IopParseDevice
NTSTATUS __stdcall IopParseDevice(
PVOID ParseObject,
PVOID ObjectType,
ACCESS_STATE *AccessState,
INT8 AccessMode,
UINT64 Attributes,
UNICODE_STRING *CompleteName,
UNICODE_STRING *RemainingName,
PVOID Context,
SECURITY_QUALITY_OF_SERVICE *SecurityQos,
_OB_EXTENDED_PARSE_PARAMETERS *ExtendedParameters,
PVOID *Object){
int v11;
ACCESS_STATE *v12;
unsigned int *v13;
unsigned int *v14;
__int64 v15;
__int64 v16;
ULONG_PTR v17;
unsigned __int64 v18;
NTSTATUS result;
bool v20;
bool v21;
__int64 v22;
ULONG_PTR v23;
ULONG_PTR v24;
_EJOB *CurrentServerSilo;
int ServerSiloServiceSessionId;
_DEVICE_OBJECT *DevicePDO;
struct _DMA_ADAPTER *v28;
ACCESS_MASK v29;
bool v30;
char v31;
__int64 v32;
int v33;
INT8 v34;
char v35;
int ActiveConsoleId;
_EJOB *v37;
int v38;
bool v39;
BOOL v40;
SECURITY_SUBJECT_CONTEXT *v41;
char v42;
VOID *ClientToken;
DWORD v44;
_UNICODE_STRING *v45;
BOOL v46;
char v47;
char v48;
unsigned __int16 Length;
__int64 v50;
_VPB *v51;
unsigned int *v52;
int v53;
VPB *v54;
_DEVICE_OBJECT *v55;
int v56;
_BOOL8 v57;
UNICODE_STRING *v58;
unsigned int v59;
_ACCESS_STATE *v60;
IRP *Irp;
IRP *v62;
INT8 v63;
_BYTE *v64;
unsigned int v65;
unsigned int v66;
char v67;
DEVICE_OBJECT *v68;
UNICODE_STRING *v69;
PFILE_OBJECT v70;
INT64 v71;
unsigned __int64 v72;
__int64 v73;
_FILE_OBJECT *v74;
_EJOB *v75;
volatile INT32 *p_Type;
_FILE_OBJECT *v77;
char v78;
_EJOB *Silo;
int v80;
_QWORD *v81;
unsigned __int16 v82;
wchar_t *PoolWithTag;
int v84;
const WCHAR *v85;
wchar_t *Buffer;
WCHAR v87;
unsigned __int16 v88;
wchar_t *v89;
const WCHAR *v90;
UNICODE_STRING *v91;
ULONG_PTR v92;
const WCHAR *v93;
INT16 *MostRecentlyUsedName;
int updated;
KEVENT *p_Event;
char v97;
NTSTATUS v98;
unsigned __int8 v99;
int v100;
__int64 v101;
unsigned __int8 CurrentIrql;
int v103;
UINT8 v104;
ECP_LIST *v105;
REPARSE_DATA_BUFFER *v106;
unsigned __int64 v107;
__int64 v108;
PVOID v109;
__int64 v110;
char v111;
int v112;
unsigned int v113;
int v114;
PDEVICE_OBJECT v115;
UNICODE_STRING *v116;
ULONG_PTR v117;
unsigned __int64 v118;
__int64 v119;
UNICODE_STRING *v120;
wchar_t *v121;
wchar_t *v122;
__int64 v123;
ULONG_PTR v124;
ULONG_PTR v125;
struct _DMA_ADAPTER *v126;
DEVICE_OBJECT *v127;
PFILE_OBJECT v128;
DEVICE_OBJECT *v129;
unsigned int v130;
void *v131;
__int64 v132;
unsigned int v133;
unsigned __int64 v134;
__int64 v135;
unsigned int v136;
_ACCESS_STATE *v137;
_OB_EXTENDED_PARSE_PARAMETERS *v138;
__int64 v139;
_DEVICE_OBJECT *RelatedDeviceObject;
_VPB *v141;
_VPB *v142;
_FILE_OBJECT *RelatedFileObject;
unsigned __int64 v144;
__int64 v145;
int FileInformation;
char v147;
__int64 v148;
__int64 v149;
__int64(__fastcall *v150)(_QWORD, _QWORD, _QWORD, _QWORD, _QWORD);
void *v151;
CHAR *Pool_1;
__int64(__fastcall *v153)(_QWORD, _QWORD, _QWORD, _QWORD, _QWORD);
void *v154;
NTSTATUS v155;
_PRIVILEGE_SET *PreviouslyGrantedAccess;
__int64 *PreviouslyGrantedAccessa;
int AccessModea;
unsigned int GrantedAccess;
INT64 AccessStatus;
int v161;
DWORD v162;
ULONG_PTR BugCheckParameter1;
PPRIVILEGE_SET Privileges;
ACCESS_MASK DesiredAccess;
PDEVICE_OBJECT DeviceObject;
_KTHREAD *Thread;
PFILE_OBJECT FileObject;
char v169;
ULONG ReturnedLength;
PVOID P;
PVOID v172;
int v173;
ECP_LIST *EcpList;
_VPB *Vpb;
ULONG_PTR BugCheckParameter4[2];
PVOID TypeExt;
_BYTE *v178;
struct _UNICODE_STRING ObjectTypeName;
struct _ECP_LIST *ExtraCreateParameter;
__int128 v181;
__int64 v182;
void *v183;
VOID *retaddr;
__int64(__fastcall *v186)(_QWORD, _QWORD, _QWORD, _QWORD, _QWORD);
_ACCESS_STATE *AccessStatea;
INT8 v188;
v188 = AccessMode;
AccessStatea = AccessState;
v12 = AccessState;
v13 = (unsigned int *)ParseObject;
v14 = (unsigned int *)Context;
v162 = 0;
LODWORD(AccessStatus) = 0;
*(_OWORD *)BugCheckParameter4 = 0i64;
v181 = 0i64;
v182 = 0i64;
v173 = 0;
LOBYTE(v161) = 0;
ReturnedLength = 0;
ObjectTypeName = 0i64;
Privileges = 0i64;
P = 0i64;
EcpList = 0i64;
v172 = 0i64;
if( ObjectType != IoFileObjectType )
