How to get Parent process ID of the caller process

NTDEV
1

Hi,
I am writing a file system filter driver, in which I get the process ID, process name and all file information at IRP_MJ_CREATE.
I am also supposed to find if any parent process exists for the respective Process ID and get the parent process name. Is there DDK APIs availble to get the parent process of a process?
Thanks in advance…
Basudeb

2

You can use ZwQueryInformationProcess with ProcessBasicInformation. The
PROCESS_BASIC_INFORMATION structure contains InheritedFromUniqueProcessId
which is what you need. Another way is to use the process callback routine
( PsSetCreateProcessNotifyRoutine ) and manage your own list.

cheers,

Marco

“basudeb gupta” wrote in message news:xxxxx@ntdev…
Hi,
I am writing a file system filter driver, in which I get the process ID,
process name and all file information at IRP_MJ_CREATE.
I am also supposed to find if any parent process exists for the respective
Process ID and get the parent process name. Is there DDK APIs availble to
get the parent process of a process?
Thanks in advance…
Basudeb