SdbReadEntryInformation
__int64 __fastcall SdbReadEntryInformation(VOID *a1, UINT64 a2, __int64 a3){
unsigned int BinaryTag;
_DB *v5;
unsigned int v6;
unsigned int FirstTag;
NTSTATUS EntryFlags;
_GUID v9;
__int64 v10;
INT8 *v12;
UINT64 v13;
UINT64 ptiWhich;
_DB *ppdb;
UINT8 pBuffer[16];
_GUID pguidDB;
__int64 v18;
LODWORD(ptiWhich) = 0;
ppdb = 0i64;
v18 = 0i64;
*(_OWORD *)pBuffer = 0i64;
pguidDB = 0i64;
BinaryTag = SdbTagRefToTagID(a1, a2, &ppdb, &ptiWhich);
if( !BinaryTag )
{
v12 = (INT8 *)"Failed to convert tagref 0x%x to tagid";
v13 = 5733i64;
LABEL_11:
AslLogCallPrintf(1ui64, (INT8 *)"SdbReadEntryInformation", v13, v12);
return BinaryTag;
}
v5 = ppdb;
v6 = ptiWhich;
FirstTag = SdbFindFirstTag(ppdb, (unsigned int)ptiWhich, 0x9004u);
if( !FirstTag )
{
AslLogCallPrintf(
1ui64,
(INT8 *)"SdbReadEntryInformation",
0x166Fui64,
(INT8 *)"Failed to read TAG_EXE_ID for tiExe 0x%x");
return 0;
}
BinaryTag = SdbReadBinaryTag(v5, FirstTag, pBuffer, 0x10ui64);
if( !BinaryTag )
{
v12 = (INT8 *)"Failed to read GUID referenced by 0x%x";
v13 = 5753i64;
goto LABEL_11;
}
if( !SdbGetDatabaseID(v5, pguidDB.Data4) )
{
AslLogCallPrintf(
1ui64,
(INT8 *)"SdbReadEntryInformation",
0x1681ui64,
(INT8 *)"Failed to read GUID of the database");
return 0;
}
EntryFlags = SdbGetEntryFlags((_GUID *)pBuffer, (UINT64 *)&pguidDB.Data1);
pguidDB.Data1 &= -(EntryFlags != 0);
*(_DWORD *)&pguidDB.Data2 = SdbFindFirstTag(v5, v6, 0x700Fu);
if( a3 )
{
v9 = pguidDB;
*(_OWORD *)a3 = *(_OWORD *)pBuffer;
v10 = v18;
*(_GUID *)(a3 + 16) = v9;
*(_QWORD *)(a3 + 32) = v10;
}
return 1;
}Referenced by:
PiIsDriverBlocked