IopQueryProcessIdsUsingFile

NTSTATUS __stdcall IopQueryProcessIdsUsingFile(
        _FILE_OBJECT *FileObject,
        _FILE_PROCESS_IDS_USING_FILE_INFORMATION *Puffer,
        UINT64 PufferLength,
        UINT64 *OutputSize){
  _FILE_PROCESS_IDS_USING_FILE_INFORMATION *v6; 
  unsigned int v7; 
  unsigned int v8; 
  _EPROCESS *i; 
  _LIST_ENTRY *NextProcess; 
  _EPROCESS *v11; 
  _HANDLE_TABLE *v12; 
  char v13; 
  _FILE_OBJECT *v15; 
  __int64 v16; 

  v6 = Puffer + 1;
  v7 = (unsigned int)(PufferLength - 8) >> 3;
  v8 = 0;
  v16 = 0i64;
  Puffer->NumberOfProcessIdsInList = 0;
  v15 = FileObject;
  for( i = 0i64; ; i = v11 )
  {
    NextProcess = PsGetNextProcess(i);
    v11 = (_EPROCESS *)NextProcess;
    if( !NextProcess )
      break;
    v12 = ObReferenceProcessHandleTable((_EPROCESS *)NextProcess);
    if( v12 )
    {
      LOBYTE(v16) = v11 == KeGetCurrentThread()->ApcState.Process;
      v13 = ExEnumHandleTable(
              v12,
              (__int64(__fastcall *)(_HANDLE_TABLE *, _HANDLE_TABLE_ENTRY *, _EXHANDLE, __int64))IopIsFileOpenOrSection,
              (__int64)&v15,
              0i64);
      ExReleaseRundownProtection(&v11->RundownProtect);
    }
    else
    {
      v13 = 0;
    }
    if( v13 || MmIsFileMapped(v11, FileObject) )
    {
      if( v8 < v7 )
      {
        *v6 = (_FILE_PROCESS_IDS_USING_FILE_INFORMATION)v11->UniqueProcessId;
        ++Puffer->NumberOfProcessIdsInList;
        ++v6;
      }
      ++v8;
    }
  }
  *(_DWORD *)OutputSize = 8 * v8 + 8;
  return v7 < v8 ? 0xC0000004 : 0;
}

Referenced by: