IRP_MN_KERNEL_CALL...?

NTFSD
1

IRP_MN_KERNEL_CALL - anybody know what this is used
for? Can I assume that I may see the same FSCTL_*
values in my filter if IRP_MN_KERNEL_CALL is specified
instead of IRP_MN_USER_FS_REQUEST?

=====

  • Nicholas Ryan

Do You Yahoo!?
Yahoo! Health - Feel better, live better
http://health.yahoo.com

2

OK it’s in the IFSKIT docs, which state that this is
indeed the case. (I’ve so overwhelmed by the fact that
we actually now have IFSKIT docs that I sometimes
forget to check them. I always check the OSR list
archives, though :).)

— Nicholas Ryan wrote:
> IRP_MN_KERNEL_CALL - anybody know what this is used
> for? Can I assume that I may see the same FSCTL_*
> values in my filter if IRP_MN_KERNEL_CALL is
> specified
> instead of IRP_MN_USER_FS_REQUEST?
>
>
> =====
> - Nicholas Ryan
>
>
> Do You Yahoo!?
> Yahoo! Health - Feel better, live better
> http://health.yahoo.com
>

=====
- Nicholas Ryan
Do You Yahoo!?
Yahoo! Health - Feel better, live better
http://health.yahoo.com

3

IRP_MN_KERNEL_CALL is used to distinguish an FSCTL that comes from kernel
mode components as opposed to user mode components. The FS has to do
security checks for user mode components.

–
Nar Ganapathy
Windows Core OS group
This posting is provided “AS IS” with no warranties, and confers no rights.

“Nicholas Ryan” wrote in message news:xxxxx@ntfsd…
>
> OK it’s in the IFSKIT docs, which state that this is
> indeed the case. (I’ve so overwhelmed by the fact that
> we actually now have IFSKIT docs that I sometimes
> forget to check them. I always check the OSR list
> archives, though :).)
>
> — Nicholas Ryan wrote:
> > IRP_MN_KERNEL_CALL - anybody know what this is used
> > for? Can I assume that I may see the same FSCTL_*
> > values in my filter if IRP_MN_KERNEL_CALL is
> > specified
> > instead of IRP_MN_USER_FS_REQUEST?
> >
> >
> > =====
> > - Nicholas Ryan
> >
> >
> > Do You Yahoo!?
> > Yahoo! Health - Feel better, live better
> > http://health.yahoo.com
> >
>
>
> =====
> - Nicholas Ryan
>
>
> Do You Yahoo!?
> Yahoo! Health - Feel better, live better
> http://health.yahoo.com
>
>
>

4

> IRP_MN_KERNEL_CALL is used to distinguish an FSCTL that comes from
kernel

mode components as opposed to user mode components.

Won’t Irp->RequestorMode do the same?

Max