RE: RE: RE: [ntfsd ] FileObje= ame , who? s the owner ?

Boa tarde,
Voc? tem ideia onde acho documenta??o de uso desteFltGetRequestorProcess ?
O google nao tem nada claro e completo sobre isto


.:: Dorival Afonso Cardozo
+55 (11) 98391-5500 (Tim S?o Paulo)
+55 (19) 8721-8981 (Oi Limeira)
+55 (19) 3792-0170 (fixo)
S?o Paulo - BRAZIL
“Simplicity is the Ultimate Sophistication…”

Date: Mon, 3 Dec 2012 08:57:13 -0500
Subject: [ntfsd] RE: RE: [ntfsd] FileObje= ame , who? =?iso-8859-1?Q?s_the_owne?= =?iso-8859-1?Q?r_=3F?=

Hi Dorival,

If you’re looking for the requestor application for a given IRP, can you can use FltGetRequestorProcess routine.

If you’re looking for the user account that is trying to open the file, you can raise that info using the SecurityContext member of FLT_PARAMETERS for IRP_MJ_CREATE.


Fernando Roberto da Silva
DriverEntry Kernel Development

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:

To unsubscribe, visit the List Server section of OSR Online at