Path, sizeof(g_FsRules[i].Path));
                RtlCopyMemory(g_FsRules[i].Path, path, pathBytes);
                g_FsRules[i].PathLength = (USHORT)pathBytes;
                g_FsRules[i].Active = TRUE;
                st = STATUS_SUCCESS;
                break;
            }
        }

        ExReleasePushLockExclusive(&g_FsRulesLock);
        KeLeaveCriticalRegion();
        return st;
    }

    case CMD_FS_REMOVE_RULE: {
        if (Msg->DataLength < sizeof(WCHAR)) {
            return STATUS_INVALID_PARAMETER;
        }

        UNICODE_STRING target;
        target.Buffer = (PWCHAR)Msg->Data;
        target.Length = (USHORT)Msg->DataLength;
        target.MaximumLength = target.Length;

        KeEnterCriticalRegion();
        ExAcquirePushLockExclusive(&g_FsRulesLock);

        NTSTATUS st = STATUS_NOT_FOUND;
        for (ULONG i = 0; i < FS_MAX_RULES; i++) {
            if (!g_FsRules[i].Active) continue;

            UNICODE_STRING rulePath;
            rulePath.Buffer = g_FsRules[i].Path;
            rulePath.Length = g_FsRules[i].PathLength;
            rulePath.MaximumLength = sizeof(g_FsRules[i].Path);

            if (RtlEqualUnicodeString(&target, &rulePath, TRUE)) {
                g_FsRules[i].Active = FALSE;
                st = STATUS_SUCCESS;
                break;
            }
        }

        ExReleasePushLockExclusive(&g_FsRulesLock);
        KeLeaveCriticalRegion();
        return st;
    }

    case CMD_FS_QUERY_RULES: {
        typedef struct { ULONG Flags; WCHAR Path[FS_RULE_MAX_PATH]; } FS_RULE_ENTRY;
        ULONG maxEntries = RING_DATA_SIZE / sizeof(FS_RULE_ENTRY);
        FS_RULE_ENTRY *out = (FS_RULE_ENTRY *)Msg->Data;
        ULONG count = 0;

        KeEnterCriticalRegion();
        ExAcquirePushLockShared(&g_FsRulesLock);

        for (ULONG i = 0; i < FS_MAX_RULES && count < maxEntries; i++) {
            if (!g_FsRules[i].Active) continue;
            out[count].Flags = g_FsRules[i].Flags;
            RtlZeroMemory(out[count].Path, sizeof(out[count].Path));
            RtlCopyMemory(out[count].Path, g_FsRules[i].Path,
                          g_FsRules[i].PathLength);
            count++;
        }

        ExReleasePushLockShared(&g_FsRulesLock);
        KeLeaveCriticalRegion();

        Msg->DataLength = count * sizeof(FS_RULE_ENTRY);
        return STATUS_SUCCESS;
    }

    default:
        return STATUS_INVALID_PARAMETER;
    }
}

NTSTATUS FsHandleConfirmCommand(_Inout_ PRING_MESSAGE Msg, ULONG Cmd)
{
    switch (Cmd) {
    case CMD_FS_APPROVE: {
        if (Msg->DataLength < sizeof(ULONG)) return STATUS_INVALID_PARAMETER;
        ULONG reqId = *(PULONG)Msg->Data;
        return FsCompleteConfirm(reqId, TRUE);
    }
    case CMD_FS_DENY: {
        if (Msg->DataLength < sizeof(ULONG)) return STATUS_INVALID_PARAMETER;
        ULONG reqId = *(PULONG)Msg->Data;
        return FsCompleteConfirm(reqId, FALSE);
    }
    case CMD_FS_ADD_CONFIRM_PATH: {
        if (Msg->DataLength < sizeof(WCHAR) ||
            (Msg->DataLength % sizeof(WCHAR)) != 0) {
            return STATUS_INVALID_PARAMETER;
        }

        KeEnterCriticalRegion();
        ExAcquirePushLockExclusive(&g_ConfirmPathsLock);

