IoEnumerateDeviceObjectList函数的还原

函数接口解释参考ddk文档（win 7 32)，用来遍历某个驱动对象的设备对象。c代码+WinDbg得到的反汇编代码

NTSTATUS 
  IoEnumerateDeviceObjectList(IN PDRIVER_OBJECT DriverObject,    //ebp+8
                             IN PDEVICE_OBJECT  *DeviceObject,    //ebp+ch
                             IN ULONG           DeviceObjectListSize,  //ebp+10h
                             OUT PLONG          ActualNumberDeviceObjects)  //ebp+14h
{
    NTSTATUS status=STATUS_SUCCESSFUL;
    PDEVICE_OBJECT tempDeviceObject=NULL;
    ULONG Count=0,i=0;
    PKIRQL OldIrql;
    KeAcquireQueuedSpinLock(0xa,OldIrql);
    DeviceObjcetListSize=DeviceObjectListSize/4;  //4=sizeof(a pointer)
    //enumerate the DeviceObject and get the number
    tempDeviceObjcet=DriverObject->DeviceObject;
    while(tempDeviceObject)
    {
        tempDeviceObject=tempDeviceObject->NextDevice;
        Count++;
    }
    //actual number
    *ActualNumberDeviceObjects=Count;
    if(Count>DeviceObjectListSize)  
    {
        status=STATUS_BUFFER_TOO_SMALL;
    }
    //
    if(DeviceObjectListSize<=0)  
    {
        KeReleaseQueuedSpinLock(0xa,OldIrql);
        return status;
    }
    tempDeviceObjcet=DriverObjct->DeviceObject;
    while(tempDeviceObcjet&&DeviceObjcetListSize)  //get the DeviceObjcet pointeres
    {
        ObfReferenceObjct(tempDeviceObjct);
        DeviceObject[i]=tempDeviceObject;   //save the DeviceObejct pointer
        DeviceObjcetListSize--;
    }

    KeReleaseQueuedSpinLock(0xa,OldIrql);
    return status;
}

反汇编代码

nt!IoEnumerateDeviceObjectList:
840485f7 8bff            mov     edi,edi
840485f9 55              push    ebp
840485fa 8bec            mov     ebp,esp
840485fc 51              push    ecx
840485fd 51              push    ecx
840485fe 56              push    esi
840485ff 57              push    edi
84048600 6a0a            push    0Ah
84048602 33ff            xor     edi,edi
84048604 217df8          and     dword ptr [ebp-8],edi
84048607 59              pop     ecx
84048608 ff1564110484    call    dword ptr [nt!_imp_KeAcquireQueuedSpinLock (84041164)]
8404860e 8b4d08          mov     ecx,dword ptr [ebp+8]
84048611 8b7510          mov     esi,dword ptr [ebp+10h]
84048614 8845ff          mov     byte ptr [ebp-1],al
84048617 8b4104          mov     eax,dword ptr [ecx+4]
8404861a c1ee02          shr     esi,2
8404861d eb04            jmp     nt!IoEnumerateDeviceObjectList+0x2c (84048623)

nt!IoEnumerateDeviceObjectList+0x28:
8404861f 8b400c          mov     eax,dword ptr [eax+0Ch]
84048622 47              inc     edi

nt!IoEnumerateDeviceObjectList+0x2c:
84048623 85c0            test    eax,eax
84048625 75f8            jne     nt!IoEnumerateDeviceObjectList+0x28 (8404861f)

nt!IoEnumerateDeviceObjectList+0x30:
84048627 8b4514          mov     eax,dword ptr [ebp+14h]
8404862a 8938            mov     dword ptr [eax],edi
8404862c 3bfe            cmp     edi,esi
8404862e 7607            jbe     nt!IoEnumerateDeviceObjectList+0x40 (84048637)

nt!IoEnumerateDeviceObjectList+0x39:
84048630 c745f8230000c0  mov     dword ptr [ebp-8],0C0000023h

nt!IoEnumerateDeviceObjectList+0x40:
84048637 8b7904          mov     edi,dword ptr [ecx+4]
8404863a 85f6            test    esi,esi
8404863c 761b            jbe     nt!IoEnumerateDeviceObjectList+0x62 (84048659)

nt!IoEnumerateDeviceObjectList+0x47:
8404863e 53              push    ebx
8404863f 8b5d0c          mov     ebx,dword ptr [ebp+0Ch]

nt!IoEnumerateDeviceObjectList+0x4b:
84048642 85ff            test    edi,edi
84048644 7412            je      nt!IoEnumerateDeviceObjectList+0x61 (84048658)

nt!IoEnumerateDeviceObjectList+0x4f:
84048646 8bcf            mov     ecx,edi
84048648 e8a7220700      call    nt!ObfReferenceObject (840ba8f4)
8404864d 893b            mov     dword ptr [ebx],edi
8404864f 8b7f0c          mov     edi,dword ptr [edi+0Ch]
84048652 83c304          add     ebx,4
84048655 4e              dec     esi
84048656 75ea            jne     nt!IoEnumerateDeviceObjectList+0x4b (84048642)

nt!IoEnumerateDeviceObjectList+0x61:
84048658 5b              pop     ebx

nt!IoEnumerateDeviceObjectList+0x62:
84048659 8a55ff          mov     dl,byte ptr [ebp-1]
8404865c 6a0a            push    0Ah
8404865e 59              pop     ecx
8404865f ff1560110484    call    dword ptr [nt!_imp_KeReleaseQueuedSpinLock (84041160)]
84048665 8b45f8          mov     eax,dword ptr [ebp-8]
84048668 5f              pop     edi
84048669 5e              pop     esi
8404866a c9              leave
8404866b c21000          ret     10h