PsGetCurrentSilo
_EJOB *__stdcall PsGetCurrentSilo(){
_ETHREAD *CurrentThread;
_EJOB *result;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
result = (_EJOB *)*((_QWORD *)CurrentThread + 193);
if( result == (_EJOB *)-3i64 )
{
for( result = *(_EJOB **)(*((_QWORD *)CurrentThread + 68) + 1296i64); result; result = result->ParentJob )
{
if( (result->JobFlags & 0x40000000) != 0 )
break;
}
}
return result;
}Referenced by:
CmLockKeyForWrite
CmpParseKey
IoQueryInformationByName
IoRevokeHandlesForProcess
IopCreateFile
IopFastQueryNetworkAttributes
NtDeleteFile
NtOpenSymbolicLinkObject
NtQueryAttributesFile
NtQueryFullAttributesFile
ObGetSiloRootDirectoryPath
ObOpenObjectByName
ObQueryNameStringMode
ObReferenceObjectByName
ObReferenceObjectByNameEx
ObpCreateSymbolicLinkName
ObpInsertOrLocateNamedObject
PsRegisterSiloMonitor
PsRootSiloInformation
VRegEnabledInJob