>>106188570 (OP)
Why Reverse Engineering Takes ~2 Weeks:
Absence of Symbols: Without public symbols (ntoskrnl.pdb), identifying the function and its parameters is the first hurdle.
Complex State Machine: PushLocks use a complex state machine encoded within a single pointer-sized value (the lock itself). Understanding how the Flags parameter interacts with this state machine across acquisition, release, contention, shared vs. exclusive modes, and priority boosting is non-trivial.
Bitmask Decoding: Reverse engineers must painstakingly trace the code flow for different Flags values to map each bit to its specific effect (e.g., which bit disables boosting, which bit allows DISPATCH_LEVEL acquisition).
IRQL Rules: Kernel synchronization has strict rules about IRQL levels. Determining the valid IRQL ranges for different Flags combinations requires careful analysis.
Concurrency and Corner Cases: Reasoning about the correctness of the implementation under heavy contention, recursion (if allowed by flags), and various wait states adds significant complexity.
Validation: Once a hypothesis about the Flags is formed, it needs rigorous testing across different scenarios and Windows versions to ensure correctness and stability. A mistake here can lead to system instability.
Lack of Context: Reverse engineering happens in isolation without the design documentation or context the original developers had.
