Expand Minimize

FltIs32bitProcess routine

The FltIs32bitProcess routine checks whether the originator of the current I/O operation is a 32-bit user-mode application.

Syntax


BOOLEAN FltIs32bitProcess(
  _In_opt_  PFLT_CALLBACK_DATA CallbackData
);

Parameters

CallbackData [in, optional]

Pointer to the callback data structure for the current I/O operation (FLT_CALLBACK_DATA). This parameter is optional and can be NULL.

Return value

FltIs32bitProcess returns TRUE if the originator of the current I/O operation is a 32-bit user-mode process, FALSE otherwise.

Remarks

Minifilter drivers call FltIs32bitProcess to determine whether an I/O request is likely to contain data elements that need to be converted, or "thunked," before they can be used in a 64-bit driver. For more information about thunking and other 64-bit driver issues, see Programming Issues for 64-Bit Drivers.

On a 32-bit system, FltIs32bitProcess always returns TRUE.

On a 64-bit system, FltIs32bitProcess returns TRUE or FALSE, according to the following conditions:

  • If the CallbackData parameter is NULL, and the caller is running in the context of a 32-bit user-mode process, FltIs32bitProcess returns TRUE.

  • If the CallbackData parameter is not NULL, and the callback data structure represents an IRP-based I/O operation where IRP was issued by the I/O manager on behalf of a user-mode process, FltIs32bitProcess returns TRUE.

  • If the CallbackData parameter is not NULL, the callback data structure represents a fast I/O operation or a file system filter (FSFilter) callback operation, and the caller is running in the context of a 32-bit user-mode process, FltIs32bitProcess returns TRUE.

  • If none of the above conditions is true, FltIs32bitProcess returns FALSE.

To determine whether a callback data structure represents an IRP-based I/O operation, use the FLT_IS_IRP_OPERATION macro.

To determine whether a callback data structure represents a fast I/O operation, use the FLT_IS_FASTIO_OPERATION macro.

To determine whether a callback data structure represents a file system filter (FSFilter) callback operation, use the FLT_IS_FS_FILTER_OPERATION macro.

Requirements

Version

The FltIs32bitProcess routine is available on Microsoft Windows XP SP2, Microsoft Windows Server 2003 SP1, and later.

Header

Fltkernel.h (include Fltkernel.h)

Library

FltMgr.lib

IRQL

<= APC_LEVEL

See also

FLT_IS_FASTIO_OPERATION
FLT_IS_FS_FILTER_OPERATION
FLT_IS_IRP_OPERATION
IoIs32bitProcess

 

 

Send comments about this topic to Microsoft

Show:
© 2014 Microsoft