How to dynamically uninstall filter binding in Windows

How to dynamically uninstall filter binding in Windows

Previously, I only talked about how to bind, but did not say how to unbind it. If you want to make this module A module that can be dynamically detached, you must provide an unmount function. We should unbind the function in the unmount function; otherwise, once unmount, the screen will be blue.
Three kernel APIs are involved: iodetachdevice, which is used to unbind the bound device, and iodeletedevice, which is used to delete the device generated with iocreatedevice to recycle memory; another one is kedelayexecutionthread, which is purely responsible for latency. The parameters of these three functions are relatively simple and will not be described in detail here. For more information, see wdk help.
There is a key problem with uninstalling the Filter Driver: We need to terminate this filter program, but some IRPs may still be in the processing process of this filter program. Canceling these requests is troublesome and may not be successful. Therefore, the solution is to wait for 5 seconds to ensure secure uninstallation. We can only make sure that these requests will be completed within five seconds, and wait until we have unbound them, so no new requests will be sent for processing within these five seconds. This is okay for the serial port, but not all devices. Therefore, readers will see different solutions in the following sections.

 

More exciting resources:
Web development column: http://blog.csdn.net/broadviewwebdev
Data Development column: http://blog.csdn.net/broadviewdatabase
Program Design column: http://blog.csdn.net/broadviewprograming
Security column: http://blog.csdn.net/BroadviewSecurity