NtWriteFile
NTSTATUS __stdcall NtWriteFile(
HANDLE FileHandle,
HANDLE Event,
PIO_APC_ROUTINE ApcRoutine,
PVOID ApcContext,
PIO_STATUS_BLOCK IoStatusBlock,
PVOID Buffer,
ULONG Length,
PLARGE_INTEGER ByteOffset,
PULONG Key){
unsigned __int8 v10;
NTSTATUS v11;
PFILE_OBJECT v12;
_DEVICE_OBJECT *RelatedDeviceObject;
__int64 v14;
unsigned int *p_Flags;
UINT8 *v16;
PLARGE_INTEGER v17;
__int64 v18;
int v19;
int v20;
int v21;
unsigned int v22;
struct _DMA_ADAPTER *v23;
__int64 v24;
unsigned int Flags;
_ETHREAD *v26;
PFILE_OBJECT v27;
__int64 v28;
CHAR v29;
__int64(__fastcall *v30)(PFILE_OBJECT, char *, _QWORD, __int64, PVOID *, UINT8 *, __int128 *, PDEVICE_OBJECT);
void *v31;
char v32;
_ETHREAD *v33;
_ETHREAD *v34;
unsigned __int64 v35;
struct _DMA_ADAPTER *v36;
IRP *Irp;
IRP *v39;
CHAR v40;
PIO_STATUS_BLOCK v41;
__int64 v42;
DEVICE_OBJECT *v43;
int v44;
_DWORD *FileObjectExtension;
UINT64 v46;
UINT8 v47;
UINT8 v48;
int v49;
_MDL *Mdl;
MDL *v51;
__int64 v52;
struct _DMA_ADAPTER *v53;
ULONG v54;
UINT8 *PoolWithQuota_0;
int v56;
PVOID *Object;
IRP *Objecta;
UINT64 v59;
unsigned __int8 v60;
char v61[15];
PFILE_OBJECT FileObject;
PRKEVENT Eventa;
ULONG v64;
PDEVICE_OBJECT DeviceObject;
int v66;
PVOID VirtualAddress;
__int128 v68;
OBJECT_HANDLE_INFORMATION v69;
_ETHREAD *CurrentThread;
unsigned int *v71;
VOID *retaddr;
INT64 v73;
PVOID v74;
v74 = ApcContext;
v73 = (INT64)ApcRoutine;
FileObject = 0i64;
v69 = 0i64;
Eventa = 0i64;
v64 = 0;
*(_QWORD *)&v61[7] = 0i64;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v10 = *((_BYTE *)CurrentThread + 562);
v60 = v10;
v11 = ObReferenceFileObjectForWrite(FileHandle, v10, (PVOID *)&FileObject, &v69);
v12 = FileObject;
if( v11 >= 0 && IopFileObjectRevoked((INT64)FileObject) )
{
HalPutDmaAdapter((PADAPTER_OBJECT)v12);
return -1073739504;
}
if( v11 < 0 )
return v11;
RelatedDeviceObject = IoGetRelatedDeviceObject(v12);
DeviceObject = RelatedDeviceObject;
if( v10 )
{
v66 = 0;
v14 = (__int64)IoStatusBlock;
if( (unsigned __int64)IoStatusBlock >= 0x7FFFFFFF0000i64 )
v14 = 0x7FFFFFFF0000i64;
*(_DWORD *)v14 = *(_DWORD *)v14;
v12 = FileObject;
p_Flags = &FileObject->Flags;
IopMarkApcRoutineIfAsynchronousIo32((UINT64 **)&IoStatusBlock, &v73, FileObject->Flags & 2);
v16 = (UINT8 *)Buffer;
if( Length && ((unsigned __int64)Buffer + Length > 0x7FFFFFFF0000i64 || (char *)Buffer + Length < Buffer) )
MEMORY[0x7FFFFFFF0000] = 0;
if( v12->CompletionContext && (v73 & 0xFFFFFFFFFFFFFFFEui64) != 0 )
goto LABEL_119;
v17 = ByteOffset;
if( ByteOffset )
{
if( ((unsigned __int8)ByteOffset & 3) != 0 )
ExRaiseDatatypeMisalignment();
*(union _LARGE_INTEGER *)&v61[7] = *ByteOffset;
v12 = FileObject;
}
if( (*p_Flags & 8) == 0 )
{
LABEL_13:
v18 = (__int64)Key;
if( Key )
{
if( (unsigned __int64)Key >= 0x7FFFFFFF0000i64 )
v18 = 0x7FFFFFFF0000i64;
v64 = *(_DWORD *)v18;
v12 = FileObject;
}
goto LABEL_42;
}
v19 = *((unsigned __int16 *)RelatedDeviceObject + 152);
