FltIsEcpFromUserMode function (fltkernel.h)

The FltIsEcpFromUserMode routine is used to determine if an extra create parameter context structure (ECP) originated from user mode.

Syntax

BOOLEAN FLTAPI FltIsEcpFromUserMode(
  [in] PFLT_FILTER Filter,
  [in] PVOID       EcpContext
);

Parameters

[in] Filter

Opaque filter pointer for the minifilter driver. This pointer uniquely identifies the minifilter driver and remains constant as long as the minifilter driver is loaded.

[in] EcpContext

Pointer to the ECP to test.

Return value

The routine returns TRUE if the ECP originated in user mode and FALSE if the ECP originated in kernel mode.

Requirements

Requirement	Value
Minimum supported client	This routine is available starting with Windows Vista.
Target Platform	Universal
Header	fltkernel.h (include Fltkernel.h)
Library	FltMgr.lib
DLL	FltMgr.sys
IRQL	<= APC_LEVEL

See also

ECP_LIST

FltAcknowledgeEcp

FltGetEcpListFromCallbackData

FltInsertExtraCreateParameter

FltRemoveExtraCreateParameter

FltSetEcpListIntoCallbackData