DLLDeciders

Writting DLL-Based Decisions

The DLLDecide filter operator allows users initiated into the art of developing dynamic link libraries to create filters of their own, not restricted by mechanisms described by the Filters page. Also, DLL based decisions are more effective in terms of performance.

Although the filtering graphical user interface suggest the opposite, the DLLDecider operator does not apply to individual columns (as other operators do). Instead, the DLL taking the decision receives the whole request and additional information, such as driver, device, file and process names. The request is given in its raw form and the DLL is responsible for extracting the data it is interested in. The string constant associated with the operator defines name of the DLL and its decision routine in the following format:`

DLLName!RoutineName

If the exclamation mark followed by the routine name is not specified, the application searches for the symbol named DecisionRoutine. The routine is expected to have this declaration:

typedef struct _DLL_DECIDER_DECISION {
  EFilterAction Action;
  ULONG HighlightColor;
  BOOLEAN Decided;
  BOOLEAN OverrideFilter;
} DLL_DECIDER_DECISION, *PDLL_DECIDER_DECISION;

ULONG cdecl DLLDecideRoutine(PREQUEST_GENERAL Request, PDP_REQUEST_EXTRA_INFO ExtraInfo, PDLL_DECIDER_DECISION Decision);

the first two arguments specify the request being filtered. If additional data are associated with it, they directly follow the REQUEST_XXX structure (not the REQUEST_GENERAL one!) where XXX depends on the request type. The third parameter is used by the routine to specify whether the decision was made (and which one). The decision is accepted only when the routine returns zero. Nonzero return values result in ignoring the filter completely.

If the routine made decision about the request, it needs to signal it by setting the Decided field to a nonzero value (TRUE). However, the action and highlight color fields are not taken into account unless the Overridefilter is also se to to TRUE. If it is set to FALSE, the filter action and higlight color defined by the GUI are used.