FltRegisterFilter registers a minifilter driver.
NTSTATUS FLTAPI FltRegisterFilter( PDRIVER_OBJECT Driver, const FLT_REGISTRATION *Registration, PFLT_FILTER *RetFilter );
A pointer to the driver object for the minifilter driver. This should be the same driver object pointer that was passed as input to the minifilter driver's DriverEntry routine.
A pointer to a caller-allocated minifilter driver registration structure (FLT_REGISTRATION).
A pointer to a caller-allocated variable that receives an opaque filter pointer for the caller.
FltRegisterFilter returns STATUS_SUCCESS or an appropriate NTSTATUS value such as one of the following:
||FltRegisterFilter encountered a pool allocation failure. This is an error code.|
One of the following:
||The Filter Manager was not initialized when the filter tried to register. Make sure that the Filter Manager is loaded as a driver. This is an error code.|
The filter service key is not found in the registry.
The filter instance is not registered.
Every minifilter driver must call FltRegisterFilter from its DriverEntry routine to add itself to the global list of registered minifilter drivers and to provide the Filter Manager with a list of callback functions and other information about the minifilter driver.
FltRegisterFilter returns an opaque filter pointer for the minifilter driver in *RetFilter. This pointer value uniquely identifies the minifilter driver and remains constant as long as the minifilter driver is loaded. The minifilter driver should save this pointer, because it is a required parameter for FltStartFiltering and FltUnregisterFilter.
After calling FltRegisterFilter, a minifilter driver typically calls FltStartFiltering to begin filtering I/O operations.
A minifilter driver can only call FltRegisterFilter to register itself, not another minifilter driver.
To unregister itself, a minifilter driver calls FltUnregisterFilter..
|Header||fltkernel.h (include Fltkernel.h)|