FilterDriverUnload routine

The system calls a filter driver's FilterDriverUnload function to perform any operations that are necessary before the system unloads the driver.

Note  You must declare the function by using the DRIVER_UNLOAD type. For more information, see the following Examples section.


VOID FilterDriverUnload(
  _In_  PDRIVER_OBJECT DriverObject


DriverObject [in]

A caller-supplied pointer to a DRIVER_OBJECT structure. This is the filter driver's driver object.

Return value



The operating system unloads a driver when the driver is being replaced, when all the devices the driver services have been removed, or when driver initialization fails after the DriverEntry routine succeeds. A filter driver supplies the entry point for a FilterDriverUnload function in the DriverUnload member of the DRIVER_OBJECT structure that was passed to its DriverEntry routine.

FilterDriverUnload performs driver-determined cleanup operations. FilterDriverUnload should undo all the operations that were performed in the DriverEntry routine.

A filter driver must call the NdisFDeregisterFilterDriver function from FilterDriverUnload. NdisFDeregisterFilterDriver calls FilterDetach to detach all currently attached filter modules that are associated with this filter driver.

A filter driver's FilterDriverUnload routine executes in a system thread context at IRQL = PASSIVE_LEVEL.


To define a FilterDriverUnload function, you must first provide a function declaration that identifies the type of function you're defining. Windows provides a set of function types for drivers. Declaring a function using the function types helps Code Analysis for Drivers, Static Driver Verifier (SDV), and other verification tools find errors, and it's a requirement for writing drivers for the Windows operating system.

For example, to define a FilterDriverUnload function that is named "MyDriverUnload", use the DRIVER_UNLOAD type as shown in this code example:


Then, implement your function as follows:

    PDRIVER_OBJECT  DriverObject

The DRIVER_UNLOAD function type is defined in the Ndis.h header file. To more accurately identify errors when you run the code analysis tools, be sure to add the _Use_decl_annotations_ annotation to your function definition. The _Use_decl_annotations_ annotation ensures that the annotations that are applied to the DRIVER_UNLOAD function type in the header file are used. For more information about the requirements for function declarations, see Declaring Functions by Using Function Role Types for NDIS Drivers. For information about _Use_decl_annotations_, see Annotating Function Behavior.



Supported in NDIS 6.0 and later.


Ndis.h (include Ndis.h)


PASSIVE_LEVEL (see Remarks section)

See also

DriverEntry of NDIS Filter Drivers



Send comments about this topic to Microsoft

© 2014 Microsoft. All rights reserved.