Writing a FilterUnloadCallback Routine
The FilterUnloadCallback routine is defined as follows:
typedef NTSTATUS
(*PFLT_FILTER_UNLOAD_CALLBACK) (
FLT_FILTER_UNLOAD_FLAGS Flags
);
The FilterUnloadCallback routine has one input parameter, Flags, which can be NULL or FLTFL_FILTER_UNLOAD_MANDATORY. The filter manager sets this parameter to FLTFL_FILTER_UNLOAD_MANDATORY to indicate that the unload operation is mandatory. For more information about this parameter, see PFLT_FILTER_UNLOAD_CALLBACK.
A minifilter driver's FilterUnloadCallback routine must perform the following steps:
Close any open kernel-mode communication server port handles.
Call FltUnregisterFilter to unregister the minifilter driver.
Perform any needed global cleanup.
Return an appropriate NTSTATUS value.
This section includes:
Feedback
https://aka.ms/ContentUserFeedback.
Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see:Submit and view feedback for