Registering the Minifilter Driver

Every minifilter driver must call FltRegisterFilter from its DriverEntry routine to add itself to the global list of registered minifilter drivers and to provide the filter manager with a list of callback routines and other information about the driver.

In the MiniSpy sample, the minifilter driver is registered as shown in the following code example:

NTSTATUS status;
status = FltRegisterFilter(
           DriverObject,                  //Driver
           &FilterRegistration,           //Registration
           &MiniSpyData.FilterHandle);    //RetFilter

FltRegisterFilter has two input parameters. The first, Driver, is the driver object pointer that the minifilter driver received as the DriverObject input parameter to its DriverEntry routine. The second, Registration, is a pointer to an FLT_REGISTRATION structure that contains entry points to the minifilter driver's callback routines.

In addition, FltRegisterFilter has an output parameter, RetFilter, that receives an opaque filter pointer for the minifilter driver. This filter pointer is a required input parameter for many FltXxx support routines, including FltStartFiltering and FltUnregisterFilter.