FwpsOpenToken0 on WFP

NTDEV
1

Hi all !
I’m again with that community.
New job theme is the W(indows) F(iltering) P(latform).
In the fwpsk.h file declared export

__drv_maxIRQL(PASSIVE_LEVEL) NTSTATUS NTAPI FwpsOpenToken0(IN HANDLE engineHandle,
IN LUID modifiedId, IN DWORD desiredAccess, OUT HANDLE* accessToken);

MS doesn’t describe this function in MSDN.
What this function does ?
What does the token is being opened ?

What is the parameter LUID modifiedId ? Where i can get it ?

Beforehand grateful
Oleg N

2

Oleshii wrote:

I’m again with that community.
New job theme is the W(indows) F(iltering) P(latform).
In the fwpsk.h file declared export

__drv_maxIRQL(PASSIVE_LEVEL) NTSTATUS NTAPI FwpsOpenToken0(IN HANDLE engineHandle,
IN LUID modifiedId, IN DWORD desiredAccess, OUT HANDLE* accessToken);

MS doesn’t describe this function in MSDN.

Then it is undocumented.

What this function does ?

There is no way to know. It is undocumented.

What does the token is being opened ?

There’s no way to know. It is undocumented.

What is the parameter LUID modifiedId ? Where i can get it ?

Why on earth do you care? If you don’t know what the function is for,
what POSSIBLY leads you to think you should use it?

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

3

It’s OK to ask about functions, structures, etc., that we haven’t documented. If something isn’t documented, that could mean we don’t want anyone to use it. (When that’s the case, we try to say so explicitly in the docs, but our track record is admittedly less than perfect there.) Or it could mean that something fell through the cracks. (It happens, especially in cases where there’s a lot of churn in the DDI after the initial documentation is written.)

In this case, it turns out that we simply forgot to document the function in question. So I’m glad Oleshii asked about it.

I’ll work with the WFP team to create a reference page for FwpsOpenToken0 and report back to NTDEV on it.

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Tim Roberts
Sent: Wednesday, February 20, 2013 9:27 AM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] FwpsOpenToken0 on WFP

Oleshii wrote:

I’m again with that community.
New job theme is the W(indows) F(iltering) P(latform).
In the fwpsk.h file declared export

__drv_maxIRQL(PASSIVE_LEVEL) NTSTATUS NTAPI FwpsOpenToken0(IN HANDLE engineHandle,
IN LUID modifiedId, IN DWORD desiredAccess, OUT HANDLE*
accessToken);

MS doesn’t describe this function in MSDN.

Then it is undocumented.

What this function does ?

There is no way to know. It is undocumented.

What does the token is being opened ?

There’s no way to know. It is undocumented.

What is the parameter LUID modifiedId ? Where i can get it ?

Why on earth do you care? If you don’t know what the function is for, what POSSIBLY leads you to think you should use it?

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

NTDEV is sponsored by OSR

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer