MCPcopy Create free account
hub / github.com/BeneficialCode/WinArk / PushItem

Function PushItem

KernelLibrary/SysMon.cpp:310–321  ·  view source on GitHub ↗

Source from the content-addressed store, hash-verified

308}
309
310void PushItem(LIST_ENTRY* entry) {
311 AutoLock<FastMutex> lock(g_SysMonGlobals.Mutex);
312 if (g_SysMonGlobals.ItemCount > 1024) {
313 // too many items,remove oldest one
314 auto head = RemoveHeadList(&g_SysMonGlobals.ItemHead);
315 g_SysMonGlobals.ItemCount--;
316 auto item = CONTAINING_RECORD(head, FullItem<ItemHeader>, Entry);
317 ExFreePool(item);
318 }
319 InsertTailList(&g_SysMonGlobals.ItemHead, entry);
320 g_SysMonGlobals.ItemCount++;
321}
322
323LOGICAL
324ExFastRefAddAdditionalReferenceCounts(

Callers 3

OnProcessNotifyFunction · 0.85
OnThreadNotifyFunction · 0.85
OnImageLoadNotifyFunction · 0.85

Calls 1

InsertTailListFunction · 0.85

Tested by

no test coverage detected