PsGetCurrentSilo
_EJOB *__stdcall PsGetCurrentSilo(){
_ETHREAD *CurrentThread;
_EJOB *result;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
result = CurrentThread->Silo;
if( result == (_EJOB *)-3i64 )
{
for( result = CurrentThread->Tcb.Process->Job; result; result = (_EJOB *)*((_QWORD *)result + 134) )
{
if( (*((_DWORD *)result + 330) & 0x40000000) != 0 )
break;
}
}
return result;
}Referenced by:
CmLockKeyForWrite
CmpParseKey
IoQueryInformationByName
IoRevokeHandlesForProcess
IopCreateFile
IopFastQueryNetworkAttributes
NtDeleteFile
NtOpenSymbolicLinkObject
NtQueryAttributesFile
NtQueryFullAttributesFile
ObGetSiloRootDirectoryPath
ObOpenObjectByName
ObQueryNameStringMode
ObReferenceObjectByName
ObReferenceObjectByNameEx
ObpCreateSymbolicLinkName
ObpInsertOrLocateNamedObject
PsRegisterSiloMonitor
PsRootSiloInformation
VRegEnabledInJob