PiDevCfgQueryDriverNode
NTSTATUS __stdcall PiDevCfgQueryDriverNode(
WCHAR *DriverInfName,
WCHAR *DeviceId,
UINT64 IdentifierScore,
UINT64 FeatureScore,
UINT64 Flags,
PI_DEVCFG_DRIVER_NODE **DriverNodeResult){
wchar_t *i;
NTSTATUS ObjectProperties;
WCHAR *v10;
VOID **PoolWithTag;
VOID **v12;
PVOID *v13;
INT64 v14;
int v15;
int v16;
NTSTATUS v17;
INT64 v18;
NTSTATUS v19;
int v20;
WCHAR *v21;
NTSTATUS v22;
int v23;
__int64 v25;
WCHAR *v26;
char v27;
INT64 v28;
INT64 v29;
INT64 v30;
INT64 v31;
INT64 v32;
INT64 v33;
INT64 v34;
INT64 v35;
UINT64 *v36;
INT64 v37;
INT64 v38;
INT64 v39;
INT64 v40;
INT64 v41;
char v42;
char v43;
int v44;
VOID *DriverPackageKeyHandle;
VOID *ConfigurationKeyHandle;
_KEXCEPTION_FRAME *ExceptionFrame;
_UNICODE_STRING DriverPackageId;
_UNICODE_STRING v49;
int v50;
int v51;
VOID *KeyHandle;
_UNICODE_STRING UnicodeString;
_OBJECT_ATTRIBUTES ObjectAttributes;
PI_DEVCFG_DRIVER_NODE **v55;
INT64 v56[28];
v55 = DriverNodeResult;
v50 = FeatureScore;
v44 = -16777216;
v51 = IdentifierScore;
*(_QWORD *)&DriverPackageId.Length = 0i64;
DriverPackageId.Buffer = 0i64;
i = 0i64;
DriverPackageKeyHandle = 0i64;
v43 = 0;
*(_QWORD *)&UnicodeString.Length = 0i64;
UnicodeString.Buffer = 0i64;
v42 = 0;
v49 = 0i64;
KeyHandle = 0i64;
ExceptionFrame = 0i64;
ConfigurationKeyHandle = 0i64;
ObjectProperties = PiDevCfgGetDriverPackageId(
DriverInfName,
&DriverPackageId,
IdentifierScore,
FeatureScore,
v28,
v31,
v36,
v39);
if( ObjectProperties < 0 )
goto LABEL_43;
ObjectProperties = PnpOpenObjectRegKey(
*(&stru_140CF2E80 + 607),
(__int64)DriverPackageId.Buffer,
8u,
131097,
0,
(__int64)&DriverPackageKeyHandle);
if( ObjectProperties < 0 )
goto LABEL_43;
memset(v56, 0i64, 0xC8u);
v56[0] = (INT64)DEVPKEY_DriverPackage_Invalidated;
LODWORD(v32) = 2;
v56[2] = (INT64)&v43;
v56[5] = (INT64)DEVPKEY_DriverPackage_TargetComputerIds;
v56[7] = (INT64)&UnicodeString;
LODWORD(v56[1]) = 17;
LODWORD(v56[3]) = 1;
LODWORD(v56[6]) = 8210;
HIDWORD(v56[8]) = 6;
ObjectProperties = PiDevCfgQueryObjectProperties(
v10,
(PNP_OBJECT_TYPE)DriverPackageId.Buffer,
(VOID *)8,
(PI_DEVCFG_QUERY_PROPERTY_PARAM *)DriverPackageKeyHandle,
(UINT64)v56,
v32);
if( ObjectProperties < 0 )
goto LABEL_43;
if( SLODWORD(v56[4]) >= 0 && v43 == -1 )
{
ObjectProperties = -1073741738;
goto LABEL_43;
}
if( SLODWORD(v56[9]) >= 0 && UnicodeString.Buffer && UnicodeString.Length > 2u )
{
for( i = UnicodeString.Buffer; *i; i += v25 + 1 )
{
if( (unsigned __int8)PipCheckComputerSupported(i) )
break;
v25 = -1i64;
do
++v25;
while( i[v25] );
}
if( !*i )
goto LABEL_63;
}
if( (Flags & 8) != 0 && !i )
{
LABEL_63:
ObjectProperties = -1073740764;
goto LABEL_43;
}
PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x1A0ui64, 1667526736i64);
v12 = PoolWithTag;
if( !PoolWithTag )
{
ObjectProperties = -1073741670;
goto LABEL_43;
}
memset(PoolWithTag, 0i64, 0x1A0u);
