PfLockSharedTryAcquire
INT64 __fastcall PfLockSharedTryAcquire(UINT64 Lock){
_ETHREAD *CurrentThread;
_ETHREAD *v3;
__int64 v4;
char v5;
__int64 v6;
int SessionId;
bool v8;
unsigned int v10;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
v10 = 0;
v3 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v3 + 243);
if( ++*((_BYTE *)v3 + 794) != 1 )
{
v6 = 0i64;
goto LABEL_9;
}
LOBYTE(v4) = *((_BYTE *)v3 + 792);
if( !(_BYTE)v4 )
{
if( !*((_BYTE *)v3 + 870) )
{
v6 = 0i64;
goto LABEL_9;
}
v4 = *((unsigned __int8 *)v3 + 870);
*((_BYTE *)v3 + 870) = 0;
LOBYTE(v4) = *((_BYTE *)v3 + 792) | v4;
}
v5 = v4;
_BitScanForward((unsigned int *)&v4, (unsigned __int8)v4);
*((_BYTE *)v3 + 792) = v5 & ~(1 << v4);
v6 = *((_QWORD *)v3 + 100) + 96 * v4;
if( !v6 )
{
LABEL_9:
_interlockedbittestandset((volatile signed __int32 *)v3 + 30, 0x10u);
goto LABEL_10;
}
if( Lock >= 0xFFFF800000000000ui64 && *((_BYTE *)&antNameB + ((Lock >> 39) & 0x1FF) - 256) == 1 )
SessionId = MmGetSessionIdEx(*((_QWORD *)v3 + 23));
else
SessionId = -1;
*(_DWORD *)(v6 + 40) = SessionId;
*(_QWORD *)(v6 + 32) = Lock & 0x7FFFFFFFFFFFFFFCi64;
LABEL_10:
--*((_BYTE *)v3 + 794);
KiAbThreadRemoveBoosts((ULONG_PTR)v3, Lock, &v10);
v8 = (*((_WORD *)v3 + 243))++ == 0xFFFF;
if( v8 && *((_ETHREAD **)v3 + 19) != (_ETHREAD *)((char *)v3 + 152) )
KiCheckForKernelApcDelivery();
if( !_InterlockedCompareExchange64((volatile signed __int64 *)Lock, 17i64, 0i64)
|| ExfTryAcquirePushLockShared((UINT64 *)Lock) )
{
if( v6 )
*(_BYTE *)(v6 + 26) |= 1u;
return 1i64;
}
else
{
if( v6 )
KeAbPostReleaseEx((PVOID)Lock, (PVOID)v6);
KeLeaveCriticalRegion();
return 0i64;
}
}Referenced by:
PfCheckDeprioritizeFile