ObOpenObjectByNameEx
NTSTATUS __stdcall ObOpenObjectByNameEx(
_OBJECT_ATTRIBUTES *ObjectAttributes,
_OBJECT_TYPE *ObjectType,
INT8 AccessMode,
_ACCESS_STATE *AccessState,
UINT64 DesiredAccess,
VOID *ParseContext,
_EJOB *Silo,
VOID **Handle){
struct _KPRCB *CurrentPrcb;
_GENERAL_LOOKASIDE *P;
PSLIST_ENTRY v14;
int v15;
void *v16;
_ETHREAD *CurrentThread;
_EX_FAST_REF *Process;
_EX_FAST_REF *v19;
_QWORD *v20;
int v21;
_SLIST_ENTRY *Next;
_SLIST_ENTRY *v23;
_OB_OPEN_REASON v24;
_ADAPTER_OBJECT *v25;
_ADAPTER_OBJECT *v26;
char *v27;
__int64 v28;
VOID *v29;
struct _KPRCB *v30;
_GENERAL_LOOKASIDE *v31;
NTSTATUS v32;
_OBJECT_HEADER *v33;
_ADAPTER_OBJECT *v34;
_SLIST_ENTRY *v35;
_SLIST_ENTRY *Buffer;
struct _KPRCB *v37;
_GENERAL_LOOKASIDE *v38;
struct _KPRCB *v39;
_GENERAL_LOOKASIDE *v40;
_ADAPTER_OBJECT *v42;
_OBJECT_HEADER *v43;
_GENERAL_LOOKASIDE *L;
__int64 Size;
void *(__fastcall *AllocateEx)(_POOL_TYPE, unsigned __int64, unsigned int, _LOOKASIDE_LIST_EX *);
__int64 Tag;
__int64 Type;
_EX_PUSH_LOCK *v49;
__int64 v50;
struct _KPRCB *v51;
_GENERAL_LOOKASIDE *v52;
__int64 v53;
_OBJECT_CREATE_INFORMATION *ObjectCreateInfo;
INT64 UseLookaside;
INT64 UseLookasidea;
UINT64 v57;
VOID *FoundObject;
VOID *Lock;
_KTHREAD *Thread;
VOID *v61;
_OBJECT_HEADER *ObjectHeader;
_UNICODE_STRING CapturedObjectName;
_SECURITY_SUBJECT_CONTEXT SubjectContext;
_LEARNING_MODE_OBJECT_INFORMATION ObjectInformation[4];
__int128 v66;
__int128 v67;
__int64 v68;
UINT64 MaxRelativeAccessMask;
v68 = 0i64;
FoundObject = 0i64;
LODWORD(MaxRelativeAccessMask) = 0;
v61 = 0i64;
*Handle = 0i64;
ObjectHeader = 0i64;
CapturedObjectName = 0i64;
*(_OWORD *)ObjectInformation = 0i64;
v66 = 0i64;
v67 = 0i64;
if( ObjectAttributes && ObjectType )
{
CurrentPrcb = KeGetCurrentPrcb();
P = CurrentPrcb->PPLookasideList[8].P;
++P->TotalAllocates;
v14 = RtlpInterlockedPopEntrySList(&P->ListHead);
if( !v14 )
{
++P->AllocateMisses;
L = CurrentPrcb->PPLookasideList[8].L;
++L->TotalAllocates;
v14 = RtlpInterlockedPopEntrySList(&L->ListHead);
if( !v14 )
{
Size = L->Size;
AllocateEx = L->AllocateEx;
Tag = L->Tag;
Type = (unsigned int)L->Type;
++L->AllocateMisses;
v14 = (PSLIST_ENTRY)((__int64(__fastcall *)(__int64, __int64, __int64))AllocateEx)(Type, Size, Tag);
if( !v14 )
return -1073741670;
}
}
LODWORD(v14->Next) = CurrentPrcb->Number;
LODWORD(UseLookaside) = 1;
v15 = ObpCaptureObjectCreateInformation(
AccessMode,
AccessMode,
ObjectAttributes,
&CapturedObjectName,
(_OBJECT_CREATE_INFORMATION *)&v14[10],
UseLookaside);
if( v15 < 0 )
{
v51 = KeGetCurrentPrcb();
v52 = v51->PPLookasideList[8].P;
++v52->TotalFrees;
if( LOWORD(v52->ListHead.Alignment) < v52->Depth