v12[29] = v12 + 28;
v12[28] = v12 + 28;
v12[27] = v12 + 26;
v12[26] = v12 + 26;
v12[47] = v12 + 46;
v12[46] = v12 + 46;
if( !RtlCreateUnicodeString((INT64)(v12 + 5), (INT8 *)DriverInfName)
|| !PnpDuplicateUnicodeString((__int64)(v12 + 7), (__int64)&DriverPackageId)
|| !RtlCreateUnicodeString((INT64)(v12 + 9), (INT8 *)DeviceId)
|| i && !RtlCreateUnicodeString((INT64)(v12 + 16), (INT8 *)i) )
{
ObjectProperties = -1073741670;
goto LABEL_41;
}
memset(v56, 0i64, 0xC8u);
v56[0] = (INT64)DEVPKEY_DriverPackage_DriverDate;
LODWORD(v33) = 5;
LODWORD(v56[1]) = 16;
v56[5] = (INT64)DEVPKEY_DriverPackage_DriverVersion;
v56[2] = (INT64)(v12 + 14);
v56[7] = (INT64)(v12 + 15);
LODWORD(v56[3]) = 8;
v56[10] = (INT64)&DEVPKEY_DriverPackage_SignerScore;
v13 = v12 + 18;
LODWORD(v56[8]) = 8;
v56[12] = (INT64)&v44;
v56[15] = (INT64)DEVPKEY_DriverPackage_ExtensionId;
v56[20] = (INT64)DEVPKEY_DriverPackage_ExtensionContractIds;
HIDWORD(v56[23]) = 2;
LODWORD(v56[6]) = 9;
LODWORD(v56[11]) = 7;
LODWORD(v56[13]) = 4;
LODWORD(v56[16]) = 13;
v56[17] = (INT64)v12 + 188;
LODWORD(v56[18]) = 16;
LODWORD(v56[21]) = 4109;
v56[22] = (INT64)(v12 + 18);
ObjectProperties = PiDevCfgQueryObjectProperties(
(WCHAR *)0x10,
(PNP_OBJECT_TYPE)DriverPackageId.Buffer,
(VOID *)8,
(PI_DEVCFG_QUERY_PROPERTY_PARAM *)DriverPackageKeyHandle,
(UINT64)v56,
v33);
if( ObjectProperties < 0 )
goto LABEL_41;
if( SLODWORD(v56[4]) < 0 )
v12[14] = 0i64;
if( SLODWORD(v56[9]) < 0 )
v12[15] = 0i64;
v15 = v44;
if( SLODWORD(v56[14]) < 0 )
v15 = -16777216;
v44 = v15;
if( SLODWORD(v56[19]) < 0 )
*(_OWORD *)((char *)v12 + 188) = 0i64;
if( SLODWORD(v56[24]) >= 0 )
{
if( (v56[23] & 0xF) != 0 )
{
ExFreePoolWithTag(*v13, 0);
*v13 = 0i64;
}
else
{
*((_DWORD *)v12 + 38) = LODWORD(v56[23]) >> 4;
}
}
else
{
*v13 = 0i64;
}
if( (Flags & 4) != 0 )
v16 = -1;
else
v16 = (unsigned __int16)v51 | v50 & 0xFF0000 | v44 & ((Flags & 1) != 0 ? -268435456 : -16777216);
*((_DWORD *)v12 + 27) = v16;
if( (Flags & 2) != 0 )
{
memset(v56, 0i64, 0xC8u);
v56[0] = (INT64)DEVPKEY_DriverPackage_F6;
v56[2] = (INT64)&v42;
LODWORD(v34) = 1;
LODWORD(v56[1]) = 17;
LODWORD(v56[3]) = 1;
ObjectProperties = PiDevCfgQueryObjectProperties(
v26,
(PNP_OBJECT_TYPE)DriverPackageId.Buffer,
(VOID *)8,
(PI_DEVCFG_QUERY_PROPERTY_PARAM *)DriverPackageKeyHandle,
(UINT64)v56,
v34);
if( ObjectProperties < 0 )
goto LABEL_41;
v27 = v42;
if( SLODWORD(v56[4]) < 0 )
v27 = 0;
v42 = v27;
if( v27 == -1 )
*((_DWORD *)v12 + 46) |= 2u;
}
*(_DWORD *)&v49.Length = 1572886;
v49.Buffer = L"Descriptors";
ObjectAttributes.RootDirectory = DriverPackageKeyHandle;
*(_QWORD *)&ObjectAttributes.Length = 48i64;
ObjectAttributes.ObjectName = &v49;
*(_QWORD *)&ObjectAttributes.Attributes = 576i64;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
v17 = ZwOpenKey(&KeyHandle, 0x20019ui64, &ObjectAttributes, v14, v29, v34, v37, v40);
