IoGetRequestorProcessId

返回IPR关联的进程id

The IoGetRequestorProcessId routine returns the unique 32-bit process ID for the thread that originally requested a given I/O operation.

IoGetRequestorProcessId 例程返回最初请求给定 I/O作的线程的唯一 32 位进程 ID。

ULONG
  IoGetRequestorProcessId(
    IN PIRP  Irp
    )
{
    PEPROCESS Process;

    /* Return the requestor process' id */
    Process = IoGetRequestorProcess(Irp);
    if (Process) return PtrToUlong(Process->UniqueProcessId);

    return 0;
}

PEPROCESS NTAPI IoGetRequestorProcess    (    IN PIRP     Irp    )    
{
    /* Return the requestor process */
    if (Irp->Tail.Overlay.Thread)
    {
        if (Irp->ApcEnvironment == OriginalApcEnvironment)
        {
            return Irp->Tail.Overlay.Thread->ThreadsProcess;
        }
        else if (Irp->ApcEnvironment == AttachedApcEnvironment)
        {
            return (PEPROCESS)Irp->Tail.Overlay.Thread->Tcb.ApcState.Process;
        }
    }

    return NULL;
}