irp = IopAllocateIrp( deviceObject->StackSize, !synchronousIo );
    if (!irp) {

        //
        // An IRP could not be allocated.  Cleanup and return an appropriate
        // error status code.
        //

        IopAllocateIrpCleanup( fileObject, eventObject );

        return STATUS_INSUFFICIENT_RESOURCES;
    }
    irp->Tail.Overlay.OriginalFileObject = fileObject;
    [COLOR="Red"]irp->Tail.Overlay.Thread = CurrentThread;[/COLOR]
    irp->Tail.Overlay.AuxiliaryBuffer = (PVOID) NULL;
    irp->RequestorMode = requestorMode;
    irp->PendingReturned = FALSE;
    irp->Cancel = FALSE;
    irp->CancelRoutine = (PDRIVER_CANCEL) NULL;

    //
    // Fill in the service independent parameters in the IRP.
    //

    irp->UserEvent = eventObject;
    irp->UserIosb = IoStatusBlock;
    irp->Overlay.AsynchronousParameters.UserApcRoutine = ApcRoutine;
    irp->Overlay.AsynchronousParameters.UserApcContext = ApcContext;

    //
    // Get a pointer to the stack location for the first driver.  This will be
    // used to pass the original function codes and parameters.  Note that
    // setting the major function here also sets:
    //
    //      MinorFunction = 0;
    //      Flags = 0;
    //      Control = 0;
    //

    irpSp = IoGetNextIrpStackLocation( irp );
    majorFunction = (PULONG) (&irpSp->MajorFunction);
    *majorFunction = IRP_MJ_READ;
    irpSp->FileObject = fileObject;

PEPROCESS
IoGetRequestorProcess(
    IN PIRP Irp
    )

/*++

Routine Description:

    This routine returns a pointer to the process that originally
    requested the specified I/O operation.

Arguments:

    Irp - Pointer to the I/O Request Packet.

Return Value:

    The function value is a pointer to the original requesting process.


--*/

{
    //
    // Return the address of the process that requested the I/O operation.
    //

    PETHREAD thread = Irp->Tail.Overlay.Thread;
    if (thread) {

        //
        // The thread was not attached when the IRP was issued. So get
        // the original process. Note that this API could be called from
        // another process or thread.
        //

        if (Irp->ApcEnvironment == OriginalApcEnvironment) {
            return (THREAD_TO_PROCESS(thread));

        //
        // The thread was attached when the IRP was issued. In this case
        // give the process to which the thread is currently attached. Note that
        // this only works if the thread that issued the IO request while it was
        // attached does not attach again. This is not allowed.
        //

        } else if (Irp->ApcEnvironment == AttachedApcEnvironment) {
            return (CONTAINING_RECORD(((thread)->Tcb.ApcState.Process),EPROCESS,Pcb));

        } else {
            return NULL;
        }
    } else {
        return NULL;
    }
}