Initializing a File System Filter Driver

The DriverEntry routine for initializing a legacy file system filter driver is similar to the DriverEntry routine for initializing a device driver. After a driver is loaded, the same component that loaded the driver also initializes the driver by calling the driver's DriverEntry routine. For file system filter drivers, the component that loads the driver is either the I/O Manager (for filters whose start type is SERVICE_BOOT_START) or the Service Control Manager (for other start types).

The DriverEntry routine runs in a system thread context at IRQL = PASSIVE_LEVEL. This routine can be pageable and should be in an INIT segment so that it will be discarded. For more information about how to make your driver code pageable, see the Remarks section of MmLockPagableCodeSection.

The DriverEntry routine is defined as follows:

NTSTATUS 
(*PDRIVER_INITIALIZE) ( 
    IN PDRIVER_OBJECT DriverObject, 
    IN PUNICODE_STRING RegistryPath 
    ); 

This routine has two input parameters. The first, DriverObject, is the driver object that was created when the file system filter driver was loaded. The second, RegistryPath, is a pointer to a counted Unicode string that contains a path to the driver's registry key.

The DriverEntry routine for a file system filter driver performs the following steps:

Creating the Control Device Object

Registering IRP Dispatch Routines

Registering Fast I/O Dispatch Routines

Registering FsFilter Callback Routines

Performing Any Other Needed Initialization

[Optional] Registering Callback Routines

[Optional] Saving a Copy of the Registry Path String

Returning Status