FltIs32bitProcess routine

The FltIs32bitProcess routine checks whether the originator of the current I/O operation is a 32-bit user-mode application.

Syntax


BOOLEAN FltIs32bitProcess(
  _In_opt_ PFLT_CALLBACK_DATA CallbackData
);

Parameters

CallbackData [in, optional]

Pointer to the callback data structure for the current I/O operation (FLT_CALLBACK_DATA). This parameter is optional and can be NULL.

Return value

FltIs32bitProcess returns TRUE if the originator of the current I/O operation is a 32-bit user-mode process, FALSE otherwise.

Remarks

Minifilter drivers call FltIs32bitProcess to determine whether an I/O request is likely to contain data elements that need to be converted, or "thunked," before they can be used in a 64-bit driver. For more information about thunking and other 64-bit driver issues, see Programming Issues for 64-Bit Drivers.

On a 32-bit system, FltIs32bitProcess always returns TRUE.

On a 64-bit system, FltIs32bitProcess returns TRUE or FALSE, according to the following conditions:

  • If the CallbackData parameter is NULL, and the caller is running in the context of a 32-bit user-mode process, FltIs32bitProcess returns TRUE.

  • If the CallbackData parameter is not NULL, and the callback data structure represents an IRP-based I/O operation where IRP was issued by the I/O manager on behalf of a user-mode process, FltIs32bitProcess returns TRUE.

  • If the CallbackData parameter is not NULL, the callback data structure represents a fast I/O operation or a file system filter (FSFilter) callback operation, and the caller is running in the context of a 32-bit user-mode process, FltIs32bitProcess returns TRUE.

  • If none of the above conditions is true, FltIs32bitProcess returns FALSE.

To determine whether a callback data structure represents an IRP-based I/O operation, use the FLT_IS_IRP_OPERATION macro.

To determine whether a callback data structure represents a fast I/O operation, use the FLT_IS_FASTIO_OPERATION macro.

To determine whether a callback data structure represents a file system filter (FSFilter) callback operation, use the FLT_IS_FS_FILTER_OPERATION macro.

Requirements

Target platform

Universal

Version

The FltIs32bitProcess routine is available on Microsoft Windows XP SP2, Microsoft Windows Server 2003 SP1, and later.

Header

Fltkernel.h (include Fltkernel.h)

Library

FltMgr.lib

DLL

Fltmgr.sys

IRQL

<= APC_LEVEL

See also

FLT_IS_FASTIO_OPERATION
FLT_IS_FS_FILTER_OPERATION
FLT_IS_IRP_OPERATION
IoIs32bitProcess

 

 

Send comments about this topic to Microsoft

Show: