Edit

PFLT_FILTER_UNLOAD_CALLBACK callback function (fltkernel.h)

  • Article

A minifilter driver can register a routine of type PFLT_FILTER_UNLOAD_CALLBACK as the minifilter driver's FilterUnloadCallback routine.

Syntax

PFLT_FILTER_UNLOAD_CALLBACK PfltFilterUnloadCallback;

NTSTATUS PfltFilterUnloadCallback(
  FLT_FILTER_UNLOAD_FLAGS Flags
)
{...}

Parameters

Flags

Bitmask of flags describing the unload request. This parameter can be NULL or the following:

Flag Meaning
FLTFL_FILTER_UNLOAD_MANDATORY The filter manager sets this flag to indicate that the unload operation is mandatory.

Return value

This callback routine returns STATUS_SUCCESS or an NTSTATUS value such as the following:

Return Code Description
STATUS_FLT_DO_NOT_DETACH If the unload operation is not mandatory, returning this status value prevents the minifilter driver from being unloaded. This is an error code.

Remarks

When a minifilter driver registers itself by calling FltRegisterFilter, it can register a FilterUnloadCallback routine. To register this callback routine, the minifilter driver stores the address of a routine of type PFLT_FILTER_UNLOAD_CALLBACK in the FilterUnloadCallback field of the FLT_REGISTRATION structure that the minifilter driver passes as a parameter to FltRegisterFilter.

Minifilter drivers are not required to register a FilterUnloadCallback routine. However, registering an unload routine is strongly recommended. If a minifilter driver does not register a FilterUnloadCallback routine, it cannot be unloaded.

When a minifilter driver does register a FilterUnloadCallback routine:

  • The filter manager calls the FilterUnloadCallback routine to notify the minifilter driver that the filter manager is about to unload the minifilter driver.

  • If the unload operation is not mandatory, and the FilterUnloadCallback routine returns an error or warning NTSTATUS code, such as STATUS_FLT_DO_NOT_DETACH, the minifilter driver is not unloaded. Otherwise, the minifilter driver is unloaded.

  • If the FLTFL_FILTER_UNLOAD_MANDATORY flag is set in the Flags parameter, the unload operation is mandatory, and the minifilter driver cannot prevent itself from being unloaded.

See When the FilterUnloadCallback Routine Is Called for more information about possible unload causes and the minifilter driver unload process.

Requirements

Requirement Value
Target Platform Desktop
Header fltkernel.h (include Fltkernel.h)
IRQL PASSIVE_LEVEL

See also

FLT_REGISTRATION

FltRegisterFilter