LIST_ENTRY 双向循环链表操作代码

Nisy

链表是内核开发中经常遇到的一个数据结构，主要是双向循环链表；要使用链表，需要用到一个LIST_ENTRY的结构，其定义如下：

1. 
   
2. typedef struct _LIST_ENTRY {
   
3.     struct _LIST_ENTRY  *Flink;    // 指向下一个节点
   
4.     struct _LIST_ENTRY  *Blink;    // 指向前一个节点
   
5. } LIST_ENTRY, *PLIST_ENTRY;
   

复制代码

1. 
   
2. FORCEINLINE VOID InitializeListHead(
   
3.     _Out_ PLIST_ENTRY ListHead
   
4.     )
   
5. {
   
6.     ListHead->Flink = ListHead->Blink = ListHead;
   
7. }
   
8. 
   
9. _Check_return_ FORCEINLINE BOOLEAN IsListEmpty(
   
10.     _In_ PLIST_ENTRY ListHead
    
11.     )
    
12. {
    
13.     return ListHead->Flink == ListHead;
    
14. }
    
15. 
    
16. FORCEINLINE BOOLEAN RemoveEntryList(
    
17.     _In_ PLIST_ENTRY Entry
    
18.     )
    
19. {
    
20.     PLIST_ENTRY Blink;
    
21.     PLIST_ENTRY Flink;
    
22. 
    
23.     Flink = Entry->Flink;
    
24.     Blink = Entry->Blink;
    
25.     Blink->Flink = Flink;
    
26.     Flink->Blink = Blink;
    
27. 
    
28.     return Flink == Blink;
    
29. }
    
30. 
    
31. FORCEINLINE PLIST_ENTRY RemoveHeadList(
    
32.     _Inout_ PLIST_ENTRY ListHead
    
33.     )
    
34. {
    
35.     PLIST_ENTRY Flink;
    
36.     PLIST_ENTRY Entry;
    
37. 
    
38.     Entry = ListHead->Flink;
    
39.     Flink = Entry->Flink;
    
40.     ListHead->Flink = Flink;
    
41.     Flink->Blink = ListHead;
    
42. 
    
43.     return Entry;
    
44. }
    
45. 
    
46. FORCEINLINE PLIST_ENTRY RemoveTailList(
    
47.     _Inout_ PLIST_ENTRY ListHead
    
48.     )
    
49. {
    
50.     PLIST_ENTRY Blink;
    
51.     PLIST_ENTRY Entry;
    
52. 
    
53.     Entry = ListHead->Blink;
    
54.     Blink = Entry->Blink;
    
55.     ListHead->Blink = Blink;
    
56.     Blink->Flink = ListHead;
    
57. 
    
58.     return Entry;
    
59. }
    
60. 
    
61. FORCEINLINE VOID InsertTailList(
    
62.     _Inout_ PLIST_ENTRY ListHead,
    
63.     _Inout_ PLIST_ENTRY Entry
    
64.     )
    
65. {
    
66.     PLIST_ENTRY Blink;
    
67. 
    
68.     Blink = ListHead->Blink;
    
69.     Entry->Flink = ListHead;
    
70.     Entry->Blink = Blink;
    
71.     Blink->Flink = Entry;
    
72.     ListHead->Blink = Entry;
    
73. }
    
74. 
    
75. FORCEINLINE VOID InsertHeadList(
    
76.     _Inout_ PLIST_ENTRY ListHead,
    
77.     _Inout_ PLIST_ENTRY Entry
    
78.     )
    
79. {
    
80.     PLIST_ENTRY Flink;
    
81. 
    
82.     Flink = ListHead->Flink;
    
83.     Entry->Flink = Flink;
    
84.     Entry->Blink = ListHead;
    
85.     Flink->Blink = Entry;
    
86.     ListHead->Flink = Entry;
    
87. }
    
88. 
    
