Hi, dears!
Just curiosity question!
I had the problem to unload the driver when it run in boot mode ( driver gone in on demand mode without problems), afterwards I found that in this mode one of my threads left in the air, and after finishing it, driver unloaded without problems.
During search I found that MSDN stand, that without FilterUnloadCallback set in FLT_REGISTRATION struct driver can’t be unloaded, which is not what happen to me, because my driver unloaded without it.
I added FilterUnloadCallback to FLT_REGISTRATION , but function never called on stop.
Maybe some can answer what’s the reason of minifilter not to call it.
I checked my filter struct with !fltkd.filter in windbg and see correct address of my
FilterUnloadCallback() in it.
TIA
Arkady