Calling Other Windows Filtering Platform Functions

  • Article

Many of the other Windows Filtering Platform functions that are available to user-mode management applications are also available to callout drivers. This enables a callout driver to perform management tasks, such as adding filters to the filter engine. The only difference between the user-mode and kernel-mode versions of these functions is the data type that is returned. The user-mode functions return Win32 error codes, whereas the kernel-mode functions return the equivalent NTSTATUS codes.

Most of the Windows Filtering Platform management functions require a handle to an open session to the filter engine as a parameter. The following topics discuss how a callout driver can open and close a session to the filter engine.

Opening a Session to the Filter Engine

Closing a Session to the Filter Engine

For a list of the other Windows Filtering Platform functions that can be called from a callout driver, see Other Windows Filtering Platform Functions. For more information about how to use these functions, see the Windows Filtering Platform documentation in the Microsoft Windows SDK.