CmpInitCmRM
NTSTATUS __stdcall CmpInitCmRM(_CMHIVE *CmHive, UINT8 NeedRmLogStart){
char v4;
_CMHIVE *v5;
__int64 v6;
int v7;
VOID **PoolWithTag;
__int64 v9;
__int64 v10;
PERESOURCE v11;
_UNICODE_STRING *v12;
_HBASE_BLOCK *BaseBlock;
UUID v14;
UUID v15;
__int128 v16;
__int64 v17;
__int64 v18;
void *v19;
__int64 v20;
int ResourceManager;
_UNICODE_STRING *p_Source;
PSECURITY_DESCRIPTOR v23;
VOID **v24;
_CLFS_MGMT_POLICY *v25;
size_t v26;
size_t v27;
ULONG v28;
const VOID *v29;
NTSTATUS TransactionManager;
INT64 v31;
INT64 v32;
VOID *v33;
_GUID RmId;
INT64 *v35;
INT64 v36;
INT64 v37;
INT64 v38;
VOID *v39;
INT64 v40;
__int64 *v41;
INT64 v42;
__int64 *v44;
__int64 v45;
__int64 v46;
__int64 v47;
__int64 v48;
__int64 v49;
_ADAPTER_OBJECT *v50;
__int64 v51;
PSECURITY_DESCRIPTOR psdLogFile;
PSECURITY_DESCRIPTOR psdLogFilea;
PSECURITY_DESCRIPTOR psdLogFileb;
INT64 fCreateDisposition;
INT64 fCreateDispositiona;
INT64 fCreateDispositionb;
INT64 fCreateDispositionc;
INT64 fCreateOptions;
INT64 fCreateOptionsa;
INT64 fCreateOptionsb;
INT64 fFlagsAndAttributes;
INT64 fFlagsAndAttributesa;
INT64 fFlagsAndAttributesb;
UINT8 v65;
int v66;
_UNICODE_STRING Destination;
_FILE_OBJECT *pplfoLog;
PSECURITY_DESCRIPTOR P;
void *ClientCookie;
ULONG CreateOptions;
_UNICODE_STRING GuidString;
_UNICODE_STRING Source;
_UNICODE_STRING LogFileName;
_OBJECT_ATTRIBUTES ObjectAttributes;
PERESOURCE Resource;
_CLFS_MGMT_CLIENT_REGISTRATION RegistrationData;
_GUID ResourceManagerGuid;
UUID Uuid;
UUID v80;
__int128 v81;
v65 = NeedRmLogStart;
*(_QWORD *)&GuidString.Length = 0i64;
GuidString.Buffer = 0i64;
*(_QWORD *)&Source.Length = 0i64;
Source.Buffer = 0i64;
v81 = 0i64;
*(_QWORD *)&Destination.Length = 0i64;
v4 = 0;
ResourceManagerGuid = 0i64;
Destination.Buffer = 0i64;
Uuid = 0i64;
pplfoLog = 0i64;
v80 = 0i64;
*(_QWORD *)&LogFileName.Length = 0i64;
memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
LogFileName.Buffer = 0i64;
CreateOptions = 0;
P = 0i64;
ClientCookie = 0i64;
memset(&RegistrationData, 0, sizeof(RegistrationData));
v66 = 0;
if( CmpMiniNTBoot )
return 0;
v5 = (_CMHIVE *)*(&stru_140C00F40 + 70);
if( CmHive )
v5 = CmHive;
if( (v5->Hive.HiveFlags & 0x8001) != 0 )
return 0;
v7 = CmpUuidCreate(&Uuid);
if( v7 < 0 || (v7 = CmpUuidCreate(&v80), v7 < 0) )
{
v5->CmRmInitFailPoint = 1;
v5->CmRmInitFailStatus = v7;
CmpLogTxrInitEvent(v6, (__int64)v5, v7);
return v7;
}
PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x88ui64, 1834110275i64);
v10 = (__int64)PoolWithTag;
if( !PoolWithTag )
{
v5->CmRmInitFailPoint = 1;
LABEL_70:
ResourceManager = -1073741670;
v5->CmRmInitFailStatus = -1073741670;
CmpLogTxrInitEvent(v9, (__int64)v5, -1073741670);
return ResourceManager;
}
memset(PoolWithTag, 0i64, 0x88u);
Resource = (PERESOURCE)ExAllocatePoolWithTag(0x200ui64, 0x68ui64, 1819430211i64);
