Calling Other Windows Filtering Platform Functions
Many of the other Windows Filtering Platform functions that are available to user-mode management applications are also available to callout drivers. This enables a callout driver to perform management tasks, such as adding filters to the filter engine. The only difference between the user-mode and kernel-mode versions of these functions is the data type that is returned. The user-mode functions return Win32 error codes, whereas the kernel-mode functions return the equivalent NTSTATUS codes.
Most of the Windows Filtering Platform management functions require a handle to an open session to the filter engine as a parameter. The following topics discuss how a callout driver can open and close a session to the filter engine.
Opening a Session to the Filter Engine
Closing a Session to the Filter Engine
For a list of the other Windows Filtering Platform functions that can be called from a callout driver, see Other Windows Filtering Platform Functions. For more information about how to use these functions, see the Windows Filtering Platform documentation in the Microsoft Windows SDK.
Feedback
Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see: https://aka.ms/ContentUserFeedback.
Submit and view feedback for