if( (_WORD)v19 )
{
v20 = *((unsigned __int16 *)RelatedDeviceObject + 152);
v21 = v20;
v22 = v20;
if( ((v19 - 1) & Length) != 0 )
{
LABEL_33:
if( (_WORD)v19 && Length % v22 || (*((_DWORD *)RelatedDeviceObject + 38) & (unsigned int)Buffer) != 0 )
goto LABEL_119;
LABEL_22:
if( ByteOffset
&& (*(_DWORD *)&v61[7] != -1 || *(_DWORD *)&v61[11] != -1)
&& (*(_DWORD *)&v61[7] != -2 || *(_DWORD *)&v61[11] != -1 || (*p_Flags & 2) == 0)
&& (_WORD)v19
&& ((v20 - 1) & *(_DWORD *)&v61[7]) != 0 )
{
goto LABEL_119;
}
goto LABEL_13;
}
}
else
{
v20 = 0;
v21 = 0;
}
v22 = v21;
if( (*((_DWORD *)RelatedDeviceObject + 38) & (unsigned int)Buffer) == 0 )
goto LABEL_22;
goto LABEL_33;
}
v17 = ByteOffset;
if( ByteOffset )
*(union _LARGE_INTEGER *)&v61[7] = *ByteOffset;
v16 = (UINT8 *)Buffer;
if( Key )
v64 = *Key;
LABEL_42:
if( (v69.GrantedAccess & 6) == 4 )
*(_QWORD *)&v61[7] = -1i64;
if( Event )
{
VirtualAddress = 0i64;
v49 = ObReferenceObjectByHandle(Event, 2u, (POBJECT_TYPE)ExEventObjectType, v10, &VirtualAddress, 0i64);
v23 = (struct _DMA_ADAPTER *)VirtualAddress;
Eventa = (PRKEVENT)VirtualAddress;
if( v49 < 0 )
{
HalPutDmaAdapter((PADAPTER_OBJECT)v12);
return v49;
}
KeResetEvent(VirtualAddress, v46, v47, v48, Objecta);
RelatedDeviceObject = DeviceObject;
}
else
{
v23 = (struct _DMA_ADAPTER *)Eventa;
}
v24 = *(_QWORD *)(*((_QWORD *)RelatedDeviceObject + 1) + 80i64);
v71 = &v12->Flags;
Flags = v12->Flags;
if( (Flags & 2) == 0 )
{
if( v17 || (Flags & 0x280) != 0 )
{
v29 = 0;
goto LABEL_67;
}
if( v23 )
HalPutDmaAdapter(v23);
LABEL_119:
HalPutDmaAdapter((PADAPTER_OBJECT)v12);
return -1073741811;
}
v26 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v26 + 242);
v27 = FileObject;
LODWORD(v28) = KeAbPreAcquire(&FileObject->Lock, 0i64, 0i64);
v61[0] = 0;
if( _InterlockedExchange((volatile __int32 *)&v27->Busy, 1) )
{
Object = (PVOID *)v61;
v12 = FileObject;
v11 = IopWaitAndAcquireFileObjectLock(FileObject, v10);
}
else
{
if( v28 )
*(_BYTE *)(v28 + 26) |= 1u;
v12 = FileObject;
ObfReferenceObject(FileObject);
v11 = 0;
}
if( v61[0] )
{
if( Eventa )
HalPutDmaAdapter((PADAPTER_OBJECT)Eventa);
HalPutDmaAdapter((PADAPTER_OBJECT)v12);
return v11;
}
v29 = 1;
if( !v17 && !*(_DWORD *)&v61[7] || *(_DWORD *)&v61[7] == -2 && *(_DWORD *)&v61[11] == -1 )
*(_QWORD *)&v61[7] = v12->CurrentByteOffset.QuadPart;
if( v12->PrivateCacheMap )
{
v68 = 0i64;
v30 = *(__int64(__fastcall **)(PFILE_OBJECT, char *, _QWORD, __int64, PVOID *, UINT8 *, __int128 *, PDEVICE_OBJECT))(v24 + 24);
if( *(int *)&v61[11] < 0 && (*(_DWORD *)&v61[11] != -1 || *(_DWORD *)&v61[7] != -1) )
{
if( Eventa )
HalPutDmaAdapter((PADAPTER_OBJECT)Eventa);
LABEL_113:
IopReleaseFileObjectLock((PADAPTER_OBJECT)v12);
LABEL_114:
HalPutDmaAdapter((PADAPTER_OBJECT)v12);
return -1073741811;
}
if( (MmVerifierData & 0x10) != 0 )
v31 = VfFastIoSnapState();
else
v31 = 0i64;
LODWORD(Object) = v64;
