MCPcopy Create free account
hub / github.com/BeneficialCode/WinArk / ExReferenceCallBackBlock

Function ExReferenceCallBackBlock

KernelLibrary/SysMon.cpp:372–415  ·  view source on GitHub ↗

Source from the content-addressed store, hash-verified

370}
371
372PEX_CALLBACK_ROUTINE_BLOCK ExReferenceCallBackBlock(
373 _Inout_ PEX_CALLBACK Callback
374) {
375 EX_FAST_REF_S OldRef;
376 PEX_CALLBACK_ROUTINE_BLOCK CallbackBlock;
377
378
379 OldRef = ExFastReference(&Callback->RoutineBlock);
380 if (OldRef.Value == 0)
381 return nullptr;
382
383 if (ExFastRefObjectNull(OldRef))
384 return nullptr;
385
386 if (!(OldRef.RefCnt & MAX_FAST_REFS)) {
387
388 KeEnterCriticalRegion();
389
390 CallbackBlock = (PEX_CALLBACK_ROUTINE_BLOCK)ExFastRefGetObject(Callback->RoutineBlock);
391 if (CallbackBlock && !ExAcquireRundownProtection(&CallbackBlock->RundownProtect)) {
392 CallbackBlock = nullptr;
393 }
394
395 KeLeaveCriticalRegion();
396
397 if (CallbackBlock == nullptr) {
398 return nullptr;
399 }
400 }
401 else {
402 CallbackBlock = (PEX_CALLBACK_ROUTINE_BLOCK)ExFastRefGetObject(OldRef);
403
404 if (ExFastRefIsLastReference(OldRef) &&
405 ExAcquireRundownProtectionEx(&CallbackBlock->RundownProtect, MAX_FAST_REFS)) {
406
407 if (!ExFastRefAddAdditionalReferenceCounts(&Callback->RoutineBlock,
408 CallbackBlock, MAX_FAST_REFS)) {
409 ExReleaseRundownProtectionEx(&CallbackBlock->RundownProtect, MAX_FAST_REFS);
410 }
411 }
412 }
413
414 return CallbackBlock;
415}
416
417EX_FAST_REF_S ExFastReference(
418 _Inout_ PEX_FAST_REF_S FastRef

Callers 2

EnumSystemNotifyFunction · 0.85

Calls 5

ExFastRefObjectNullFunction · 0.85
ExFastRefGetObjectFunction · 0.85
ExFastRefIsLastReferenceFunction · 0.85
ExFastReferenceFunction · 0.70

Tested by

no test coverage detected