[irp]

Hi all,

from msdn: FltGetRequestorProcessId returns the process ID for the process that the requesting thread is currently attached to. This process may or may not be the same process that created the thread.

So, there is a way to find the owner process ID?

Thanks, irp

[EP_X0FF]

FLT_CALLBACK_DATA has Thread field (Pointer to the thread that initiated the I/O operation), which is PETHREAD.

ep = IoThreadToProcess(et), id = PsGetProcessId(ep)

?

FltGetRequestorProcessId just PsGetProcessId for result of FltGetRequestorProcess which calls IoGetRequestorProcess / IoGetCurrentProcess.

[irp]

Hello,

thank for your reply and sorry for my question, pretty banal (I'm just at the beginning). Irp