FltIsEcpFromUserMode function (fltkernel.h)
The FltIsEcpFromUserMode routine is used to determine if an extra create parameter context structure (ECP) originated from user mode.
Syntax
BOOLEAN FLTAPI FltIsEcpFromUserMode(
[in] PFLT_FILTER Filter,
[in] PVOID EcpContext
);
Parameters
[in] Filter
Opaque filter pointer for the minifilter driver. This pointer uniquely identifies the minifilter driver and remains constant as long as the minifilter driver is loaded.
[in] EcpContext
Pointer to the ECP to test.
Return value
The routine returns TRUE if the ECP originated in user mode and FALSE if the ECP originated in kernel mode.
Requirements
| Requirement | Value |
|---|---|
| Minimum supported client | This routine is available starting with Windows Vista. |
| Target Platform | Universal |
| Header | fltkernel.h (include Fltkernel.h) |
| Library | FltMgr.lib |
| DLL | FltMgr.sys |
| IRQL | <= APC_LEVEL |