FltGetEcpListFromCallbackData function (fltkernel.h)

Article
10/21/2021

The FltGetEcpListFromCallbackData routine returns a pointer to an extra create parameter context structure (ECP) list that is associated with a given create operation callback-data object.

Syntax

NTSTATUS FLTAPI FltGetEcpListFromCallbackData(
  [in]  PFLT_FILTER        Filter,
        PFLT_CALLBACK_DATA CallbackData,
  [out] PECP_LIST          *EcpList
);

Parameters

[in] Filter

An opaque filter pointer to the minifilter driver. This pointer uniquely identifies the minifilter driver and remains constant as long as the minifilter driver is loaded.

CallbackData

A pointer to a callback-data object of type FLT_CALLBACK_DATA, which represents the create operation.

[out] EcpList

Receives a pointer to the ECP list that is associated with the CallbackData callback-data object.

Return value

FltGetEcpListFromCallbackData returns one of the following NTSTATUS values:

Return code	Description
STATUS_SUCCESS	EcpList received a pointer to the ECP list that is associated with the given callback-data object. If the callback-data object has no associated ECP, STATUS_SUCCESS is returned and EcpList is NULL.
STATUS_INVALID_PARAMETER	The given callback-data object was not an IRP-based create operation. In this case, EcpList is undefined.

Remarks

To attach an ECP list to a callback-data object, use the FltSetEcpListIntoCallbackData routine.

Requirements

Requirement	Value
Minimum supported client	This routine is available starting with Windows Vista.
Target Platform	Universal
Header	fltkernel.h (include Fltkernel.h)
Library	FltMgr.lib
DLL	Fltmgr.sys
IRQL	<= APC_LEVEL