Reverse Engineering for Beginners

CHAPTER 68. WINDOWS NT CHAPTER 68. WINDOWS NT

Listing 68.3: WRK-v1.2/base/ntos/ob/obwait.c

try {

KeReleaseMutant( (PKMUTANT)SignalObject,

MUTANT_INCREMENT,

FALSE,

TRUE );

} except((GetExceptionCode () == STATUS_ABANDONED ||
GetExceptionCode () == STATUS_MUTANT_NOT_OWNED)?
EXCEPTION_EXECUTE_HANDLER :
EXCEPTION_CONTINUE_SEARCH) {
Status = GetExceptionCode();

goto WaitExit;
}

Listing 68.4: WRK-v1.2/base/ntos/cache/cachesub.c

try {

RtlCopyBytes( (PVOID)((PCHAR)CacheBuffer + PageOffset),

UserBuffer,

MorePages?

(PAGE_SIZE - PageOffset) :

(ReceivedLength - PageOffset) );

} except( CcCopyReadExceptionFilter( GetExceptionInformation(),
&Status ) ) {

Here is also a filter code example:

Listing 68.5: WRK-v1.2/base/ntos/cache/copysup.c

LONG
CcCopyReadExceptionFilter(
IN PEXCEPTION_POINTERS ExceptionPointer,
IN PNTSTATUS ExceptionCode
)

/*++

Routine Description:

This routine serves as a exception filter and has the special job of

extracting the "real" I/O error when Mm raises STATUS_IN_PAGE_ERROR

beneath us.

Arguments:

ExceptionPointer - A pointer to the exception record that contains

the real Io Status.

ExceptionCode - A pointer to an NTSTATUS that is to receive the real

status.

Return Value:

EXCEPTION_EXECUTE_HANDLER

--*/

{
*ExceptionCode = ExceptionPointer->ExceptionRecord->ExceptionCode;

if ( (*ExceptionCode == STATUS_IN_PAGE_ERROR) &&

(ExceptionPointer->ExceptionRecord->NumberParameters >= 3) ) {

*ExceptionCode = (NTSTATUS) ExceptionPointer->ExceptionRecord->ExceptionInformation[2];

}