PFLT_FILTER_UNLOAD_CALLBACK - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
// fltkernel.h
PFLT_FILTER_UNLOAD_CALLBACK PfltFilterUnloadCallback;
NTSTATUS PfltFilterUnloadCallback(
FLT_FILTER_UNLOAD_FLAGS Flags
)
{...}
View the official Windows Driver Kit DDI referenceNo description available.
A minifilter driver can register a routine of type PFLT_FILTER_UNLOAD_CALLBACK as the minifilter driver's FilterUnloadCallback routine.
FlagsBitmask of flags describing the unload request. This parameter can be NULL or the following:
| Flag | Meaning |
|---|---|
| FLTFL_FILTER_UNLOAD_MANDATORY | The filter manager sets this flag to indicate that the unload operation is mandatory. |
This callback routine returns STATUS_SUCCESS or an NTSTATUS value such as the following:
| Return Code | Description |
|---|---|
| STATUS_FLT_DO_NOT_DETACH | If the unload operation is not mandatory, returning this status value prevents the minifilter driver from being unloaded. This is an error code. |
When a minifilter driver registers itself by calling FltRegisterFilter, it can register a FilterUnloadCallback routine. To register this callback routine, the minifilter driver stores the address of a routine of type PFLT_FILTER_UNLOAD_CALLBACK in the FilterUnloadCallback field of the FLT_REGISTRATION structure that the minifilter driver passes as a parameter to FltRegisterFilter.
Minifilter drivers are not required to register a FilterUnloadCallback routine. However, registering an unload routine is strongly recommended. If a minifilter driver does not register a FilterUnloadCallback routine, it cannot be unloaded.
When a minifilter driver does register a FilterUnloadCallback routine:
The filter manager calls the FilterUnloadCallback routine to notify the minifilter driver that the filter manager is about to unload the minifilter driver.
If the unload operation is not mandatory, and the FilterUnloadCallback routine returns an error or warning NTSTATUS code, such as STATUS_FLT_DO_NOT_DETACH, the minifilter driver is not unloaded. Otherwise, the minifilter driver is unloaded.
If the FLTFL_FILTER_UNLOAD_MANDATORY flag is set in the Flags parameter, the unload operation is mandatory, and the minifilter driver cannot prevent itself from being unloaded.
See When the FilterUnloadCallback Routine Is Called for more information about possible unload causes and the minifilter driver unload process.