        NTSTATUS st = FsApplyConfirmPathBatchLocked(
            Msg->Data,
            Msg->DataLength,
            TRUE
        );

        ExReleasePushLockExclusive(&g_ConfirmPathsLock);
        KeLeaveCriticalRegion();
        return st;
    }
    case CMD_FS_REMOVE_CONFIRM_PATH: {
        if (Msg->DataLength < sizeof(WCHAR) ||
            (Msg->DataLength % sizeof(WCHAR)) != 0) {
            return STATUS_INVALID_PARAMETER;
        }

        KeEnterCriticalRegion();
        ExAcquirePushLockExclusive(&g_ConfirmPathsLock);

        NTSTATUS st = FsApplyConfirmPathBatchLocked(
            Msg->Data,
            Msg->DataLength,
            FALSE
        );

        ExReleasePushLockExclusive(&g_ConfirmPathsLock);
        KeLeaveCriticalRegion();
        return st;
    }
    case CMD_FS_QUERY_CONFIRM_PATHS: {
        typedef struct { WCHAR Path[FS_CONFIRM_PATH_LEN]; } CONFIRM_PATH_ENTRY;
        ULONG maxEntries = RING_DATA_SIZE / sizeof(CONFIRM_PATH_ENTRY);
        CONFIRM_PATH_ENTRY *out = (CONFIRM_PATH_ENTRY *)Msg->Data;
        ULONG count = 0;

        KeEnterCriticalRegion();
        ExAcquirePushLockShared(&g_ConfirmPathsLock);

        for (ULONG i = 0; i < FS_MAX_CONFIRM_PATHS && count < maxEntries; i++) {
            if (!g_ConfirmPaths[i].Active) continue;
            RtlZeroMemory(out[count].Path, sizeof(out[count].Path));
            RtlCopyMemory(out[count].Path, g_ConfirmPaths[i].Path,
                          g_ConfirmPaths[i].PathLength);
            count++;
        }

        ExReleasePushLockShared(&g_ConfirmPathsLock);
        KeLeaveCriticalRegion();

        Msg->DataLength = count * sizeof(CONFIRM_PATH_ENTRY);
        return STATUS_SUCCESS;
    }
    default:
        return STATUS_INVALID_PARAMETER;
    }
}

static PFS_RULE FsFindMatchingRule(
    _In_ PUNICODE_STRING FilePath,
    _In_ ULONG RequiredFlags
)
{
    for (ULONG i = 0; i < FS_MAX_RULES; i++) {
        if (!g_FsRules[i].Active) continue;
        if (!(g_FsRules[i].Flags & RequiredFlags)) continue;

        UNICODE_STRING rulePath;
        rulePath.Buffer = g_FsRules[i].Path;
        rulePath.Length = g_FsRules[i].PathLength;
        rulePath.MaximumLength = sizeof(g_FsRules[i].Path);

        if (FsPathMatchesPattern(&rulePath, FilePath)) {
            return &g_FsRules[i];
        }
    }
    return NULL;
}

static BOOLEAN FsIsOurProcess(VOID)
{
    ULONG currentPid = (ULONG)(ULONG_PTR)PsGetCurrentProcessId();
    return FsIsExemptProcessId(currentPid);
}

static BOOLEAN FsIsExemptProcessId(_In_ ULONG ProcessId)
{
    if (ProcessId == 4) {
        return TRUE;
    }

    return CommIsAgentProcessId(ProcessId);
}

static PFS_PENDING_OP FsAllocPendingOp(_Out_ PULONG RequestId)
{
    KIRQL oldIrql;
    KeAcquireSpinLock(&g_PendingLock, &oldIrql);

    for (ULONG i = 0; i < FS_MAX_PENDING; i++) {
        if (!g_PendingOps[i].InUse) {
            g_PendingOps[i].InUse = TRUE;
            g_PendingOps[i].Approved = FALSE;
            g_PendingOps[i].RequestId =
                (ULONG)InterlockedIncrement(&g_NextRequestId);
            KeInitializeEvent(&g_PendingOps[i].CompletionEvent,
                              SynchronizationEvent, FALSE);
            *RequestId = g_PendingOps[i].RequestId;
            KeReleaseSpinLock(&g_PendingLock, oldIrql);
            return &g_PendingOps[i];
        }
    }

