FltRemoveExtraCreateParameter - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
// fltkernel.h
NTSTATUS FLTAPI FltRemoveExtraCreateParameter(
[in] PFLT_FILTER Filter,
[in, out] PECP_LIST EcpList,
[in] LPCGUID EcpType,
[out] PVOID *EcpContext,
[out, optional] ULONG *EcpContextSize
);
View the official Windows Driver Kit DDI referenceNo description available.
The FltRemoveExtraCreateParameter routine searches an ECP list for an ECP context structure and, if found, detaches it from the ECP list.
Filter [in]Opaque filter pointer for the minifilter driver. This pointer uniquely identifies the minifilter driver and remains constant as long as the minifilter driver is loaded.
EcpList [in, out]Pointer to the extra create parameter (ECP) list that contains the ECP context structure to be detached from the given list.
EcpType [in]Pointer to a user-defined GUID that uniquely identifies the ECP context structure to be detached from the list.
EcpContext [out]Pointer to the detached ECP context structure. If the ECP context structure is successfully detached from the given list, this parameter will be set to point to the detached ECP context structure. If the ECP context structure is not found in the given ECP list, this parameter is set to NULL.
EcpContextSize [out, optional]Optional parameter that receives the size of the detached ECP context structure. If this parameter is present when the routine is called, the parameter will receive the size, in bytes, of the detached ECP context structure. If the given ECP context structure was not found in the given ECP list, this parameter is undefined.
FltRemoveExtraCreateParameter returns one of the following NTSTATUS values:
| Return code | Description |
|---|---|
| STATUS_SUCCESS | The given ECP context structure was successfully detached from the given ECP list. |
| STATUS_NOT_FOUND | The given ECP context structure was not found in the given ECP list. |
The FltRemoveExtraCreateParameter routine searches the ECP list given by the EcpList parameter for an ECP context structure given by the EcpType parameter. If the ECP context structure exists in the list, it is detached from the list, the EcpContext parameter is set to point to it, and the routine returns STATUS_SUCCESS. If the ECP context structure does not exist in the list, the EcpContext parameter is set to NULL and the routine returns STATUS_NOT_FOUND.
Note This routine does not free the memory pool for the ECP context structure. To free the ECP context structure, first call this routine to detach it from the list and then call the FltFreeExtraCreateParameter routine to free the ECP context structure itself.
FltAllocateExtraCreateParameterFromLookasideList
FltRemoveExtraCreateParameter