I want to convey process creation and termination information to user mode app.For this i am using inverted call model. The user mode sends sufficient ioctl’s which the driver inserts in a cancel safe queue maintained with the device extension of device object.The irp is then pended. Driver registers Process Notify routine using PsSetCreateProcessNotifyRoutineEx().
Now my problem is in processnotify routine, i need to access the cancel safe queue stored in device extension.How can i access the device object to access the device extension?
void ProcessNotifyRoutin(PEPROCESS PRocess,
HANDLE ProcessId,
PPS_CREATE_NOTIFY_INFO CreateInfo
)
{
//how can i access the device object to get the device extension here.
}