return -1073741788;
Thread = (_ETHREAD *)KeGetCurrentThread();
LOBYTE(v11) = 4;
RtlInitUnicodeString(&ObjectTypeName, L"File", (WCHAR)AccessState);
*Object = 0i64;
FileObject = 0i64;
if( !v14 )
return -1073741788;
while( 1 )
{
v15 = 0x60010000110040i64;
v16 = 0x1080020084i64;
if( *(_WORD *)v14 != 8 || *((_WORD *)v14 + 1) != 216 )
return -1073741788;
v17 = (ULONG_PTR)v13;
BugCheckParameter1 = (ULONG_PTR)v13;
if( v14[8] == 1 )
{
v14[8] = -1096154543;
*((_QWORD *)v14 + 5) = v13;
v14[4] = 0;
ObfReferenceObject(v13);
return 0;
}
if( (v14[38] & 0x10) != 0 )
{
v18 = v13[18];
if( *((_QWORD *)v14 + 3) == 2684354563i64 )
{
if( (unsigned int)v18 > 0x24 || !_bittest64(&v16, v18) )
goto LABEL_10;
}
else
{
v20 = (unsigned int)v18 <= 0x24 && _bittest64(&v16, v18);
v21 = (unsigned int)v18 <= 0x36 && _bittest64(&v15, v18);
if( !v20 && !v21 )
{
LABEL_10:
v14[4] = -1073741192;
return -1073741192;
}
result = IopSymlinkEnforceEnabledTypes(v14[38] & 8, v20, *((ECP_LIST **)v14 + 21));
LODWORD(AccessStatus) = result;
if( result < 0 )
goto LABEL_413;
}
}
v22 = *((_QWORD *)v14 + 5);
if( v22 )
{
v17 = *(_QWORD *)(v22 + 8);
BugCheckParameter1 = v17;
}
if( *(_DWORD *)(v17 + 72) == 7 )
{
v23 = v17;
v24 = v17;
do
{
if( *(_QWORD *)(v23 + 56) )
break;
v23 = *(_QWORD *)(v23 + 24);
v24 = v23;
}
while( v23 );
if( v24 && v24 != v17 )
{
v14[38] |= 2u;
v17 = v24;
BugCheckParameter1 = v24;
}
}
result = IopCheckDeviceAndDriver((_OPEN_PACKET *)v14, (_DEVICE_OBJECT *)v17);
LODWORD(AccessStatus) = result;
if( result < 0 )
goto LABEL_413;
if( (*(_DWORD *)(*(_QWORD *)(v17 + 312) + 32i64) & 0x400) != 0 && !*((_QWORD *)v14 + 5) )
{
CurrentServerSilo = PsGetCurrentServerSilo();
ServerSiloServiceSessionId = PsGetServerSiloServiceSessionId(CurrentServerSilo);
if( ServerSiloServiceSessionId != (unsigned int)PsGetCurrentProcessSessionId()
|| IopSessionZeroAccessCheckEnabled && (v14[16] & 0x40000) == 0 )
{
DevicePDO = IopGetDevicePDO((DEVICE_OBJECT *)v17);
v28 = (struct _DMA_ADAPTER *)DevicePDO;
if( DevicePDO )
{
if( !IopCheckSessionDeviceAccess(DevicePDO) )
{
HalPutDmaAdapter(v28);
IopDecrementDeviceObjectRef((DEVICE_OBJECT *)v17, 0, 0);
v14[4] = -1073741790;
return -1073741790;
}
HalPutDmaAdapter(v28);
}
}
}
RtlMapGenericMask((UINT64 *)v12 + 2, (_GENERIC_MAPPING *)((char *)IoFileObjectType + 76));
RtlMapGenericMask((UINT64 *)v12 + 3, (_GENERIC_MAPPING *)((char *)IoFileObjectType + 76));
SeSetAccessStateGenericMapping(v12, (_GENERIC_MAPPING *)((char *)IoFileObjectType + 76));
v29 = *((_DWORD *)v12 + 4);
DesiredAccess = v29;
v30 = v188 || (v14[21] & 1) != 0;
IopCheckBackupRestorePrivilege(v12, (UINT64 *)v14 + 8, v30, v14[22]);
v31 = *((_BYTE *)v14 + 136);
if( v31 && !RemainingName->Length || (*((_DWORD *)v12 + 3) & 0x100) != 0 )
{
v29 |= *((_DWORD *)v12 + 5);
DesiredAccess = v29;
}
v32 = *((_QWORD *)v14 + 5);
LOBYTE(v33) = v161;
if( v32 && (*(_DWORD *)(v32 + 80) & 0x400000) != 0 )
{
v33 = (unsigned __int8)v161;
if( !RemainingName->Length )
v33 = 1;
v161 = v33;
}
if( ((v34 = v188) != 0 || (v14[21] & 1) != 0) && (!v32 || (_BYTE)v33) && !v31 )
{
v35 = v11 & 0xDF;
if( RemainingName->Length )
{
v41 = (SECURITY_SUBJECT_CONTEXT *)((char *)v12 + 32);
if( IopDoFullTraverseCheck((DEVICE_OBJECT *)v17, v188, (SECURITY_SUBJECT_CONTEXT *)v12 + 1) )
{
v45 = CompleteName;
LODWORD(PreviouslyGrantedAccess) = 1;
LOBYTE(v11) = (v35 ^ IopCreateSecurityCheck(
(_DEVICE_OBJECT *)v17,
0i64,
v12,
v29 | 0x20,
PreviouslyGrantedAccess,
(UINT64 *)&Privileges->PrivilegeCount,
(_UNICODE_STRING *)&v162,
CompleteName,
(_ETHREAD *)&ObjectTypeName,
(UINT8)Thread)) & 1 ^ v35;
}
else
{
if( (*((_DWORD *)v12 + 3) & 1) != 0 )
{
LOBYTE(v11) = v35 | 1;
}
else
{
KeEnterCriticalRegionThread((_KTHREAD *)Thread);
LOBYTE(v46) = 1;
ExAcquireResourceSharedLite(&IopSecurityResource, v46);
LOBYTE(v11) = (v35 ^ SeFastTraverseCheck(*(PVOID *)(v17 + 272), v12, 0x20ui64)) & 1 ^ v35;
if( (v11 & 1) == 0 )
{
Privileges = 0i64;
SeLockSubjectContext((_SECURITY_SUBJECT_CONTEXT *)v12 + 1);
