KsepResolveApplicableShimsForDriver
NTSTATUS __stdcall KsepResolveApplicableShimsForDriver(_KSE_SHIM_INFO *Shims, UINT64 ShimCount){
_ETHREAD *CurrentThread;
int LoadedModulesList;
int v4;
int v5;
unsigned int v6;
__int64 v8;
_KSE_SHIM_INFO *v9;
_KSE_SHIM_INFO *v10;
__int64 v11;
int v12;
__int64 v13;
_KSE_SHIM_INFO *v14;
int v15;
_ETHREAD *v16;
__int64 v17;
__int64 v18;
_KSE_SHIM_INFO *v19;
__int64 v20;
_ETHREAD *v21;
__int64 v22;
_KSE_SHIM_INFO *v23;
__int64 v24;
__int64 v26;
__int64 v27;
__int64 v28;
int v29;
_RTL_PROCESS_MODULES *LoadedModules;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
LoadedModulesList = 0;
LoadedModules = 0i64;
v4 = 0;
v5 = 0;
v6 = ShimCount;
v29 = 0;
--CurrentThread->Tcb.KernelApcDisable;
ExAcquirePushLockExclusiveEx(&stru_140C50350, 0i64);
if( v6 )
{
v9 = Shims + 18;
v10 = Shims;
v11 = v6;
do
{
if( (unsigned int)KsepIsShimRegistered((__int64)&Engine, v10, v8, (_QWORD *)v10 + 9) == 1 )
{
v12 = *(_DWORD *)(*(_QWORD *)v9 + 24i64);
if( !v12 )
v5 = 1;
*(_DWORD *)(*(_QWORD *)v9 + 24i64) = v12 + 1;
}
else
{
*(_QWORD *)v9 = 0i64;
v5 = 1;
v29 = 1;
}
v10 += 20;
v9 += 20;
--v11;
}
while( v11 );
v4 = v29;
LoadedModulesList = 0;
}
if( (_InterlockedExchangeAdd64(&stru_140C50350._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(&stru_140C50350);
KeAbPostRelease(&stru_140C50350);
KeLeaveCriticalRegionThread(KeGetCurrentThread());
if( !v4 )
{
LABEL_25:
if( v5 )
{
LoadedModulesList = KsepGetLoadedModulesList(&LoadedModules);
if( LoadedModulesList < 0 )
goto LABEL_38;
v21 = (_ETHREAD *)KeGetCurrentThread();
--v21->Tcb.KernelApcDisable;
ExAcquirePushLockExclusiveEx(&stru_140C50350, 0i64);
v22 = 0i64;
if( v6 )
{
v23 = Shims + 18;
while( 1 )
{
LoadedModulesList = KsepResolveShimHooks(
LoadedModules,
*(_KSE_HOOK_COLLECTION **)(*(_QWORD *)(*(_QWORD *)v23 + 16i64) + 48i64));
if( LoadedModulesList < 0 )
break;
v22 = (unsigned int)(v22 + 1);
v23 += 20;
if( (unsigned int)v22 >= v6 )
goto LABEL_31;
}
if( (_InterlockedExchangeAdd64(&stru_140C50350._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(&stru_140C50350);
KeAbPostRelease(&stru_140C50350);
KeLeaveCriticalRegionThread(KeGetCurrentThread());
v28 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
dword_140C2A864[2 * v28] = LoadedModulesList;
KsepHistoryErrors[2 * v28] = 459292;
if( (KsepDebugFlag & 2) != 0 )
KsepDebugPrint(
6i64,
"KSE: Failed to resolve hooks for shim [0x%08X]. Status 0x%x.\n",
(unsigned int)Shims[20 * v22],
(unsigned int)LoadedModulesList);
KsepLogError(
6,
"KSE: Failed to resolve hooks for shim [0x%08X]. Status 0x%x.\n",
(unsigned int)Shims[20 * v22],
(unsigned int)LoadedModulesList);
}
else
{
LABEL_31:
if( (_InterlockedExchangeAdd64(&stru_140C50350._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(&stru_140C50350);
KeAbPostRelease(&stru_140C50350);
KeLeaveCriticalRegionThread(KeGetCurrentThread());
}
}
goto LABEL_34;
}
v13 = 0i64;
if( v6 )
{
v14 = Shims + 18;
while( 1 )
{
if( !*(_QWORD *)v14 )
{
KsepLoadShimProvider(&Shims[20 * v13]);
LoadedModulesList = v15;
if( v15 < 0 )
break;
}
v13 = (unsigned int)(v13 + 1);
v14 += 20;
if( (unsigned int)v13 >= v6 )
goto LABEL_18;
}
v26 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
dword_140C2A864[2 * v26] = LoadedModulesList;
KsepHistoryErrors[2 * v26] = 459215;
if( (KsepDebugFlag & 2) != 0 )
KsepDebugPrint(
6i64,
"KSE: Failed to load provider for shim [0x%08X]. Status: 0x%x\n",
(unsigned int)Shims[20 * v13],
(unsigned int)LoadedModulesList);
KsepLogError(
6,
"KSE: Failed to load provider for shim [0x%08X]. Status: 0x%x\n",
(unsigned int)Shims[20 * v13],
(unsigned int)LoadedModulesList);
LABEL_34:
if( LoadedModulesList >= 0 )
{
v24 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryMessagesIndex, 1u) + 1) & 0x3F;
HIDWORD(KsepHistoryMessages[v24]) = 0;
LODWORD(KsepHistoryMessages[v24]) = 459306;
if( (KsepDebugFlag & 1) != 0 )
KsepDebugPrint(6i64, "KSE: Successfully resolved %d shim(s).\n", v6);
KsepLogInfo(6, "KSE: Successfully resolved %d shim(s).\n", v6);
}
goto LABEL_38;
}
LABEL_18:
v16 = (_ETHREAD *)KeGetCurrentThread();
--v16->Tcb.KernelApcDisable;
ExAcquirePushLockExclusiveEx(&stru_140C50350, 0i64);
v18 = 0i64;
if( !v6 )
{
LABEL_22:
if( (_InterlockedExchangeAdd64(&stru_140C50350._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(&stru_140C50350);
KeAbPostRelease(&stru_140C50350);
KeLeaveCriticalRegionThread(KeGetCurrentThread());
goto LABEL_25;
}
v19 = Shims + 18;
while( (unsigned int)KsepIsShimRegistered((__int64)&Engine, &Shims[20 * v18], v17, &Shims[20 * v18 + 18]) )
{
v20 = *(_QWORD *)v19;
v18 = (unsigned int)(v18 + 1);
v19 += 20;
++*(_DWORD *)(v20 + 24);
if( (unsigned int)v18 >= v6 )
goto LABEL_22;
}
if( (_InterlockedExchangeAdd64(&stru_140C50350._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(&stru_140C50350);
KeAbPostRelease(&stru_140C50350);
KeLeaveCriticalRegionThread(KeGetCurrentThread());
LoadedModulesList = -1073740782;
v27 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
dword_140C2A864[2 * v27] = -1073740782;
KsepHistoryErrors[2 * v27] = 459244;
if( (KsepDebugFlag & 2) != 0 )
KsepDebugPrint(6i64, "KSE: The provider did not register shim [0x%08X] in time\n", (unsigned int)Shims[20 * v18]);
KsepLogError(6, "KSE: The provider did not register shim [0x%08X] in time\n", (unsigned int)Shims[20 * v18]);
LABEL_38:
KsepPoolFreePaged(LoadedModules);
return LoadedModulesList;
}Referenced by:
KsepGetShimsForDriver