    KeReleaseSpinLock(&g_PendingLock, oldIrql);
    *RequestId = 0;
    return NULL;
}

static VOID FsFreePendingOp(_In_ PFS_PENDING_OP Op)
{
    KIRQL oldIrql;
    KeAcquireSpinLock(&g_PendingLock, &oldIrql);
    Op->InUse = FALSE;
    KeReleaseSpinLock(&g_PendingLock, oldIrql);
}

static BOOLEAN FsMatchesConfirmPath(_In_ PUNICODE_STRING FilePath)
{
    BOOLEAN matched = FALSE;

    KeEnterCriticalRegion();
    ExAcquirePushLockShared(&g_ConfirmPathsLock);

    for (ULONG i = 0; i < FS_MAX_CONFIRM_PATHS; i++) {
        if (!g_ConfirmPaths[i].Active) continue;

        UNICODE_STRING watchPath;
        watchPath.Buffer = g_ConfirmPaths[i].Path;
        watchPath.Length = g_ConfirmPaths[i].PathLength;
        watchPath.MaximumLength = sizeof(g_ConfirmPaths[i].Path);

        if (FsPathMatchesPattern(&watchPath, FilePath)) {
            matched = TRUE;
            break;
        }
    }

    ExReleasePushLockShared(&g_ConfirmPathsLock);
    KeLeaveCriticalRegion();
    return matched;
}

static BOOLEAN FsPathMatchesPattern(
    _In_ PUNICODE_STRING Pattern,
    _In_ PUNICODE_STRING Path
)
{
    if (!Pattern || !Path || Pattern->Length == 0 || Path->Length == 0) {
        return FALSE;
    }

    if (RtlEqualUnicodeString(Pattern, Path, TRUE)) {
        return TRUE;
    }

    __try {
        return FsRtlIsNameInExpression(Pattern, Path, TRUE, NULL);
    }
    __except (EXCEPTION_EXECUTE_HANDLER) {
        return FALSE;
    }
}

static NTSTATUS FsAddConfirmPathLocked(
    _In_reads_(PathChars) PWCHAR Path,
    _In_ USHORT PathChars
)
{
    USHORT pathBytes = (USHORT)(PathChars * sizeof(WCHAR));
    if (PathChars == 0 || pathBytes > (FS_CONFIRM_PATH_LEN - 1) * sizeof(WCHAR)) {
        return STATUS_BUFFER_OVERFLOW;
    }

    UNICODE_STRING target;
    target.Buffer = Path;
    target.Length = pathBytes;
    target.MaximumLength = pathBytes;

    for (ULONG i = 0; i < FS_MAX_CONFIRM_PATHS; i++) {
        if (!g_ConfirmPaths[i].Active) continue;

        UNICODE_STRING existing;
        existing.Buffer = g_ConfirmPaths[i].Path;
        existing.Length = g_ConfirmPaths[i].PathLength;
        existing.MaximumLength = sizeof(g_ConfirmPaths[i].Path);
        if (RtlEqualUnicodeString(&target, &existing, TRUE)) {
            return STATUS_SUCCESS;
        }
    }

    for (ULONG i = 0; i < FS_MAX_CONFIRM_PATHS; i++) {
        if (!g_ConfirmPaths[i].Active) {
            RtlZeroMemory(g_ConfirmPaths[i].Path, sizeof(g_ConfirmPaths[i].Path));
            RtlCopyMemory(g_ConfirmPaths[i].Path, Path, pathBytes);
            g_ConfirmPaths[i].PathLength = pathBytes;
            g_ConfirmPaths[i].Active = TRUE;
            return STATUS_SUCCESS;
        }
    }

    return STATUS_INSUFFICIENT_RESOURCES;
}

static NTSTATUS FsRemoveConfirmPathLocked(
    _In_reads_(PathChars) PWCHAR Path,
    _In_ USHORT PathChars
)
{
    USHORT pathBytes = (USHORT)(PathChars * sizeof(WCHAR));
    if (PathChars == 0) {
        return STATUS_INVALID_PARAMETER;
    }

