NtQueryObject
NTSTATUS __stdcall NtQueryObject(
VOID *Handle,
_OBJECT_INFORMATION_CLASS ObjectInformationClass,
VOID *ObjectInformation,
UINT64 ObjectInformationLength,
UINT64 *ReturnLength){
unsigned int v8;
char PreviousMode;
INT64 v10;
UINT64 *v11;
__int64 v12;
NTSTATUS result;
NTSTATUS v14;
_ADAPTER_OBJECT *v15;
unsigned int GrantedAccess;
_EX_PUSH_LOCK *v17;
__int64 v18;
NTSTATUS v19;
__int32 v20;
__int32 v21;
char v22;
unsigned int HandleAttributes;
char v24;
_OBJECT_HEADER_QUOTA_INFO *v25;
_EX_PUSH_LOCK *v26;
_OBJECT_TYPE *v27;
__int64 v28;
_ETHREAD *CurrentThread;
_EX_PUSH_LOCK *v30;
_EX_PUSH_LOCK *v31;
__int32 v32;
_EX_PUSH_LOCK *v33;
_ADAPTER_OBJECT *v34;
unsigned int i;
__int64 v36;
NTSTATUS TypeInfo;
int v38;
_EX_PUSH_LOCK *p_LowMemoryLogicalAddressQueueEntry;
_ETHREAD *v40;
char *v41;
_ADAPTER_OBJECT *v42;
_ADAPTER_OBJECT *v43;
_EX_PUSH_LOCK *v44;
NTSTATUS v45;
UINT64 v46;
_EX_PUSH_LOCK *PushLock;
unsigned int v48;
_ADAPTER_OBJECT *v49;
unsigned int v50;
int v51;
int v52;
_HALP_EMERGENCY_LA_QUEUE_ENTRY *v53;
_OBJECT_HANDLE_INFORMATION HandleInformation;
PADAPTER_OBJECT v55;
__int64 v56;
__int128 v57;
__m256i v58;
__int64 v59;
PVOID Object;
PADAPTER_OBJECT DmaAdapter;
VOID *v62;
__int64 v63;
unsigned int Length;
Length = ObjectInformationLength;
v8 = 0;
HandleInformation = 0i64;
v57 = 0i64;
memset(&v58, 0, sizeof(v58));
v59 = 0i64;
v52 = 0;
v51 = 0;
LODWORD(v46) = 0;
PreviousMode = KeGetCurrentThread()->PreviousMode;
if( PreviousMode )
{
v10 = 4i64;
if( ObjectInformationClass == ObjectHandleFlagInformation )
v10 = 1i64;
ProbeForWrite((UINT64)ObjectInformation, (unsigned int)ObjectInformationLength, v10);
v11 = ReturnLength;
if( ReturnLength )
{
v12 = (__int64)ReturnLength;
if( (unsigned __int64)ReturnLength >= 0x7FFFFFFF0000i64 )
v12 = 0x7FFFFFFF0000i64;
*(_DWORD *)v12 = *(_DWORD *)v12;
}
}
else
{
v11 = ReturnLength;
}
if( ObjectInformationClass == ObjectTypesInformation )
{
GrantedAccess = 0;
v50 = 0;
v15 = 0i64;
v49 = 0i64;
v17 = 0i64;
v18 = 0i64;
v56 = 0i64;
v14 = 0;
v45 = 0;
}
else
{
Object = 0i64;
result = ObReferenceObjectByHandle(Handle, 0i64, 0i64, PreviousMode, &Object, &HandleInformation);
v14 = result;
v15 = (_ADAPTER_OBJECT *)Object;
v49 = (_ADAPTER_OBJECT *)Object;
v45 = result;
if( result < 0 )
return result;
GrantedAccess = HandleInformation.GrantedAccess;
v50 = HandleInformation.GrantedAccess;
v17 = (_EX_PUSH_LOCK *)((char *)Object - 48);
v18 = ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ (unsigned __int8)*((char *)Object - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)Object - 48) >> 8)];
