ObQueryDeviceMapInformation
NTSTATUS __stdcall ObQueryDeviceMapInformation(_EPROCESS *TargetProcess, VOID *DeviceMapInformation, UINT64 Flags){
char v5;
int v6;
_KSPIN_LOCK *v7;
_DEVICE_MAP *v8;
_EJOB *v9;
_ESERVERSILO_GLOBALS *ServerSiloGlobals;
_EX_PUSH_LOCK *v11;
_ETHREAD *CurrentThread;
NTSTATUS v13;
_DEVICE_MAP *DeviceMap;
_OBJECT_DIRECTORY *GlobalDosDevicesDirectory;
unsigned int DriveMap;
int v17;
unsigned int v18;
int v19;
int v20;
int v21;
int v22;
int v23;
int v24;
int v25;
int v26;
int v27;
int v28;
int v29;
int v30;
int v31;
int v32;
int v33;
void **p_DeviceMap;
__int128 v36;
__int128 v37;
__int64 v38;
v36 = 0i64;
v37 = 0i64;
v38 = 0i64;
v5 = 0;
if( (Flags & 0xFFFFFFFE) != 0 )
return -1073741811;
v6 = Flags & 1;
if( TargetProcess )
{
if( KeGetCurrentThread()->ApcState.Process != TargetProcess )
return -1073741811;
}
v8 = ObpReferenceDeviceMap(0);
if( TargetProcess )
{
LODWORD(v9) = PsGetProcessServerSilo((INT64)TargetProcess);
ServerSiloGlobals = PsGetServerSiloGlobals(v9);
}
else
{
ServerSiloGlobals = PsGetCurrentServerSiloGlobals(v7);
}
v11 = (_EX_PUSH_LOCK *)ServerSiloGlobals;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.SpecialApcDisable;
ExAcquirePushLockSharedEx(v11 + 15, 0i64);
if( v8 )
{
v5 = 1;
}
else
{
p_DeviceMap = &TargetProcess->DeviceMap;
if( !TargetProcess )
p_DeviceMap = (void **)v11;
v8 = (_DEVICE_MAP *)*p_DeviceMap;
}
if( v8 )
{
v13 = 0;
DeviceMap = v8;
GlobalDosDevicesDirectory = v8->GlobalDosDevicesDirectory;
if( GlobalDosDevicesDirectory && GlobalDosDevicesDirectory->DeviceMap )
DeviceMap = GlobalDosDevicesDirectory->DeviceMap;
DriveMap = v8->DriveMap;
LODWORD(v36) = DriveMap;
v17 = 1;
v18 = 2;
do
{
*((_BYTE *)&v36 + v18 + 2) = v8->DriveType[v18 - 2];
if( (DriveMap & v17) == 0 && !v6 )
{
*((_BYTE *)&v36 + v18 + 2) = DeviceMap->DriveType[v18 - 2];
LODWORD(v36) = v17 & DeviceMap->DriveMap | v36;
}
v19 = 2 * v17;
*((_BYTE *)&v36 + v18 + 3) = v8->DriveType[v18 - 1];
if( (DriveMap & v19) == 0 && !v6 )
{
*((_BYTE *)&v36 + v18 + 3) = DeviceMap->DriveType[v18 - 1];
LODWORD(v36) = v19 & DeviceMap->DriveMap | v36;
}
v20 = 2 * v19;
*((_BYTE *)&v36 + v18 + 4) = v8->DriveType[v18];
if( (DriveMap & v20) == 0 && !v6 )
{
*((_BYTE *)&v36 + v18 + 4) = DeviceMap->DriveType[v18];
LODWORD(v36) = v20 & DeviceMap->DriveMap | v36;
}
v21 = 2 * v20;
*((_BYTE *)&v36 + v18 + 5) = v8->DriveType[v18 + 1];
if( (DriveMap & v21) == 0 && !v6 )
{
*((_BYTE *)&v36 + v18 + 5) = DeviceMap->DriveType[v18 + 1];
LODWORD(v36) = v21 & DeviceMap->DriveMap | v36;
}
v22 = 2 * v21;
*((_BYTE *)&v36 + v18 + 6) = v8->DriveType[v18 + 2];
if( (DriveMap & v22) == 0 && !v6 )
{
*((_BYTE *)&v36 + v18 + 6) = DeviceMap->DriveType[v18 + 2];
LODWORD(v36) = v22 & DeviceMap->DriveMap | v36;
}
v23 = 2 * v22;
*((_BYTE *)&v36 + v18 + 7) = v8->DriveType[v18 + 3];
if( (DriveMap & v23) == 0 && !v6 )
