PiInitializeDDB
NTSTATUS __stdcall PiInitializeDDB(PCWSTR SourceString){
char v1;
_OWORD *v2;
char v3;
_QWORD *v4;
int Section;
INT64 v7;
VOID *inited;
int v9;
const wchar_t *v10;
UINT64 ShareAccess;
INT64 ShareAccessa;
UINT64 OpenOptions;
INT64 OpenOptionsa;
UINT64 AllocationType;
UINT64 Win32Protect;
VOID *SectionHandle;
VOID *FileHandle;
_UNICODE_STRING v19;
UINT64 ViewSize;
_OBJECT_ATTRIBUTES ObjectAttributes;
_UNICODE_STRING DestinationString;
_IO_STATUS_BLOCK IoStatusBlock;
VOID *BaseAddress;
*(_QWORD *)&ObjectAttributes.Length = 48i64;
*(_QWORD *)&ObjectAttributes.Attributes = 576i64;
v3 = v1;
ViewSize = 0i64;
FileHandle = 0i64;
*v2 = 0i64;
SectionHandle = 0i64;
v2[1] = 0i64;
v4 = v2;
BaseAddress = 0i64;
DestinationString = 0i64;
IoStatusBlock = 0i64;
RtlInitUnicodeString(&DestinationString, SourceString);
LODWORD(OpenOptions) = 0;
ObjectAttributes.ObjectName = &DestinationString;
ObjectAttributes.RootDirectory = 0i64;
LODWORD(ShareAccess) = 5;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
Section = ZwOpenFile(&FileHandle, 0x80000000ui64, &ObjectAttributes, &IoStatusBlock, ShareAccess, OpenOptions);
if( Section >= 0 )
{
LODWORD(OpenOptionsa) = 0x8000000;
ObjectAttributes.Length = 48;
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.Attributes = 576;
ObjectAttributes.ObjectName = 0i64;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
LODWORD(ShareAccessa) = 2;
Section = ZwCreateSection(
(UINT64)&SectionHandle,
4ui64,
(INT64)&ObjectAttributes,
0i64,
ShareAccessa,
OpenOptionsa,
(UINT64)FileHandle);
if( Section < 0 )
{
if( (PiLoggedErrorEventsMask & 0x20) == 0 )
{
v9 = PiLoggedErrorEventsMask | 0x20;
v10 = L"DATABASE SECTION FAILED";
goto LABEL_17;
}
}
else
{
LODWORD(Win32Protect) = 2;
LODWORD(AllocationType) = 0;
Section = ZwMapViewOfSection(
SectionHandle,
(VOID *)0xFFFFFFFFFFFFFFFFi64,
&BaseAddress,
0i64,
0i64,
0i64,
&ViewSize,
ViewShare,
AllocationType,
Win32Protect);
if( Section < 0 )
{
if( (PiLoggedErrorEventsMask & 0x40) == 0 )
{
v9 = PiLoggedErrorEventsMask | 0x40;
v10 = L"DATABASE MAPPING FAILED";
goto LABEL_17;
}
}
else
{
inited = SdbInitDatabaseInMemory(BaseAddress, (unsigned int)ViewSize, v7);
if( inited )
{
*v4 = inited;
v4[3] = FileHandle;
v4[2] = SectionHandle;
v4[1] = BaseAddress;
BaseAddress = 0i64;
SectionHandle = 0i64;
FileHandle = 0i64;
goto LABEL_4;
}
Section = -1073741823;
if( (PiLoggedErrorEventsMask & 0x80u) == 0 )
{
v9 = PiLoggedErrorEventsMask | 0x80;
v10 = L"INIT DATABASE FAILED";
goto LABEL_17;
}
}
}
}
else if( !InitIsWinPEMode && !v3 && (PiLoggedErrorEventsMask & 0x10) == 0 )
{
v9 = PiLoggedErrorEventsMask | 0x10;
v10 = L"DATABASE OPEN FAILED";
LABEL_17:
PiLoggedErrorEventsMask = v9;
v19 = 0i64;
RtlInitUnicodeString(&v19, v10);
PnpLogEvent((const VOID **)&v19, 0i64, -1073740947, 0i64, 0);
}
LABEL_4:
if( BaseAddress )
ZwUnmapViewOfSection((VOID *)0xFFFFFFFFFFFFFFFFi64, BaseAddress);
if( SectionHandle )
ZwClose((_HANDLE)SectionHandle);
if( FileHandle )
ZwClose((_HANDLE)FileHandle);
return Section;
}Referenced by:
PiLookupInDDB