UINT8 __stdcall FsRtlIsEcpFromUserMode(PVOID EcpContext){ return(*((_DWORD *)EcpContext - 6) & 0x10) != 0; }