LODWORD(PreviouslyGrantedAccess) = 0;
LOBYTE(v11) = ((v11 | 0x20) ^ SeAccessCheck(
*(VOID **)(v17 + 272),
(SECURITY_SUBJECT_CONTEXT *)v12 + 1,
1u,
0x20ui64,
(UINT64)PreviouslyGrantedAccess,
&Privileges,
(GENERIC_MAPPING *)((char *)IoFileObjectType + 76),
1,
(UINT64 *)&v162,
&AccessStatus)) & 1 ^ (v11 | 0x20);
if( Privileges )
{
SeAppendPrivileges(v12, Privileges);
CmSiFreeMemory(Privileges);
}
}
ExReleaseResourceLite(&IopSecurityResource);
KeLeaveCriticalRegionThread((__int64)Thread);
}
v45 = CompleteName;
}
}
else
{
v39 = 0;
if( (*(_DWORD *)(v17 + 52) & 0x40001) != 0 && (v29 & 0xFFEDFF7F) != 0 )
{
ActiveConsoleId = RtlGetActiveConsoleId();
if( ActiveConsoleId != (unsigned int)PsGetCurrentProcessSessionId() )
{
v37 = PsGetCurrentServerSilo();
v38 = PsGetServerSiloServiceSessionId(v37);
if( v38 != (unsigned int)PsGetCurrentProcessSessionId() && !IopAllowRemoteDASD() )
v39 = 1;
}
}
Privileges = 0i64;
KeEnterCriticalRegionThread((_KTHREAD *)Thread);
LOBYTE(v40) = 1;
ExAcquireResourceSharedLite(&IopSecurityResource, v40);
v41 = (SECURITY_SUBJECT_CONTEXT *)((char *)v12 + 32);
SeLockSubjectContext((_SECURITY_SUBJECT_CONTEXT *)v12 + 1);
v42 = v35 | 0x20;
if( !v39 )
goto LABEL_71;
ClientToken = v41->ClientToken;
if( !v41->ClientToken )
ClientToken = (VOID *)*((_QWORD *)v12 + 6);
if( SeTokenIsAdmin(ClientToken) )
{
LABEL_71:
LODWORD(PreviouslyGrantedAccess) = 0;
v29 = DesiredAccess;
LOBYTE(v11) = (v42 ^ SeAccessCheck(
*(VOID **)(v17 + 272),
(SECURITY_SUBJECT_CONTEXT *)v12 + 1,
(v42 & 0x20) != 0,
DesiredAccess,
(UINT64)PreviouslyGrantedAccess,
&Privileges,
(GENERIC_MAPPING *)((char *)IoFileObjectType + 76),
1,
(UINT64 *)&v162,
&AccessStatus)) & 1 ^ v42;
if( Privileges )
{
SeAppendPrivileges(v12, Privileges);
CmSiFreeMemory(Privileges);
}
if( (v11 & 1) != 0 )
{
v44 = v162;
*((_DWORD *)v12 + 5) |= v162;
*((_DWORD *)v12 + 4) &= ~(v44 | 0x2000000);
*((_BYTE *)v14 + 136) = 1;
}
}
else
{
LOBYTE(v11) = v42 & 0xFE;
LODWORD(AccessStatus) = -1073741790;
v29 = DesiredAccess;
}
v45 = CompleteName;
SeOpenObjectAuditAlarm(
&ObjectTypeName,
(PVOID)v17,
CompleteName,
*(PVOID *)(v17 + 272),
v12,
0,
v11 & 1,
1,
(UINT8 *)v12 + 10);
ExReleaseResourceLite(&IopSecurityResource);
KeLeaveCriticalRegionThread((__int64)Thread);
}
if( (v11 & 0x20) != 0 )
SeUnlockSubjectContext(v41);
if( (v11 & 1) == 0 )
goto LABEL_299;
v34 = v188;
}
else
{
v45 = CompleteName;
}
if( *((_BYTE *)v14 + 137) || *((_BYTE *)v14 + 138) )
v47 = 64;
else
v47 = 0;
v48 = v47 | v11 & 0xBF;
Length = RemainingName->Length;
if( RemainingName->Length || (v50 = *((_QWORD *)v14 + 5)) != 0 || (v29 & 0xFEE1FF7F) != 0 || (v48 & 0x40) != 0 )
{
LOBYTE(v11) = v48 & 0xF7;
v50 = *((_QWORD *)v14 + 5);
}
else
{
LOBYTE(v11) = v48 | 8;
}
HIDWORD(AccessStatus) = v11;
v51 = 0i64;
Vpb = 0i64;
if( !v50 || (*(_DWORD *)(v50 + 80) & 0x800) != 0 )
{
v52 = (unsigned int *)v17;
DeviceObject = (PDEVICE_OBJECT)v17;
v53 = HIDWORD(AccessStatus);
if( *(_QWORD *)(v17 + 56) && (AccessStatus & 0x800000000i64) == 0 )
{
if( (*(_DWORD *)(v17 + 52) & 0x100) != 0
&& (*(_DWORD *)(*(_QWORD *)(v17 + 312) + 32i64) & 0x800) == 0
&& (v34 || (v14[21] & 1) != 0)
&& (v50 || Length)
&& !(_BYTE)v161 )
{
Privileges = 0i64;
LODWORD(PreviouslyGrantedAccess) = v14[22];
if( !IopCreateSecurityCheck(
(_DEVICE_OBJECT *)v17,
(_DEVICE_OBJECT *)v17,
AccessStatea,
v29,
PreviouslyGrantedAccess,
0i64,
(_UNICODE_STRING *)&v162,
CompleteName,
(_ETHREAD *)&ObjectTypeName,
(UINT8)Thread) )
goto LABEL_299;
}
v54 = IopCheckVpbMounted((INT64)v14, (DEVICE_OBJECT *)v17, (UINT8 *)RemainingName, &AccessStatus);
v51 = v54;
Vpb = v54;
if( !v54 )
return AccessStatus;
v52 = (unsigned int *)v54->DeviceObject;
DeviceObject = (PDEVICE_OBJECT)v52;
}
if( (v14[38] & 1) != 0 )
{
LOBYTE(v53) = v53 | 2;
HIDWORD(AccessStatus) = v53;
}
else if( *((_QWORD *)v52 + 3) )
{
IoGetAttachedDevice((_DEVICE_OBJECT *)v52);
v52 = (unsigned int *)v55;
DeviceObject = v55;
}
}
else
{
v52 = (unsigned int *)ParseObject;
