Download EaseFilter Filter Driver SDK Setup File Download EaseFilter Filter Driver SDK Zip File
FltRegisterFilter registers a minifilter driver.
NTSTATUS FLTAPI FltRegisterFilter( PDRIVER_OBJECT Driver, const FLT_REGISTRATION *Registration, PFLT_FILTER *RetFilter );
Driver
A pointer to the driver object for the minifilter driver. This should be the same driver object pointer that was passed as input to the minifilter driver's DriverEntry routine.
Registration
A pointer to a caller-allocated minifilter driver registration structure (FLT_REGISTRATION).
RetFilter
A pointer to a caller-allocated variable that receives an opaque filter pointer for the caller.
FltRegisterFilter returns STATUS_SUCCESS or an appropriate NTSTATUS value such as one of the following:
Return code | Description |
---|---|
|
FltRegisterFilter encountered a pool allocation failure. This is an error code. |
|
One of the following:
|
|
The Filter Manager was not initialized when the filter tried to register. Make sure that the Filter Manager is loaded as a driver. This is an error code. |
|
The filter service key is not found in the registry.
-or- The filter instance is not registered. |
Every minifilter driver must call FltRegisterFilter from its DriverEntry routine to add itself to the global list of registered minifilter drivers and to provide the Filter Manager with a list of callback functions and other information about the minifilter driver.
FltRegisterFilter returns an opaque filter pointer for the minifilter driver in *RetFilter. This pointer value uniquely identifies the minifilter driver and remains constant as long as the minifilter driver is loaded. The minifilter driver should save this pointer, because it is a required parameter for FltStartFiltering and FltUnregisterFilter.
After calling FltRegisterFilter, a minifilter driver typically calls FltStartFiltering to begin filtering I/O operations.
A minifilter driver can only call FltRegisterFilter to register itself, not another minifilter driver.
To unregister itself, a minifilter driver calls FltUnregisterFilter..
Target Platform | Universal |
Header | fltkernel.h (include Fltkernel.h) |
Library | FltMgr.lib |
DLL | Fltmgr.sys |
IRQL | <= APC_LEVEL |