CcChangeBackingFileObject
NTSTATUS __stdcall CcChangeBackingFileObject(FILE_OBJECT *CurrentFileObject, FILE_OBJECT *NewFileObject){
UINT64 v4;
_ETHREAD *CurrentThread;
unsigned int SessionId;
char v7;
int v8;
unsigned __int64 v9;
bool v10;
__int64 v11;
int v12;
unsigned int v13;
__int64 v14;
char *SharedCacheMap;
_ETHREAD *v17;
unsigned int v18;
char v19;
int v20;
unsigned __int64 v21;
__int64 v22;
int v23;
unsigned int v24;
__int64 v25;
_ETHREAD *v26;
unsigned int v27;
char v28;
int v29;
unsigned __int64 v30;
__int64 v31;
int v32;
unsigned int v33;
__int64 v34;
_EX_FAST_REF *v35;
FILE_OBJECT *v36;
unsigned int v37;
char v38;
int v39;
unsigned __int64 v40;
__int64 v41;
int v42;
unsigned int v43;
__int64 v44;
_ETHREAD *v45;
unsigned int v46;
char v47;
int v48;
unsigned __int64 v49;
__int64 v50;
int v51;
unsigned int v52;
__int64 v53;
unsigned int v54[2];
unsigned int v55[2];
unsigned int v56[2];
int v57;
struct _KLOCK_QUEUE_HANDLE LockHandle;
int v59;
int v60;
memset(&LockHandle, 0, sizeof(LockHandle));
ExAcquirePushLockExclusiveEx((UINT64)&CcChangeSharedCacheMapFileLock, 0i64);
KeAcquireInStackQueuedSpinLock(&CcMasterLock, &LockHandle);
if( CurrentFileObject && CurrentFileObject->SectionObjectPointer != NewFileObject->SectionObjectPointer )
{
KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
__writecr8(LockHandle.OldIrql);
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&CcChangeSharedCacheMapFileLock, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)&CcChangeSharedCacheMapFileLock);
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v59 = 0;
if( (unsigned int)MiGetSystemRegionType((UINT64)&CcChangeSharedCacheMapFileLock) == 1 )
SessionId = MmGetSessionIdEx(*((_QWORD *)CurrentThread + 23));
else
SessionId = -1;
--*((_WORD *)CurrentThread + 243);
v7 = ++*((_BYTE *)CurrentThread + 794);
v8 = (*((char *)CurrentThread + 792) | *((char *)CurrentThread + 870)) ^ 0x3F;
while( 1 )
{
v10 = !_BitScanReverse((unsigned int *)&v11, v8);
if( v10 )
goto LABEL_15;
v9 = *((_QWORD *)CurrentThread + 100) + 96 * v11;
v8 &= ~(1 << v11);
if( (*(_BYTE *)(v9 + 26) & 1) != 0
&& (*(_DWORD *)(v9 + 32) & 1) == 0
&& (*(_QWORD *)(v9 + 32) & 0x7FFFFFFFFFFFFFFCi64) == ((unsigned __int64)&CcChangeSharedCacheMapFileLock & 0x7FFFFFFFFFFFFFFCi64)
&& *(_DWORD *)(v9 + 40) == SessionId )
{
*(_BYTE *)(v9 + 26) &= ~1u;
if( *(_QWORD *)(v9 + 32) )
break;
}
}
if( !v9 )
{
LABEL_15:
if( (*((_DWORD *)CurrentThread + 30) & 0x10000) == 0 )
KeBugCheckEx(0x162u, (ULONG_PTR)CurrentThread, (ULONG_PTR)&CcChangeSharedCacheMapFileLock, SessionId, 0i64);
goto LABEL_22;
}
*(_BYTE *)(v9 + 32) |= 2u;
if( *(__int64 *)(v9 + 32) < 0 )
KiAbEntryRemoveFromTree(v9);
v12 = *(_DWORD *)(v9 + 88) & 0x1FFFF;
v13 = *(_DWORD *)(v9 + 88) & 0xFFFE0000;
*(_BYTE *)(v9 + 25) &= ~1u;
v59 = v12;
*(_DWORD *)(v9 + 88) = v13;
*(_QWORD *)(v9 + 32) = 0i64;
v14 = (__int64)(v9 - *((_QWORD *)CurrentThread + 100)) / 96;
if( v7 == 1 )