ObjectProperties = v17;
if( v17 == -1073741772 )
goto LABEL_52;
if( v17 < 0 )
goto LABEL_41;
ObjectAttributes.RootDirectory = KeyHandle;
*(_QWORD *)&ObjectAttributes.Length = 48i64;
*(_QWORD *)&ObjectAttributes.Attributes = 576i64;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
ObjectAttributes.ObjectName = (_UNICODE_STRING *)(v12 + 9);
v19 = ZwOpenKey((VOID **)&ExceptionFrame, 0x20019ui64, &ObjectAttributes, v18, v30, v35, v38, v41);
ObjectProperties = v19;
if( v19 == -1073741772 )
{
LABEL_52:
ObjectProperties = 0;
}
else
{
if( v19 < 0 )
goto LABEL_41;
memset(v56, 0i64, sizeof(v56));
v56[2] = (INT64)L"Configuration";
LODWORD(v56[4]) = 0x1000000;
v56[3] = (INT64)(v12 + 11);
LODWORD(v56[1]) = 288;
LOBYTE(v35) = 1;
LOBYTE(v20) = RtlpQueryRegistryValues((_KTRAP_FRAME *)0xC0000000i64, ExceptionFrame);
ObjectProperties = v20;
if( v20 < 0 )
goto LABEL_41;
if( !*((_WORD *)v12 + 44) && v12[12] )
RtlFreeAnsiString((_UNICODE_STRING *)(v12 + 11));
}
v21 = (WCHAR *)v12[12];
if( !v21 )
{
LABEL_39:
if( PnpBootMode )
{
*(_DWORD *)&v49.Length = 1572886;
v49.Buffer = (wchar_t *)L"ConfigFlags";
if( !ConfigurationKeyHandle || !PnpRegistryValueExists(ConfigurationKeyHandle, &v49) )
*((_DWORD *)v12 + 46) |= 4u;
}
v12[2] = DriverPackageKeyHandle;
v12[3] = ExceptionFrame;
v12[4] = ConfigurationKeyHandle;
DriverPackageKeyHandle = 0i64;
ExceptionFrame = 0i64;
ConfigurationKeyHandle = 0i64;
*v55 = (PI_DEVCFG_DRIVER_NODE *)v12;
v12 = 0i64;
goto LABEL_41;
}
v22 = PiDevCfgOpenDriverConfiguration(DriverPackageKeyHandle, v21, &ConfigurationKeyHandle, v18, v30, v35, v38, v41);
ObjectProperties = v22;
if( v22 == -1073741772 )
{
ObjectProperties = 0;
goto LABEL_39;
}
if( v22 >= 0 )
{
memset(v56, 0i64, sizeof(v56));
v56[0] = (INT64)PiDevCfgQueryDriverVersionValueCallback;
v56[2] = (INT64)L"DriverDate";
v56[7] = (INT64)PiDevCfgQueryDriverVersionValueCallback;
v56[9] = (INT64)L"DriverVersion";
v56[3] = (INT64)(v12 + 14);
v56[10] = (INT64)(v12 + 15);
LODWORD(v56[18]) = 117440512;
v56[16] = (INT64)L"ExcludeIds";
v56[17] = (INT64)(v12 + 20);
LODWORD(v56[15]) = 304;
LOBYTE(v23) = RtlpQueryRegistryValues((_KTRAP_FRAME *)0xC0000000i64, (_KEXCEPTION_FRAME *)ConfigurationKeyHandle);
ObjectProperties = v23;
if( v23 >= 0 )
{
if( *((_WORD *)v12 + 80) <= 2u && v12[21] )
RtlFreeAnsiString((_UNICODE_STRING *)v12 + 10);
goto LABEL_39;
}
}
LABEL_41:
if( v12 )
PiDevCfgFreeDriverNode((_PI_DEVCFG_DRIVER_NODE *)v12);
LABEL_43:
if( DriverPackageKeyHandle )
ZwClose((_HANDLE)DriverPackageKeyHandle);
if( ExceptionFrame )
ZwClose((_HANDLE)ExceptionFrame);
if( KeyHandle )
ZwClose((_HANDLE)KeyHandle);
if( ConfigurationKeyHandle )
ZwClose((_HANDLE)ConfigurationKeyHandle);
RtlFreeAnsiString(&DriverPackageId);
RtlFreeAnsiString(&UnicodeString);
return ObjectProperties;
}Referenced by:
PiDevCfgFindDeviceDriver