FltIsEcpFromUserMode - NtDoc

Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers 
// fltkernel.h

BOOLEAN FLTAPI FltIsEcpFromUserMode(
  [in] PFLT_FILTER Filter,
  [in] PVOID       EcpContext
);
View the official Windows Driver Kit DDI reference

NtDoc

No description available.

Edit description on GitHub

Windows Driver Kit DDI reference (nf-fltkernel-fltisecpfromusermode)

FltIsEcpFromUserMode function

Description

The FltIsEcpFromUserMode routine is used to determine if an extra create parameter context structure (ECP) originated from user mode.

Parameters

Filter [in]

Opaque filter pointer for the minifilter driver. This pointer uniquely identifies the minifilter driver and remains constant as long as the minifilter driver is loaded.

EcpContext [in]

Pointer to the ECP to test.

Return value

The routine returns TRUE if the ECP originated in user mode and FALSE if the ECP originated in kernel mode.

See also

ECP_LIST

FltAcknowledgeEcp

FltGetEcpListFromCallbackData

FltInsertExtraCreateParameter

FltRemoveExtraCreateParameter

FltSetEcpListIntoCallbackData

View the official Windows Driver Kit DDI reference

Edit description on GitHub