1. Filter Manager Support In User Mode
© 2004 Microsoft Corporation. All rights reserved.

2. Why provide user mode interfaces?
Provide common functionality for products that include filter drivers
General control of driver
Communication between user-mode service and filter driver
Provide interfaces for management tools
Allow enumeration of filters, volumes and instances
© 2004 Microsoft Corporation. All rights reserved.

3. What can be done from user mode?
Load and unload filters
Attach and detach filters to volumes
Open communication channels to filters from user mode and send/receive data from the filters
Query the system for information such as:
Filters loaded
Volumes
Instances attached to a given volume
© 2004 Microsoft Corporation. All rights reserved.

4. User mode library security
All user mode APIs require administrator privileges
User/Kernel mode communication APIs are an exception
Necessary privilege defined by minifilter through ACL defined on Port
© 2004 Microsoft Corporation. All rights reserved.

5. User mode library Prototypes in: Link to: FltUser.h
FltUserStructures.h
Link to:
FltLib.lib
© 2004 Microsoft Corporation. All rights reserved.

6. Load/Unload Filters FilterLoad() FilterUnload()
Loads a filter and calls its DriverEntry() routine
FilterUnload()
Unloads a filter
Unload request can be failed by the filter
© 2004 Microsoft Corporation. All rights reserved.

7. Handle creation FilterCreate() FilterInstanceCreate()
Opens a handle to a filter with the given filter name
FilterInstanceCreate()
Opens a handle to an instance
Identify with filter and volume
instance id optional
FilterClose()/FilterInstanceClose()
Closes the given handle
© 2004 Microsoft Corporation. All rights reserved.

8. Informational API’s FilterGetInformation()
Returns information about the given filter, such as its name, number of instances, etc.
FilterInstanceGetInformation()
Returns information about an instance, such as its instance ID and the name of the volume it is attached to, etc.
© 2004 Microsoft Corporation. All rights reserved.

9. Adding/Removing Filter Instances
FilterAttach()
Creates a new instance for the given filter and attaches it to the stack of the volume specified
Instance altitude is determined from the given instance name
FilterAttachAtAltitude()
Creates a new instance for the given filter and attaches it to the stack of the volume at the specified altitude
For debug purpose only – may be removed in the final Filter Manager release
FilterDetach()
Detaches a filter instance from a volume for the specified filter with the given Instance Name
© 2004 Microsoft Corporation. All rights reserved.

10. Enumeration API’s Filter enumeration: Volume enumeration:
FilterFindFirst()
FilterFindNext()
Volume enumeration:
FilterVolumeFindFirst()
FilterVolumeFindNext()
Filter Instance enumeration:
FilterInstanceFindFirst()
FilterInstanceFindNext()
Volume Instance enumeration:
FilterVolumeInstanceFindFirst()
FilterVolumeInstanceFindNext()
© 2004 Microsoft Corporation. All rights reserved.

11. User-Initiated Communication APIs
These routines send messages from user-mode to a port exposed by the minifilter
They potentially expect a response
Access to the port is controlled by the minifilter
FilterConnectCommunicationPort()
Opens a port handle to the communication port created by the filter
FilterSendMessage()
Used to send a message from user-mode to kernel-mode through a port handle
© 2004 Microsoft Corporation. All rights reserved.

12. User-Initiated Communication APIs
FilterGetMessage()
Allows user to request a message from a kernel mode filter through a port handle
FilterReplyMessage()
Used to reply to a message received via FilterGetMessage()
© 2004 Microsoft Corporation. All rights reserved.

13. Kernel-Initiated Communication APIs
FltSendMessage()
Sends message to a user mode component through a port
Filter can wait on port object for a reply to this message from user mode
Timeout can be specified for user to receive message and reply to be returned
© 2004 Microsoft Corporation. All rights reserved.

14. Support APIs FilterGetDosName()
Given a volume name it returns the DOS name for the device
Volume name can be one of the following forms:
NT device name, e.g. \Device\HarddiskVolume1
Dos device name, e.g. D:
Volume GUID name, e.g. \\?\Volume{a4e6ccb3-134a-11d5-b660-00c04f72d8dd}
Mount point name, e.g. C:\MountPoint
Returned DOS name will be one of the following:
Drive letter (if one exists), e.g. D:
Does not work for network drives
© 2004 Microsoft Corporation. All rights reserved.