ObReferenceObjectByPointerWithTag
NTSTATUS __stdcall ObReferenceObjectByPointerWithTag(
PVOID Object,
ACCESS_MASK DesiredAccess,
POBJECT_TYPE ObjectType,
KPROCESSOR_MODE AccessMode,
ULONG Tag){
signed __int64 BugCheckParameter4;
if( !ObjectType )
{
if( !AccessMode )
goto LABEL_3;
return -1073741788;
}
if( (POBJECT_TYPE)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ (unsigned __int8)*((char *)Object - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)Object - 48) >> 8)] != ObjectType )
return -1073741788;
LABEL_3:
if( ObpTraceFlags )
ObpPushStackInfo((INT64)Object - 48, 1, 1i64, Tag);
BugCheckParameter4 = _InterlockedIncrement64((volatile signed __int64 *)Object - 6);
if( BugCheckParameter4 <= 1 )
KeBugCheckEx(0x18u, 0i64, (ULONG_PTR)Object, 0x10ui64, BugCheckParameter4);
return 0;
}Referenced by:
IoRegisterPlugPlayNotification
ObOpenObjectByPointer