DeviceObject = (PDEVICE_OBJECT)ParseObject;
if( *(_QWORD *)(v50 + 16) )
{
v51 = *(_VPB **)(v50 + 16);
Vpb = v51;
if( (*(_DWORD *)(v17 + 52) & 0x100) != 0
&& (*(_DWORD *)(*(_QWORD *)(v17 + 312) + 32i64) & 0x800) == 0
&& (v34 || (v14[21] & 1) != 0)
&& !(_BYTE)v161 )
{
Privileges = 0i64;
LODWORD(PreviouslyGrantedAccess) = v14[22];
if( !IopCreateSecurityCheck(
(_DEVICE_OBJECT *)v17,
(_DEVICE_OBJECT *)v17,
AccessStatea,
v29,
PreviouslyGrantedAccess,
0i64,
(_UNICODE_STRING *)&v162,
v45,
(_ETHREAD *)&ObjectTypeName,
(UINT8)Thread) )
goto LABEL_299;
}
IopIncrementVpbRefCount(v51, 1u);
}
if( (v14[38] & 1) != 0 )
{
if( v51 )
{
v52 = (unsigned int *)v51->DeviceObject;
DeviceObject = (PDEVICE_OBJECT)v52;
}
v53 = HIDWORD(AccessStatus);
LOBYTE(v53) = BYTE4(AccessStatus) | 2;
HIDWORD(AccessStatus) = v53;
}
else
{
LOBYTE(v53) = BYTE4(AccessStatus);
}
}
v56 = *(_DWORD *)(v17 + 52);
if( (v56 & 0x40001) != 0
&& (*(_DWORD *)(v17 + 48) & 0x600100) == 0
&& (v56 & 0x100) == 0
&& IopIsSecurityContextAppContainer((SECURITY_SUBJECT_CONTEXT *)AccessStatea + 1) )
{
if( !v51 )
goto LABEL_299;
if( (*((_DWORD *)v51->DeviceObject + 12) & 0x20000) == 0 )
{
IopDereferenceVpbAndFree(v51);
LABEL_299:
IopDecrementDeviceObjectRef((DEVICE_OBJECT *)v17, 0, 0);
return -1073741790;
}
}
if( (v53 & 2) != 0 )
{
v57 = (v53 & 8) != 0;
v58 = RemainingName;
LODWORD(AccessStatus) = IopCheckTopDeviceHint(
&DeviceObject,
(_OPEN_PACKET *)v14,
(const _UNICODE_STRING *)v57,
RemainingName);
if( (int)AccessStatus < 0 )
{
if( v51 )
IopDereferenceVpbAndFree(v51);
IopDecrementDeviceObjectRef((DEVICE_OBJECT *)v17, 0, 0);
return AccessStatus;
}
v52 = (unsigned int *)DeviceObject;
}
else
{
v58 = RemainingName;
}
v59 = v14[38];
if( (v59 & 0x10) != 0 )
v14[38] = v59 & 0xFFFFFFEF;
if( ((v52[13] & 0x100) != 0 || IopRequireDeviceAccessCheck && (*(_DWORD *)(v17 + 52) & 0x100000) != 0)
&& (v188 || (v14[21] & 1) != 0)
&& (*((_QWORD *)v14 + 5) || v58->Length) )
{
v60 = AccessStatea;
if( !(_BYTE)v161 )
{
Privileges = 0i64;
LODWORD(PreviouslyGrantedAccess) = v14[22];
if( !IopCreateSecurityCheck(
(_DEVICE_OBJECT *)v17,
(_DEVICE_OBJECT *)v52,
AccessStatea,
v29,
PreviouslyGrantedAccess,
0i64,
(_UNICODE_STRING *)&v162,
CompleteName,
(_ETHREAD *)&ObjectTypeName,
(UINT8)Thread) )
{
IopDecrementDeviceObjectRef((DEVICE_OBJECT *)v17, 0, 0);
if( v51 )
IopDereferenceVpbAndFree(v51);
return -1073741790;
}
}
}
else
{
v60 = AccessStatea;
}
Irp = IopAllocateIrpExReturn((DEVICE_OBJECT *)v52, *((_BYTE *)v52 + 76), 0, retaddr);
v62 = Irp;
if( !Irp )
{
IopDecrementDeviceObjectRef((DEVICE_OBJECT *)BugCheckParameter1, 0, 0);
if( v51 )
IopDereferenceVpbAndFree(v51);
return -1073741670;
}
*((_QWORD *)Irp + 19) = Thread;
v63 = v188;
*((_BYTE *)Irp + 64) = v188;
*((_DWORD *)Irp + 4) = 2180;
*(_QWORD *)&v181 = SecurityQos;
*((_QWORD *)&v181 + 1) = v60;
LODWORD(v182) = v29;
HIDWORD(v182) = v14[16];
v64 = (_BYTE *)(*((_QWORD *)Irp + 23) - 72i64);
v178 = v64;
v64[3] = 0;
v65 = v14[30];
v66 = Attributes;
if( v65 )
{
*v64 = v65 == 1 ? 1 : 19;
*((_QWORD *)v64 + 4) = *((_QWORD *)v14 + 16);
}
else
{
*v64 = 0;
*((_DWORD *)v64 + 8) = v14[20];
v67 = *((_BYTE *)v14 + 84);
v64[2] = v67;
if( (v66 & 0x40) == 0 )
v64[2] = v67 | 0x80;
}
*((_QWORD *)v62 + 11) = *((_QWORD *)v14 + 7);
*((_QWORD *)v62 + 3) = *((_QWORD *)v14 + 9);
*((_DWORD *)v64 + 4) = (v14[22] << 24) | v14[16] & 0xFFFFFF;
*((_WORD *)v64 + 12) = *((_WORD *)v14 + 34);
*((_WORD *)v64 + 13) = *((_WORD *)v14 + 35);
*((_QWORD *)v64 + 1) = &v181;
*((_QWORD *)v62 + 14) = *((_QWORD *)v14 + 21);
*((_QWORD *)v62 + 9) = BugCheckParameter4;
*((_QWORD *)v62 + 1) = 0i64;
*((_BYTE *)v62 + 65) = 0;
*((_BYTE *)v62 + 68) = 0;
*((_QWORD *)v62 + 10) = 0i64;
*((_QWORD *)v62 + 13) = 0i64;
*((_QWORD *)v62 + 20) = 0i64;
if( *((_BYTE *)v14 + 137) )
break;
GrantedAccess = v29;
LOBYTE(AccessModea) = 0;
LOBYTE(PreviouslyGrantedAccess) = v63;
v68 = (DEVICE_OBJECT *)BugCheckParameter1;
LODWORD(AccessStatus) = IopAllocRealFileObject(