|| (++v52->FreeMisses,
v52 = v51->PPLookasideList[8].L,
++v52->TotalFrees,
LOWORD(v52->ListHead.Alignment) < v52->Depth) )
{
RtlpInterlockedPushEntrySList(&v52->ListHead, v14);
}
else
{
++v52->FreeMisses;
((void(__fastcall *)(PSLIST_ENTRY))v52->FreeEx)(v14);
}
return v15;
}
if( !AccessState )
{
v16 = 0i64;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
*(_QWORD *)&SubjectContext.ImpersonationLevel = 0i64;
Process = (_EX_FAST_REF *)CurrentThread->Tcb.ApcState.Process;
SubjectContext.ProcessAuditId = Process[136].Object;
if( CurrentThread && (CurrentThread->CrossThreadFlags & 8) != 0 )
{
Thread = (_ETHREAD *)KeGetCurrentThread();
--Thread->Tcb.KernelApcDisable;
Lock = &CurrentThread->ThreadLock;
ExAcquirePushLockSharedEx(&CurrentThread->ThreadLock, 0i64);
if( (CurrentThread->CrossThreadFlags & 8) != 0 )
{
v16 = (void *)(CurrentThread->ClientSecurity.ImpersonationData & 0xFFFFFFFFFFFFFFF8ui64);
ObfReferenceObject(v16);
SubjectContext.ImpersonationLevel = CurrentThread->ClientSecurity.ImpersonationData & 3;
}
if( _InterlockedCompareExchange64((volatile signed __int64 *)Lock, 0i64, 17i64) != 17 )
ExfReleasePushLockShared((_EX_PUSH_LOCK *)Lock);
KeAbPostRelease(Lock);
KeLeaveCriticalRegionThread(&Thread->Tcb);
}
SubjectContext.ClientToken = v16;
v19 = Process + 151;
v20 = ObFastReferenceObject(Process + 151);
if( !v20 )
{
Thread = (_ETHREAD *)KeGetCurrentThread();
--Thread->Tcb.KernelApcDisable;
v49 = (_EX_PUSH_LOCK *)&Process[135];
ExAcquirePushLockSharedEx(v49, 0i64);
v20 = ObFastReferenceObjectLocked(v19);
if( _InterlockedCompareExchange64(&v49->_bf_0, 0i64, 17i64) != 17 )
ExfReleasePushLockShared(v49);
KeAbPostRelease(v49);
KeLeaveCriticalRegionThread(&Thread->Tcb);
}
SubjectContext.PrimaryToken = v20;
if( SeTokenLeakTracking )
{
if( v20 )
{
_InterlockedIncrement((volatile signed __int32 *)(v20[143] + 284i64));
if( v20 == (_QWORD *)SepTokenLeakToken )
__debugbreak();
}
if( SubjectContext.ClientToken )
{
_InterlockedIncrement((volatile signed __int32 *)(*((_QWORD *)SubjectContext.ClientToken + 143) + 284i64));
if( SubjectContext.ClientToken == (void *)SepTokenLeakToken )
__debugbreak();
}
}
SepCreateAccessStateFromSubjectContext(
&SubjectContext,
(_ACCESS_STATE *)v14,
(_AUX_ACCESS_DATA *)&v14[14],
(unsigned int)DesiredAccess,
&ObjectType->TypeInfo.GenericMapping);
v15 = v21;
if( v21 < 0 )
goto LABEL_33;
AccessState = (_ACCESS_STATE *)v14;
}
Next = v14[12].Next;
if( Next )
*((_QWORD *)AccessState + 8) = Next;
else
Next = (_SLIST_ENTRY *)*((_QWORD *)AccessState + 8);
if( Next )
{
if( !RtlValidSecurityDescriptor(Next) )
{
v15 = -1073741703;
LABEL_33:
if( AccessState == (_ACCESS_STATE *)v14 )
