MmGetSessionObjectById
NTSTATUS __stdcall MmGetSessionObjectById(UINT64 SessionId){
unsigned int(__fastcall *GetDmaAlignment)(_DMA_ADAPTER *);
struct _DMA_ADAPTER *v2;
struct _DMA_ADAPTER *v3;
_DMA_OPERATIONS *DmaOperations;
struct _KLOCK_QUEUE_HANDLE LockHandle;
memset(&LockHandle, 0, sizeof(LockHandle));
LODWORD(GetDmaAlignment) = 0;
LODWORD(v2) = MmGetSessionById(SessionId);
v3 = v2;
if( v2 )
{
DmaOperations = v2[85].DmaOperations;
GetDmaAlignment = DmaOperations->GetDmaAlignment;
KeAcquireInStackQueuedSpinLock(&WorkerRoutine, &LockHandle);
if( (*(&DmaOperations->Size + 1) & 2) != 0 )
LODWORD(GetDmaAlignment) = 0;
else
ObfReferenceObjectWithTag(GetDmaAlignment, 0x746C6644u);
KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
__writecr8(LockHandle.OldIrql);
HalPutDmaAdapter(v3);
}
return(int)GetDmaAlignment;
}Referenced by:
IoRegisterContainerNotification
NtSetInformationObject
SeExchangePrimaryToken
SeSetSessionIdToken
SepDuplicateToken
SepSetTokenSessionById