PspStorageEmptyArrayNonReadonly
NTSTATUS __stdcall PspStorageEmptyArrayNonReadonly(PSP_STORAGE_SLOT *Array, UINT64 ArraySize){
NTSTATUS v2;
int v3;
unsigned __int64 v4;
__int64 v5;
VOID *v6;
char v7;
_ETHREAD *v8;
unsigned int v9;
unsigned __int8 v10;
int v11;
bool v12;
__int64 v13;
_KLOCK_ENTRY *v14;
int v15;
unsigned int v16;
__int64 v17;
char v18;
_ETHREAD *CurrentThread;
unsigned int v20;
unsigned __int8 v21;
int v22;
__int64 v23;
_KLOCK_ENTRY *v24;
int v25;
unsigned int v26;
__int64 v27;
__int64 a3[2];
PSP_STORAGE_SLOT *v30;
unsigned int v31;
UINT64 v32;
v31 = ArraySize;
v30 = Array;
v2 = 0;
v3 = 0;
if( (_DWORD)ArraySize )
{
while( 1 )
{
v4 = (unsigned __int64)&Array[4 * v3];
ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)v4, 0i64);
v5 = *(_QWORD *)(v4 + 8);
if( (v5 & 1) != 0 )
{
v18 = _InterlockedExchangeAdd64((volatile signed __int64 *)v4, 0xFFFFFFFFFFFFFFFFui64);
if( (v18 & 2) != 0 && (v18 & 4) == 0 )
ExfTryToWakePushLock((_EX_PUSH_LOCK *)v4);
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
LODWORD(v32) = 0;
v20 = MiGetSystemRegionType(v4) == 1 ? MmGetSessionIdEx(CurrentThread->Tcb.ApcState.Process) : -1;
--CurrentThread->Tcb.SpecialApcDisable;
v21 = ++CurrentThread->Tcb.AbAllocationRegionCount;
v22 = ((char)CurrentThread->Tcb.AbEntrySummary | (char)CurrentThread->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
while( 1 )
{
v12 = !_BitScanReverse((unsigned int *)&v23, v22);
if( v12 )
break;
v24 = &CurrentThread->Tcb.LockEntries[v23];
v22 &= ~(1 << v23);
if( (v24->AcquiredByte & 1) != 0
&& (v24->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v24->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == (v4 & 0x7FFFFFFFFFFFFFFCi64)
&& v24->LockState.SessionId == v20 )
{
v24->AcquiredByte &= ~1u;
if( v24->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
{
if( v24 )
{
v24->CrossThreadReleasableAndBusyByte |= 2u;
if( v24->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v24);
v25 = v24->BoostBitmap.AllFields & 0x1FFFF;
v26 = v24->BoostBitmap.AllFields & 0xFFFE0000;
v24->ThreadLocalFlags &= ~1u;
LODWORD(v32) = v25;
v24->BoostBitmap.AllFields = v26;
v24->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v27 = v24 - CurrentThread->Tcb.LockEntries;
if( v21 == 1 )
CurrentThread->Tcb.AbEntrySummary |= 1 << v27;
else
_InterlockedOr8((volatile signed __int8 *)&CurrentThread->Tcb.AbOrphanedEntrySummary, 1 << v27);
goto LABEL_43;
}
break;
}
}
}
if( (*(&CurrentThread->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, CurrentThread, (PVOID)v4, (PVOID)v20, 0i64);
LABEL_43:
--CurrentThread->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&CurrentThread->Tcb, (VOID *)v4, &v32);
v12 = CurrentThread->Tcb.SpecialApcDisable++ == -1;
if( v12
&& ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)CurrentThread->Tcb.ApcState.ApcListHead[0].Flink != &CurrentThread->Tcb.152 )
{
KiCheckForKernelApcDelivery();
}
}
else
{
*(_QWORD *)(v4 + 8) = 1i64;
v6 = (VOID *)(v5 & 0xFFFFFFFFFFFFFFFEui64);
v7 = _InterlockedExchangeAdd64((volatile signed __int64 *)v4, 0xFFFFFFFFFFFFFFFFui64);
if( (v7 & 2) != 0 && (v7 & 4) == 0 )
ExfTryToWakePushLock((_EX_PUSH_LOCK *)v4);
v8 = (_ETHREAD *)KeGetCurrentThread();
LODWORD(a3[0]) = 0;
v9 = MiGetSystemRegionType(v4) == 1 ? MmGetSessionIdEx(v8->Tcb.ApcState.Process) : -1;
--v8->Tcb.SpecialApcDisable;
v10 = ++v8->Tcb.AbAllocationRegionCount;
v11 = ((char)v8->Tcb.AbEntrySummary | (char)v8->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
while( 1 )
{
v12 = !_BitScanReverse((unsigned int *)&v13, v11);
if( v12 )
break;
v14 = &v8->Tcb.LockEntries[v13];
v11 &= ~(1 << v13);
if( (v14->AcquiredByte & 1) != 0
&& (v14->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v14->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == (v4 & 0x7FFFFFFFFFFFFFFCi64)
&& v14->LockState.SessionId == v9 )
{
v14->AcquiredByte &= ~1u;
if( v14->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
{
if( v14 )
{
v14->CrossThreadReleasableAndBusyByte |= 2u;
if( v14->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v14);
v15 = v14->BoostBitmap.AllFields & 0x1FFFF;
v16 = v14->BoostBitmap.AllFields & 0xFFFE0000;
v14->ThreadLocalFlags &= ~1u;
LODWORD(a3[0]) = v15;
v14->BoostBitmap.AllFields = v16;
v14->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v17 = v14 - v8->Tcb.LockEntries;
if( v10 == 1 )
v8->Tcb.AbEntrySummary |= 1 << v17;
else
_InterlockedOr8((volatile signed __int8 *)&v8->Tcb.AbOrphanedEntrySummary, 1 << v17);
goto LABEL_18;
}
break;
}
}
}
if( (*(&v8->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, v8, (PVOID)v4, (PVOID)v9, 0i64);
LABEL_18:
--v8->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v8->Tcb, (VOID *)v4, (UINT64 *)a3);
v12 = v8->Tcb.SpecialApcDisable++ == -1;
if( v12 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v8->Tcb.ApcState.ApcListHead[0].Flink != &v8->Tcb.152 )
KiCheckForKernelApcDelivery();
if( v6 )
{
ObfDereferenceObjectWithTag(v6, 0x746C6644ui64);
++v2;
}
}
if( ++v3 >= v31 )
break;
Array = v30;
}
}
return v2;
}Referenced by:
PspCompleteHardDereferenceSiloDeferred