{
SepDeleteAccessState(AccessState);
if( SeTokenLeakTracking )
{
v53 = *((_QWORD *)AccessState + 6);
if( v53 )
{
_InterlockedDecrement((volatile signed __int32 *)(*(_QWORD *)(v53 + 1144) + 284i64));
if( *((_QWORD *)AccessState + 6) == SepTokenLeakToken )
__debugbreak();
}
v50 = *((_QWORD *)AccessState + 4);
if( v50 )
{
_InterlockedDecrement((volatile signed __int32 *)(*(_QWORD *)(v50 + 1144) + 284i64));
if( *((_QWORD *)AccessState + 4) == SepTokenLeakToken )
__debugbreak();
}
}
ObFastDereferenceObject(&KeGetCurrentThread()->ApcState.Process->Token, *((VOID **)AccessState + 6));
v34 = (_ADAPTER_OBJECT *)*((_QWORD *)AccessState + 4);
*((_QWORD *)AccessState + 6) = 0i64;
if( v34 )
HalPutDmaAdapter(v34);
*((_QWORD *)AccessState + 4) = 0i64;
}
v35 = v14[12].Next;
if( v35 )
{
SeReleaseSecurityDescriptor(v35, (CHAR)v14[11].Next, 1u);
v14[12].Next = 0i64;
}
Buffer = (_SLIST_ENTRY *)CapturedObjectName.Buffer;
if( CapturedObjectName.Buffer )
{
if( CapturedObjectName.MaximumLength == 248 )
{
v37 = KeGetCurrentPrcb();
v38 = v37->PPLookasideList[5].P;
++v38->TotalFrees;
if( LOWORD(v38->ListHead.Alignment) < v38->Depth
|| (++v38->FreeMisses,
v38 = v37->PPLookasideList[5].L,
++v38->TotalFrees,
LOWORD(v38->ListHead.Alignment) < v38->Depth) )
{
RtlpInterlockedPushEntrySList(&v38->ListHead, Buffer);
}
else
{
++v38->FreeMisses;
((void(__fastcall *)(_SLIST_ENTRY *))v38->FreeEx)(Buffer);
}
}
else
{
ExFreePoolWithTag(CapturedObjectName.Buffer, 0);
}
}
SeClearLearningModeObjectInformation();
v39 = KeGetCurrentPrcb();
v40 = v39->PPLookasideList[8].P;
++v40->TotalFrees;
if( LOWORD(v40->ListHead.Alignment) < v40->Depth
|| (++v40->FreeMisses,
v40 = v39->PPLookasideList[8].L,
++v40->TotalFrees,
LOWORD(v40->ListHead.Alignment) < v40->Depth) )
{
RtlpInterlockedPushEntrySList(&v40->ListHead, v14);
}
else
{
++v40->FreeMisses;
((void(__fastcall *)(PSLIST_ENTRY))v40->FreeEx)(v14);
}
return v15;
}
if( (BYTE2(Next->Next) & 0x10) != 0 && (*((_DWORD *)AccessState + 5) & 0x1000000) == 0 )
*((_DWORD *)AccessState + 4) |= SeObjectCreateSaclAccessBits(Next);
}
v23 = v14 + 28;
v24 = ObCreateHandle;
v15 = ObpLookupObjectName(
*((VOID **)&v14[10].Next + 1),
&CapturedObjectName,
LODWORD(v14[10].Next),
ObjectType,
AccessMode,
ParseContext,
*((_SECURITY_QUALITY_OF_SERVICE **)&v14[12].Next + 1),
0i64,
Silo,
AccessState,
(_OBP_LOOKUP_CONTEXT *)&v14[28],
&MaxRelativeAccessMask,
&FoundObject);
if( v15 >= 0 )
{
if( *((_BYTE *)&v14[29].Next + 14) )
{
v43 = (_OBJECT_HEADER *)(*((_QWORD *)&v14[28].Next + 1) - 48i64);
ObjectHeader = v43;
ObfReferenceObject(&v43->Body);
_InterlockedIncrement((volatile signed __int32 *)(&v43->TypeIndex