&FileObject,
(_DEVICE_OBJECT *)v52,
(_DEVICE_OBJECT *)BugCheckParameter1,
v66,
PreviouslyGrantedAccess,
(_OPEN_PACKET *)v14,
ExtendedParameters,
AccessModea,
GrantedAccess);
if( (int)AccessStatus < 0 )
{
IoFreeIrp(v62);
IopDecrementDeviceObjectRef(v68, 0, 0);
if( v51 )
IopDereferenceVpbAndFree(v51);
v126 = (struct _DMA_ADAPTER *)FileObject;
if( FileObject )
{
FileObject->DeviceObject = 0i64;
HalPutDmaAdapter(v126);
result = AccessStatus;
v14[4] = AccessStatus;
return result;
}
goto LABEL_412;
}
v70 = FileObject;
LABEL_189:
if( (AccessStatus & 0x800000000i64) != 0 )
v70->Flags |= 0x800u;
*((_QWORD *)v62 + 24) = v70;
*((_QWORD *)v64 + 6) = v70;
v82 = RemainingName->Length;
if( RemainingName->Length )
{
if( v82 >= 0x38u )
{
if( v82 >= 0x78u )
{
if( v82 < 0xF8u )
v82 = 248;
}
else
{
v82 = 120;
}
}
else
{
v82 = 56;
}
v70->FileName.MaximumLength = v82;
PoolWithTag = (wchar_t *)ExAllocatePoolWithTag(PagedPool, v82, 0x6D4E6F49ui64);
v70->FileName.Buffer = PoolWithTag;
if( !PoolWithTag )
{
IoFreeIrp(v62);
IopDecrementDeviceObjectRef(v68, 0, 0);
if( v51 )
IopDereferenceVpbAndFree(v51);
v70->DeviceObject = 0i64;
if( !*((_BYTE *)v14 + 137) )
{
HalPutDmaAdapter((PADAPTER_OBJECT)v70);
return -1073741670;
}
return -1073741670;
}
}
RtlCopyUnicodeString(&v70->FileName, RemainingName, v69);
if( *((_BYTE *)v14 + 137) )
{
LOBYTE(v186) = 0;
PreviouslyGrantedAccessa = (__int64 *)&v186;
LOBYTE(v84) = IopQueryInformation((UINT64)v14);
LODWORD(AccessStatus) = v84;
if( v84 < 0 || (_BYTE)v186 )
{
v130 = *((_DWORD *)v62 + 12);
v14[4] = v130;
*((_QWORD *)v14 + 3) = *((_QWORD *)v62 + 7);
if( v130 == 260 )
{
v131 = (void *)*((_QWORD *)v62 + 20);
if( v131 )
{
ExFreePoolWithTag(v131, 0);
*((_QWORD *)v62 + 20) = 0i64;
*((_QWORD *)v14 + 5) = 0i64;
}
}
if( v70->FileName.Length )
ExFreePoolWithTag(v70->FileName.Buffer, 0);
if( v70->FileObjectExtension )
IopDeleteFileObjectExtension((_UNICODE_STRING *)v70, v85);
v129 = (DEVICE_OBJECT *)BugCheckParameter1;
goto LABEL_334;
}
if( !RtlEqualUnicodeString(&v70->FileName, RemainingName, 0) )
{
Buffer = v70->FileName.Buffer;
if( Buffer )
{
ExFreePoolWithTag(Buffer, 0);
RtlInitUnicodeString(&v70->FileName, 0i64, v87);
}
v88 = RemainingName->Length;
if( RemainingName->Length )
{
if( v88 >= 0x38u )
{
if( v88 >= 0x78u )
{
if( v88 < 0xF8u )
v88 = 248;
}
else
{
v88 = 120;
}
}
else
{
v88 = 56;
}
v70->FileName.MaximumLength = v88;
v89 = (wchar_t *)ExAllocatePoolWithTag(PagedPool, v88, 0x6D4E6F49ui64);
v70->FileName.Buffer = v89;
if( !v89 )
{
if( v70->FileObjectExtension )
IopDeleteFileObjectExtension((_UNICODE_STRING *)v70, v90);
IopDecrementDeviceObjectRef((DEVICE_OBJECT *)BugCheckParameter1, 0, 0);
if( v51 )
IopDereferenceVpbAndFree(v51);
IoFreeIrp(v62);
return -1073741670;
}
RtlCopyUnicodeString(&v70->FileName, RemainingName, v91);
}
}
LOBYTE(AccessModea) = 1;
LOBYTE(PreviouslyGrantedAccessa) = v188;
v92 = BugCheckParameter1;
LODWORD(AccessStatus) = IopAllocRealFileObject(
&FileObject,
(_DEVICE_OBJECT *)v52,
(_DEVICE_OBJECT *)BugCheckParameter1,
Attributes,
PreviouslyGrantedAccessa,
(_OPEN_PACKET *)v14,
ExtendedParameters,
AccessModea,
DesiredAccess);
if( (int)AccessStatus < 0 )
{
v128 = FileObject;
if( FileObject->FileName.Length )
ExFreePoolWithTag(FileObject->FileName.Buffer, 0);
if( v128->FileObjectExtension )
IopDeleteFileObjectExtension((_UNICODE_STRING *)v128, v93);
v129 = (DEVICE_OBJECT *)v92;
LABEL_334:
IopDecrementDeviceObjectRef(v129, 0, 0);
if( v51 )
IopDereferenceVpbAndFree(v51);
IoFreeIrp(v62);
return AccessStatus;
}
v70 = FileObject;
*((_QWORD *)v64 + 6) = FileObject;
*((_QWORD *)v62 + 24) = v70;
}
if( !v14[30] )
{
ExtraCreateParameter = 0i64;
LODWORD(AccessStatus) = IoGetIrpExtraCreateParameter(v62, &ExtraCreateParameter);
if( ExtraCreateParameter )
{
if( (unsigned int)IopSymlinkGetECP(ExtraCreateParameter, (_RELATIVE_SYMLINK_INFO **)&v172) != -1073741275 )
{
MostRecentlyUsedName = (INT16 *)IopSymlinkGetMostRecentlyUsedName((INT64)v172);
