FltIs32bitProcess - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
// fltkernel.h
BOOLEAN FLTAPI FltIs32bitProcess(
[in, optional] PFLT_CALLBACK_DATA CallbackData
);
View the official Windows Driver Kit DDI referenceNo description available.
The FltIs32bitProcess routine checks whether the originator of the current I/O operation is a 32-bit user-mode application.
CallbackData [in, optional]Pointer to the callback data structure for the current I/O operation (FLT_CALLBACK_DATA). This parameter is optional and can be NULL.
FltIs32bitProcess returns TRUE if the originator of the current I/O operation is a 32-bit user-mode process, FALSE otherwise.
Minifilter drivers call FltIs32bitProcess to determine whether an I/O request is likely to contain data elements that need to be converted, or "thunked," before they can be used in a 64-bit driver. For more information about thunking and other 64-bit driver issues, see Programming Issues for 64-Bit Drivers.
On a 32-bit system, FltIs32bitProcess always returns TRUE.
On a 64-bit system, FltIs32bitProcess returns TRUE or FALSE, according to the following conditions:
If the CallbackData parameter is NULL, and the caller is running in the context of a 32-bit user-mode process, FltIs32bitProcess returns TRUE.
If the CallbackData parameter is not NULL, and the callback data structure represents an IRP-based I/O operation where IRP was issued by the I/O manager on behalf of a user-mode process, FltIs32bitProcess returns TRUE.
If the CallbackData parameter is not NULL, the callback data structure represents a fast I/O operation or a file system filter (FSFilter) callback operation, and the caller is running in the context of a 32-bit user-mode process, FltIs32bitProcess returns TRUE.
If none of the above conditions is true, FltIs32bitProcess returns FALSE.
To determine whether a callback data structure represents an IRP-based I/O operation, use the FLT_IS_IRP_OPERATION macro.
To determine whether a callback data structure represents a fast I/O operation, use the FLT_IS_FASTIO_OPERATION macro.
To determine whether a callback data structure represents a file system filter (FSFilter) callback operation, use the FLT_IS_FS_FILTER_OPERATION macro.