- *((unsigned __int8 *)&dword_140C25D60 + (v43->InfoMask & 3))));
v24 = ObCreateHandle;
}
if( *((_BYTE *)&v14[29].Next + 14) )
{
ExReleasePushLockEx(LODWORD(v23->Next) + 296, 0);
v42 = (_ADAPTER_OBJECT *)v23->Next;
LODWORD(v14[30].Next) = -286387660;
HalPutDmaAdapter(v42);
v23->Next = 0i64;
*((_WORD *)&v14[29].Next + 7) = 0;
KeLeaveCriticalRegion();
}
v25 = (_ADAPTER_OBJECT *)*((_QWORD *)&v14[28].Next + 1);
if( v25 )
{
HalPutDmaAdapter(v25);
*((_QWORD *)&v14[28].Next + 1) = 0i64;
}
v26 = (_ADAPTER_OBJECT *)FoundObject;
v27 = (char *)FoundObject - 48;
if( (*((char *)FoundObject - 21) & 1) != 0 )
{
v28 = *((_QWORD *)v27 + 4);
if( v28 )
{
v29 = *(VOID **)(v28 + 32);
if( v29 )
{
SeReleaseSecurityDescriptor(v29, *(_BYTE *)(v28 + 16), 1u);
*(_QWORD *)(*((_QWORD *)v27 + 4) + 32i64) = 0i64;
v28 = *((_QWORD *)v27 + 4);
}
v30 = KeGetCurrentPrcb();
v31 = v30->PPLookasideList[4].P;
++v31->TotalFrees;
if( LOWORD(v31->ListHead.Alignment) < v31->Depth
|| (++v31->FreeMisses,
v31 = v30->PPLookasideList[4].L,
++v31->TotalFrees,
LOWORD(v31->ListHead.Alignment) < v31->Depth) )
{
RtlpInterlockedPushEntrySList(&v31->ListHead, (PSLIST_ENTRY)v28);
}
else
{
++v31->FreeMisses;
((void(__fastcall *)(__int64))v31->FreeEx)(v28);
}
*((_QWORD *)v27 + 4) = 0i64;
v26 = (_ADAPTER_OBJECT *)FoundObject;
}
}
else
{
v24 = ObOpenHandle;
}
if( (*(_DWORD *)(ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ (unsigned __int8)v27[24] ^ (unsigned __int64)BYTE1(v27)]
+ 72) & (__int64)v14[10].Next) != 0 )
{
HalPutDmaAdapter(v26);
v15 = -1073741811;
}
else
{
*((_QWORD *)&v66 + 1) = &CapturedObjectName;
*(_QWORD *)&v66 = &ObjectType->Name;
*(_QWORD *)&v67 = *((_QWORD *)&v14[10].Next + 1);
SeSetLearningModeObjectInformation(ObjectInformation);
LODWORD(v57) = MaxRelativeAccessMask;
LODWORD(UseLookasidea) = v14[10].Next;
LODWORD(ObjectCreateInfo) = 0;
v32 = ObpCreateHandle(
v24,
FoundObject,
0i64,
AccessState,
(UINT64)ObjectCreateInfo,
UseLookasidea,
AccessMode,
0i64,
v57,
0i64,
&v61);
if( v32 < 0 )
{
HalPutDmaAdapter((PADAPTER_OBJECT)FoundObject);
v15 = v32;
}
else
{
*Handle = v61;
}
}
v33 = ObjectHeader;
if( ObjectHeader )
{
if( _InterlockedExchangeAdd(
(volatile signed __int32 *)(&ObjectHeader->TypeIndex
- *((unsigned __int8 *)&dword_140C25D60 + (ObjectHeader->InfoMask & 3))),
0xFFFFFFFF) == 1 )
ObpDeleteNameCheck(v33);
HalPutDmaAdapter((PADAPTER_OBJECT)&v33->Body);
}
}
goto LABEL_33;
}
return -1073741811;
}Referenced by:
IoQueryInformationByName
IoRevokeHandlesForProcess
IopCreateFile
IopFastQueryNetworkAttributes
NtDeleteFile
NtOpenSymbolicLinkObject
NtQueryAttributesFile
NtQueryFullAttributesFile
ObOpenObjectByName