>> As DDK Documentation says that the Highest level driver’s Dispatch
Routines are always
> called in the context of the calling Process’s Thread…So if i call
> PsGetCurrentProcessId in my filter driver’s dispatch routine while
filtering
> IRP_MJ_CREATE for TCP then it should give me the calling process ID
[atleast
> theoratically…] Am i Correct ??? Pls some one confirm .
If you are the top most
> but could not find any information regarding the creator process name or
process ID…
IO manager is designed to isolate the originator … when you get the IRP.
Govind