FsRtlRemovePerFileObjectContext
_FSRTL_PER_FILEOBJECT_CONTEXT *__stdcall FsRtlRemovePerFileObjectContext(
_FILE_OBJECT *FileObject,
PVOID OwnerId,
PVOID InstanceId){
_ETHREAD *CurrentThread;
_FSRTL_PER_FILEOBJECT_CONTEXT *v6;
ULONG_PTR v7;
_FSRTL_PER_FILEOBJECT_CONTEXT *i;
_LIST_ENTRY *Flink;
_LIST_ENTRY *Blink;
ULONG_PTR BugCheckParameter2;
BugCheckParameter2 = 0i64;
if( !FileObject )
return 0i64;
IoGetFileObjectFilterContext(FileObject, (PVOID *)&BugCheckParameter2, 0);
if( !BugCheckParameter2 )
return 0i64;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v6 = 0i64;
--*((_WORD *)CurrentThread + 242);
v7 = BugCheckParameter2;
ExAcquirePushLockExclusiveEx(BugCheckParameter2, 0i64);
if( InstanceId )
{
for( i = *(_FSRTL_PER_FILEOBJECT_CONTEXT **)(v7 + 8);
i != (_FSRTL_PER_FILEOBJECT_CONTEXT *)(v7 + 8);
i = (_FSRTL_PER_FILEOBJECT_CONTEXT *)i->Links.Flink )
{
if( i->OwnerId == OwnerId && i->InstanceId == InstanceId )
{
LABEL_8:
v6 = i;
goto LABEL_9;
}
}
}
else if( OwnerId )
{
for( i = *(_FSRTL_PER_FILEOBJECT_CONTEXT **)(v7 + 8);
i != (_FSRTL_PER_FILEOBJECT_CONTEXT *)(v7 + 8);
i = (_FSRTL_PER_FILEOBJECT_CONTEXT *)i->Links.Flink )
{
if( i->OwnerId == OwnerId )
goto LABEL_8;
}
}
else if( *(_QWORD *)(v7 + 8) != v7 + 8 )
{
v6 = *(_FSRTL_PER_FILEOBJECT_CONTEXT **)(v7 + 8);
LABEL_9:
if( v6 )
{
Flink = v6->Links.Flink;
if( (_FSRTL_PER_FILEOBJECT_CONTEXT *)v6->Links.Flink->Blink != v6
|| (Blink = v6->Links.Blink, (_FSRTL_PER_FILEOBJECT_CONTEXT *)Blink->Flink != v6) )
{
__fastfail(3u);
}
Blink->Flink = Flink;
Flink->Blink = Blink;
}
}
ExReleasePushLockEx(v7, 0i64);
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
return v6;
}Referenced by:
No references.