ExEnumHandleTable
__int64 __fastcall ExEnumHandleTable(
unsigned int *a1,
__int64 (__fastcall *a2)(unsigned int *, __int64 *, __int64, __int64),
__int64 a3,
__int64 *a4){
_ETHREAD *CurrentThread;
unsigned __int8 v5;
_HANDLE_TABLE_ENTRY *NextHandleTableEntry;
INT64 LowValue;
__int64 Value;
unsigned __int64 v13;
_EXHANDLE pHandle[7];
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v5 = 0;
pHandle[0].Value = 0i64;
--*((_WORD *)CurrentThread + 242);
NextHandleTableEntry = ExpGetNextHandleTableEntry((_HANDLE_TABLE *)a1, 0i64, pHandle);
if( !NextHandleTableEntry )
goto LABEL_13;
do
{
while( 1 )
{
_m_prefetchw(NextHandleTableEntry);
LowValue = NextHandleTableEntry->LowValue;
if( (NextHandleTableEntry->LowValue & 1) != 0 )
break;
if( LowValue )
{
ExpBlockOnLockedHandleEntry((_HANDLE_TABLE *)a1, NextHandleTableEntry, LowValue);
}
else
{
Value = pHandle[0].Value;
LABEL_5:
v13 = Value + 4;
if( (Value ^ (unsigned __int64)(Value + 4)) >= 0x400 )
NextHandleTableEntry = ExpLookupHandleTableEntry((_HANDLE_TABLE *)a1, (_EXHANDLE)(Value + 8));
else
++NextHandleTableEntry;
pHandle[0].Value = v13;
if( !NextHandleTableEntry )
goto LABEL_13;
}
}
}
while( LowValue != _InterlockedCompareExchange64(&NextHandleTableEntry->VolatileLowValue, LowValue - 1, LowValue) );
Value = pHandle[0].Value;
v5 = a2(a1, &NextHandleTableEntry->LowValue, pHandle[0].Value, a3);
if( !v5 )
goto LABEL_5;
if( a4 )
*a4 = Value;
LABEL_13:
KeLeaveCriticalRegionThread((__int64)CurrentThread);
return v5;
}Referenced by:
EtwpObjectHandleRundown
IoRevokeHandlesForProcess
IopQueryProcessIdsUsingFile
NtQueryInformationProcess
ObFindHandleForObject
ObInitProcess
ObShutdownSystem
PnpHandleEnumerateHandlesAgainstDeviceObject