VrpHandleIoctlCreateNamespaceNode
NTSTATUS __stdcall VrpHandleIoctlCreateNamespaceNode(
VOID *Data,
UINT64 DataLength,
CHAR RequestorMode,
_GUID *ActivityId,
VOID *ReturnData,
UINT64 *ReturnDataLength){
unsigned int v6;
UINT64 *v8;
int v9;
VOID *v10;
int v11;
int v12;
unsigned int v13;
unsigned int v14;
int JobSilo;
int v16;
unsigned __int64 v17;
int v18;
wchar_t *v19;
_SIZE_T v20;
wchar_t *v21;
int v22;
UINT64 Tag;
_SIZE_T Taga;
wchar_t *v26;
_SIZE_T v27;
wchar_t *v28;
PVOID ReturnedSiloContext;
_VRP_JOB_CONTEXT *JobContext;
__int128 v31;
_UNICODE_STRING InputString;
_EJOB *Silo;
ReturnDataLength = 0i64;
ReturnedSiloContext = 0i64;
v6 = DataLength;
ReturnData = 0i64;
Silo = 0i64;
v8 = 0i64;
v9 = 0;
v10 = 0i64;
InputString = 0i64;
v31 = 0i64;
if( (unsigned int)DataLength < 0x18 )
return -1073741811;
v11 = *((unsigned __int16 *)Data + 4);
if( (v11 & 1) != 0 || (v12 = *((unsigned __int16 *)Data + 5), (v12 & 1) != 0) )
{
JobSilo = -1073741811;
goto LABEL_25;
}
if( !(_WORD)v11 )
return -1073741811;
if( !(_WORD)v12 )
return -1073741811;
v13 = v11 + 20;
v14 = v13 + v12;
if( v13 > v14 || v6 < v14 )
return -1073741811;
LODWORD(Tag) = 1381395779;
JobSilo = ObReferenceObjectByHandleWithTag(
*(VOID **)Data,
6ui64,
(_OBJECT_TYPE *)PsJobType,
RequestorMode,
Tag,
(VOID **)&ReturnDataLength,
0i64);
if( JobSilo < 0 )
goto LABEL_19;
v16 = *((_DWORD *)Data + 3);
InputString.Buffer = (wchar_t *)((char *)Data + 20);
v17 = *((unsigned __int16 *)Data + 4);
InputString.MaximumLength = v17;
InputString.Length = v17;
*((_QWORD *)&v31 + 1) = (char *)Data + 2 * (v17 >> 1) + 20;
LOWORD(v17) = *((_WORD *)Data + 5);
v18 = *((_DWORD *)Data + 4);
WORD1(v31) = v17;
LOWORD(v31) = v17;
if( (v16 & 7) == v16 )
{
JobSilo = PsGetJobSilo((_EJOB *)ReturnDataLength, &Silo);
if( JobSilo < 0 )
goto LABEL_19;
if( !PsIsThreadInSilo((_ETHREAD *)KeGetCurrentThread(), Silo) )
{
JobContext = 0i64;
VRegEnabledInJob(&JobContext);
JobSilo = PsGetPermanentSiloContext(Silo, (unsigned int)VrpSiloContextSlot, &ReturnedSiloContext);
if( JobSilo < 0 )
goto LABEL_19;
v8 = (UINT64 *)ReturnedSiloContext;
VrpLockJobContextExclusive(
(PWCHAR)ReturnedSiloContext,
v19,
v20,
v21,
Taga,
v26,
v27,
v28,
(_SIZE_T)ReturnedSiloContext,
(INT64)JobContext,
(PWCHAR)v31);
v9 = 1;
v22 = VrpCreateNamespaceNode(v8, &InputString, JobContext, (const VOID **)&v31, v16, v18, (__int64)&ReturnData);
v10 = ReturnData;
JobSilo = v22;
if( v22 >= 0 )
{
JobSilo = VrpAddNamespaceNodeToList((_VRP_JOB_CONTEXT *)v8, (_UNICODE_STRING *)ReturnData);
if( JobSilo >= 0 )
{
JobSilo = VrpCreateNamespaceNodePlaceholderKey((INT64)v10);
if( JobSilo >= 0 )
{
JobSilo = 0;
LABEL_18:
VrpUnlockJobContextExclusive((INT64)v8);
goto LABEL_19;
}
}
}
LABEL_25:
if( v10 )
VrpDestroyNamespaceNode(v8, (__int64)v10);
if( !v9 )
goto LABEL_19;
goto LABEL_18;
}
}
JobSilo = -1073741811;
LABEL_19:
if( ReturnDataLength )
ObfDereferenceObjectWithTag(ReturnDataLength, 0x52566D43ui64);
return JobSilo;
}Referenced by:
VrpIoctlDeviceDispatch