VfClearVerifierSettings
VOID __stdcall VfClearVerifierSettings(){
unsigned int v0;
_UNICODE_STRING *v1;
WCHAR v2;
WCHAR v3;
NTSTATUS v4;
WCHAR v5;
NTSTATUS v6;
WCHAR v7;
NTSTATUS v8;
WCHAR v9;
NTSTATUS v10;
WCHAR v11;
NTSTATUS v12;
NTSTATUS v13;
WCHAR v14;
NTSTATUS v15;
WCHAR v16;
NTSTATUS v17;
NTSTATUS v18;
WCHAR v19;
NTSTATUS v20;
WCHAR v21;
NTSTATUS v22;
WCHAR v23;
NTSTATUS v24;
UINT64 DataSize;
struct _UNICODE_STRING DestinationString;
struct _OBJECT_ATTRIBUTES ObjectAttributes;
unsigned int Data;
void *KeyHandle;
KeyHandle = 0i64;
*(&ObjectAttributes.Length + 1) = 0;
*(&ObjectAttributes.Attributes + 1) = 0;
DestinationString = 0i64;
if( (VfOptionFlags & 0x20) != 0 )
{
v0 = VfOptionFlags & 0xFFFFFFCF;
}
else if( (VfOptionFlags & 0x400) != 0 )
{
v0 = VfOptionFlags & 0xFFFFFBC7;
}
else
{
v0 = VfOptionFlags & 0xFFFFFFE7;
}
Data = v0;
v1 = (_UNICODE_STRING *)&VfPersistentStateRoot;
ObjectAttributes.Length = 48;
if( !CmStateSeparationEnabled )
v1 = &CmRegistryMachineSystemCurrentControlSetControlSessionManagerMemoryManagement;
ObjectAttributes.Attributes = 576;
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.ObjectName = v1;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
if( ZwOpenKey(&KeyHandle, 0xF003Fu, &ObjectAttributes) < 0 )
{
VfUtilDbgPrint((INT8 *)"Driver Verifier: Failed to open Memory Management key with status: 0x%x\n"
" Registry updates aborted!");
}
else
{
RtlInitUnicodeString(&DestinationString, L"VerifierOptions", v2);
LODWORD(DataSize) = 4;
if( ZwSetValueKey(KeyHandle, &DestinationString, 0i64, 4ui64, &Data, DataSize) < 0 )
{
VfUtilDbgPrint((INT8 *)"Driver Verifier: Failed to set VerifierOptionFlags key value with status: 0x%x\n"
" Registry updates aborted!");
}
else
{
RtlInitUnicodeString(&DestinationString, L"VerifyDriverLevel", v3);
v4 = ZwDeleteValueKey(KeyHandle, &DestinationString);
if( (int)(v4 + 0x80000000) >= 0 && v4 != -1073741772 )
VfUtilDbgPrint((INT8 *)"Driver Verifier: Failed to delete VerifyDriverLevel key value with status: 0x%x\n");
RtlInitUnicodeString(&DestinationString, L"VerifierSettingState", v5);
v6 = ZwDeleteValueKey(KeyHandle, &DestinationString);
if( ((v6 + 0x80000000) & 0x80000000) == 0 && v6 != -1073741772 )
VfUtilDbgPrint((INT8 *)"Driver Verifier: Failed to delete RuleClasses key value with status: 0x%x\n");
RtlInitUnicodeString(&DestinationString, L"VerifyDrivers", v7);
v8 = ZwDeleteValueKey(KeyHandle, &DestinationString);
if( ((v8 + 0x80000000) & 0x80000000) == 0 && v8 != -1073741772 )
VfUtilDbgPrint((INT8 *)"Driver Verifier: Failed to delete VerifyDrivers key value with status: 0x%x\n");
RtlInitUnicodeString(&DestinationString, L"VerifierRandomTargets", v9);
v10 = ZwDeleteValueKey(KeyHandle, &DestinationString);
if( ((v10 + 0x80000000) & 0x80000000) == 0 && v10 != -1073741772 )
VfUtilDbgPrint((INT8 *)"Driver Verifier: Failed to delete VerifierRandomTargets key value with status: 0x%x\n");