v32 = v30(v12, &v61[7], Length, 1i64, Object, v16, &v68, DeviceObject);
if( v31 )
VfFastIoCheckState(v31, v30);
if( v32 && !(_DWORD)v68 )
{
v33 = (_ETHREAD *)KeGetCurrentThread();
++*((_QWORD *)v33 + 113);
__incgsdword(0x2EE0u);
v34 = (_ETHREAD *)KeGetCurrentThread();
v35 = DWORD2(v68);
*((_QWORD *)v34 + 116) += DWORD2(v68);
__addgsqword(0x2EF0u, v35);
*IoStatusBlock = (struct _IO_STATUS_BLOCK)v68;
v36 = (struct _DMA_ADAPTER *)FileObject;
if( Event )
{
v53 = (struct _DMA_ADAPTER *)Eventa;
if( (FileObject->Flags & 0x8000000) == 0 )
KeSetEvent(Eventa, 0);
HalPutDmaAdapter(v53);
}
IopReleaseFileObjectLock(v36);
HalPutDmaAdapter(v36);
return v68;
}
}
v23 = (struct _DMA_ADAPTER *)Eventa;
LABEL_67:
if( *(int *)&v61[11] < 0 && (*(_DWORD *)&v61[11] != -1 || *(_DWORD *)&v61[7] != -1) )
{
if( v23 )
HalPutDmaAdapter(v23);
if( !v29 )
goto LABEL_114;
goto LABEL_113;
}
IopResetEvent(v12);
Irp = IopAllocateIrpExReturn(DeviceObject, *((_BYTE *)DeviceObject + 76), v29 ^ 1u, retaddr);
v39 = Irp;
VirtualAddress = Irp;
if( Irp )
{
*((_QWORD *)Irp + 24) = v12;
*((_QWORD *)Irp + 19) = CurrentThread;
*((_QWORD *)Irp + 20) = 0i64;
v40 = v60;
*((_WORD *)Irp + 32) = v60;
*((_BYTE *)Irp + 68) = 0;
*((_QWORD *)Irp + 13) = 0i64;
*((_QWORD *)Irp + 10) = v23;
v41 = IoStatusBlock;
*((_QWORD *)Irp + 9) = IoStatusBlock;
*((_QWORD *)Irp + 11) = v73;
*((_QWORD *)Irp + 12) = v74;
v42 = *((_QWORD *)Irp + 23);
*(_DWORD *)(v42 - 72) = 4;
*(_QWORD *)(v42 - 24) = v12;
if( (*v71 & 0x10) != 0 )
*(_BYTE *)(v42 - 70) = 4;
*((_QWORD *)Irp + 3) = 0i64;
*((_QWORD *)Irp + 1) = 0i64;
v43 = DeviceObject;
v44 = *((_DWORD *)DeviceObject + 12);
if( (v44 & 4) != 0 )
{
if( Length )
{
v54 = Length;
PoolWithQuota_0 = (UINT8 *)IopVerifierExAllocatePoolWithQuota_0(NonPagedPoolNxCacheAligned, Length);
*((_QWORD *)v39 + 3) = PoolWithQuota_0;
memmove(PoolWithQuota_0, v16, v54);
v56 = 48;
v40 = v60;
v43 = DeviceObject;
}
else
{
v56 = 16;
}
*((_DWORD *)v39 + 4) = v56;
}
else
{
*((_DWORD *)v39 + 4) = 0;
if( (v44 & 0x10) != 0 )
{
if( Length )
{
Mdl = IoAllocateMdl(v16, Length, 0, 1u, v39);
v51 = Mdl;
if( !Mdl )
RtlRaiseStatus(-1073741670);
v52 = *(unsigned __int8 *)(v42 - 72);
MmProbeAndLockPages(Mdl, v60, IoReadAccess);
if( (MmTrackLockedPages & 1) != 0 )
MmUpdateMdlTracker(v51, *(PVOID *)(*((_QWORD *)DeviceObject + 1) + 8 * v52 + 112), DeviceObject);
v40 = v60;
v43 = DeviceObject;
}
}
else
{
*((_QWORD *)v39 + 14) = v16;
}
}
*((_DWORD *)v39 + 4) |= (v12->Flags & 8 | 0x5000) >> 3;
*(_DWORD *)(v42 - 64) = Length;
*(_DWORD *)(v42 - 56) = v64;
*(_QWORD *)(v42 - 48) = *(_QWORD *)&v61[7];
FileObjectExtension = v12->FileObjectExtension;
if( FileObjectExtension && (*FileObjectExtension & 0x10) != 0 )
*(_DWORD *)(v42 - 52) = v41->Information;
LODWORD(v59) = 1;
return IopSynchronousServiceTail(v43, v39, v12, 1, v40, v29, v59);
}
else
{
IopAllocateIrpCleanup((PUNICODE_STRING)v12);
return -1073741670;
}
}Referenced by:
SmKmIssueFileIo