RE: RE: RE: [ntfsd ] FileObje= ame , who? s the owner ?

NTFSD
1

This may be the way …

You?re the CARA Fernando ! or the COROA …

thanx

Date: Mon, 3 Dec 2012 08:57:13 -0500
From: xxxxx@driverentry.com.br
To: xxxxx@lists.osr.com
Subject: [ntfsd] RE: RE: [ntfsd] FileObje= ame , who? =?iso-8859-1?Q?s_the_owne?= =?iso-8859-1?Q?r_=3F?=

Hi Dorival,

If you’re looking for the requestor application for a given IRP, can you can use FltGetRequestorProcess routine.

If you’re looking for the user account that is trying to open the file, you can raise that info using the SecurityContext member of FLT_PARAMETERS for IRP_MJ_CREATE.

Regards,

Fernando Roberto da Silva
DriverEntry Kernel Development
http:\www.driverentry.com.br

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer