question about minifilter altitudes

NTDEV
1

may be quite basic question but I could not find what I was looking for:

For a filesystem minifilter How do I specify altitude.

–> As I found I can do it by INF file. ( fair enough )

–> I can also specify as given in
( https://msdn.microsoft.com/en-us/windows/hardware/drivers/ifs/load-order-groups-and-altitudes-for-minifilter-drivers )

A minifilter driver must specify an altitude value from an altitude range that represents a load order group.
Altitude values for a minifilter driver are specified in the Instance definitions of the Strings Section in the
INF file that is used to install the minifilter driver. Instance definitions can also be specified in calls
to the InstanceSetupCallback routine in the FLT_REGISTRATION structure. Multiple instances and altitudes
can be defined for a minifilter driver. These instance definitions apply across all volumes.

Now I could not get any sample code of how to Instance definitions can also be specified in calls to the InstanceSetupCallback routine in the FLT_REGISTRATION structure

–> Also I find I can do it using ObRegisterCallbacks but could not find a sample code doing that.

–> Basically I find using some troubleshooting that ultimately specifying altitude creates registry settings in service key/instances.
what If I delete this key.I can see minifilter still working but fltmc does not specify this minifilter.
So quite confused.Is minifilter working now or what is its status now.

2

If InstanceSetupCallback is being called then a filter has been already registered and has an assigned altitude. FLT_REGISTRATION is a parameter for FltRegisterFilter .

Altitude is a parameter in a minifilter registry key. It doesn’t matter how it was set. You can even set it manually by directly writing to a registry key before loading a minifilter. After the minitilter has been started you can remove the registry key.

3

Thanks really.

But from MSDN

Instance definitions
can also be specified in calls
to the InstanceSetupCallback routine in the FLT_REGISTRATION structure

what does this statement mean?

4

I don’t have idea. Looks like a poorly formed statement.