NTSTATUS FreePagedLookasideListForDirectory() { NTSTATUS status = STATUS_SUCCESS; PDIRECTORY_INFO pDirectoryInfo = g_pDirectoryInfo, pNextDirectoryInfo = NULL; __try { if (NULL != g_pPageListDirectory && NULL != g_pDirectoryInfo) { while (pDirectoryInfo) { pNextDirectoryInfo = pDirectoryInfo->next; ExFreeToPagedLookasideList(g_pPageListDirectory, pDirectoryInfo); pDirectoryInfo = pNextDirectoryInfo; } ExDeletePagedLookasideList(g_pPageListDirectory); ExFreePool(g_pPageListDirectory); g_pPageListDirectory = NULL; g_pDirectoryInfo = NULL; } } __except(EXCEPTION_EXECUTE_HANDLER) { KdPrint(("SSDT:FreePagedLookasideListForSSDT failed!")); status = GetExceptionCode(); } return status; }
// // Функция, вызываемая при выгрузке драйвера. // VOID DriverUnload(IN PDRIVER_OBJECT pDriverObject) { ULONG reg; // удаление символьной ссылки и объекта устройства IoDeleteSymbolicLink(&glSymLinkName); IoDeleteDevice(pDriverObject->DeviceObject); // удаляем элементы списка файлов while (!IsListEmpty(&glOpenFiles)) { PLIST_ENTRY pLink = RemoveHeadList(&glOpenFiles); OpenFileEntry *entry = CONTAINING_RECORD(pLink, OpenFileEntry, link); RtlFreeAnsiString(&entry->fileName); RtlFreeUnicodeString(&entry->fullName); ExFreeToPagedLookasideList(&glPagedList, entry); } // удаляем резервный список ExDeletePagedLookasideList(&glPagedList); KdPrint(("Driver unload\n")); //reg = ClearWP(); KeServiceDescriptorTable->Base[NUMBER_NT_CREATE_FILE] = (ULONG)glRealNtCreateFile; KeServiceDescriptorTable->Base[NUMBER_NT_OPEN_FILE] = (ULONG)glRealNtOpenFile; //WriteCR0(reg); WaitHookUnload(&glHookCounter); //FreeProtectedFiles(); return; }
void TestLookaside() { KdPrint(("enter TestLookaside ......\n")); PAGED_LOOKASIDE_LIST tLookaside; ExInitializePagedLookasideList(&tLookaside,NULL,NULL,0,sizeof(MyListNode),'1234',0); MyListNode* MyList[10] = {0}; for(int i=0; i<10; i++) { MyList[i] = (MyListNode*)ExAllocateFromPagedLookasideList(&tLookaside); if(MyList[i] == NULL) { KdPrint(("i f**k ..\n")); continue; } MyList[i]->data = i; } for(int k=0; k<10; k++) { if(MyList[k] == NULL) { KdPrint(("i f**k too \n")); continue; } KdPrint(("%d ",MyList[k]->data)); ExFreeToPagedLookasideList(&tLookaside,MyList[k]); MyList[k] = NULL; } ExDeletePagedLookasideList(&tLookaside); KdPrint(("leave TestLookaside ......\n")); }
NTSTATUS FreePagedLookasideListForServices() { NTSTATUS status = STATUS_SUCCESS; PSERVICES_INFO pServicesInfo = NULL,\ pNextServicesInfo = NULL; __try { if (g_pServicesInfo != NULL) { pServicesInfo = g_pServicesInfo; while (pServicesInfo != NULL) { pNextServicesInfo = pServicesInfo->next; ExFreeToPagedLookasideList(&g_PageListServices, pServicesInfo); pServicesInfo = pNextServicesInfo; } ExDeletePagedLookasideList(&g_PageListServices); g_pServicesInfo = NULL; } } __except(EXCEPTION_EXECUTE_HANDLER) { KdPrint(("Services:FreePagedLookasideListForDriverModule failed!")); status = STATUS_UNSUCCESSFUL; } return status; }
VOID DestroyProctectProcessList() { // 清理链表 CleanupProtectProcess(); // 清理Lookaside结构 ExDeletePagedLookasideList(&ProtectProcessList.PageList); // 清理自旋锁 // WDK没有提及,我这里就暂时不清理自旋锁 }
VOID DestroyMatchExpressionList() { // 清理链表 CleanupMatchExpression(); // 清理Lookaside结构 ExDeletePagedLookasideList(&MatchExpressionList.PageList); // 清理自旋锁 // WDK没有提及,我这里就暂时不清理自旋锁 }
int kmem_cache_destroy (kmem_cache_t * cachep) { printk("kmem_cache: %s: destroy (objects not freed: %d)\n", cachep->name, cachep->objects_allocated); #ifdef USE_NONPAGED_MEMORY ExDeleteNPagedLookasideList(&cachep->lookaside); #else ExDeletePagedLookasideList(&cachep->lookaside); #endif kfree(cachep); cachep=NULL; return 0; }