文件驱动过滤微端口开发模板代码

/*++ Copyright (c) 1999 - 2002 Microsoft Corporation Module Name: nullFilter.c Abstract: This is the main module of the nullFilter mini filter driver. It is a simple minifilter that registers itself with the main filter for no callback operations. Environment: Kernel mode --*/ #include <fltKernel.h> #include <dontuse.h> #include <suppress.h> #pragma prefast(disable:__WARNING_ENCODE_MEMBER_FUNCTION_POINTER, "Not valid for kernel mode drivers") //--------------------------------------------------------------------------- // Global variables //--------------------------------------------------------------------------- #define NULL_FILTER_FILTER_NAME L"NullFilter" typedef struct _NULL_FILTER_DATA { // // The filter handle that results from a call to // FltRegisterFilter. // PFLT_FILTER FilterHandle; } NULL_FILTER_DATA, *PNULL_FILTER_DATA; /************************************************************************* Prototypes for the startup and unload routines used for this Filter. Implementation in nullFilter.c *************************************************************************/ NTSTATUS DriverEntry ( __in PDRIVER_OBJECT DriverObject, __in PUNICODE_STRING RegistryPath ); NTSTATUS NullUnload ( __in FLT_FILTER_UNLOAD_FLAGS Flags ); NTSTATUS NullQueryTeardown ( __in PCFLT_RELATED_OBJECTS FltObjects, __in FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags ); // // Structure that contains all the global data structures // used throughout NullFilter. // NULL_FILTER_DATA NullFilterData; // // Assign text sections for each routine. // #ifdef ALLOC_PRAGMA #pragma alloc_text(INIT, DriverEntry) #pragma alloc_text(PAGE, NullUnload) #pragma alloc_text(PAGE, NullQueryTeardown) #endif // // This defines what we want to filter with FltMgr // CONST FLT_REGISTRATION FilterRegistration = { sizeof( FLT_REGISTRATION ), // Size FLT_REGISTRATION_VERSION, // Version 0, // Flags NULL, // Context NULL, // Operation callbacks NullUnload, // FilterUnload NULL, // InstanceSetup NullQueryTeardown, // InstanceQueryTeardown NULL, // InstanceTeardownStart NULL, // InstanceTeardownComplete NULL, // GenerateFileName NULL, // GenerateDestinationFileName NULL // NormalizeNameComponent }; /************************************************************************* Filter initialization and unload routines. *************************************************************************/ NTSTATUS DriverEntry ( __in PDRIVER_OBJECT DriverObject, __in PUNICODE_STRING RegistryPath ) /*++ Routine Description: This is the initialization routine for this miniFilter driver. This registers the miniFilter with FltMgr and initializes all its global data structures. Arguments: DriverObject - Pointer to driver object created by the system to represent this driver. RegistryPath - Unicode string identifying where the parameters for this driver are located in the registry. Return Value: Returns STATUS_SUCCESS. --*/ { NTSTATUS status; UNREFERENCED_PARAMETER( RegistryPath ); // // Register with FltMgr // status = FltRegisterFilter( DriverObject, &FilterRegistration, &NullFilterData.FilterHandle ); ASSERT( NT_SUCCESS( status ) ); if (NT_SUCCESS( status )) { // // Start filtering i/o // status = FltStartFiltering( NullFilterData.FilterHandle ); if (!NT_SUCCESS( status )) { FltUnregisterFilter( NullFilterData.FilterHandle ); } } return status; } NTSTATUS NullUnload ( __in FLT_FILTER_UNLOAD_FLAGS Flags ) /*++ Routine Description: This is the unload routine for this miniFilter driver. This is called when the minifilter is about to be unloaded. We can fail this unload request if this is not a mandatory unloaded indicated by the Flags parameter. Arguments: Flags - Indicating if this is a mandatory unload. Return Value: Returns the final status of this operation. --*/ { UNREFERENCED_PARAMETER( Flags ); PAGED_CODE(); FltUnregisterFilter( NullFilterData.FilterHandle ); return STATUS_SUCCESS; } NTSTATUS NullQueryTeardown ( __in PCFLT_RELATED_OBJECTS FltObjects, __in FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags ) /*++ Routine Description: This is the instance detach routine for this miniFilter driver. This is called when an instance is being manually deleted by a call to FltDetachVolume or FilterDetach thereby giving us a chance to fail that detach request. Arguments: FltObjects - Pointer to the FLT_RELATED_OBJECTS data structure containing opaque handles to this filter, instance and its associated volume. Flags - Indicating where this detach request came from. Return Value: Returns the status of this operation. --*/ { UNREFERENCED_PARAMETER( FltObjects ); UNREFERENCED_PARAMETER( Flags ); PAGED_CODE(); return STATUS_SUCCESS; }