Writing a FilterUnloadCallback Routine

The FilterUnloadCallback routine is defined as follows:

typedef NTSTATUS
(*PFLT_FILTER_UNLOAD_CALLBACK) (
    FLT_FILTER_UNLOAD_FLAGS Flags
    );

The FilterUnloadCallback routine has one input parameter, Flags, which can be NULL or FLTFL_FILTER_UNLOAD_MANDATORY. The filter manager sets this parameter to FLTFL_FILTER_UNLOAD_MANDATORY to indicate that the unload operation is mandatory. For more information about this parameter, see PFLT_FILTER_UNLOAD_CALLBACK.

A minifilter driver's FilterUnloadCallback routine must perform the following steps:

• Close any open kernel-mode communication server port handles.

• Call FltUnregisterFilter to unregister the minifilter driver.

• Perform any needed global cleanup.

• Return an appropriate NTSTATUS value.

This section includes:

Closing the Communication Server Port

Unregistering the Minifilter

Performing Global Cleanup

Returning Status from a FilterUnloadCallback Routine