locked
Problem with Monitoring Filter Changes example RRS feed

  • Question

  • I am trying to use the Monitoring Filter Changes sample code in http://msdn.microsoft.com/en-us/library/windows/desktop/bb427379(v=VS.85).aspx.

    I managed to add a _getch() call at the end of the wmain such that I can see the FilterChangeCallback being triggered, and changed the layer to monitor.

    I have another application running to add a filter to the layer specified in the code.

    It was found that everytime when a filter is added, the changeType and filterId is displayed (which is nice!), but the sample code crashes after. An access violation error pointing at ntdll.dll!778215ee is shown in the Call Stack.

    It is working fine if the sample code is terminated without any filter changes.

    Would someone nicely pointed out to me what went wrong?

    Thank you.

    Tuesday, October 18, 2011 9:18 PM

Answers

  • I finally have it working. The keyword CALLBACK, or WINAPI is missing in the definition of FilterChangeCallback function.

    This is the fix:

    void CALLBACK FilterChangeCallback(IN void* context, IN const FWPM_FILTER_CHANGE0* change)

    • Marked as answer by Scarlett Chan Wednesday, October 19, 2011 10:01 PM
    Wednesday, October 19, 2011 10:01 PM