v11 = Resource;
if( !Resource )
{
ExFreePoolWithTag((PVOID)v10, 0x6D524D43u);
v5->CmRmInitFailPoint = 2;
goto LABEL_70;
}
*(_QWORD *)(v10 + 88) = 0i64;
*(_QWORD *)(v10 + 24) = v10 + 16;
*(_QWORD *)(v10 + 16) = v10 + 16;
*(_QWORD *)(v10 + 96) = 0i64;
*(_DWORD *)(v10 + 104) = NeedRmLogStart != 0 ? 4 : 0;
*(_QWORD *)(v10 + 108) = 0i64;
*(_DWORD *)(v10 + 68) = 0;
*(_QWORD *)(v10 + 72) = 0i64;
*(_QWORD *)(v10 + 128) = v11;
ExInitializeResourceLite((INT64)v11);
BaseBlock = v5->Hive.BaseBlock;
v14 = Uuid;
v15 = v80;
if( BaseBlock->GuidSignature != 1836346738 )
{
BaseBlock->GuidSignature = 1836346738;
goto LABEL_83;
}
v16 = v81;
v17 = v81 - *(_QWORD *)&BaseBlock->TmId.Data1;
if( (_QWORD)v81 == *(_QWORD *)&BaseBlock->TmId.Data1 )
v17 = *((_QWORD *)&v81 + 1) - *(_QWORD *)BaseBlock->TmId.Data4;
if( !v17 )
{
BaseBlock->TmId = v80;
BaseBlock = v5->Hive.BaseBlock;
v4 = 1;
v66 = 1;
}
v12 = (_UNICODE_STRING *)(v16 - *(_QWORD *)&BaseBlock->RmId.Data1);
if( (_QWORD)v16 == *(_QWORD *)&BaseBlock->RmId.Data1 )
v12 = (_UNICODE_STRING *)(*((_QWORD *)&v16 + 1) - *(_QWORD *)BaseBlock->RmId.Data4);
if( !v12 )
{
BaseBlock->RmId = v14;
BaseBlock = v5->Hive.BaseBlock;
v4 = 1;
}
v18 = v16 - *(_QWORD *)&BaseBlock->LogId.Data1;
if( !v18 )
v18 = *((_QWORD *)&v16 + 1) - *(_QWORD *)BaseBlock->LogId.Data4;
if( !v18 )
{
v4 = 1;
BaseBlock->LogId = BaseBlock->RmId;
}
while( 1 )
{
if( v4 )
{
CmpLockRegistry();
HvLockHiveFlusherShared((INT64)v5);
HvLockHiveWriter((INT64)v5);
HvMarkBaseBlockDirty(&v5->Hive);
HvUnlockHiveWriter((INT64)v5);
HvUnlockHiveFlusherShared((INT64)v5);
CmpUnlockRegistry();
}
v19 = v5->FileHandles[0];
ResourceManager = RtlStringFromGUID(&v5->Hive.BaseBlock->TmId, &GuidString, v12);
if( ResourceManager < 0 )
{
v5->CmRmInitFailPoint = 3;
goto LABEL_99;
}
if( CmHive )
{
ResourceManager = CmpQueryNameString(CmHive->FileHandles[0], &Source);
if( ResourceManager < 0 )
{
v5->CmRmInitFailPoint = 4;
goto LABEL_99;
}
p_Source = &Source;
}
else
{
p_Source = (_UNICODE_STRING *)&CmpLogPath;
CreateOptions = 52;
}
Destination.MaximumLength = GuidString.Length
+ *(&stru_140C00F40 + 1352)
+ *(&stru_140C00F40 + 1344)
+ p_Source->Length;
Destination.Buffer = (wchar_t *)ExpAllocateStringRoutine(Destination.MaximumLength);
if( !Destination.Buffer )
{
ResourceManager = -1073741670;
v5->CmRmInitFailPoint = 5;
LABEL_99:
CmpLogTxrInitEvent(v20, (__int64)v5, ResourceManager);
if( ClientCookie )
{
ClfsMgmtDeregisterManagedClient(ClientCookie);
ClientCookie = 0i64;
}
if( pplfoLog )
ClfsCloseLogFileObject(pplfoLog);
if( GuidString.Buffer )
RtlFreeAnsiString(&GuidString);
if( Source.Buffer )
RtlFreeAnsiString(&Source);
if( Destination.Buffer )
RtlFreeAnsiString(&Destination);
v49 = *(_QWORD *)(v10 + 48);
if( v49 )
ZwClose(v49);
