In my FSFD I make a call to PsSetLoadImageNotification () and get a callback as expected.
One of the params in the callback is the ProcessId.
I’m saving the processId to note when a particular (say, my) user mode component is loaded so that when I see Ioctl’s I can assure myself that I know who I’m talking to.
In XP this worked fine, the same code in Vista does not: Once the user mode program is running , I dump out the process using !process 0 0 in windbg which indicates that the ProcessId that I got in my callback is that of the Parent CID not the guy I’m loading
Of course, when I do PsGetCurrentProcessId() in my DeviceControl routine, I get the process’s Id, and I never recognize my particular user mode component.
Any ideas, beyond of course going back to an XP box and making sure that the behavior I think I saw is really happening there?