- I find out that ntoskrnl exported run-time hashtable library:
but when searching it on google there is no one use or an example about it.
is it have many disadvantage or something?
- If someone have experienced on RtlxxxHashTable pls review my codes (insert/remove and clear function) with RtlxxxHashTable below, it is implemented right? (because it undocumented).
void
UpdateTable(
_In_ ULONG ProcessId,
_In_ bool Insert
)
{
sync::AutoLock _(m_lock); // RAII fast mutex lock
if (Insert) // insert
{
auto entry = ExAllocatePool(PagedPool, sizeof(MY_STRUCT_ENTRY));
if (entry)
{
RtlInsertEntryHashTable(m_hashTable, &entry->entry, ULONG_PTR(ProcessId), nullptr); // m_hashTable is a class member;
}
}
else // remove
{
auto entry = RtlLookupEntryHashTable(m_hashTable, ULONG_PTR(ProcessId), nullptr);
if (entry)
{
RtlRemoveEntryHashTable(m_hashTable, entry, nullptr);
ExFreePoo(entry);
}
}
}
void
Clear(
)
{
sync::AutoLock _(m_lock); // RAII fast mutex lock
if (m_hashTable) // a class member;
{
RTL_DYNAMIC_HASH_TABLE_ENUMERATOR enumrator = {};
if (RtlInitEnumerationHashTable(m_hashTable, &enumrator))
{
while (true)
{
auto entry = RtlEnumerateEntryHashTable(m_hashTable, &enumrator);
if (entry == nullptr)
{
break;
}
RtlRemoveEntryHashTable(m_hashTable, entry, nullptr);
ExFreePool(entry);
}
RtlEndEnumerationHashTable(m_hashTable, &enumrator);
}
RtlDeleteHashTable(m_hashTable);
}
}