ObGetObjectInformation
NTSTATUS __stdcall ObGetObjectInformation(INT64 a1, INT64 a2, UINT64 r8_0, UINT64 *a4){
INT64 v4;
VOID **PoolWithTag;
_OBJECT_NAME_INFORMATION *v6;
unsigned __int16 *v8;
NTSTATUS v9;
unsigned int v10;
_OBJECT_TYPE_ARRAY *TypeArray;
unsigned int v12;
__int64 v13;
_OBJECT_TYPE *v14;
_OBJECT_TYPE_ARRAY *v15;
__int64 Mode;
char v17;
unsigned int i;
__int64 v19;
__int64 v20;
VOID *v21;
INT64 v22;
__int64 v23;
NTSTATUS v24;
unsigned int v25;
__int64 v26;
unsigned int v27;
_OBJECT_HEADER_QUOTA_INFO *v28;
unsigned int DefaultPagedPoolCharge;
unsigned int DefaultNonPagedPoolCharge;
_OBJECT_HEADER_PROCESS_INFO *v31;
unsigned int v32;
__int64 v33;
__int64 v34;
_EPROCESS *ExclusiveProcess;
NTSTATUS v36;
int v37;
unsigned int v38;
VOID *v39;
_OBJECT_NAME_INFORMATION *v40;
__int16 v41;
__int16 v42;
UINT64 ReturnLength;
char v44;
unsigned int v45;
NTSTATUS v46;
unsigned int v47;
const VOID **v48;
unsigned int v49;
__int64 v50;
UINT64 Length;
_OBJECT_TYPE_ARRAY *v52;
_OBJECT_NAME_INFORMATION *v53;
_OBJECT_TYPE *v54;
_OBJECT_TYPE_ARRAY *v55;
__int64 v56;
VOID *Object;
INT64 v58;
INT64 v59;
_OBJECT_NAME_INFORMATION *v60;
unsigned int a3;
a3 = r8_0;
LODWORD(ReturnLength) = 0;
v4 = 0i64;
v52 = 0i64;
Length = 536i64;
PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x218ui64, 1916887631i64);
v6 = (_OBJECT_NAME_INFORMATION *)PoolWithTag;
v53 = (_OBJECT_NAME_INFORMATION *)PoolWithTag;
if( !PoolWithTag )
return -1073741670;
v8 = (unsigned __int16 *)PoolWithTag;
v48 = (const VOID **)PoolWithTag;
v9 = 0;
v10 = 0;
v50 = 0i64;
TypeArray = ObpCreateTypeArray(*(&stru_140C23628 + 837));
v55 = TypeArray;
if( !TypeArray )
{
ExFreePoolWithTag(v6, 0x7241624Fu);
return -1073741823;
}
v12 = 0;
LABEL_6:
v47 = v12;
if( v12 < *TypeArray )
{
v13 = *(_QWORD *)&TypeArray[2 * v12 + 2];
if( !v13 )
goto LABEL_22;
v14 = (_OBJECT_TYPE *)(v13 + 80);
v54 = v14;
if( v14 == (_OBJECT_TYPE *)*(&stru_140C23628 + 837) )
goto LABEL_22;
v15 = ObpCreateTypeArray(v14);
v52 = v15;
LODWORD(Mode) = 0;
if( !v15 )
goto LABEL_21;
v17 = 1;
v44 = 1;
for( i = 0; ; ++i )
{
v49 = i;
if( i >= *v15 )
{
LABEL_20:
ObpDestroyTypeArray(v15);
v52 = 0i64;
TypeArray = v55;
LABEL_21:
v12 = v47;
LABEL_22:
++v12;
goto LABEL_6;
}
v19 = *(_QWORD *)&v15[2 * i + 2];
v56 = v19;
if( v19 )
break;
LABEL_71:
;
}
v20 = v19 + 32;
v21 = (VOID *)(v19 + 80);
Object = (VOID *)(v19 + 80);
if( v17 )
{
v44 = Mode;
if( v50 && v10 < a3 )
*(_DWORD *)v50 = v10;
v22 = a2 + v10;
