Questions about FltUnregisterFilter

I have two questions about FltUnregisterFilter:

  1. Is it possbile that minifilter is unregistered between a pre and corresponding post calls? how can i free CompletionContext if post callback is skipped because of driver unloading.
  2. Does system free all allocated stream contexts and stream handle contexts allocated by my minifilter during FltUnregisterFilter call? i assume yes, can someone confirm?

Regards,
Haibo

  1. yes. You will be called at the post call with the draining bit set. And you won’t be called in the same context even if you specified SYNCHRONIZE, which has implications….

  2. no. It detaches them from their related object (instance, file object,…) and issues a dereference. If the attachment was the only thing pinning them then they will be freed, but if you had a reference on them they will only be freed when you dereference them.

Thank you rod, more about unloading minifilter. Now I want to unload my driver from memory in order to update it, and i have unload routine in FLT_REGISTRATION, do i have to implement DriverObject->DriverUnload?

I said no, but I meant “I usually doe” (I was thinking about something else)

I don’t usually do anything in there - instead I rely on the filter manager callback.

For having standard structure in minifilter driver you should implement Unload driver routine in FLT_REGISTRATION, and to free all allocated memory or other contexts, you should call to the Unload routine for freeing up all of these memories