| 16 | PSYSTEM_DLL* PspSystemDlls; |
| 17 | |
| 18 | NTSTATUS NTAPI |
| 19 | NtCreateDebugObject( |
| 20 | _Out_ PHANDLE DebugObjectHandle, |
| 21 | _In_ ACCESS_MASK DesiredAccess, |
| 22 | _In_ POBJECT_ATTRIBUTES ObjectAttributes, |
| 23 | _In_ ULONG Flags |
| 24 | ) { |
| 25 | return kDbgUtil::g_pNtCreateDebugObject(DebugObjectHandle, |
| 26 | DesiredAccess, ObjectAttributes, Flags); |
| 27 | NTSTATUS status; |
| 28 | HANDLE handle; |
| 29 | PDEBUG_OBJECT DebugObject; |
| 30 | KPROCESSOR_MODE PreviousMode; |
| 31 | |
| 32 | PreviousMode = ExGetPreviousMode(); |
| 33 | |
| 34 | // �ж��û�������ַ�Ƿ�Ϸ� |
| 35 | __try { |
| 36 | if (PreviousMode != KernelMode) { |
| 37 | ProbeForWriteHandle(DebugObjectHandle); |
| 38 | } |
| 39 | *DebugObjectHandle = nullptr; |
| 40 | } |
| 41 | __except(EXCEPTION_EXECUTE_HANDLER) { |
| 42 | return GetExceptionCode(); |
| 43 | } |
| 44 | |
| 45 | if (Flags & ~DEBUG_KILL_ON_CLOSE) { |
| 46 | return STATUS_INVALID_PARAMETER; |
| 47 | } |
| 48 | |
| 49 | // �������Զ��� |
| 50 | status = ObCreateObject( |
| 51 | PreviousMode, |
| 52 | *DbgkDebugObjectType, |
| 53 | ObjectAttributes, |
| 54 | PreviousMode, |
| 55 | nullptr, |
| 56 | sizeof(DEBUG_OBJECT), |
| 57 | 0, |
| 58 | 0, |
| 59 | (PVOID*)&DebugObject); |
| 60 | |
| 61 | if (!NT_SUCCESS(status)) { |
| 62 | return status; |
| 63 | } |
| 64 | // ��ʼ�����Զ��� |
| 65 | ExInitializeFastMutex(&DebugObject->Mutex); |
| 66 | InitializeListHead(&DebugObject->EventList); |
| 67 | KeInitializeEvent(&DebugObject->EventsPresent, NotificationEvent, FALSE); |
| 68 | |
| 69 | if (Flags & DEBUG_KILL_ON_CLOSE) { |
| 70 | DebugObject->Flags = DEBUG_OBJECT_KILL_ON_CLOSE; |
| 71 | } |
| 72 | else { |
| 73 | DebugObject->Flags = 0; |
| 74 | } |
| 75 |
nothing calls this directly
no test coverage detected