v50 = v22;
v58 = v22;
v10 += 48;
v45 = v10;
if( v10 < 0x30 )
goto LABEL_18;
if( v10 >= a3 )
goto LABEL_24;
*(_DWORD *)v22 = Mode;
v23 = (__int64)v54;
*(_DWORD *)(v22 + 4) = v54->TotalNumberOfObjects;
*(_DWORD *)(v22 + 8) = *(_DWORD *)(v23 + 48);
*(_DWORD *)(v22 + 12) = *(unsigned __int8 *)(v23 + 40);
*(_DWORD *)(v22 + 16) = *(_DWORD *)(v23 + 72);
*(_OWORD *)(v22 + 20) = *(_OWORD *)(v23 + 76);
*(_DWORD *)(v22 + 36) = *(_DWORD *)(v23 + 92);
*(_DWORD *)(v22 + 40) = *(_DWORD *)(v23 + 100);
*(_BYTE *)(v22 + 44) = (*(_BYTE *)(v23 + 66) & 8) != 0;
LODWORD(ReturnLength) = Mode;
v24 = ObQueryTypeName(v21, (_UNICODE_STRING *)(v22 + 48), a3 - v10, &ReturnLength);
v46 = v24;
v25 = (ReturnLength + 7) & 0xFFFFFFF8;
LODWORD(ReturnLength) = v25;
LODWORD(Mode) = 0;
if( v24 < 0 )
{
v9 = v24;
HIDWORD(ReturnLength) = v24;
}
else
{
v26 = v50;
*(_WORD *)(v50 + 50) = v25 - 16;
*(_QWORD *)(v26 + 56) += a1 - a2;
v25 = ReturnLength;
}
v10 += v25;
v45 = v10;
if( v10 < v25 )
{
LABEL_18:
v9 = -1073741675;
LABEL_19:
HIDWORD(ReturnLength) = v9;
goto LABEL_20;
}
v19 = v56;
v27 = a3;
v21 = (VOID *)(v20 + 48);
}
else
{
v27 = a3;
if( v10 < a3 )
*(_DWORD *)v4 = v10;
}
v4 = a2 + v10;
v59 = v4;
v10 += 64;
v45 = v10;
if( v10 < 0x40 )
goto LABEL_18;
if( v10 >= v27 )
{
LABEL_24:
v9 = -1073741820;
goto LABEL_19;
}
*(_DWORD *)v4 = Mode;
*(_QWORD *)(v4 + 8) = v21;
*(_QWORD *)(v4 + 16) = *(_QWORD *)(v19 + 16);
*(_WORD *)(v4 + 24) = *(_WORD *)(v19 + 24);
*(_DWORD *)(v4 + 28) = *(_DWORD *)v20;
*(_DWORD *)(v4 + 32) = *(_DWORD *)(v20 + 8);
*(_WORD *)(v4 + 26) = *(unsigned __int8 *)(v20 + 27);
*(_QWORD *)(v4 + 56) = *(_QWORD *)(v20 + 40) & 0xFFFFFFFFFFFFFFF0ui64;
v28 = OBJECT_HEADER_TO_QUOTA_INFO((_OBJECT_HEADER *)v20);
DefaultPagedPoolCharge = v54->TypeInfo.DefaultPagedPoolCharge;
DefaultNonPagedPoolCharge = v54->TypeInfo.DefaultNonPagedPoolCharge;
if( v28 )
{
DefaultPagedPoolCharge = v28->PagedPoolCharge;
DefaultNonPagedPoolCharge = v28->NonPagedPoolCharge;
}
*(_DWORD *)(v4 + 36) = DefaultPagedPoolCharge;
*(_DWORD *)(v4 + 40) = DefaultNonPagedPoolCharge;
v31 = OBJECT_HEADER_TO_PROCESS_INFO((_OBJECT_HEADER *)v20);
if( v31 )
{
ExclusiveProcess = v31->ExclusiveProcess;
if( ExclusiveProcess )
*(_QWORD *)(v4 + 48) = ExclusiveProcess->UniqueProcessId;
}
LODWORD(ReturnLength) = Mode;
v36 = Mode;
v46 = Mode;
if( *(_QWORD *)(v33 + 160) != Mode && (POBJECT_TYPE *)v33 == IoFileObjectType )
{
*(_OWORD *)v8 = *(_OWORD *)(v34 + 88);
v37 = *v8;
