WDK Mini Filter Example
nullFilter.c
Go to the documentation of this file.
1 /*++
2 
3 Copyright (c) 1999 - 2002 Microsoft Corporation
4 
5 Module Name:
6 
7  nullFilter.c
8 
9 Abstract:
10 
11  This is the main module of the nullFilter mini filter driver.
12  It is a simple minifilter that registers itself with the main filter
13  for no callback operations.
14 
15 Environment:
16 
17  Kernel mode
18 
19 --*/
20 
21 #include <fltKernel.h>
22 #include <dontuse.h>
23 #include <suppress.h>
24 
25 #pragma prefast(disable:__WARNING_ENCODE_MEMBER_FUNCTION_POINTER, "Not valid for kernel mode drivers")
26 
27 //---------------------------------------------------------------------------
28 // Global variables
29 //---------------------------------------------------------------------------
30 
31 #define NULL_FILTER_FILTER_NAME L"NullFilter"
32 
33 typedef struct _NULL_FILTER_DATA {
34 
35  //
36  // The filter handle that results from a call to
37  // FltRegisterFilter.
38  //
39 
40  PFLT_FILTER FilterHandle;
41 
43 
44 
45 /*************************************************************************
46  Prototypes for the startup and unload routines used for
47  this Filter.
48 
49  Implementation in nullFilter.c
50 *************************************************************************/
51 
52 DRIVER_INITIALIZE DriverEntry;
53 NTSTATUS
55  _In_ PDRIVER_OBJECT DriverObject,
56  _In_ PUNICODE_STRING RegistryPath
57  );
58 
59 NTSTATUS
60 NullUnload (
61  _In_ FLT_FILTER_UNLOAD_FLAGS Flags
62  );
63 
64 NTSTATUS
66  _In_ PCFLT_RELATED_OBJECTS FltObjects,
67  _In_ FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags
68  );
69 
70 //
71 // Structure that contains all the global data structures
72 // used throughout NullFilter.
73 //
74 
76 
77 //
78 // Assign text sections for each routine.
79 //
80 
81 #ifdef ALLOC_PRAGMA
82 #pragma alloc_text(INIT, DriverEntry)
83 #pragma alloc_text(PAGE, NullUnload)
84 #pragma alloc_text(PAGE, NullQueryTeardown)
85 #endif
86 
87 
88 //
89 // This defines what we want to filter with FltMgr
90 //
91 
92 CONST FLT_REGISTRATION FilterRegistration = {
93 
94  sizeof( FLT_REGISTRATION ), // Size
95  FLT_REGISTRATION_VERSION, // Version
96  0, // Flags
97 
98  NULL, // Context
99  NULL, // Operation callbacks
100 
101  NullUnload, // FilterUnload
102 
103  NULL, // InstanceSetup
104  NullQueryTeardown, // InstanceQueryTeardown
105  NULL, // InstanceTeardownStart
106  NULL, // InstanceTeardownComplete
107 
108  NULL, // GenerateFileName
109  NULL, // GenerateDestinationFileName
110  NULL // NormalizeNameComponent
111 
112 };
113 
114 
115 /*************************************************************************
116  Filter initialization and unload routines.
117 *************************************************************************/
118 
119 NTSTATUS
121  _In_ PDRIVER_OBJECT DriverObject,
122  _In_ PUNICODE_STRING RegistryPath
123  )
124 /*++
125 
126 Routine Description:
127 
128  This is the initialization routine for this miniFilter driver. This
129  registers the miniFilter with FltMgr and initializes all
130  its global data structures.
131 
132 Arguments:
133 
134  DriverObject - Pointer to driver object created by the system to
135  represent this driver.
136  RegistryPath - Unicode string identifying where the parameters for this
137  driver are located in the registry.
138 
139 Return Value:
140 
141  Returns STATUS_SUCCESS.
142 
143 --*/
144 {
145  NTSTATUS status;
146 
147  UNREFERENCED_PARAMETER( RegistryPath );
148 
149  //
150  // Register with FltMgr
151  //
152 
153  status = FltRegisterFilter( DriverObject,
155  &NullFilterData.FilterHandle );
156 
157  FLT_ASSERT( NT_SUCCESS( status ) );
158 
159  if (NT_SUCCESS( status )) {
160 
161  //
162  // Start filtering i/o
163  //
164 
165  status = FltStartFiltering( NullFilterData.FilterHandle );
166 
167  if (!NT_SUCCESS( status )) {
168  FltUnregisterFilter( NullFilterData.FilterHandle );
169  }
170  }
171  return status;
172 }
173 
174 NTSTATUS
176  _In_ FLT_FILTER_UNLOAD_FLAGS Flags
177  )
178 /*++
179 
180 Routine Description:
181 
182  This is the unload routine for this miniFilter driver. This is called
183  when the minifilter is about to be unloaded. We can fail this unload
184  request if this is not a mandatory unloaded indicated by the Flags
185  parameter.
186 
187 Arguments:
188 
189  Flags - Indicating if this is a mandatory unload.
190 
191 Return Value:
192 
193  Returns the final status of this operation.
194 
195 --*/
196 {
197  UNREFERENCED_PARAMETER( Flags );
198 
199  PAGED_CODE();
200 
201  FltUnregisterFilter( NullFilterData.FilterHandle );
202 
203  return STATUS_SUCCESS;
204 }
205 
206 NTSTATUS
208  _In_ PCFLT_RELATED_OBJECTS FltObjects,
209  _In_ FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags
210  )
211 /*++
212 
213 Routine Description:
214 
215  This is the instance detach routine for this miniFilter driver.
216  This is called when an instance is being manually deleted by a
217  call to FltDetachVolume or FilterDetach thereby giving us a
218  chance to fail that detach request.
219 
220 Arguments:
221 
222  FltObjects - Pointer to the FLT_RELATED_OBJECTS data structure containing
223  opaque handles to this filter, instance and its associated volume.
224 
225  Flags - Indicating where this detach request came from.
226 
227 Return Value:
228 
229  Returns the status of this operation.
230 
231 --*/
232 {
233  UNREFERENCED_PARAMETER( FltObjects );
234  UNREFERENCED_PARAMETER( Flags );
235 
236  PAGED_CODE();
237 
238  return STATUS_SUCCESS;
239 }
240 
NTSTATUS NullUnload(_In_ FLT_FILTER_UNLOAD_FLAGS Flags)
Definition: nullFilter.c:175
FLT_ASSERT(IS_MY_CONTROL_DEVICE_OBJECT(DeviceObject))
NTSTATUS NullQueryTeardown(_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags)
Definition: nullFilter.c:207
struct _NULL_FILTER_DATA NULL_FILTER_DATA
UNREFERENCED_PARAMETER(FileObject)
NcLoadRegistryStringRetry NULL
Definition: ncinit.c:53
PFLT_FILTER FilterHandle
Definition: nullFilter.c:40
PAGED_CODE()
NULL_FILTER_DATA NullFilterData
Definition: nullFilter.c:75
DRIVER_INITIALIZE DriverEntry
Definition: nullFilter.c:52
struct _NULL_FILTER_DATA * PNULL_FILTER_DATA
CONST FLT_REGISTRATION FilterRegistration
Definition: nullFilter.c:92

Social Network


Services Overview

Architect, implement and test file system filter drivers for a wide range of functionality. We can offer several levels of assistance to meet your specific.

Contact Us

You are welcome to contact us for salse or partnership.

Sales: sales@easefilter.com
Support: support@easefilter.com
Info: info@easefilter.com