Instance Tear Down Call Callback RRS feed

  • Question

  • I am writing following function for safely unloading driver without causing system crash.

      _In_  PCFLT_RELATED_OBJECTS FltObjects,

    It requires following functions to be called within above function.

    VOID FltCompletePendedPreOperation(
      _In_      PFLT_CALLBACK_DATA Data,
      _In_      FLT_PREOP_CALLBACK_STATUS CallbackStatus,
      _In_opt_  PVOID Context

    VOID FltCbdqDisable(

    VOID FltCompletePendedPostOperation(
      _In_  PFLT_CALLBACK_DATA CallbackData

    But from where to get PFLT_CALLBACK_DATA Data and PFLT_CALLBACK_DATA_QUEUE Cbdq inside VOID ( *PFLT_INSTANCE_TEARDOWN_CALLBACK)() funtion  ,So that they can be passed to above mentioned functions.

    Tuesday, January 8, 2013 7:24 AM


  • You need to store in the instance context the Cbdq then you use FltCbdqRemoveNextIo to fetch the Data and complete the pended operations.  Note: to do this it assumes you have been using FltCbdqInsertIo to pend the operations, a lot of file system filters just pass through the operations so don't need this.

    Don Burn Windows Filesystem and Driver Consulting Website: Blog:

    Tuesday, January 8, 2013 12:58 PM