PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
// fltkernel.h
PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK PfltInstanceQueryTeardownCallback;
NTSTATUS PfltInstanceQueryTeardownCallback(
[in] PCFLT_RELATED_OBJECTS FltObjects,
[in] FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags
)
{...}
View the official Windows Driver Kit DDI referenceNo description available.
A minifilter driver can register a routine of type PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK as the minifilter driver's InstanceQueryTeardownCallback routine.
FltObjects [in]Pointer to an FLT_RELATED_OBJECTS structure that contains opaque pointers for the objects related to the current operation.
Flags [in]Bitmask of flags that describe why the given instance query teardown callback routine was called. No flags are currently defined.
This callback routine returns STATUS_SUCCESS or an NTSTATUS value such as one of the following:
| Return code | Description |
|---|---|
| STATUS_FLT_DO_NOT_DETACH | Returning this status value prevents the minifilter driver instance from being detached. This is an error code. |
When a minifilter driver registers itself by calling FltRegisterFilter from its DriverEntry routine, it can register a routine of type PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK as the minifilter driver's InstanceQueryTeardownCallback routine.
To register the InstanceQueryTeardownCallback routine, the minifilter driver stores the address of a routine of type PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK in the InstanceQueryTeardownCallback member of the FLT_REGISTRATION structure that the minifilter driver passes as the Registration parameter of FltRegisterFilter.
The filter manager calls this routine to allow the minifilter driver to respond to a manual detach request. Such a request is received when a user-mode application calls FilterDetach or a kernel-mode component calls FltDetachVolume.
This routine is not called for automatic or mandatory detach requests, for example, when the minifilter driver is unloaded or a volume is dismounted.
If this routine returns an error or warning NTSTATUS code, such as STATUS_FLT_DO_NOT_DETACH, the minifilter driver instance is not detached from the volume. Otherwise, the instance is detached.
If a minifilter driver does not define an InstanceQueryTeardownCallback routine, its instances cannot be detached manually by calling FilterDetach or FltDetachVolume.
PFLT_INSTANCE_TEARDOWN_CALLBACK