FltIsEcpFromUserMode - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
// fltkernel.h
BOOLEAN FLTAPI FltIsEcpFromUserMode(
[in] PFLT_FILTER Filter,
[in] PVOID EcpContext
);
View the official Windows Driver Kit DDI referenceNo description available.
The FltIsEcpFromUserMode routine is used to determine if an extra create parameter context structure (ECP) originated from user mode.
Filter [in]Opaque filter pointer for the minifilter driver. This pointer uniquely identifies the minifilter driver and remains constant as long as the minifilter driver is loaded.
EcpContext [in]Pointer to the ECP to test.
The routine returns TRUE if the ECP originated in user mode and FALSE if the ECP originated in kernel mode.