wdk 下的 FltRegisterFilter

NTSTATUS
  FltRegisterFilter(
    IN PDRIVER_OBJECT  Driver,
    IN CONST FLT_REGISTRATION  *Registration,
    OUT PFLT_FILTER  *RetFilter

    ); 

1.  参数介绍

1.1 Driver

通过DriverEntry 传递进来的。

1.2  Registration

是一个结构体，有一系列的callback 定义：

typedef struct _FLT_REGISTRATION {
  USHORT  Size;
  USHORT  Version;
  FLT_REGISTRATION_FLAGS  Flags;
  CONST FLT_CONTEXT_REGISTRATION  *ContextRegistration;
  CONST FLT_OPERATION_REGISTRATION  *OperationRegistration;
  PFLT_FILTER_UNLOAD_CALLBACK  FilterUnloadCallback;
  PFLT_INSTANCE_SETUP_CALLBACK  InstanceSetupCallback;
  PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK  InstanceQueryTeardownCallback;
  PFLT_INSTANCE_TEARDOWN_CALLBACK  InstanceTeardownStartCallback;
  PFLT_INSTANCE_TEARDOWN_CALLBAC