if( !MostRecentlyUsedName[2] )
{
updated = IopSymlinkUpdateECP(
v62,
MostRecentlyUsedName,
*MostRecentlyUsedName,
CompleteName,
CompleteName->Length - RemainingName->Length,
MostRecentlyUsedName[1]);
LODWORD(AccessStatus) = updated;
if( updated < 0 )
{
*((_DWORD *)v62 + 12) = updated;
*((_QWORD *)v62 + 7) = 0i64;
BYTE4(AccessStatus) &= ~4u;
}
}
}
}
}
p_Event = &v70->Event;
KeInitializeEvent(&v70->Event, NotificationEvent, 0);
*((_QWORD *)v14 + 1) = v70;
v97 = BYTE4(AccessStatus);
if( (AccessStatus & 0x400000000i64) != 0 )
{
IopQueueThreadIrp(v62);
v98 = IoCallDriverWithTracing((DEVICE_OBJECT *)v52, v62);
LODWORD(AccessStatus) = v98;
v97 = BYTE4(AccessStatus);
}
else
{
v98 = AccessStatus;
}
if( v98 == 259 )
{
v99 = v97 | 0x80;
v100 = v97 & 0x7F;
if( (*((_DWORD *)KeGetCurrentThread() + 29) & 0x400) == 0 )
v100 = v99;
HIDWORD(AccessStatus) = v100;
v101 = (unsigned __int8)v100 >> 7;
LODWORD(AccessStatus) = KeWaitForSingleObject(p_Event, Executive, 0, (unsigned __int8)v100 >> 7, 0i64);
if( (_DWORD)AccessStatus == 257 )
{
while( 1 )
{
CurrentIrql = KeGetCurrentIrql();
__writecr8(1ui64);
if( PsIsThreadTerminating(KeGetCurrentThread()) || !KeReadStateSemaphore(p_Event) && *((_BYTE *)v62 + 68) )
break;
__writecr8(CurrentIrql);
LODWORD(AccessStatus) = KeWaitForSingleObject(p_Event, Executive, 0, v101, 0i64);
if( (_DWORD)AccessStatus != 257 )
goto LABEL_235;
}
__writecr8(CurrentIrql);
IopCancelAlertedRequest(p_Event, v62);
}
LABEL_235:
LODWORD(AccessStatus) = BugCheckParameter4[0];
v70 = FileObject;
}
LODWORD(AccessStatus) = IoGetIrpExtraCreateParameter(v62, &EcpList);
v103 = v14[21] & 8;
v104 = v103 != 0;
v105 = EcpList;
if( *((_DWORD *)v62 + 12) == 260 )
{
P = (PVOID)*((_QWORD *)v62 + 20);
if( !EcpList || (unsigned int)IopSymlinkGetECP(EcpList, (_RELATIVE_SYMLINK_INFO **)&v172) == -1073741275 )
{
LODWORD(AccessStatus) = IopSymlinkCreateECP(
v62,
v70,
CompleteName,
CompleteName->Length - RemainingName->Length,
(_RELATIVE_SYMLINK_INFO **)&v172);
if( (int)AccessStatus >= 0 )
{
if( !v105 )
{
LODWORD(AccessStatus) = IoGetIrpExtraCreateParameter(v62, &EcpList);
v105 = EcpList;
}
}
else
{
*((_QWORD *)v62 + 7) = 0i64;
*((_DWORD *)v62 + 12) = AccessStatus;
}
}
if( *((_DWORD *)v62 + 12) == 260 )
{
v106 = (REPARSE_DATA_BUFFER *)P;
if( v103 && v105 )
v104 = IopCheckAndUpdateStopOnSymlinkEcp(v105, *((unsigned int *)v62 + 14), (INT64)P);
IopSymlinkProcessReparse(v62, v70, v106, v104);
v107 = *((_QWORD *)v62 + 7) - 2684354563i64;
if( v107 <= 0x16 )
{
v108 = 4194817i64;
if( _bittest64(&v108, v107) )
{
v109 = P;
v110 = *((unsigned __int16 *)P + 3);
v111 = 0;
if( !(_WORD)v110 )
v111 = 16;
v112 = HIDWORD(AccessStatus);
LOBYTE(v112) = v111 | BYTE4(AccessStatus) & 0xEF;
HIDWORD(AccessStatus) = v112;
if( (v112 & 0x10) == 0 && *(wchar_t *)((char *)RemainingName->Buffer + RemainingName->Length - v110) != 58 )
goto LABEL_262;
v113 = v14[16];
if( (v113 & 0x41) != 0 || *v178 )
goto LABEL_262;
if( *(_DWORD *)P == -1610612733 )
goto LABEL_260;
if( *(_DWORD *)P != -1610612724 )
goto LABEL_262;
if( *((int *)P + 4) < 0 )
{
LABEL_260:
v114 = v113 | 1;
LABEL_261:
v14[16] = v114;
}
else if( (*((_DWORD *)P + 4) & 0x40000000) != 0 )
{
v114 = v113 | 0x40;
goto LABEL_261;
}
LABEL_262:
if( !v104 )
{
ExFreePoolWithTag(v109, 0);
P = 0i64;
}
}
}
}
}
if( *((_DWORD *)v62 + 12) || v14[30] )
{
v115 = DeviceObject;
}
else
{
LODWORD(AccessStatus) = IopSymlinkPropagateToExtensionIfNeeded(v70, v105, CompleteName);
v115 = DeviceObject;
if( (int)AccessStatus < 0 )
{
IoCancelFileOpen(DeviceObject, v70);
*((_QWORD *)v62 + 7) = 0i64;
*((_DWORD *)v62 + 12) = AccessStatus;
}
}
if( v105 )
*((_QWORD *)v14 + 21) = v105;
*(_OWORD *)BugCheckParameter4 = *((_OWORD *)v62 + 3);
LODWORD(AccessStatus) = _mm_cvtsi128_si32(*(__m128i *)BugCheckParameter4);
v70->Event.Header.SignalState = 1;
v11 = HIDWORD(AccessStatus);
if( (AccessStatus & 0x400000000i64) != 0 )
{
*((_QWORD *)v62 + 19) = Thread;
IopDequeueIrpFromThread(v62);
