FsRtlIsEcpFromUserMode function

The FsRtlIsEcpFromUserMode routine determines whether an extra create parameter (ECP) context structure originated from user mode.

Syntax

BOOLEAN FsRtlIsEcpFromUserMode(
  _In_ PVOID EcpContext
);

Parameters

EcpContext

Pointer to the ECP context structure to test.

Return Value

FsRtlIsEcpFromUserMode returns TRUE if the ECP context structure originated in user mode and FALSE if the ECP context structure originated in kernel mode.

Requirements

   
Windows version FsRtlIsEcpFromUserMode is available starting with Windows Vista. FsRtlIsEcpFromUserMode is available starting with Windows Vista.
Target Platform Universal
Header ntifs.h (include Ntifs.h)
Library NtosKrnl.lib
DLL NtosKrnl.exe
IRQL "<= APC_LEVEL"