ObpInsertOrLocateNamedObject
NTSTATUS __stdcall ObpInsertOrLocateNamedObject(
_EPROCESS *Process,
PVOID InsertObject,
UINT64 *GrantedAccess,
_ACCESS_STATE *AccessState,
CHAR AccessMode,
_OBJECT_CREATE_INFORMATION *ObjectCreateInfo,
PVOID *ReferencedNewObject){
unsigned __int64 v11;
unsigned __int64 v12;
char v13;
_EJOB *Silo;
UINT64 Attributes;
char v16;
_UNICODE_STRING *v17;
struct _DMA_ADAPTER *v18;
NTSTATUS ObjectSecurity;
bool v20;
PADAPTER_OBJECT v21;
_DWORD **v22;
unsigned __int8 v23;
_DWORD *v24;
UINT8 UseTokenDefaultDaclForBaseDescriptor;
_ACCESS_STATE *v26;
INT64 v28;
int v29;
PADAPTER_OBJECT v30;
void *v31;
__int128 v32;
__int128 v33;
__int128 v34;
__int128 v35;
__int128 v36;
__int128 v37;
__int128 v38;
__int128 v39;
INT64 v40;
INT64 v41;
unsigned __int8 DaclDefaulted;
char DaclPresent[3];
WORD Control;
ULONG Revision[2];
UINT64 AdditionalAutoInheritFlags;
PADAPTER_OBJECT DmaAdapter;
PVOID SecurityDescriptor;
PACL Dacl;
PVOID Object;
_OBP_LOOKUP_CONTEXT LookupContext;
unsigned __int64 v52;
PVOID *v53;
__int128 result[4];
__int128 v55;
__int128 v56;
__int128 v57;
__int128 v58;
__int128 v59;
__int128 v60;
Object = InsertObject;
v53 = ReferencedNewObject;
Control = 0;
DaclPresent[0] = 0;
DmaAdapter = 0i64;
memset(&LookupContext, 0, sizeof(LookupContext));
memset((INT64)result, 0i64);
*ReferencedNewObject = 0i64;
Dacl = 0i64;
v11 = (unsigned __int64)InsertObject - 48;
if( (*((char *)InsertObject - 22) & 2) != 0 )
v12 = v11 - *((unsigned __int8 *)ObpInfoMaskToOffset + (*((char *)InsertObject - 22) & 3));
else
v12 = 0i64;
v13 = *(_BYTE *)(v11 + 27);
*(_QWORD *)Revision = v12;
Silo = PsGetCurrentSilo();
Attributes = ObjectCreateInfo->Attributes;
v16 = BYTE1(v11) ^ *(_BYTE *)(v11 + 24);
v52 = v11 >> 8;
v17 = (_UNICODE_STRING *)(v12 + 8);
v18 = (struct _DMA_ADAPTER *)Object;
LOBYTE(v40) = (v13 & 2) == 0;
ObjectSecurity = ObpLookupObjectName(
ObjectCreateInfo->RootDirectory,
v17,
Attributes,
(_OBJECT_TYPE *)ObTypeIndexTable[(unsigned __int8)(ObHeaderCookie ^ v16)],
v40,
0i64,
ObjectCreateInfo->SecurityQos,
Object,
Silo,
AccessState,
&LookupContext,
0i64,
(VOID **)&DmaAdapter);
if( ObjectSecurity < 0 )
goto LABEL_45;
v20 = DmaAdapter == v18;
v21 = 0i64;
if( !v20 )
{
if( LookupContext.DirectoryLocked )
{
v21 = DmaAdapter - 3;
ObpReferenceNamedObject((INT64)&DmaAdapter[-3]);
}
ObpReleaseLookupContext((INT64)&LookupContext);
ObpDecrementHandleCount((ULONG_PTR)Process, v11);
if( (ObjectCreateInfo->Attributes & 0x80u) == 0 )
{
if( v21 )
ObpDereferenceNamedObject((INT64)v21);
ObjectSecurity = -1073741771;
}
else
{
v29 = *((_DWORD *)AccessState + 6);
*((_DWORD *)AccessState + 5) = 0;
v30 = DmaAdapter;
LOBYTE(v28) = AccessMode;
*((_DWORD *)AccessState + 4) = v29;
LODWORD(v41) = ObjectCreateInfo->Attributes;
ObjectSecurity = ObpGrantAccess(ObOpenHandle, v30, AccessState, v28, v41, (UINT *)GrantedAccess);
if( ObjectSecurity < 0 )
{
if( v21 )
ObpDereferenceNamedObject((INT64)v21);
}
else
{
ObjectSecurity = ObpIncrementHandleCountEx(
1,
(__int64)GrantedAccess,
(ULONG_PTR)Process,