}
if( (*((_BYTE *)v62 + 16) & 0x30) == 48 )
ExFreePoolWithTag(*((PVOID *)v62 + 3), 0);
IoFreeIrp(v62);
v117 = BugCheckParameter4[1];
*((_QWORD *)v14 + 3) = BugCheckParameter4[1];
if( (int)AccessStatus < 0 )
{
if( (v70->Flags & 0x200000) != 0 )
{
HalPutDmaAdapter((PADAPTER_OBJECT)v70);
*((_QWORD *)v14 + 1) = 0i64;
result = AccessStatus;
v14[4] = AccessStatus;
return result;
}
if( v70->FileName.Length )
{
ExFreePoolWithTag(v70->FileName.Buffer, 0);
v70->FileName.Length = 0;
}
v70->DeviceObject = 0i64;
HalPutDmaAdapter((PADAPTER_OBJECT)v70);
IopDecrementDeviceObjectRef((DEVICE_OBJECT *)BugCheckParameter1, 0, 0);
if( Vpb )
IopDereferenceVpbAndFree(Vpb);
*((_QWORD *)v14 + 1) = 0i64;
goto LABEL_412;
}
if( (_DWORD)AccessStatus != 260 )
{
RelatedDeviceObject = IoGetRelatedDeviceObject(v70);
if( v115 != RelatedDeviceObject )
{
v141 = v70->Vpb;
v142 = Vpb;
if( v141 != Vpb )
{
if( v141 )
IopIncrementVpbRefCount(v141, 1u);
if( v142 )
IopDereferenceVpbAndFree(v142);
}
}
if( (AccessStatus & 0x4000000000i64) == 0 )
{
*Object = v70;
v14[8] = -1096154543;
ObfReferenceObject(v70);
RelatedFileObject = v70->RelatedFileObject;
if( (!RelatedFileObject || (RelatedFileObject->Flags & 0x400000) != 0) && !v70->FileName.Length )
{
v144 = *((unsigned int *)RelatedDeviceObject + 18);
if( (unsigned int)v144 <= 0x20 )
{
v145 = 0x100000308i64;
if( _bittest64(&v145, v144) )
v70->Flags |= 0x400000u;
}
}
result = BugCheckParameter4[0];
v14[4] = BugCheckParameter4[0];
return result;
}
if( *((_BYTE *)v14 + 137) )
{
if( *((_BYTE *)v14 + 208) )
{
FileInformation = IoQueryFileInformation(
v70,
(FILE_INFORMATION_CLASS)v14[50],
v14[51],
*((PVOID *)v14 + 14),
v14 + 51);
goto LABEL_403;
}
v147 = 0;
v148 = *(_QWORD *)(*((_QWORD *)RelatedDeviceObject + 1) + 80i64);
if( *((_BYTE *)v14 + 139) )
{
if( v148 )
{
if( *(_DWORD *)v148 > 0x70u )
{
v153 = *(__int64(__fastcall **)(_QWORD, _QWORD, _QWORD, _QWORD, _QWORD))(v148 + 112);
if( v153 )
{
v154 = (MmVerifierData & 0x10) != 0 ? VfFastIoSnapState() : 0i64;
LOBYTE(v139) = 1;
v147 = v153(v70, v139, *((_QWORD *)v14 + 13), BugCheckParameter4, RelatedDeviceObject);
if( v154 )
VfFastIoCheckState(v154, v153);
}
}
}
if( !v147 )
{
v155 = IoQueryFileInformation(v70, FileNetworkOpenInformation, 0x38u, *((PVOID *)v14 + 13), &ReturnedLength);
LODWORD(AccessStatus) = v155;
if( v155 == -1073741811 || v155 == -1073741822 )
{
FileInformation = IopGetNetworkOpenInformation(v70, (INT64)v14);
LABEL_403:
LODWORD(AccessStatus) = FileInformation;
}
}
}
else
{
v149 = 0i64;
v172 = 0i64;
if( v148 )
v150 = *(__int64(__fastcall **)(_QWORD, _QWORD, _QWORD, _QWORD, _QWORD))(v148 + 32);
else
v150 = 0i64;
v186 = v150;
if( v150 )
{
v151 = (MmVerifierData & 0x10) != 0 ? VfFastIoSnapState() : 0i64;
v183 = v151;
LOBYTE(v149) = 1;
v147 = v150(v70, v149, *((_QWORD *)v14 + 12), BugCheckParameter4, RelatedDeviceObject);
v169 = v147;
if( v151 )
VfFastIoCheckState(v151, v150);
}
if( v147 )
{
LODWORD(AccessStatus) = BugCheckParameter4[0];
}
else
{
Pool_1 = IopVerifierExAllocatePool_1(NonPagedPoolNx, 0x28ui64);
v172 = Pool_1;
if( Pool_1 )
{
LODWORD(AccessStatus) = IoQueryFileInformation(v70, FileBasicInformation, 0x28u, Pool_1, &ReturnedLength);
if( (int)AccessStatus >= 0 )
memmove(*((UINT8 **)v14 + 12), (UINT8 *)Pool_1, ReturnedLength);
ExFreePoolWithTag(Pool_1, 0);
}
else
{
LODWORD(AccessStatus) = -1073741670;
}
}
}
}
v14[8] = -1096154543;
IopCloseFile(0i64);
HalPutDmaAdapter((PADAPTER_OBJECT)v70);
*((_QWORD *)v14 + 1) = 0i64;
result = AccessStatus;
v14[4] = AccessStatus;
return result;
}
if( (v117 & 0xFFFFFFFFFFFFFFFDui64) != 0
&& ((v118 = v117 - 2684354563u, v117 - 2684354563u > 0x16) || (v119 = 4194817i64, !_bittest64(&v119, v118))
|| v104) )
{
v120 = CompleteName;
}
else
{
v120 = CompleteName;
if( CompleteName->MaximumLength < v70->FileName.Length )
{
v121 = (wchar_t *)ExAllocatePoolWithTag(PagedPool, v70->FileName.Length, 0x63466F49ui64);
if( !v121 )
{
v14[4] = -1073741670;
return -1073741670;