if( *(_DWORD *)VfFlightOptions )
{
RtlInitUnicodeString(&DestinationString, L"XdvVerifierOptions", v11);
v12 = ZwDeleteValueKey(KeyHandle, &DestinationString);
if( ((v12 + 0x80000000) & 0x80000000) == 0 && v12 != -1073741772 )
VfUtilDbgPrint((INT8 *)"Driver Verifier: Failed to delete XdvVerifierOptions key value with status: 0x%x\n");
}
RtlInitUnicodeString(&DestinationString, L"VrfPersistThroughUpgrade", v11);
v13 = ZwDeleteValueKey(KeyHandle, &DestinationString);
if( ((v13 + 0x80000000) & 0x80000000) == 0 && v13 != -1073741772 )
VfUtilDbgPrint((INT8 *)"Driver Verifier: Failed to delete VrfPersistThroughUpgrade key value with status: 0x%x\n");
RtlInitUnicodeString(&DestinationString, L"VerifierTriageContext", v14);
v15 = ZwDeleteValueKey(KeyHandle, &DestinationString);
if( ((v15 + 0x80000000) & 0x80000000) == 0 && v15 != -1073741772 )
VfUtilDbgPrint((INT8 *)"Driver Verifier: Failed to delete VerifierTriageContext key value with status: 0x%x\n");
if( VfXdvSuppressDriversBufferLength != -1 )
{
RtlInitUnicodeString(&DestinationString, L"VerifyDriversSuppress", v16);
v17 = ZwDeleteValueKey(KeyHandle, &DestinationString);
if( ((v17 + 0x80000000) & 0x80000000) == 0 && v17 != -1073741772 )
VfUtilDbgPrint((INT8 *)"Driver Verifier: Failed to delete VerifyDriversSuppress key value with status: 0x%x\n");
}
RtlInitUnicodeString(&DestinationString, L"VerifierTipLimitNumerator", v16);
v18 = ZwDeleteValueKey(KeyHandle, &DestinationString);
if( ((v18 + 0x80000000) & 0x80000000) == 0 && v18 != -1073741772 )
VfUtilDbgPrint((INT8 *)"Driver Verifier: Failed to delete VerifierTipLimitNumerator key value with status: 0x%x\n");
RtlInitUnicodeString(&DestinationString, L"VerifierTipLimitDenominator", v19);
v20 = ZwDeleteValueKey(KeyHandle, &DestinationString);
if( ((v20 + 0x80000000) & 0x80000000) == 0 && v20 != -1073741772 )
VfUtilDbgPrint((INT8 *)"Driver Verifier: Failed to delete VerifierTipLimitDenominator key value with status: 0x%x\n");
RtlInitUnicodeString(&DestinationString, L"VerifierTipSparseness", v21);
v22 = ZwDeleteValueKey(KeyHandle, &DestinationString);
if( ((v22 + 0x80000000) & 0x80000000) == 0 && v22 != -1073741772 )
VfUtilDbgPrint((INT8 *)"Driver Verifier: Failed to delete VerifierTipSparseness key value with status: 0x%x\n");
RtlInitUnicodeString(&DestinationString, L"VerifierLwspPoolTags", v23);
v24 = ZwDeleteValueKey(KeyHandle, &DestinationString);
if( ((v24 + 0x80000000) & 0x80000000) == 0 && v24 != -1073741772 )
VfUtilDbgPrint((INT8 *)"Driver Verifier: Failed to delete VerifierLwspPoolTags key value with status: 0x%x\n");
ZwFlushKey(KeyHandle);
if( VfClearanceFlag )
VfUtilDbgPrint((INT8 *)"Driver Verifier: Clearing Verifier options from Registry for preventing recursive crash.\n");
}
ZwClose(KeyHandle);
}
}Referenced by:
Phase1InitializationIoReady
VfNotifyVerifierOfEvent