v56 = v18;
}
PushLock = v17;
if( ObjectInformationClass == ObjectNameInformation )
{
v19 = ObQueryNameStringMode(v15, (_OBJECT_NAME_INFORMATION *)ObjectInformation, Length, &v46, PreviousMode);
}
else
{
if( ObjectInformationClass == ObjectBasicInformation )
{
if( Length != 56 )
{
HalPutDmaAdapter(v15);
return -1073741820;
}
memset(&v58.m256i_u64[1], 0, 24);
HandleAttributes = HandleInformation.HandleAttributes;
LODWORD(v57) = HandleInformation.HandleAttributes;
v24 = BYTE3(v17[3].Ptr);
if( (v24 & 0x10) != 0 )
{
HandleAttributes = HandleInformation.HandleAttributes | 0x10;
LODWORD(v57) = HandleInformation.HandleAttributes | 0x10;
}
if( (v24 & 8) != 0 )
LODWORD(v57) = HandleAttributes | 0x20;
DWORD1(v57) = GrantedAccess;
DWORD2(v57) = v17[1]._bf_0;
HIDWORD(v57) = v17->_bf_0;
v25 = OBJECT_HEADER_TO_QUOTA_INFO((_OBJECT_HEADER *)v17);
if( v25 )
v58.m256i_i64[0] = *(_QWORD *)&v25->PagedPoolCharge;
else
v58.m256i_i64[0] = 0i64;
if( v27 == ObjectType )
v28 = *(_QWORD *)&v15->AdapterObject.DmaHeader.Version;
else
v28 = 0i64;
v59 = v28;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
v30 = v26 + 2;
ExAcquirePushLockSharedEx(v26 + 2, 0i64);
v31 = PushLock;
if( (PushLock[3].Value & 0x20000) != 0
&& (v33 = (_EX_PUSH_LOCK *)*((unsigned __int8 *)&dword_140C25D60 + (BYTE2(PushLock[3].Value) & 3)),
PushLock = (_EX_PUSH_LOCK *)((char *)PushLock - (__int64)v33),
v31 != v33)
&& (v34 = *(_ADAPTER_OBJECT **)((char *)v31 - (char *)v33), (v55 = v34) != 0i64) )
{
ObfReferenceObject(v34);
if( _InterlockedCompareExchange64(&v30->_bf_0, 0i64, 17i64) != 17 )
ExfReleasePushLockShared(v30);
KeAbPostRelease(v30);
KeLeaveCriticalRegionThread(KeGetCurrentThread());
v38 = LOWORD(PushLock[1].Value) + 2;
while( 1 )
{
DmaAdapter = v55;
if( !v55 )
break;
p_LowMemoryLogicalAddressQueueEntry = (_EX_PUSH_LOCK *)&v55[-1].LowMemoryLogicalAddressQueueEntry;
v53 = &v55[-1].LowMemoryLogicalAddressQueueEntry;
v40 = (_ETHREAD *)KeGetCurrentThread();
--v40->Tcb.KernelApcDisable;
PushLock = p_LowMemoryLogicalAddressQueueEntry + 2;
ExAcquirePushLockSharedEx(p_LowMemoryLogicalAddressQueueEntry + 2, 0i64);
if( (BYTE2(v53[1].ListEntry.Flink) & 2) == 0
|| (v41 = (char *)v53 - *((unsigned __int8 *)&dword_140C25D60 + (BYTE2(v53[1].ListEntry.Flink) & 3))) == 0i64
|| (v42 = *(_ADAPTER_OBJECT **)v41) == 0i64 )
{
if( _InterlockedCompareExchange64(&PushLock->_bf_0, 0i64, 17i64) != 17 )
ExfReleasePushLockShared(PushLock);
KeAbPostRelease(PushLock);