(__int64)DmaAdapter,
AccessMode,
ObjectCreateInfo->Attributes,
0i64);
if( v21 )
ObpDereferenceNamedObject((INT64)v21);
if( ObjectSecurity >= 0 )
goto LABEL_19;
}
}
HalPutDmaAdapter(DmaAdapter);
return ObjectSecurity;
}
v22 = *(_DWORD ***)Revision;
v23 = 0;
SecurityDescriptor = 0i64;
DaclDefaulted = 0;
LODWORD(AdditionalAutoInheritFlags) = 0;
v24 = **(_DWORD ***)Revision;
if( **(_QWORD **)Revision )
{
if( (v24[84] & 8) != 0 || ObpObjectSecurityInheritance )
LODWORD(AdditionalAutoInheritFlags) = 3;
ObjectSecurity = ObpGetObjectSecurity(v24, &SecurityDescriptor, &DaclDefaulted, AccessMode);
if( ObjectSecurity < 0 )
goto LABEL_52;
v21 = (PADAPTER_OBJECT)SecurityDescriptor;
v23 = DaclDefaulted;
v22 = *(_DWORD ***)Revision;
}
UseTokenDefaultDaclForBaseDescriptor = 0;
if( !*v22 || ((*v22)[84] & 8) == 0 && !ObpObjectSecurityInheritance )
goto LABEL_13;
v31 = (void *)*((_QWORD *)AccessState + 8);
if( !v31 )
goto LABEL_13;
Revision[0] = RtlGetDaclSecurityDescriptor(v31, (UINT8 *)DaclPresent, &Dacl, &DaclDefaulted);
if( (Revision[0] & 0x80000000) == 0 )
{
Revision[0] = RtlGetControlSecurityDescriptor(*((PVOID *)AccessState + 8), &Control, (UINT64 *)Revision);
if( (Revision[0] & 0x80000000) == 0 )
{
if( !Dacl && (Control & 0x1000) == 0 )
{
v32 = *((_OWORD *)AccessState + 1);
result[0] = *(_OWORD *)AccessState;
v33 = *((_OWORD *)AccessState + 2);
result[1] = v32;
v34 = *((_OWORD *)AccessState + 3);
result[2] = v33;
v35 = *((_OWORD *)AccessState + 4);
result[3] = v34;
v36 = *((_OWORD *)AccessState + 5);
v55 = v35;
v37 = *((_OWORD *)AccessState + 6);
v56 = v36;
v38 = *((_OWORD *)AccessState + 8);
v57 = v37;
v58 = *((_OWORD *)AccessState + 7);
v39 = *((_OWORD *)AccessState + 9);
v59 = v38;
v60 = v39;
*(_QWORD *)&v55 = 0i64;
v26 = (_ACCESS_STATE *)result;
goto LABEL_14;
}
LABEL_13:
v26 = AccessState;
LABEL_14:
if( !*((_QWORD *)v26 + 8) )
{
if( (_DWORD)AdditionalAutoInheritFlags )
UseTokenDefaultDaclForBaseDescriptor = 1;
}
LODWORD(v41) = AdditionalAutoInheritFlags;
ObjectSecurity = ObpAssignSecurity(
v26,
v21,
Object,
(_OBJECT_TYPE *)ObTypeIndexTable[(unsigned __int8)(ObHeaderCookie ^ v52 ^ *((char *)Object - 24))],
v41,
UseTokenDefaultDaclForBaseDescriptor);
if( v21 )
{
ObReleaseObjectSecurity(v21, v23);
goto LABEL_17;
}
if( ObjectSecurity >= 0 )
{
SeReleaseSecurityDescriptor(ObjectCreateInfo->SecurityDescriptor, ObjectCreateInfo->ProbeMode, 1u);
ObjectCreateInfo->SecurityDescriptor = 0i64;
*((_QWORD *)AccessState + 8) = 0i64;
LABEL_17:
if( ObjectSecurity >= 0 )
{
ObpReleaseLookupContext((INT64)&LookupContext);
LABEL_19:
*v53 = DmaAdapter;
return ObjectSecurity;
}
}
LABEL_52:
ObpDeleteDirectoryEntry((INT64)&LookupContext);
ObpReleaseLookupContext((INT64)&LookupContext);
LABEL_45:
ObpDecrementHandleCount((ULONG_PTR)Process, v11);
return ObjectSecurity;
}
}
if( v21 )
ObReleaseObjectSecurity(v21, v23);
ObpDeleteDirectoryEntry((INT64)&LookupContext);
ObpReleaseLookupContext((INT64)&LookupContext);
ObpDecrementHandleCount((ULONG_PTR)Process, v11);
return Revision[0];
}Referenced by:
ObpCreateHandle