FltGetBottomInstance function

FltGetBottomInstance returns an opaque instance pointer for the minifilter driver instance, if there is one, that is attached at the bottom of the instance stack for a given volume.

Syntax


NTSTATUS FltGetBottomInstance(
  _In_  PFLT_VOLUME   Volume,
  _Out_ PFLT_INSTANCE *Instance
);

Parameters

Volume [in]

Opaque pointer for the volume.

Instance [out]

Pointer to a caller-allocated variable that receives an opaque instance pointer for the bottom instance for this volume. This parameter is required and cannot be NULL.

Return value

FltGetBottomInstance returns STATUS_SUCCESS or an appropriate NTSTATUS value such as the following:

Return codeDescription
STATUS_NO_MORE_ENTRIES

No matching instance was found. This is a warning code.

 

Remarks

An instance is said to be at the bottom of the minifilter driver instance stack if its altitude is lower than that of all other instances attached to the same volume. The term "altitude" refers to the position that an instance occupies in the minifilter driver instance stack for a volume. The higher the altitude, the farther the instance is from the base file system in the stack. Only one instance can be attached at a given altitude on a given volume.

Altitude is specified by an altitude string, which is a counted Unicode string consisting of one or more decimal digits from 0 through 9, and it can include a single decimal point. For example, "100.123456" and "03333" are valid altitude strings.

The string "03333" represents a higher altitude than "100.123456". (Leading and trailing zeros are ignored.) In other words, an instance whose altitude is "03333" is farther from the base file system than an instance whose altitude is "100.123456". However, this comparison is only meaningful if both instances are attached to the same volume.

FltGetBottomInstance adds a rundown reference to the opaque instance pointer returned in *Instance. When this pointer is no longer needed, the caller must release it by calling FltObjectDereference. Thus every successful call to FltGetBottomInstance must be matched by a subsequent call to FltObjectDereference.

Requirements

Target platform

Universal

Header

Fltkernel.h (include Fltkernel.h)

Library

FltMgr.lib

DLL

Fltmgr.sys

IRQL

<= APC_LEVEL

See also

FltAttachVolume
FltAttachVolumeAtAltitude
FltCompareInstanceAltitudes
FltGetLowerInstance
FltGetTopInstance
FltGetUpperInstance
FltObjectDereference

 

 

Send comments about this topic to Microsoft

Show: