Panoptes 1.0.0
Endpoint Detection and Response
Loading...
Searching...
No Matches
Functions
pano_filter.h File Reference
#include <fltKernel.h>

Go to the source code of this file.

Functions

NTSTATUS FilterInit (PDRIVER_OBJECT *DriverObject)
 

Function Documentation

◆ FilterInit()

NTSTATUS FilterInit ( PDRIVER_OBJECT *  DriverObject)

Definition at line 244 of file pano_filter.cpp.

245{
246 NTSTATUS status = FltRegisterFilter(
247 *DriverObject, //Driver
248 &FilterRegistration, //Registration
249 &g_FilterHandle); //RetFilter
250 if (!NT_SUCCESS(status)) {
251 DbgPrint("Failed FltRegisterFilter\n");
252 switch (status)
253 {
254 case STATUS_INSUFFICIENT_RESOURCES:
255 DbgPrint("STATUS_INSUFFICIENT_RESOURCES\n");
256 break;
257 case STATUS_INVALID_PARAMETER:
258 DbgPrint("STATUS_INVALID_PARAMETER\n");
259 break;
260 case STATUS_FLT_NOT_INITIALIZED:
261 DbgPrint("STATUS_FLT_NOT_INITIALIZED\n");
262 break;
263 case STATUS_OBJECT_NAME_NOT_FOUND:
264 DbgPrint("STATUS_OBJECT_NAME_NOT_FOUND\n");
265 break;
266 default:
267 DbgPrint("UNKNOWN\n");
268 break;
269 }
270 return status;
271 }
272
273 status = FltStartFiltering(g_FilterHandle);
274 if (!NT_SUCCESS(status)) {
275 DbgPrint("Failed FltStartFiltering\n");
276 FltUnregisterFilter(g_FilterHandle);
277 g_FilterHandle = nullptr;
278 return status;
279 }
280
281 return status;
282}
const FLT_REGISTRATION FilterRegistration
PFLT_FILTER g_FilterHandle

References FilterRegistration, and g_FilterHandle.

Referenced by DriverEntry().