IopAllocRealFileObject
NTSTATUS __stdcall IopAllocRealFileObject(
_FILE_OBJECT **FileObject,
_DEVICE_OBJECT *DeviceObject,
_DEVICE_OBJECT *ParseDeviceObject,
UINT64 Attributes,
VOID *AccessMode,
_OPEN_PACKET *Op,
_OB_EXTENDED_PARSE_PARAMETERS *ExtendedParameters,
UINT8 CopyOldFileObject,
UINT64 DesiredAccess){
struct _KPRCB *CurrentPrcb;
_OBJECT_TYPE *v10;
char v12;
_GENERAL_LOOKASIDE *P;
_DEVICE_OBJECT *v14;
_FILE_OBJECT *p_Body;
_OBJECT_CREATE_INFORMATION *v16;
unsigned int Number;
INT8 v18;
INT8 v19;
NTSTATUS v20;
unsigned int DefaultNonPagedPoolCharge;
_OBJECT_HEADER *v22;
int TransactionParameters;
_OPEN_PACKET *v24;
unsigned int v25;
_OB_EXTENDED_PARSE_PARAMETERS *v26;
INT64 RelatedFileObject;
_DEVICE_OBJECT *v28;
int v29;
unsigned int CreateOptions;
_LIST_ENTRY *p_IrpList;
void *FileObjectExtension;
unsigned __int64 DeviceType;
__int64 v35;
_EJOB *v36;
_OB_EXTENDED_PARSE_PARAMETERS *v37;
_GENERAL_LOOKASIDE *L;
__int64 Size;
void *(__fastcall *AllocateEx)(_POOL_TYPE, unsigned __int64, unsigned int, _LOOKASIDE_LIST_EX *);
__int64 Tag;
__int64 Type;
struct _KPRCB *v43;
_GENERAL_LOOKASIDE *v44;
VOID *SecurityDescriptor;
struct _KPRCB *v46;
_GENERAL_LOOKASIDE *v47;
_OBJECT_CREATE_INFORMATION *ObjectCreateInfo;
INT64 UseLookaside;
_OBJECT_HEADER *ReturnedObjectHeader;
_UNICODE_STRING CapturedObjectName;
_OBJECT_ATTRIBUTES ObjectAttributes;
_OB_EXTENDED_CREATION_INFO ExtendedInfo;
CurrentPrcb = KeGetCurrentPrcb();
v10 = (_OBJECT_TYPE *)IoFileObjectType;
*(_QWORD *)&ObjectAttributes.Length = 48i64;
*(&ObjectAttributes.Attributes + 1) = 0;
v12 = Attributes;
P = CurrentPrcb->PPLookasideList[4].P;
v14 = ParseDeviceObject;
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.Attributes = Attributes;
p_Body = 0i64;
ObjectAttributes.ObjectName = 0i64;
++P->TotalAllocates;
ExtendedInfo = (_OB_EXTENDED_CREATION_INFO)1;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
CapturedObjectName = 0i64;
ReturnedObjectHeader = 0i64;
v16 = (_OBJECT_CREATE_INFORMATION *)RtlpInterlockedPopEntrySList(&P->ListHead);
if( !v16 )
{
++P->AllocateMisses;
L = CurrentPrcb->PPLookasideList[4].L;
++L->TotalAllocates;
v16 = (_OBJECT_CREATE_INFORMATION *)RtlpInterlockedPopEntrySList(&L->ListHead);
if( !v16 )
{
Size = L->Size;
AllocateEx = L->AllocateEx;
Tag = L->Tag;
Type = (unsigned int)L->Type;
++L->AllocateMisses;
v16 = (_OBJECT_CREATE_INFORMATION *)((__int64(__fastcall *)(__int64, __int64, __int64))AllocateEx)(
Type,
Size,
Tag);
if( !v16 )
{
TransactionParameters = -1073741670;
LABEL_56:
if( !CopyOldFileObject )
*FileObject = 0i64;
return TransactionParameters;
}
}
}
Number = CurrentPrcb->Number;
v18 = (char)AccessMode;
v19 = (char)AccessMode;
LODWORD(UseLookaside) = 0;
v16->Attributes = Number;
v20 = ObpCaptureObjectCreateInformation(0, v19, &ObjectAttributes, &CapturedObjectName, v16, UseLookaside);
if( v20 < 0 )
{
v43 = KeGetCurrentPrcb();
v44 = v43->PPLookasideList[4].P;
++v44->TotalFrees;
if( LOWORD(v44->ListHead.Alignment) < v44->Depth
|| (++v44->FreeMisses,
v44 = v43->PPLookasideList[4].L,
++v44->TotalFrees,
LOWORD(v44->ListHead.Alignment) < v44->Depth) )
{
RtlpInterlockedPushEntrySList(&v44->ListHead, (PSLIST_ENTRY)v16);
}
else
{
++v44->FreeMisses;
((void(__fastcall *)(_OBJECT_CREATE_INFORMATION *))v44->FreeEx)(v16);
}
goto LABEL_9;
}
if( (v16->Attributes & v10->TypeInfo.InvalidAttributes) != 0 )
{
v20 = -1073741811;
goto LABEL_65;
}
if( (v16->Attributes & 0x10) != 0 && !SeSinglePrivilegeCheck(*(_QWORD *)&SeCreatePermanentPrivilege, 0) )
{
v20 = -1073741727;
goto LABEL_65;
}
DefaultNonPagedPoolCharge = v10->TypeInfo.DefaultNonPagedPoolCharge;
v16->PagedPoolCharge = v10->TypeInfo.DefaultPagedPoolCharge;
v16->NonPagedPoolCharge = DefaultNonPagedPoolCharge;
LODWORD(ObjectCreateInfo) = 216;
v20 = ObpAllocateObject(
