Getting a process ID from a hook or elsewhere?

Question

Hi: We are working on a project where we need to get the process ID's from I/o activities that take place within the I/o manager to the file system.

Can we use the IFSMGR_InstallFileSystemApiHook API for this, if we can then where is the documentation on that object, and if we can not, does anybody know how we can get the process ID when we see a file being written to the file system? Do we have to monitor the applications? Can we monitor the I/O manager, it seems clear that in monitoring the file system we can not get to this data?

Anybody know?

Answer 1

PsGetCurrentProcess and/or IoGetCurrentProcess