v50 = *(_ADAPTER_OBJECT **)(v10 + 40);
if( v50 )
HalPutDmaAdapter(v50);
v51 = *(_QWORD *)(v10 + 32);
if( v51 )
ZwClose(v51);
ExFreePoolWithTag((PVOID)v10, 0x6D524D43u);
ExDeleteResourceLite((UINT64)Resource);
ExFreePoolWithTag(Resource, 0);
v5->CmRmInitFailStatus = ResourceManager;
return ResourceManager;
}
RtlAppendUnicodeStringToString(&Destination, (_UNICODE_STRING *)&stru_140C00F40 + 169);
RtlAppendUnicodeStringToString(&Destination, p_Source);
RtlAppendUnicodeStringToString(&Destination, &GuidString);
RtlAppendUnicodeStringToString(&Destination, (_UNICODE_STRING *)&stru_140C00F40 + 168);
RtlFreeAnsiString(&GuidString);
if( CmHive )
RtlFreeAnsiString(&Source);
ResourceManager = CmpQueryFileSecurityDescriptor(v19, &P);
if( ResourceManager < 0 )
{
v5->CmRmInitFailPoint = 6;
goto LABEL_99;
}
v23 = P;
ResourceManager = ClfsCreateLogFile(&pplfoLog, &Destination, 0xC0000000, 7u, P, 3u, 8u, 0, 0x200u, 0i64, 0);
ExFreePoolWithTag(v23, 0);
if( ResourceManager >= 0 )
break;
if( v66 )
{
v5->CmRmInitFailPoint = 7;
goto LABEL_99;
}
RtlFreeAnsiString(&Destination);
CmpLogTxrInitEvent(v48, (__int64)v5, ResourceManager);
LABEL_83:
v4 = 1;
v66 = 1;
v5->Hive.BaseBlock->TmId = v15;
v5->Hive.BaseBlock->RmId = v14;
v5->Hive.BaseBlock->LogId = v14;
if( !CmHive )
v65 = 1;
}
memset(&RegistrationData, 0, sizeof(RegistrationData));
RegistrationData.Version = 1;
ResourceManager = ClfsMgmtRegisterManagedClient(pplfoLog, &RegistrationData, &ClientCookie);
if( ResourceManager < 0 )
{
v5->CmRmInitFailPoint = 8;
goto LABEL_99;
}
v24 = ExAllocatePoolWithTag(1ui64, (unsigned __int16)TmContainerExt + 24i64, 1834110275i64);
v25 = (_CLFS_MGMT_POLICY *)v24;
if( !v24 )
{
v5->CmRmInitFailPoint = 9;
goto LABEL_99;
}
v26 = (unsigned __int16)TmContainerExt;
*(_OWORD *)v24 = 0i64;
v24[2] = 0i64;
v27 = v26;
v28 = v26 + 24;
*((_WORD *)v24 + 8) = v26;
v29 = off_140C04790;
*((_DWORD *)v24 + 1) = v28;
*(_DWORD *)v24 = 1;
*((_DWORD *)v24 + 3) = 9;
memmove((char *)v24 + 18, v29, v27);
ResourceManager = ClfsMgmtInstallPolicy(pplfoLog, v25, v28);
ExFreePoolWithTag(v25, 0);
if( ResourceManager < 0 )
{
v5->CmRmInitFailPoint = 10;
goto LABEL_99;
}
LODWORD(fCreateDisposition) = 0;
LogFileName.Length = Destination.Length - *(&stru_140C00F40 + 1352);
ObjectAttributes.Length = 48;
LogFileName.MaximumLength = Destination.MaximumLength - *(&stru_140C00F40 + 1352);
LogFileName.Buffer = (wchar_t *)((char *)Destination.Buffer + *(&stru_140C00F40 + 1352));
LODWORD(psdLogFile) = CreateOptions;
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.Attributes = 576;
ObjectAttributes.ObjectName = 0i64;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
TransactionManager = ZwCreateTransactionManager(
v10 + 32,
983103i64,
(INT64)&ObjectAttributes,
(INT64)&LogFileName,
(INT64)psdLogFile,
fCreateDisposition,