*((_BYTE *)CurrentThread + 792) |= 1 << v14;
else
_InterlockedOr8((volatile signed __int8 *)CurrentThread + 870, 1 << v14);
LABEL_22:
--*((_BYTE *)CurrentThread + 794);
KiAbThreadRemoveBoosts((ULONG_PTR)CurrentThread, (__int64)&CcChangeSharedCacheMapFileLock, (unsigned int *)&v59);
v10 = (*((_WORD *)CurrentThread + 243))++ == 0xFFFF;
if( v10 && *((_ETHREAD **)CurrentThread + 19) != (_ETHREAD *)((char *)CurrentThread + 152) )
KiCheckForKernelApcDelivery();
return -1073741584;
}
SharedCacheMap = (char *)NewFileObject->SectionObjectPointer->SharedCacheMap;
if( !SharedCacheMap )
{
KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
__writecr8(LockHandle.OldIrql);
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&CcChangeSharedCacheMapFileLock, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)&CcChangeSharedCacheMapFileLock);
v17 = (_ETHREAD *)KeGetCurrentThread();
v54[0] = 0;
if( (unsigned int)MiGetSystemRegionType((UINT64)&CcChangeSharedCacheMapFileLock) == 1 )
v18 = MmGetSessionIdEx(*((_QWORD *)v17 + 23));
else
v18 = -1;
--*((_WORD *)v17 + 243);
v19 = ++*((_BYTE *)v17 + 794);
v20 = (*((char *)v17 + 792) | *((char *)v17 + 870)) ^ 0x3F;
while( 1 )
{
v10 = !_BitScanReverse((unsigned int *)&v22, v20);
v60 = v22;
if( v10 )
goto LABEL_40;
v21 = *((_QWORD *)v17 + 100) + 96 * v22;
v20 &= ~(1 << v22);
if( (*(_BYTE *)(v21 + 26) & 1) != 0
&& (*(_DWORD *)(v21 + 32) & 1) == 0
&& (*(_QWORD *)(v21 + 32) & 0x7FFFFFFFFFFFFFFCi64) == ((unsigned __int64)&CcChangeSharedCacheMapFileLock & 0x7FFFFFFFFFFFFFFCi64)
&& *(_DWORD *)(v21 + 40) == v18 )
{
*(_BYTE *)(v21 + 26) &= ~1u;
if( *(_QWORD *)(v21 + 32) )
break;
}
}
if( !v21 )
{
LABEL_40:
if( (*((_DWORD *)v17 + 30) & 0x10000) == 0 )
KeBugCheckEx(0x162u, (ULONG_PTR)v17, (ULONG_PTR)&CcChangeSharedCacheMapFileLock, v18, 0i64);
goto LABEL_47;
}
*(_BYTE *)(v21 + 32) |= 2u;
if( *(__int64 *)(v21 + 32) < 0 )
KiAbEntryRemoveFromTree(v21);
v23 = *(_DWORD *)(v21 + 88) & 0x1FFFF;
v24 = *(_DWORD *)(v21 + 88) & 0xFFFE0000;
*(_BYTE *)(v21 + 25) &= ~1u;
v54[0] = v23;
*(_DWORD *)(v21 + 88) = v24;
*(_QWORD *)(v21 + 32) = 0i64;
v25 = (__int64)(v21 - *((_QWORD *)v17 + 100)) / 96;
if( v19 == 1 )
*((_BYTE *)v17 + 792) |= 1 << v25;
else
_InterlockedOr8((volatile signed __int8 *)v17 + 870, 1 << v25);
LABEL_47:
--*((_BYTE *)v17 + 794);
KiAbThreadRemoveBoosts((ULONG_PTR)v17, (__int64)&CcChangeSharedCacheMapFileLock, v54);
v10 = (*((_WORD *)v17 + 243))++ == 0xFFFF;
if( !v10 )
return 0;
goto LABEL_97;
}
if( (*((_DWORD *)SharedCacheMap + 38) & 0x100000) == 0 )
{
v35 = (_EX_FAST_REF *)(SharedCacheMap + 96);
v36 = (FILE_OBJECT *)(v35->Value & 0xFFFFFFFFFFFFFFF0ui64);
if( !CurrentFileObject || v36 == CurrentFileObject )
{
ObFastReplaceObject(v35, NewFileObject, v4);
KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
__writecr8(LockHandle.OldIrql);
if( (_InterlockedExchangeAdd64(
(volatile signed __int64 *)&CcChangeSharedCacheMapFileLock,
