What I want to do is to add some audit function to the srv.sys. Much similar
to the smb monitor in application mode. I want to do some filter on
lanmanserver in kernel mode. But I can only get the threadid or user token
from irp filter. So I wonder if I can query the IP address from the
sessionid or threadid or token.