KeLeaveCriticalRegionThread(KeGetCurrentThread());
if( v55 )
HalPutDmaAdapter(v55);
break;
}
v38 += *((unsigned __int16 *)v41 + 4) + 2;
v43 = *(_ADAPTER_OBJECT **)v41;
v55 = v42;
ObfReferenceObject(v43);
v44 = PushLock;
if( _InterlockedCompareExchange64(&PushLock->_bf_0, 0i64, 17i64) != 17 )
{
ExfReleasePushLockShared(PushLock);
v44 = PushLock;
}
KeAbPostRelease(v44);
KeLeaveCriticalRegionThread(KeGetCurrentThread());
HalPutDmaAdapter(DmaAdapter);
}
v32 = v38 + 18;
}
else
{
if( _InterlockedCompareExchange64(&v30->_bf_0, 0i64, 17i64) != 17 )
ExfReleasePushLockShared(v30);
KeAbPostRelease(v30);
KeLeaveCriticalRegionThread(KeGetCurrentThread());
v32 = 0;
}
v58.m256i_i32[5] = v32;
v58.m256i_i32[6] = *(unsigned __int16 *)(v56 + 16) + 106;
if( (v50 & 0x20000) != 0 && v31[5]._bf_0 )
{
v51 = 15;
v15 = v49;
(*(void(__fastcall **)(_ADAPTER_OBJECT *, __int64, int *))(v56 + 152))(v49, 1i64, &v51);
}
else
{
v15 = v49;
}
v58.m256i_i32[7] = v52;
*(_OWORD *)ObjectInformation = v57;
*(__m256i *)((char *)ObjectInformation + 16) = v58;
*((_QWORD *)ObjectInformation + 6) = v59;
LODWORD(v46) = 56;
v14 = v45;
goto LABEL_14;
}
v20 = ObjectInformationClass - 2;
if( v20 )
{
v21 = v20 - 1;
if( v21 )
{
if( v21 != 1 )
{
HalPutDmaAdapter(v15);
return -1073741821;
}
LODWORD(v46) = 2;
if( Length < 2 )
{
v14 = -1073741820;
}
else
{
*(_BYTE *)ObjectInformation = 0;
v22 = HandleInformation.HandleAttributes;
if( (HandleInformation.HandleAttributes & 2) != 0 )
*(_BYTE *)ObjectInformation = 1;
*((_BYTE *)ObjectInformation + 1) = 0;
if( (v22 & 1) != 0 )
*((_BYTE *)ObjectInformation + 1) = 1;
}
}
else
{
LODWORD(v46) = 8;
v62 = ObjectInformation;
if( Length >= 4 )
{
*(_DWORD *)ObjectInformation = 0;
for( i = 0; ; ++i )
{
v48 = i;
if( i >= 0x100 )
break;
v56 = *((_QWORD *)&stru_140C23628 + i + 839);
if( !v56 )
break;
++*(_DWORD *)ObjectInformation;
}
while( 1 )
{
v48 = v8;
if( v8 >= 0x100 )
break;
v63 = (__int64)ObjectInformation + (unsigned int)v46;
v36 = *((_QWORD *)&stru_140C23628 + v8 + 839);
v56 = v36;
if( !v36 )
break;
TypeInfo = ObQueryTypeInfo(
v36,
(__int64)ObjectInformation + (unsigned int)v46,
Length,
(unsigned int *)&v46);
v14 = TypeInfo;
if( ((TypeInfo + 0x80000000) & 0x80000000) == 0 && TypeInfo != -1073741820 )
break;
++v8;
}
}
else
{
v14 = -1073741820;
}
}
goto LABEL_14;
}
v19 = ObQueryTypeInfo(v18, (__int64)ObjectInformation, Length, (unsigned int *)&v46);
}
v14 = v19;
LABEL_14:
if( v11 )
*(_DWORD *)v11 = v46;
if( v15 )
HalPutDmaAdapter(v15);
return v14;
}Referenced by:
IopLoadDriver
IopQueryRegistryKeySystemPath