0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)&CcChangeSharedCacheMapFileLock);
v45 = (_ETHREAD *)KeGetCurrentThread();
v57 = 0;
if( (unsigned int)MiGetSystemRegionType((UINT64)&CcChangeSharedCacheMapFileLock) == 1 )
v46 = MmGetSessionIdEx(*((_QWORD *)v45 + 23));
else
v46 = -1;
--*((_WORD *)v45 + 243);
v47 = ++*((_BYTE *)v45 + 794);
v48 = (*((char *)v45 + 792) | *((char *)v45 + 870)) ^ 0x3F;
while( 1 )
{
v10 = !_BitScanReverse((unsigned int *)&v50, v48);
v56[1] = v50;
if( v10 )
goto LABEL_112;
v49 = *((_QWORD *)v45 + 100) + 96 * v50;
v48 &= ~(1 << v50);
if( (*(_BYTE *)(v49 + 26) & 1) != 0
&& (*(_DWORD *)(v49 + 32) & 1) == 0
&& (*(_QWORD *)(v49 + 32) & 0x7FFFFFFFFFFFFFFCi64) == ((unsigned __int64)&CcChangeSharedCacheMapFileLock & 0x7FFFFFFFFFFFFFFCi64)
&& *(_DWORD *)(v49 + 40) == v46 )
{
*(_BYTE *)(v49 + 26) &= ~1u;
if( *(_QWORD *)(v49 + 32) )
break;
}
}
if( !v49 )
{
LABEL_112:
if( (*((_DWORD *)v45 + 30) & 0x10000) == 0 )
KeBugCheckEx(0x162u, (ULONG_PTR)v45, (ULONG_PTR)&CcChangeSharedCacheMapFileLock, v46, 0i64);
goto LABEL_119;
}
*(_BYTE *)(v49 + 32) |= 2u;
if( *(__int64 *)(v49 + 32) < 0 )
KiAbEntryRemoveFromTree(v49);
v51 = *(_DWORD *)(v49 + 88) & 0x1FFFF;
v52 = *(_DWORD *)(v49 + 88) & 0xFFFE0000;
*(_BYTE *)(v49 + 25) &= ~1u;
v57 = v51;
*(_DWORD *)(v49 + 88) = v52;
*(_QWORD *)(v49 + 32) = 0i64;
v53 = (__int64)(v49 - *((_QWORD *)v45 + 100)) / 96;
if( v47 == 1 )
*((_BYTE *)v45 + 792) |= 1 << v53;
else
_InterlockedOr8((volatile signed __int8 *)v45 + 870, 1 << v53);
LABEL_119:
--*((_BYTE *)v45 + 794);
KiAbThreadRemoveBoosts((ULONG_PTR)v45, (__int64)&CcChangeSharedCacheMapFileLock, (unsigned int *)&v57);
v10 = (*((_WORD *)v45 + 243))++ == 0xFFFF;
if( v10 && *((_ETHREAD **)v45 + 19) != (_ETHREAD *)((char *)v45 + 152) )
KiCheckForKernelApcDelivery();
ObfReferenceObjectWithTag(NewFileObject, 0x746C6644u);
ObDereferenceObjectDeferDeleteWithTag(v36, 0x746C6644ui64);
return 0;
}
KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
__writecr8(LockHandle.OldIrql);
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&CcChangeSharedCacheMapFileLock, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)&CcChangeSharedCacheMapFileLock);
v17 = (_ETHREAD *)KeGetCurrentThread();
v56[0] = 0;
if( (unsigned int)MiGetSystemRegionType((UINT64)&CcChangeSharedCacheMapFileLock) == 1 )
v37 = MmGetSessionIdEx(*((_QWORD *)v17 + 23));
else
v37 = -1;
--*((_WORD *)v17 + 243);
v38 = ++*((_BYTE *)v17 + 794);
v39 = (*((char *)v17 + 792) | *((char *)v17 + 870)) ^ 0x3F;
while( 1 )
{
v10 = !_BitScanReverse((unsigned int *)&v41, v39);
v55[1] = v41;
if( v10 )
goto LABEL_89;
v40 = *((_QWORD *)v17 + 100) + 96 * v41;
v39 &= ~(1 << v41);
if( (*(_BYTE *)(v40 + 26) & 1) != 0
&& (*(_DWORD *)(v40 + 32) & 1) == 0
&& (*(_QWORD *)(v40 + 32) & 0x7FFFFFFFFFFFFFFCi64) == ((unsigned __int64)&CcChangeSharedCacheMapFileLock & 0x7FFFFFFFFFFFFFFCi64)
&& *(_DWORD *)(v40 + 40) == v37 )
{
*(_BYTE *)(v40 + 26) &= ~1u;
if( *(_QWORD *)(v40 + 32) )
break;
}
}
if( !v40 )
