FltGetRequestorProcessIdEx function (fltkernel.h)

Article
02/22/2024

The FltGetRequestorProcessIdEx routine returns the kernel-mode handle for the process that is associated with the thread that requested a given I/O operation.

Syntax

HANDLE FLTAPI FltGetRequestorProcessIdEx(
  [in] PFLT_CALLBACK_DATA CallbackData
);

Parameters

[in] CallbackData

A pointer to an FLT_CALLBACK_DATA structure that identifies the thread and the I/O operation.

Return value

The FltGetRequestorProcessIdEx routine returns the kernel-mode handle for the process that is associated with the thread that originally requested the I/O operation. If the operation is not associated with any thread, FltGetRequestorProcessIdEx returns NULL.

Remarks

The FltGetRequestorProcessIdEx routine returns the kernel-mode handle for the process that the requesting thread is currently attached to. This process may or may not be the same process that created the thread.

Requirements

Requirement	Value
Minimum supported client	Available in Microsoft Vista or later versions of the Windows operating system.
Target Platform	Universal
Header	fltkernel.h (include Fltkernel.h)
Library	FltMgr.lib
DLL	Fltmgr.sys
IRQL	<= DISPATCH_LEVEL