FltIs32bitProcess function (fltkernel.h)

The FltIs32bitProcess routine checks whether the originator of the current I/O operation is a 32-bit user-mode application.

Syntax

BOOLEAN FLTAPI FltIs32bitProcess(
  [in, optional] PFLT_CALLBACK_DATA CallbackData
);

Parameters

[in, optional] CallbackData

Pointer to the callback data structure for the current I/O operation (FLT_CALLBACK_DATA). This parameter is optional and can be NULL.

Return value

FltIs32bitProcess returns TRUE if the originator of the current I/O operation is a 32-bit user-mode process, FALSE otherwise.

Remarks

Minifilter drivers call FltIs32bitProcess to determine whether an I/O request is likely to contain data elements that need to be converted, or "thunked," before they can be used in a 64-bit driver. For more information about thunking and other 64-bit driver issues, see Programming Issues for 64-Bit Drivers.

On a 32-bit system, FltIs32bitProcess always returns TRUE.

On a 64-bit system, FltIs32bitProcess returns TRUE or FALSE, according to the following conditions:

• If the CallbackData parameter is NULL, and the caller is running in the context of a 32-bit user-mode process, FltIs32bitProcess returns TRUE.

• If the CallbackData parameter is not NULL, and the callback data structure represents an IRP-based I/O operation where IRP was issued by the I/O manager on behalf of a user-mode process, FltIs32bitProcess returns TRUE.

• If the CallbackData parameter is not NULL, the callback data structure represents a fast I/O operation or a file system filter (FSFilter) callback operation, and the caller is running in the context of a 32-bit user-mode process, FltIs32bitProcess returns TRUE.

• If none of the above conditions is true, FltIs32bitProcess returns FALSE.

To determine whether a callback data structure represents an IRP-based I/O operation, use the FLT_IS_IRP_OPERATION macro.

To determine whether a callback data structure represents a fast I/O operation, use the FLT_IS_FASTIO_OPERATION macro.

To determine whether a callback data structure represents a file system filter (FSFilter) callback operation, use the FLT_IS_FS_FILTER_OPERATION macro.

Requirements

See also

FLT_CALLBACK_DATA

FLT_IS_FASTIO_OPERATION

FLT_IS_FS_FILTER_OPERATION

FLT_IS_IRP_OPERATION

IoIs32bitProcess