PnpCollectOpenHandles
CHAR __fastcall PnpCollectOpenHandles(DEVICE_OBJECT **a1, VOID *a2, INT64 a3){
__int64 v4;
CHAR result;
v4 = (unsigned int)a2;
if( *(_BYTE *)(a3 + 36) )
IopDebugPrint(0x14ui64, (INT8 *)"Beginning handle dump:\n");
*(_DWORD *)(a3 + 32) = 0;
*(_QWORD *)(a3 + 24) = a3 + 16;
*(_QWORD *)(a3 + 16) = a3 + 16;
result = *(_BYTE *)(a3 + 36);
if( result || *(_BYTE *)(a3 + 37) )
{
if( (_DWORD)v4 )
{
do
{
*(_QWORD *)a3 = *a1;
PnpHandleEnumerateHandlesAgainstPdoStack(*a1++, a2);
--v4;
}
while( v4 );
result = *(_BYTE *)(a3 + 36);
}
if( result )
return IopDebugPrint(0x14ui64, (INT8 *)"Dump complete - %d total handles found.\n");
}
return result;
}Referenced by:
PipRecordOpenHandleVeto
PipSendQueryRemoveIrpAndCheckOpenHandles