{
LABEL_89:
if( (*((_DWORD *)v17 + 30) & 0x10000) == 0 )
KeBugCheckEx(0x162u, (ULONG_PTR)v17, (ULONG_PTR)&CcChangeSharedCacheMapFileLock, v37, 0i64);
goto LABEL_96;
}
*(_BYTE *)(v40 + 32) |= 2u;
if( *(__int64 *)(v40 + 32) < 0 )
KiAbEntryRemoveFromTree(v40);
v42 = *(_DWORD *)(v40 + 88) & 0x1FFFF;
v43 = *(_DWORD *)(v40 + 88) & 0xFFFE0000;
*(_BYTE *)(v40 + 25) &= ~1u;
v56[0] = v42;
*(_DWORD *)(v40 + 88) = v43;
*(_QWORD *)(v40 + 32) = 0i64;
v44 = (__int64)(v40 - *((_QWORD *)v17 + 100)) / 96;
if( v38 == 1 )
*((_BYTE *)v17 + 792) |= 1 << v44;
else
_InterlockedOr8((volatile signed __int8 *)v17 + 870, 1 << v44);
LABEL_96:
--*((_BYTE *)v17 + 794);
KiAbThreadRemoveBoosts((ULONG_PTR)v17, (__int64)&CcChangeSharedCacheMapFileLock, v56);
v10 = (*((_WORD *)v17 + 243))++ == 0xFFFF;
if( !v10 )
return 0;
LABEL_97:
if( *((_ETHREAD **)v17 + 19) != (_ETHREAD *)((char *)v17 + 152) )
KiCheckForKernelApcDelivery();
return 0;
}
KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
__writecr8(LockHandle.OldIrql);
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&CcChangeSharedCacheMapFileLock, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)&CcChangeSharedCacheMapFileLock);
v26 = (_ETHREAD *)KeGetCurrentThread();
v55[0] = 0;
if( (unsigned int)MiGetSystemRegionType((UINT64)&CcChangeSharedCacheMapFileLock) == 1 )
v27 = MmGetSessionIdEx(*((_QWORD *)v26 + 23));
else
v27 = -1;
--*((_WORD *)v26 + 243);
v28 = ++*((_BYTE *)v26 + 794);
v29 = (*((char *)v26 + 792) | *((char *)v26 + 870)) ^ 0x3F;
while( 1 )
{
v10 = !_BitScanReverse((unsigned int *)&v31, v29);
v54[1] = v31;
if( v10 )
goto LABEL_63;
v30 = *((_QWORD *)v26 + 100) + 96 * v31;
v29 &= ~(1 << v31);
if( (*(_BYTE *)(v30 + 26) & 1) != 0
&& (*(_DWORD *)(v30 + 32) & 1) == 0
&& (*(_QWORD *)(v30 + 32) & 0x7FFFFFFFFFFFFFFCi64) == ((unsigned __int64)&CcChangeSharedCacheMapFileLock & 0x7FFFFFFFFFFFFFFCi64)
&& *(_DWORD *)(v30 + 40) == v27 )
{
*(_BYTE *)(v30 + 26) &= ~1u;
if( *(_QWORD *)(v30 + 32) )
break;
}
}
if( !v30 )
{
LABEL_63:
if( (*((_DWORD *)v26 + 30) & 0x10000) == 0 )
KeBugCheckEx(0x162u, (ULONG_PTR)v26, (ULONG_PTR)&CcChangeSharedCacheMapFileLock, v27, 0i64);
goto LABEL_70;
}
*(_BYTE *)(v30 + 32) |= 2u;
if( *(__int64 *)(v30 + 32) < 0 )
KiAbEntryRemoveFromTree(v30);
v32 = *(_DWORD *)(v30 + 88) & 0x1FFFF;
v33 = *(_DWORD *)(v30 + 88) & 0xFFFE0000;
*(_BYTE *)(v30 + 25) &= ~1u;
v55[0] = v32;
*(_DWORD *)(v30 + 88) = v33;
*(_QWORD *)(v30 + 32) = 0i64;
v34 = (__int64)(v30 - *((_QWORD *)v26 + 100)) / 96;
if( v28 == 1 )
*((_BYTE *)v26 + 792) |= 1 << v34;
else
_InterlockedOr8((volatile signed __int8 *)v26 + 870, 1 << v34);
LABEL_70:
--*((_BYTE *)v26 + 794);
KiAbThreadRemoveBoosts((ULONG_PTR)v26, (__int64)&CcChangeSharedCacheMapFileLock, v55);
v10 = (*((_WORD *)v26 + 243))++ == 0xFFFF;
if( v10 && *((_ETHREAD **)v26 + 19) != (_ETHREAD *)((char *)v26 + 152) )
KiCheckForKernelApcDelivery();
return -1073741637;
}Referenced by:
FsRtlChangeBackingFileObject