{
*((_BYTE *)&v36 + v18 + 7) = DeviceMap->DriveType[v18 + 3];
LODWORD(v36) = v23 & DeviceMap->DriveMap | v36;
}
v24 = 2 * v23;
*((_BYTE *)&v36 + v18 + 8) = v8->DriveType[v18 + 4];
if( (DriveMap & v24) == 0 && !v6 )
{
*((_BYTE *)&v36 + v18 + 8) = DeviceMap->DriveType[v18 + 4];
LODWORD(v36) = v24 & DeviceMap->DriveMap | v36;
}
v25 = 2 * v24;
*((_BYTE *)&v36 + v18 + 9) = v8->DriveType[v18 + 5];
if( (DriveMap & v25) == 0 && !v6 )
{
*((_BYTE *)&v36 + v18 + 9) = DeviceMap->DriveType[v18 + 5];
LODWORD(v36) = v25 & DeviceMap->DriveMap | v36;
}
v26 = 2 * v25;
*((_BYTE *)&v36 + v18 + 10) = v8->DriveType[v18 + 6];
if( (DriveMap & v26) == 0 && !v6 )
{
*((_BYTE *)&v36 + v18 + 10) = DeviceMap->DriveType[v18 + 6];
LODWORD(v36) = v26 & DeviceMap->DriveMap | v36;
}
v27 = 2 * v26;
*((_BYTE *)&v36 + v18 + 11) = v8->DriveType[v18 + 7];
if( (DriveMap & v27) == 0 && !v6 )
{
*((_BYTE *)&v36 + v18 + 11) = DeviceMap->DriveType[v18 + 7];
LODWORD(v36) = v27 & DeviceMap->DriveMap | v36;
}
v28 = 2 * v27;
*((_BYTE *)&v36 + v18 + 12) = v8->DriveType[v18 + 8];
if( (DriveMap & v28) == 0 && !v6 )
{
*((_BYTE *)&v36 + v18 + 12) = DeviceMap->DriveType[v18 + 8];
LODWORD(v36) = v28 & DeviceMap->DriveMap | v36;
}
v29 = 2 * v28;
*((_BYTE *)&v36 + v18 + 13) = v8->DriveType[v18 + 9];
if( (DriveMap & v29) == 0 && !v6 )
{
*((_BYTE *)&v36 + v18 + 13) = DeviceMap->DriveType[v18 + 9];
LODWORD(v36) = v29 & DeviceMap->DriveMap | v36;
}
v30 = 2 * v29;
*((_BYTE *)&v36 + v18 + 14) = v8->DriveType[v18 + 10];
if( (DriveMap & v30) == 0 && !v6 )
{
*((_BYTE *)&v36 + v18 + 14) = DeviceMap->DriveType[v18 + 10];
LODWORD(v36) = v30 & DeviceMap->DriveMap | v36;
}
v31 = 2 * v30;
*((_BYTE *)&v36 + v18 + 15) = v8->DriveType[v18 + 11];
if( (DriveMap & v31) == 0 && !v6 )
{
*((_BYTE *)&v36 + v18 + 15) = DeviceMap->DriveType[v18 + 11];
LODWORD(v36) = v31 & DeviceMap->DriveMap | v36;
}
v32 = 2 * v31;
*((_BYTE *)&v36 + v18 + 16) = v8->DriveType[v18 + 12];
if( (DriveMap & v32) == 0 && !v6 )
{
*((_BYTE *)&v36 + v18 + 16) = DeviceMap->DriveType[v18 + 12];
LODWORD(v36) = v32 & DeviceMap->DriveMap | v36;
}
v33 = 2 * v32;
*((_BYTE *)&v36 + v18 + 17) = v8->DriveType[v18 + 13];
if( (DriveMap & v33) == 0 && !v6 )
{
*((_BYTE *)&v36 + v18 + 17) = DeviceMap->DriveType[v18 + 13];
LODWORD(v36) = v33 & DeviceMap->DriveMap | v36;
}
v17 = 2 * v33;
v18 += 16;
}
while( v18 - 2 < 0x20 );
ExReleasePushLockEx((_DWORD)v11 + 120, 0);
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
if( v5 == 1 )
ObfDereferenceDeviceMap(v8);
*(_OWORD *)DeviceMapInformation = v36;
*((_OWORD *)DeviceMapInformation + 1) = v37;
*((_DWORD *)DeviceMapInformation + 8) = v38;
}
else
{
ExReleasePushLockEx((_DWORD)v11 + 120, 0);
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
return -1073741807;
}
return v13;
}Referenced by:
NtQueryInformationProcess