    UNICODE_STRING target;
    target.Buffer = Path;
    target.Length = pathBytes;
    target.MaximumLength = pathBytes;

    BOOLEAN removed = FALSE;
    for (ULONG i = 0; i < FS_MAX_CONFIRM_PATHS; i++) {
        if (!g_ConfirmPaths[i].Active) continue;

        UNICODE_STRING existing;
        existing.Buffer = g_ConfirmPaths[i].Path;
        existing.Length = g_ConfirmPaths[i].PathLength;
        existing.MaximumLength = sizeof(g_ConfirmPaths[i].Path);
        if (RtlEqualUnicodeString(&target, &existing, TRUE)) {
            g_ConfirmPaths[i].Active = FALSE;
            removed = TRUE;
        }
    }

    return removed ? STATUS_SUCCESS : STATUS_NOT_FOUND;
}

/*
 * Agent payload format for add/remove:
 *   - Single UTF-16 path (legacy)
 *   - MULTI_SZ (NUL-separated UTF-16 paths, optional double-NUL tail)
 */
static NTSTATUS FsApplyConfirmPathBatchLocked(
    _In_reads_bytes_(DataLength) PUCHAR Data,
    _In_ ULONG DataLength,
    _In_ BOOLEAN Add
)
{
    if (!Data || DataLength < sizeof(WCHAR) || (DataLength % sizeof(WCHAR)) != 0) {
        return STATUS_INVALID_PARAMETER;
    }

    PWCHAR list = (PWCHAR)Data;
    ULONG totalChars = DataLength / sizeof(WCHAR);
    ULONG pos = 0;
    BOOLEAN sawEntry = FALSE;
    ULONG successCount = 0;
    NTSTATUS firstError = STATUS_SUCCESS;

    while (pos < totalChars) {
        ULONG start = pos;
        while (pos < totalChars && list[pos] != L'\0') {
            pos++;
        }

        ULONG lenChars = pos - start;
        if (lenChars > 0) {
            NTSTATUS st;
            sawEntry = TRUE;
            st = Add
                ? FsAddConfirmPathLocked(&list[start], (USHORT)lenChars)
                : FsRemoveConfirmPathLocked(&list[start], (USHORT)lenChars);

            if (NT_SUCCESS(st)) {
                successCount++;
            } else if (firstError == STATUS_SUCCESS) {
                firstError = st;
            }
        }

        if (pos < totalChars && list[pos] == L'\0') {
            pos++;
        }
    }

    if (!sawEntry) {
        return STATUS_INVALID_PARAMETER;
    }
    if (successCount > 0) {
        return STATUS_SUCCESS;
    }
    if (firstError != STATUS_SUCCESS) {
        return firstError;
    }
    return Add ? STATUS_INSUFFICIENT_RESOURCES : STATUS_NOT_FOUND;
}

static ULONG FsClassifyOperation(_In_ PFLT_CALLBACK_DATA Data)
{
    UCHAR majorFn = Data->Iopb->MajorFunction;

    if (majorFn == IRP_MJ_CREATE) {
        ACCESS_MASK access = Data->Iopb->Parameters.Create.SecurityContext
            ? Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess
            : 0;

