[irp]

Hi all.

The scenario is a minifilter in kernel space. If I'm filtering the MJ_CREATEs, how I can get the private id of the originator process?

Thanks. IRP.

[GamingMasteR]

Irp->Tail.Overlay.Thread
From ETHREAD you can get the ClientID and EPROCESS ..

[irp]

Hello! Thanks for your replay. Can I use FLT_CALLBACK_DATA structure too?

[GamingMasteR]

I don't know :)

[irp]

There is a fild called [from msdn] "Thread: Pointer to the thread that initiated the I/O operation." And FLT_CALLBACKDATA struct represents an IO op. So maybe this is a way too!