v16,
v18,
v10,
&CapturedObjectName,
(UINT64)ObjectCreateInfo,
&ReturnedObjectHeader,
&ExtendedInfo);
if( v20 < 0 )
{
LABEL_65:
if( CapturedObjectName.Buffer )
ObpFreeObjectNameBuffer(&CapturedObjectName);
SecurityDescriptor = v16->SecurityDescriptor;
if( SecurityDescriptor )
{
SeReleaseSecurityDescriptor(SecurityDescriptor, v16->ProbeMode, 1u);
v16->SecurityDescriptor = 0i64;
}
v46 = KeGetCurrentPrcb();
v47 = v46->PPLookasideList[4].P;
++v47->TotalFrees;
if( LOWORD(v47->ListHead.Alignment) < v47->Depth
|| (++v47->FreeMisses,
v47 = v46->PPLookasideList[4].L,
++v47->TotalFrees,
LOWORD(v47->ListHead.Alignment) < v47->Depth) )
{
RtlpInterlockedPushEntrySList(&v47->ListHead, (PSLIST_ENTRY)v16);
}
else
{
++v47->FreeMisses;
((void(__fastcall *)(_OBJECT_CREATE_INFORMATION *))v47->FreeEx)(v16);
}
goto LABEL_9;
}
v22 = ReturnedObjectHeader;
if( ObpTraceFlags )
{
ObpRegisterObject(ReturnedObjectHeader);
ObpPushStackInfo(v22, 1u, 1ui64, 0x746C6644ui64);
}
p_Body = (_FILE_OBJECT *)&v22->Body;
LABEL_9:
TransactionParameters = v20;
if( v20 < 0 )
goto LABEL_56;
memset(p_Body, 0i64, sizeof(_FILE_OBJECT));
v24 = Op;
if( CopyOldFileObject )
{
p_Body->FsContext = (*FileObject)->FsContext;
p_Body->FsContext2 = (*FileObject)->FsContext2;
p_Body->FileName.Length = (*FileObject)->FileName.Length;
p_Body->FileName.MaximumLength = (*FileObject)->FileName.MaximumLength;
p_Body->FileName.Buffer = (*FileObject)->FileName.Buffer;
FileObjectExtension = (*FileObject)->FileObjectExtension;
if( FileObjectExtension )
p_Body->FileObjectExtension = FileObjectExtension;
}
else
{
v25 = DesiredAccess;
v26 = ExtendedParameters;
if( (Op->InternalFlags & 0x47) == 0
&& PsIsHostSilo(ExtendedParameters->Silo)
&& ((RelatedFileObject = (INT64)v24->RelatedFileObject) == 0
|| (LODWORD(v36) = IoGetSilo(RelatedFileObject), PsIsHostSilo(v36))) )
{
v28 = DeviceObject;
}
else
{
v37 = v26;
LODWORD(ObjectCreateInfo) = v25;
v28 = DeviceObject;
TransactionParameters = IopAllocateFoExtensionsOnCreate(p_Body, DeviceObject, v24, v37, (UINT64)ObjectCreateInfo);
}
if( TransactionParameters >= 0 )
{
if( v18 )
{
if( (v24->InternalFlags & 0x20) != 0 )
{
if( (v28->Flags & 0x40000) != 0
|| (DeviceType = v28->DeviceType, (unsigned int)DeviceType <= 0x35)
&& (v35 = 0x20000100100108i64, _bittest64(&v35, DeviceType)) )
{
TransactionParameters = IopRetrieveTransactionParameters(v28, v24, v25, p_Body);
}
}
}
if( TransactionParameters >= 0 && v18 && (v24->CreateOptions & 0x20000) != 0 )
TransactionParameters = IopCheckInitiatorHint(p_Body, v24->RelatedFileObject);
}
v14 = ParseDeviceObject;
}
*FileObject = p_Body;
if( !v24->DeleteOnly && !v24->QueryOnly )
{
if( (v24->CreateOptions & 0x30) != 0 )
{
v29 = p_Body->Flags | 2;
p_Body->Flags = v29;
if( (v24->CreateOptions & 0x10) != 0 )
p_Body->Flags = v29 | 4;
}
if( (p_Body->Flags & 2) != 0 )
{
KeInitializeEvent((INT64)p_Body->gap80, 1, 0);
p_Body->Waiters = 0;
p_Body->CurrentByteOffset.QuadPart = 0i64;
}
CreateOptions = v24->CreateOptions;
if( (CreateOptions & 8) != 0 )
{
p_Body->Flags |= 8u;
CreateOptions = v24->CreateOptions;
}
if( (CreateOptions & 2) != 0 )
{
p_Body->Flags |= 0x10u;
CreateOptions = v24->CreateOptions;
}
if( (CreateOptions & 4) != 0 )
{
p_Body->Flags |= 0x20u;
CreateOptions = v24->CreateOptions;
}
if( (CreateOptions & 0x800) != 0 )
{
p_Body->Flags |= 0x100000u;
CreateOptions = v24->CreateOptions;
}
if( (CreateOptions & 0x20000) != 0 )
p_Body->Flags |= 0x2000000u;
}
if( (v12 & 0x40) == 0 )
p_Body->Flags |= 0x20000u;
*(_DWORD *)&p_Body->Type = 14155781;
p_Body->RelatedFileObject = v24->RelatedFileObject;
p_Body->DeviceObject = v14;
p_Body->IrpListLock = 0i64;
p_IrpList = &p_Body->IrpList;
p_IrpList->Blink = p_IrpList;
p_IrpList->Flink = p_IrpList;
return TransactionParameters;
}Referenced by:
IopParseDevice