Hi,
There is no definition of “FSCTL_NETWORK_DELETE_CONNECTION” in IFS kit.But I see it in Filemon’s log. I get the definition from gnu_ntifs.h on line.Now I have to get the “TYPE” for the buffer:
if (pIrpStack->MajorFunction == IRP_MJ_FILE_SYSTEM_CONTROL &&
pIrpStack->MinorFunction == IRP_MN_USER_FS_REQUEST &&
pIrpStack->Parameters.FileSystemControl.FsControlCode == FSCTL_NETWORK_DELETE_CONNECTION)
{
TYPE *Ptr = (TYPE *)Irp->AssociatedIrp.SystemBuffer;
}