89. FORCEINLINE VOID AppendTailList(
    
90.     _Inout_ PLIST_ENTRY ListHead,
    
91.     _Inout_ PLIST_ENTRY ListToAppend
    
92.     )
    
93. {
    
94.     PLIST_ENTRY ListEnd = ListHead->Blink;
    
95. 
    
96.     ListHead->Blink->Flink = ListToAppend;
    
97.     ListHead->Blink = ListToAppend->Blink;
    
98.     ListToAppend->Blink->Flink = ListHead;
    
99.     ListToAppend->Blink = ListEnd;
    
100. }
     
101. 
     
102. FORCEINLINE PSINGLE_LIST_ENTRY PopEntryList(
     
103.     _Inout_ PSINGLE_LIST_ENTRY ListHead
     
104.     )
     
105. {
     
106.     PSINGLE_LIST_ENTRY FirstEntry;
     
107. 
     
108.     FirstEntry = ListHead->Next;
     
109. 
     
110.     if (FirstEntry)
     
111.         ListHead->Next = FirstEntry->Next;
     
112. 
     
113.     return FirstEntry;
     
114. }
     
115. 
     
116. FORCEINLINE VOID PushEntryList(
     
117.     _Inout_ PSINGLE_LIST_ENTRY ListHead,
     
118.     _Inout_ PSINGLE_LIST_ENTRY Entry
     
119.     )
     
120. {
     
121.     Entry->Next = ListHead->Next;
     
122.     ListHead->Next = Entry;
     
123. }
     
124. 
     

复制代码

飘云

这是准备断链的节奏啊，O(∩_∩)O哈哈~

Nisy

飘云 发表于 2019-11-22 10:12
这是准备断链的节奏啊，O(∩_∩)O哈哈~

补上~

1. VOID NsBreakAwayFromMemoryOrderModuleList(PWCHAR szFullDllName)
   
2. {
   
3.     PTEB   pTeb = NtCurrentTeb();
   
4.     PPEB   pPeb = pTeb->ProcessEnvironmentBlock;
   
5.     PPEB_LDR_DATA Ldr = pPeb->Ldr;
   
6.     LIST_ENTRY* Head = NULL;
   
7.     LIST_ENTRY* entry = NULL;
   
8. 
   
9.     Head = Ldr->InLoadOrderModuleList.Flink;
   
10.     entry = Head->Flink;
    
11.     while (entry != Head)
    
12.     {
    
13.         PLDR_DATA_TABLE_ENTRY item = (PLDR_DATA_TABLE_ENTRY)entry;
    
14.         if (CheckDllPatch(&item->FullDllName, szFullDllName))
    
15.             RemoveEntryList(entry);
    
16.         entry = entry->Flink;
    
17.     }
    
18. 
    
19.     Head = Ldr->InMemoryOrderModuleList.Flink;
    
20.     entry = Head->Flink;
    
21.     while (entry != Head)
    
22.     {
    
23.         PLDR_DATA_TABLE_ENTRY item = \
    
24.             (PLDR_DATA_TABLE_ENTRY)CONTAINING_RECORD(entry, LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks);
    
25.         if (CheckDllPatch(&item->FullDllName, szFullDllName))
    
26.             RemoveEntryList(entry);
    
27.         entry = entry->Flink;
    
28.     }
    
29. 
    
30.     Head = Ldr->InInitializationOrderModuleList.Flink;
    
31.     entry = Head->Flink;
    
32.     while (entry != Head)
    
33.     {
    
34.         PLDR_DATA_TABLE_ENTRY item = \
    
35.             (PLDR_DATA_TABLE_ENTRY)CONTAINING_RECORD(entry, LDR_DATA_TABLE_ENTRY, InInitializationOrderLinks);;
    
36.         if (CheckDllPatch(&item->FullDllName, szFullDllName))
    
37.             RemoveEntryList(entry);
    
38.         entry = entry->Flink;
    
39.     }
    
40. }
    
41. 
    

复制代码

意净无柒