if( (_WORD)v37 && *((_QWORD *)v8 + 1) != Mode )
{
v38 = v37 + 2;
LODWORD(ReturnLength) = v38;
if( v38 > 0x208 )
{
LODWORD(ReturnLength) = 520;
*v8 = 518;
v38 = ReturnLength;
}
v39 = v8 + 8;
memmove(v39, v48[1], v38 - 2);
v48[1] = v39;
v8 = (unsigned __int16 *)v48;
*((_WORD *)v48 + 1) = ReturnLength;
LODWORD(Mode) = 0;
*(_WORD *)(*((_QWORD *)v8 + 1) + 2i64 * (*v8 >> 1)) = 0;
LODWORD(ReturnLength) = ReturnLength + 16;
v32 = a3;
}
LABEL_53:
if( (_DWORD)ReturnLength )
{
LODWORD(ReturnLength) = (ReturnLength + 7) & 0xFFFFFFF8;
v10 += ReturnLength;
v45 = v10;
if( v10 < (unsigned int)ReturnLength )
goto LABEL_18;
if( v36 < 0 )
{
v10 += 16;
v45 = v10;
if( v10 < 0x10 )
goto LABEL_18;
if( v10 < v32 )
{
RtlInitUnicodeString((PUNICODE_STRING)(v4 + 64), 0i64);
v9 = v36;
HIDWORD(ReturnLength) = v36;
goto LABEL_69;
}
}
else
{
v41 = *v8;
if( *v8 && v10 < v32 )
{
v42 = v41 + 2;
*(_WORD *)(v4 + 64) = v41;
memmove((VOID *)(v4 + 80), v48[1], (unsigned __int16)(v41 + 2));
*(_QWORD *)(v4 + 72) = a1 + v4 + 80 - a2;
*(_WORD *)(v4 + 66) = v42;
LABEL_69:
LODWORD(Mode) = 0;
goto LABEL_70;
}
if( *v8 == (_WORD)Mode )
goto LABEL_66;
}
LABEL_67:
v9 = -1073741820;
HIDWORD(ReturnLength) = -1073741820;
LABEL_70:
v8 = (unsigned __int16 *)v48;
i = v49;
v17 = v44;
goto LABEL_71;
}
v10 += 16;
v45 = v10;
if( v10 < 0x10 )
goto LABEL_18;
LABEL_66:
if( v10 < v32 )
{
RtlInitUnicodeString((PUNICODE_STRING)(v4 + 64), 0i64);
goto LABEL_69;
}
goto LABEL_67;
}
v36 = ObQueryNameStringMode((VOID *)v34, (_OBJECT_NAME_INFORMATION *)v8, (unsigned int)Length, &ReturnLength, Mode);
v46 = v36;
if( v36 == -1073741820 )
{
v32 = a3;
if( (unsigned int)ReturnLength <= Length || v10 + (unsigned int)ReturnLength >= a3 )
goto LABEL_52;
v40 = v6;
v6 = (_OBJECT_NAME_INFORMATION *)ExAllocatePoolWithTag(1ui64, (unsigned int)ReturnLength, 1916887631i64);
v53 = v6;
LODWORD(Mode) = 0;
if( !v6 )
{
v6 = v40;
v53 = v40;
v36 = -1073741670;
v46 = -1073741670;
v32 = a3;
goto LABEL_53;
}
ExFreePoolWithTag(v40, 0x7241624Fu);
Length = (unsigned int)ReturnLength;
v56 = (unsigned int)ReturnLength;
v8 = (unsigned __int16 *)v6;
v48 = (const VOID **)v6;
v60 = v6;
v36 = ObQueryNameStringMode(Object, v6, (unsigned int)ReturnLength, &ReturnLength, 0);
v46 = v36;
}
v32 = a3;
LABEL_52:
LODWORD(Mode) = 0;
goto LABEL_53;
}
if( a4 )
*(_DWORD *)a4 = v10;
ObpDestroyTypeArray(TypeArray);
ExFreePoolWithTag(v6, 0x7241624Fu);
if( !v50 )
return -1073741823;
return v9;
}Referenced by:
ExpGetObjectInformation