Hi,
I’m using FltRegisterForDataScan(), FltAllocateContext() /w FLT_SECTION_CONTEXT as well as FltCreateSectionForDataScan() & FltCloseSectionForDataScan(). In its remarks section for FltCloseSectionForDataScan() MSDN mentions: All previously allocated section contexts passed to FltCreateSectionForDataScan must be passed to FltCloseSectionForDataScan. Otherwise, minifilters can call FltReleaseContext if the section context was allocated with FltAllocateContext but no section was created with FltCreateSectionForDataScan.
Assuming I have called FltCreateSectionForDataScan, does this mean FltCloseSectionForDataScan() will decrement the ref count of the section context and I must not touch it anymore after the call to FltCloseSectionForDataScan()? Or do I still have to call FltReleaseContext() as well?
I am asking because I?d like to keep and use the section context for a little longer after the call to FltCloseSectionForDataScan() and I don?t want to delay the closing of the data scan section until I am done using the context. If FltCloseSectionForDataScan() does decrement the ref count, would an extra pair of FltReferenceContext()/FltReleaseContext() solve my problem?
Thanks for your help,
Michael