Geoff Chappell, Software Analyst
Given an IRP that has a generic IRP extension, this function produces a copy of the contents.
NTSTATUS IoGetGenericIrpExtension ( IRP *Irp, UCHAR *GenericExtensionData, USHORT GenericExtensionDataSize);
The Irp argument is the address of an IRP that has a generic extension.
The GenericExtensionData and GenericExtensionDataSize arguments are respectively the address and size, in bytes, of a buffer into which the function is to copy the generic extension.
The function returns STATUS_SUCCESS if successful, else a negative error code which can presently be only STATUS_INVALID_PARAMETER or STATUS_NOT_FOUND.
The IoGetGenericIrpExtension function is exported by name from the kernel in version 6.3 and higher.
The IoGetGenericIrpExtension function is not documented. It is, however, declared in the NTOSIFS.H and NTOSP.H files in the Windows Driver Kit (WDK) for Windows 10.
A generic IRP extension can hold 4 bytes. If asked for more, the function fails, returning STATUS_INVALID_PARAMETER. If the IRP does not have a generic IRP extension, whether overlaying the IrpExtension or in an IOP_IRP_EXTENSION that is pointed to by the IrpExtension, the function fails, returning STATUS_NOT_FOUND. Otherwise it copies the wanted number of bytes from the extension to the given buffer and is done.