        if (Data->Iopb->Parameters.Create.Options & FILE_DELETE_ON_CLOSE)
            return FS_OP_DELETE;
        if (access & FILE_EXECUTE)
            return FS_OP_EXECUTE;
        if (access & (FILE_WRITE_DATA | FILE_APPEND_DATA))
            return FS_OP_WRITE;
        if (access & FILE_READ_DATA)
            return FS_OP_READ;
    }
    else if (majorFn == IRP_MJ_WRITE) {
        return FS_OP_WRITE;
    }
    else if (majorFn == IRP_MJ_SET_INFORMATION) {
        ULONG infoClass = Data->Iopb->Parameters.SetFileInformation.FileInformationClass;
        if (infoClass == FileDispositionInformation ||
            infoClass == FileDispositionInformationEx)
            return FS_OP_DELETE;
        if (infoClass == FileRenameInformation ||
            infoClass == FileRenameInformationEx)
            return FS_OP_RENAME;
    }

    return 0;
}

static NTSTATUS FsWaitForConfirm(
    _In_ PFLT_CALLBACK_DATA Data,
    _In_ ULONG OpType,
    _In_ PUNICODE_STRING FilePath,
    _Out_ BOOLEAN *Approved
)
{
    UNREFERENCED_PARAMETER(Data);

    *Approved = FALSE;

    ULONG requestId = 0;
    PFS_PENDING_OP pending = FsAllocPendingOp(&requestId);
    if (!pending) {
        return STATUS_INSUFFICIENT_RESOURCES;
    }

    ULONG callerPid = (ULONG)(ULONG_PTR)PsGetCurrentProcessId();
    ULONG pathBytes = (ULONG)min(FilePath->Length,
        RING_DATA_SIZE - sizeof(FS_CONFIRM_REQUEST));

    ULONG totalLen = sizeof(FS_CONFIRM_REQUEST) + pathBytes;
    PUCHAR evtBuf = (PUCHAR)ExAllocatePool2(POOL_FLAG_NON_PAGED, totalLen, 'fCsF');
    if (!evtBuf) {
        FsFreePendingOp(pending);
        return STATUS_INSUFFICIENT_RESOURCES;
    }
    PFS_CONFIRM_REQUEST req = (PFS_CONFIRM_REQUEST)evtBuf;
    req->RequestId = requestId;
    req->OperationType = OpType;
    req->CallerPid = callerPid;
    req->PathLength = pathBytes;
    RtlCopyMemory((PUCHAR)req + sizeof(FS_CONFIRM_REQUEST),
                   FilePath->Buffer, pathBytes);

    NTSTATUS status = CommPostEvent(
        EVT_FS_CONFIRM_REQ, callerPid, evtBuf, totalLen);
    ExFreePoolWithTag(evtBuf, 'fCsF');
    if (!NT_SUCCESS(status)) {
        FsFreePendingOp(pending);
        return status;
    }

    LARGE_INTEGER timeout;
    timeout.QuadPart = FS_CONFIRM_TIMEOUT;

    status = KeWaitForSingleObject(
        &pending->CompletionEvent,
        Executive,
        KernelMode,
        FALSE,
        &timeout
    );

    if (status == STATUS_TIMEOUT) {
        *Approved = FALSE;
    }
    else if (NT_SUCCESS(status)) {
        *Approved = pending->Approved;
    }
    else {
        *Approved = FALSE;
    }

    FsFreePendingOp(pending);
    return STATUS_SUCCESS;
}

NTSTATUS FsCompleteConfirm(_In_ ULONG RequestId, _In_ BOOLEAN Approve)
{
    KIRQL oldIrql;
    KeAcquireSpinLock(&g_PendingLock, &oldIrql);

    for (ULONG i = 0; i < FS_MAX_PENDING; i++) {
        if (g_PendingOps[i].InUse &&
            g_PendingOps[i].RequestId == RequestId) {
            g_PendingOps[i].Approved = Approve;
            KeSetEvent(&g_PendingOps[i].CompletionEvent,
                       IO_NO_INCREMENT, FALSE);
            KeReleaseSpinLock(&g_PendingLock, oldIrql);
            return STATUS_SUCCESS;
        }
    }

    KeReleaseSpinLock(&g_PendingLock, oldIrql);
    return STATUS_NOT_FOUND;
}