FltRegisterFilter 怎么用？

在微软的网站上找到的filter的文档上说的，那个函数在哪有定义？

这是微软最性的东东，新的过滤驱动
叫什么wfc
这些函数在
FltKernel.h定义
需要FltMgr.lib.

Mini file system filter drivers are kernel-mode drivers.  As such, they must export a function called DriverEntry(), which will be the first function invoked when the driver is loaded.  Most minifilters will call FltRegisterFilter() in their DriverEntry().  
FltRegisterFilter() takes as a parameter a FLT_REGISTRATION structure, which contains an unload routine, instance notification callbacks, a list of context callback function pointers and a list of file system operation callback pointers.  In the most common case, where the minifilter hooks just a few operations, this list can be very short.  
The minifilter also can specify additional flags for each operation that controls whether it receives the callbacks in all cases. For instance, if FLTFL_OPERATION_REGISTRATION_SKIP_PAGING_IO is supplied, the minifilter will not receive any paging I/O operations for that particular IRP major code.
Similarly, if FLTFL_OPERATION_REGISTRATION_SKIP_CACHED_IO is specified, only the non-cached I/O path will be seen for that operation (i.e., if it is supplied for IRP_MJ_READ, all cached read paths will be skipped by that minifilter).
 

找不到这些玩意，也不知道到底支持哪些系统

Quoting a previous post from Neal:

You can get the latest beta IFSKit (which also
supports filter manager)
from Microsoft\'s Betaplace site.

To do this register in the filter manager beta
Go to:  http://beta.microsoft.com
Using GuestID: Filtermgr

Once approved you can download the latest IFSkit which
contains this new
documentation.

这是微软最性的东东，新的过滤驱动
叫什么wfc
这些函数在
FltKernel.h定义
需要FltMgr.lib.

Mini file system filter drivers are kernel-mode drivers.  As such, they must export a function called DriverEntry(), which will be the first function invoked when the driver is loaded.  Most minifilters will call FltRegisterFilter() in their DriverEntry().  
FltRegisterFilter() takes as a parameter a FLT_REGISTRATION structure, which contains an unload routine, instance notification callbacks, a list of context callback function pointers and a list of file system operation callback pointers.  In the most common case, where the minifilter hooks just a few operations, this list can be very short.  
The minifilter also can specify additional flags for each operation that controls whether it receives the callbacks in all cases. For instance, if FLTFL_OPERATION_REGISTRATION_SKIP_PAGING_IO is supplied, the minifilter will not receive any paging I/O operations for that particular IRP major code.
Similarly, if FLTFL_OPERATION_REGISTRATION_SKIP_CACHED_IO is specified, only the non-cached I/O path will be seen for that operation (i.e., if it is supplied for IRP_MJ_READ, all cached read paths will be skipped by that minifilter).

在最新的IFS里有,好象MS在LONGHORN里用的,不过据说OSR已经将其移植到2K下,据说可以统一处理FASTIO,IRP等,功能十分强大、

据OSR介绍这部分在windows xp ifx ddk sp2里有，但是到哪能搞到这玩意？

在最新的IFS里有,好象MS在LONGHORN里用的,不过据说OSR已经将其移植到2K下,据说可以统一处理FASTIO,IRP等,功能十分强大、