Writing a DriverEntry Routine for a Minifilter Driver

  • Article

Every file system minifilter driver must have a DriverEntry routine. The DriverEntry routine is called when the minifilter driver is loaded.

The DriverEntry routine performs global initialization, registers the minifilter driver, and initiates filtering. This routine runs in a system thread context at IRQL PASSIVE_LEVEL.

The DriverEntry routine is defined as follows:

NTSTATUS 
(*PDRIVER_INITIALIZE) ( 
    IN PDRIVER_OBJECT DriverObject, 
    IN PUNICODE_STRING RegistryPath 
    );

DriverEntry has two input parameters. The first, DriverObject, is the driver object that was created when the minifilter driver was loaded. The second, RegistryPath, is a pointer to a counted Unicode string that contains a path to the minifilter driver's registry key.

A minifilter driver's DriverEntry routine must perform the following steps, in order:

  1. Perform any needed global initialization for the minifilter driver.

  2. Register the minifilter driver by calling FltRegisterFilter.

  3. Initiate filtering by calling FltStartFiltering.

  4. Return an appropriate NTSTATUS value.

This section includes:

Registering the Minifilter Driver

Initiating Filtering

Returning Status from a Minifilter DriverEntry Routine