FltGetDeviceObject - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
// fltkernel.h
NTSTATUS FLTAPI FltGetDeviceObject(
[in] PFLT_VOLUME Volume,
[out] PDEVICE_OBJECT *DeviceObject
);
View the official Windows Driver Kit DDI referenceNo description available.
The FltGetDeviceObject routine returns a pointer to the Filter Manager's volume device object (VDO) for a given volume.
Volume [in]Opaque pointer for the volume.
DeviceObject [out]Pointer to a caller-allocated variable that receives the volume device object pointer. This parameter is required and cannot be NULL.
FltGetDeviceObject returns STATUS_SUCCESS or an appropriate NTSTATUS value such as the following:
| Return code | Description |
|---|---|
| STATUS_FLT_NO_DEVICE_OBJECT | The requested device object does not exist for the given volume. This is an error code. |
FltGetDeviceObject returns a pointer to the Filter Manager's volume device object (VDO) for the given volume.
For more information about volume device objects, see File System Stacks.
The Filter Manager's VDO is not the same as the underlying storage driver's disk device object or the base file system's VDO. To get a pointer to the disk device object, call FltGetDiskDeviceObject on the volume specified in the Volume parameter. To get a pointer to the base file system's VDO, call IoGetDeviceAttachmentBaseRef on the RetDeviceObject returned by FltGetDeviceObject.
To get an opaque pointer for the corresponding volume for a given device object, call FltGetVolumeFromDeviceObject.
FltGetDeviceObject increments the reference count on the returned device object pointer. When this pointer is no longer needed, the caller must decrement this reference count by calling ObDereferenceObject. Thus every successful call to FltGetDeviceObject must be matched by a subsequent call to ObDereferenceObject.