FltGetFilterFromName - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
// fltkernel.h
NTSTATUS FLTAPI FltGetFilterFromName(
[in] PCUNICODE_STRING FilterName,
[out] PFLT_FILTER *RetFilter
);
View the official Windows Driver Kit DDI referenceNo description available.
The FltGetFilterFromName routine returns an opaque filter pointer for a registered minifilter driver whose name matches the value in the FilterName parameter.
FilterName [in]Pointer to a UNICODE_STRING structure containing the minifilter driver name. (The name comparison is case-insensitive.)
RetFilter [out]Pointer to a caller-allocated variable that receives an opaque filter pointer for the minifilter driver whose name matches the name in the FilterName parameter. This parameter is required and cannot be NULL.
FltGetFilterFromName returns STATUS_SUCCESS or an appropriate NTSTATUS value such as one of the following:
| Return code | Description |
|---|---|
| STATUS_FLT_DELETING_OBJECT | A matching minifilter driver was found, but it is being torn down. This is an error code. |
| STATUS_FLT_FILTER_NOT_FOUND | No matching minifilter driver was found. This is an error code. |
FltGetFilterFromName adds a rundown reference to the opaque filter pointer returned in the RetFilter parameter. When this pointer is no longer needed, the caller must release it by calling FltObjectDereference. Thus every successful call to FltGetFilterFromName must be matched by a subsequent call to FltObjectDereference.
To register a minifilter driver with the Filter Manager, call FltRegisterFilter.