Initializing and Unloading the Filter-Hook Driver
The filter-hook driver's DriverEntryroutine creates and initializes a device object for the driver object. The filter-hook driver's DriverEntryroutine can also register the driver's filter hook with the IP filter driver.
If a user-mode application or a higher-level driver sends an I/O control request to the filter-hook driver to set up the filter hook, then the DriverEntryroutine must export an IRP_MJ_DEVICE_CONTROL dispatch routine that enables device control. If DriverEntryenables device control in this way, this dispatch routine registers the driver's filter hook rather than DriverEntry.
The DriverEntryroutine must export a routine that unloads the filter-hook driver. This unload routine removes the device that was created in DriverEntrybut must not clear the previously registered filter hook.