IoRegisterFsRegistrationChange function (ntifs.h)

Article
06/06/2023

The IoRegisterFsRegistrationChange routine registers a file system filter driver's notification routine to be called whenever a file system registers or unregisters itself as an active file system.

Syntax

NTSTATUS IoRegisterFsRegistrationChange(
  [in] PDRIVER_OBJECT          DriverObject,
  [in] PDRIVER_FS_NOTIFICATION DriverNotificationRoutine
);

Parameters

[in] DriverObject

Pointer to the driver object for the FS filter driver.

[in] DriverNotificationRoutine

A pointer to the PDRIVER_FS_NOTIFICATION routine, which the file system calls when it registers or unregisters itself.

Return value

IoRegisterFsRegistrationChange returns an NTSTATUS value such as one of the following.

Return code	Description
STATUS_SUCCESS	The notification routine was successfully registered.
STATUS_INSUFFICIENT_RESOURCES	A notification packet couldn't be allocated for the notification routine.
STATUS_DEVICE_ALREADY_ATTACHED	See Remarks.
STATUS_NOT_SUPPORTED	Legacy FS filter drivers are blocked by system policy. See Blocking legacy file system filter drivers for more information.

Remarks

IoRegisterFsRegistrationChange registers a FS filter driver to be notified whenever a file system calls IoRegisterFileSystem or IoUnregisterFileSystem.

To stop receiving such notifications, the filter driver should call IoUnregisterFsRegistrationChange.

When a FS filter driver calls IoRegisterFsRegistrationChange, the OS calls its notification routine immediately for all currently registered file systems. (A registered file system is one that has already successfully called IoRegisterFileSystem but has not yet called IoUnregisterFileSystem.) Because the caller's notification routine can be called even before IoRegisterFsRegistrationChange returns, a filter driver shouldn't call this routine until after it has created any data structures that it needs in order to process these notifications.

IoRegisterFsRegistrationChange ignores RAW devices. For information about attaching to the RAW file system by name, see Attaching the Filter Device Object to the Target Device Object.

IoRegisterFsRegistrationChange increments the reference count on the filter driver's driver object.

IoRegisterFsRegistrationChange returns STATUS_DEVICE_ALREADY_ATTACHED if the following conditions are true:

A FS filter driver has called IoRegisterFsRegistrationChange twice in succession without calling IoUnregisterFsRegistrationChange in between.
That FS filter driver has passed the same values for the DriverObject and DriverNotificationRoutine that it registered in the previous call to IoRegisterFsRegistrationChange.
No other filter drivers have registered since the first call.

Requirements

Requirement	Value
Target Platform	Universal
Header	ntifs.h (include Ntifs.h)
Library	NtosKrnl.lib
DLL	NtosKrnl.exe
IRQL	< DISPATCH_LEVEL