BOOLEAN
PspInitPhase0 (
IN PLOADER_PARAMETER_BLOCK LoaderBlock
)
{
//
// Initialize CID handle table.
//
// N.B. The CID handle table is removed from the handle table list so
// it will not be enumerated for object handle queries.
//
PspCidTable = ExCreateHandleTable (NULL);
if (PspCidTable == NULL) {
return FALSE;
}
//
// Set PID and TID reuse to strict FIFO. This isn't absolutely needed but
// it makes tracking audits easier.
//
ExSetHandleTableStrictFIFO (PspCidTable);
ExRemoveHandleTable (PspCidTable);
NTKERNELAPI
VOID
ExRemoveHandleTable (
IN PHANDLE_TABLE HandleTable
)
{
PKTHREAD CurrentThread;
PAGED_CODE();
CurrentThread = KeGetCurrentThread ();
//
// First, acquire the global handle table lock
//
KeEnterCriticalRegionThread (CurrentThread);
ExAcquirePushLockExclusive( &HandleTableListLock );
//
// Remove the handle table from the handle table list. This routine is
// written so that multiple calls to remove a handle table will not
// corrupt the system.
//
RemoveEntryList( &HandleTable->HandleTableList );
InitializeListHead( &HandleTable->HandleTableList );
//
// Now release the global lock and return to our caller
//
ExReleasePushLockExclusive( &HandleTableListLock );
KeLeaveCriticalRegionThread (CurrentThread);
return;
}
0: kd> x nt!PspCidTable
80bf44a0 nt!PspCidTable = 0xe1002cf0
0: kd> dx -r1 ((ntkrnlmp!_HANDLE_TABLE *)0xe1002cf0)
((ntkrnlmp!_HANDLE_TABLE *)0xe1002cf0) : 0xe1002cf0 [Type: _HANDLE_TABLE *]
[+0x000] TableCode : 0xe1005000 [Type: unsigned long]
[+0x004] QuotaProcess : 0x0 [Type: _EPROCESS *]
[+0x008] UniqueProcessId : 0x0 [Type: void *]
[+0x00c] HandleTableLock [Type: _EX_PUSH_LOCK [4]]
[+0x01c] HandleTableList [Type: _LIST_ENTRY]
[+0x024] HandleContentionEvent [Type: _EX_PUSH_LOCK]
[+0x028] DebugInfo : 0x0 [Type: _HANDLE_TRACE_DEBUG_INFO *]
[+0x02c] ExtraInfoPages : 0 [Type: long]
[+0x030] FirstFree : 0x5d8 [Type: unsigned long]
[+0x034] LastFree : 0x5d0 [Type: unsigned long]
[+0x038] NextHandleNeedingPool : 0x800 [Type: unsigned long]
[+0x03c] HandleCount : 250 [Type: long]
[+0x040] Flags : 0x1 [Type: unsigned long]
[+0x040 ( 0: 0)] StrictFIFO : 0x1 [Type: unsigned char]
0: kd> dx -r1 (*((ntkrnlmp!_LIST_ENTRY *)0xe1002d0c))
(*((ntkrnlmp!_LIST_ENTRY *)0xe1002d0c)) [Type: _LIST_ENTRY]
[+0x000] Flink : 0xe1002d0c [Type: _LIST_ENTRY *] //指向了本身
[+0x004] Blink : 0xe1002d0c [Type: _LIST_ENTRY *] //指向了本身