}
v122 = v120->Buffer;
if( v122 )
ExFreePoolWithTag(v122, 0);
v120->Buffer = v121;
v120->MaximumLength = v70->FileName.Length;
}
RtlCopyUnicodeString(v120, &v70->FileName, v116);
if( BugCheckParameter4[1] - 2684354563u <= 0x16 )
{
v123 = 4194817i64;
if( _bittest64(&v123, BugCheckParameter4[1] - 2684354563u) )
*((_QWORD *)v14 + 5) = 0i64;
}
}
if( v70->FileName.Length )
{
ExFreePoolWithTag(v70->FileName.Buffer, 0);
v70->FileName.Length = 0;
}
v70->DeviceObject = 0i64;
HalPutDmaAdapter((PADAPTER_OBJECT)v70);
*((_QWORD *)v14 + 1) = 0i64;
v124 = BugCheckParameter1;
IopDecrementDeviceObjectRef((DEVICE_OBJECT *)BugCheckParameter1, 0, 0);
if( Vpb )
IopDereferenceVpbAndFree(Vpb);
v125 = BugCheckParameter4[1];
if( BugCheckParameter4[1] != 1 )
{
*((_QWORD *)v14 + 5) = 0i64;
v132 = 4194817i64;
if( v125 - 2684354563u <= 0x16 && _bittest64(&v132, v125 - 2684354563u) )
{
v14[38] |= 0x10u;
v133 = v14[38];
v134 = *(unsigned int *)(v124 + 72);
if( (unsigned int)v134 <= 0x24 && (v135 = 0x1080020084i64, _bittest64(&v135, v134)) )
v136 = v133 | 8;
else
v136 = v133 & 0xFFFFFFF7;
v14[38] = v136;
}
if( *((_BYTE *)v14 + 136) )
KeBugCheckEx(0xF9u, v124, (ULONG_PTR)DeviceObject, (ULONG_PTR)v120, v125);
if( (*(_DWORD *)(*(_QWORD *)(v124 + 312) + 32i64) & 0x800) == 0 )
{
v137 = AccessStatea;
*((_QWORD *)AccessStatea + 2) = *((unsigned int *)AccessStatea + 6);
*((_DWORD *)v137 + 3) &= ~0x100u;
}
if( v125 - 2684354563u <= 0x16 && _bittest64(&v132, v125 - 2684354563u) && v104 )
{
*((_QWORD *)v14 + 3) = P;
v14[4] = -2147483603;
return -2147483603;
}
else if( v125 == 2684354585 || v125 == 2 )
{
v138 = ExtendedParameters;
v138->Silo = (_EJOB *)PsGetParentSilo((INT64)ExtendedParameters->Silo);
return 872;
}
else
{
return 260;
}
}
if( (unsigned int)++v173 > 0x20 )
return -1073741823;
*Object = 0i64;
FileObject = 0i64;
v12 = AccessStatea;
v13 = (unsigned int *)ParseObject;
}
v71 = *((_QWORD *)v14 + 18);
memset(v71, 0i64);
v70 = (PFILE_OBJECT)(v71 + 48);
FileObject = (PFILE_OBJECT)(v71 + 48);
*(_BYTE *)(v71 + 24) = ObHeaderCookie ^ *((_BYTE *)IoFileObjectType + 40) ^ BYTE1(v71);
*(_QWORD *)v71 = 1i64;
if( (Attributes & 0x40) == 0 )
*(_DWORD *)(v71 + 128) |= 0x20000u;
*(_DWORD *)&v70->Type = 14155781;
*(_QWORD *)(v71 + 112) = *((_QWORD *)v14 + 5);
v68 = (DEVICE_OBJECT *)BugCheckParameter1;
v70->DeviceObject = (_DEVICE_OBJECT *)BugCheckParameter1;
if( (v14[38] & 0x20) == 0
|| !v188
|| (v52[12] & 0x40000) == 0
&& ((v72 = v52[18], (unsigned int)v72 > 0x35) || (v73 = 0x20000100100108i64, !_bittest64(&v73, v72)))
|| (LODWORD(AccessStatus) = IopRetrieveTransactionParameters((DEVICE_OBJECT *)v52, (INT64)v14, DesiredAccess, v70),
(int)AccessStatus >= 0) )
{
if( !PsIsHostSilo(ExtendedParameters->Silo)
|| (v74 = v70->RelatedFileObject) != 0i64 && (v75 = IoGetSilo(v74), !PsIsHostSilo(v75)) )
{
TypeExt = 0i64;
p_Type = (volatile INT32 *)&v70->RelatedFileObject->Type;
if( p_Type && (PsIsServerSilo((INT64)ExtendedParameters->Silo, p_Type), v78) )
Silo = IoGetSilo(v77);
else
Silo = ExtendedParameters->Silo;
if( !PsIsHostSilo(Silo) )
{
LODWORD(AccessStatus) = PsAcquireSiloHardReference(Silo);
if( (int)AccessStatus < 0 )
goto LABEL_311;
IopGetSetSpecificExtension(v70, FoExtTypeSilo, 0x10ui64, 1u, &TypeExt, 0i64);
LODWORD(AccessStatus) = v80;
if( v80 < 0 )
{
PsReleaseSiloHardReference(Silo);
v80 = AccessStatus;
}
v81 = TypeExt;
if( v80 < 0 )
{
LABEL_311:
IoFreeIrp(v62);
v127 = (DEVICE_OBJECT *)BugCheckParameter1;
goto LABEL_309;
}
*(_DWORD *)TypeExt = 16;
v81[1] = Silo;
*((_DWORD *)v81 + 1) |= 1u;
ObfReferenceObjectWithTag(Silo, 0x70536F49u);
}
v68 = (DEVICE_OBJECT *)BugCheckParameter1;
v64 = v178;
}
goto LABEL_189;
}
IoFreeIrp(v62);
v127 = v68;
LABEL_309:
IopDecrementDeviceObjectRef(v127, 0, 0);
if( v51 )
{
IopDereferenceVpbAndFree(v51);
result = AccessStatus;
v14[4] = AccessStatus;
return result;
}
LABEL_412:
result = AccessStatus;
LABEL_413:
v14[4] = result;
return result;
}Referenced by:
IopParseFile