MiResolveImageReferences
NTSTATUS __stdcall MiResolveImageReferences(
VOID *ImageBase,
_UNICODE_STRING *ImageName,
VOID *OriginalFileDirectory,
const _UNICODE_STRING *NamePrefix,
PVOID *LoadedImports){
_UNICODE_STRING *v5;
char *v6;
unsigned int *v7;
INT64 v8;
INT64 v9;
unsigned int *v10;
char v11;
_UNICODE_STRING *v12;
NTSTATUS v13;
_LOAD_IMPORTS *v14;
NTSTATUS v15;
INT8 *v16;
const char *v17;
unsigned int v18;
_DWORD *CurrentApiSetSchema;
INT64 *v20;
__int64 *v21;
VOID *v22;
int v23;
__int64 v24;
_IMAGE_THUNK_DATA32 *v25;
_IMAGE_THUNK_DATA32 *v26;
_LOAD_IMPORTS *v27;
_UNICODE_STRING *v29;
INT64 v30;
char v31;
char v32[7];
_LOAD_IMPORTS *ImportList;
INT8 *v34;
UINT64 Size;
_UNICODE_STRING UnicodeString;
_UNICODE_STRING FullImageName;
VOID *ImageHandle[2];
_UNICODE_STRING String1;
VOID *ImageBaseAddress;
__int64 v41[2];
_UNICODE_STRING *ImageFileDirectory;
_STRING DestinationString;
v41[0] = 3932218i64;
v41[1] = (__int64)L"\\SystemRoot\\System32\\drivers\\";
v5 = (_UNICODE_STRING *)NamePrefix;
*(_QWORD *)&String1.Length = 0i64;
v6 = (char *)*((_QWORD *)ImageBase + 6);
*((_QWORD *)ImageBase + 17) = -2i64;
ImageHandle[0] = 0i64;
ImageBaseAddress = 0i64;
v32[0] = 0;
DestinationString = 0i64;
UnicodeString = 0i64;
FullImageName = 0i64;
v7 = (unsigned int *)RtlImageDirectoryEntryToData(v6, 1u, 1u, &Size);
v10 = v7;
if( !v7 )
return 0;
v31 = 0;
ImportList = 0i64;
v11 = 0;
v34 = 0i64;
v12 = 0i64;
LODWORD(Size) = 0;
String1.Buffer = 0i64;
v13 = MiPrepareImportList(v7, &ImportList, v8, v9);
v14 = ImportList;
v15 = v13;
v16 = 0i64;
if( v15 >= 0 )
{
while( 1 )
{
if( !v10[3] || !*v10 )
{
v27 = MiCompressImportList(v14);
if( MiGetSystemRegionType((UINT64)v6) == 1 )
MiSessionLookupImage((UINT64)v6)[3].ParentValue = (unsigned __int64)v27;
else
*((_QWORD *)ImageBase + 17) = v27;
return 0;
}
v17 = &v6[v10[3]];
ImportList = 0i64;
RtlInitAnsiString(&DestinationString, v17);
v18 = 0;
v15 = RtlAnsiStringToUnicodeString(&UnicodeString, &DestinationString, 1u);
if( v15 < 0 )
goto LABEL_67;
if( !UnicodeString.Buffer )
{
LABEL_66:
v15 = -1073741670;
goto LABEL_67;
}
CurrentApiSetSchema = PsQueryCurrentApiSetSchema();
v15 = ApiSetResolveToHost(
CurrentApiSetSchema,
&UnicodeString.Length,
(__int64)ImageName,
v32,
(__int64)&FullImageName);
if( v15 < 0 )
goto LABEL_67;
if( v32[0] )
{
RtlFreeAnsiString(&UnicodeString);
if( !FullImageName.Length )
goto LABEL_7;
ImageFileDirectory = (_UNICODE_STRING *)v41;
v18 = 0x80000000;
v15 = RtlDuplicateUnicodeString(0i64, &FullImageName, &UnicodeString);
v16 = 0i64;
if( v15 < 0 )
goto LABEL_68;
}
else
{
ImageFileDirectory = (_UNICODE_STRING *)OriginalFileDirectory;
}
if( !v5 || !strnicmp(v17, "ntoskrnl", 8u) || !strnicmp(v17, "hal", 3u) )
{
String1 = UnicodeString;
}
else
{
String1.MaximumLength = UnicodeString.Length + v5->Length;
String1.Buffer = (wchar_t *)MiAllocatePool(256i64, String1.MaximumLength, 0x54446D4Dui64);
if( !String1.Buffer )
goto LABEL_66;
String1.Length = 0;
RtlAppendUnicodeStringToString(&String1, v5);
RtlAppendUnicodeStringToString(&String1, &UnicodeString);
v31 = 1;
}
v20 = (INT64 *)PsLoadedModuleList;
ImportList = (_LOAD_IMPORTS *)&String1;
if( (INT64 *)PsLoadedModuleList == &PsLoadedModuleList )
goto LABEL_20;
while( !(unsigned __int8)RtlEqualUnicodeString(&String1, (PCUNICODE_STRING)(v20 + 11), 1u) )
{
v20 = (INT64 *)*v20;
if( v20 == &PsLoadedModuleList )
goto LABEL_20;
}
v22 = (VOID *)v20[6];
if( !v22 )
break;
if( (v20[13] & 0x1000) == 0 )
{
if( MiGetSystemRegionType(v20[6]) == 1 )
{
if( !MiSessionReferenceImage(v22) )
v22 = 0i64;
}
else if( v20[17] != 1 )
{
++*((_WORD *)v20 + 54);
}
}
if( !v22 )
break;
LABEL_31:
if( (v20[13] & 0x1000) == 0 && v20[17] != 1 )
{
v23 = Size;
*(_QWORD *)&v14[2 * (unsigned int)Size + 2] = v20;
LODWORD(Size) = v23 + 1;
}
v24 = *v10;
if( (_DWORD)v24 )
{
v25 = (_IMAGE_THUNK_DATA32 *)&v6[v24];
v26 = (_IMAGE_THUNK_DATA32 *)&v6[v10[4]];
while( *(_QWORD *)&v25->u1.ForwarderString )
{
v15 = MiSnapThunk(v22, v6, v25, v26, 0i64);
if( v15 < 0 )
{
v16 = MiSnapUnresolvedImport(v6, v25, v22);
goto LABEL_68;
}
v25 += 2;
v26 += 2;
}
}
RtlFreeAnsiString(&UnicodeString);
if( v31 )
{
ExFreePoolWithTag(String1.Buffer, 0);
v31 = 0;
}
v5 = (_UNICODE_STRING *)NamePrefix;
LABEL_7:
v10 += 5;
}
v5 = (_UNICODE_STRING *)NamePrefix;
LABEL_20:
v21 = (__int64 *)ImageFileDirectory;
if( !MiFormFullImageName(ImageFileDirectory, &UnicodeString, &FullImageName) )
goto LABEL_66;
v15 = MiLoadImportDll(&FullImageName, v5, v18, ImageHandle, &ImageBaseAddress);
if( v15 == -1073741800 )
{
if( MiGetSystemRegionType((UINT64)v6) != 1 )
{
LABEL_23:
ExFreePoolWithTag(FullImageName.Buffer, 0);
v16 = 0i64;
if( v15 < 0 )
goto LABEL_68;
v20 = (INT64 *)ImageHandle[0];
v22 = (VOID *)*((_QWORD *)ImageHandle[0] + 6);
goto LABEL_31;
}
v15 = MiLoadImportDll(&FullImageName, v5, v18 | 1, ImageHandle, &ImageBaseAddress);
}
if( v15 == -1073741772 )
{
ExFreePoolWithTag(FullImageName.Buffer, 0);
if( v21 == v41 )
{
if( !v32[0] )
{
v15 = -1073741772;
LABEL_67:
v16 = v34;
LABEL_68:
v12 = (_UNICODE_STRING *)ImportList;
v11 = v31;
goto LABEL_69;
}
v29 = (_UNICODE_STRING *)OriginalFileDirectory;
}
else
{
v29 = (_UNICODE_STRING *)v41;
}
if( !MiFormFullImageName(v29, &UnicodeString, &FullImageName) )
goto LABEL_66;
v15 = MiLoadImportDll(&FullImageName, v5, v18, ImageHandle, &ImageBaseAddress);
if( v32[0] && v15 == -1073741800 && MiGetSystemRegionType((UINT64)v6) == 1 )
v15 = MiLoadImportDll(&FullImageName, v5, v18 | 1, ImageHandle, &ImageBaseAddress);
}
goto LABEL_23;
}
LABEL_69:
MiLogFailedDriverLoad(ImageName, v12, v16, (unsigned int)v15, v30);
if( v11 )
ExFreePoolWithTag(String1.Buffer, 0);
RtlFreeAnsiString(&UnicodeString);
if( v14 )
{
if( (unsigned int)Size != *(_QWORD *)v14 )
*(_QWORD *)v14 = (unsigned int)Size;
MiDereferenceImports(v14);
ExFreePoolWithTag(v14, 0);
}
return v15;
}Referenced by:
MiResolveImageImports