fCreateOptions,
fFlagsAndAttributes);
ResourceManager = TransactionManager;
if( TransactionManager == -1073741771 )
{
if( Destination.Buffer )
RtlFreeAnsiString(&Destination);
if( pplfoLog )
{
ClfsCloseLogFileObject(pplfoLog);
pplfoLog = 0i64;
}
if( ClientCookie )
{
ClfsMgmtDeregisterManagedClient(ClientCookie);
ClientCookie = 0i64;
}
if( v66 )
goto LABEL_39;
goto LABEL_83;
}
if( TransactionManager >= 0 )
ResourceManager = ZwRecoverTransactionManager(
*(_QWORD *)(v10 + 32),
v31,
(INT64)v12,
v32,
(INT64)psdLogFilea,
fCreateDispositiona,
fCreateOptionsa,
fFlagsAndAttributesa);
LABEL_39:
RtlFreeAnsiString(&Destination);
if( ResourceManager < 0 )
{
v5->CmRmInitFailPoint = 11;
goto LABEL_99;
}
if( pplfoLog )
{
ClfsCloseLogFileObject(pplfoLog);
pplfoLog = 0i64;
}
if( ClientCookie )
{
ClfsMgmtDeregisterManagedClient(ClientCookie);
ClientCookie = 0i64;
}
v33 = *(VOID **)(v10 + 32);
P = 0i64;
ResourceManager = ObReferenceObjectByHandle(
v33,
0xF003Fui64,
(_OBJECT_TYPE *)TmTransactionManagerObjectType,
0,
&P,
0i64);
*(_QWORD *)(v10 + 40) = P;
if( ResourceManager < 0 )
{
v5->CmRmInitFailPoint = 12;
goto LABEL_99;
}
LODWORD(fCreateDispositionb) = 0;
RmId = v5->Hive.BaseBlock->RmId;
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.ObjectName = 0i64;
v35 = (INT64 *)(v10 + 48);
ResourceManagerGuid = RmId;
ObjectAttributes.Length = 48;
ObjectAttributes.Attributes = 576;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
ResourceManager = ZwCreateResourceManager(
v10 + 48,
2031743i64,
*(_QWORD *)(v10 + 32),
(INT64)&ResourceManagerGuid,
(INT64)&ObjectAttributes,
fCreateDispositionb,
0i64,
fFlagsAndAttributesa);
if( ResourceManager == -1073741771 )
ResourceManager = ZwOpenResourceManager(
v10 + 48,
2031743i64,
*(_QWORD *)(v10 + 32),
(INT64)&ResourceManagerGuid,
(INT64)&ObjectAttributes,
fCreateDispositionc,
fCreateOptionsb,
fFlagsAndAttributesb);
if( ResourceManager < 0 )
{
v5->CmRmInitFailPoint = 13;
goto LABEL_99;
}
ResourceManager = ZwRecoverResourceManager(
*v35,
v36,
v37,
v38,
(INT64)psdLogFileb,
fCreateDispositionc,
fCreateOptionsb,
fFlagsAndAttributesb);
if( ResourceManager < 0 )
{
v5->CmRmInitFailPoint = 14;
goto LABEL_99;
}
v39 = (VOID *)*v35;
P = 0i64;
ResourceManager = ObReferenceObjectByHandle(
v39,
0x1F007Fui64,
(_OBJECT_TYPE *)TmResourceManagerObjectType,
0,
&P,
0i64);
*(_QWORD *)(v10 + 56) = P;
if( ResourceManager < 0 )
{
v5->CmRmInitFailPoint = 15;
goto LABEL_99;
}
if( CmHive )
{
CmHive->CmRm = (_CM_RM *)v10;
*(_DWORD *)(v10 + 64) = 1;
goto LABEL_52;
}
CmRmSystem = (PVOID)v10;
v44 = &qword_140C00F18;
v45 = 7i64;
while( 2 )
{
v46 = v44[3];
if( v46 && (*(_DWORD *)(v46 + 160) & 2) == 0 )
{
++*(_DWORD *)(v10 + 64);
v47 = v44[3];
goto LABEL_63;
}
if( *v44 && (*(_DWORD *)(*v44 + 160) & 2) == 0 )
{
++*(_DWORD *)(v10 + 64);
v47 = *v44;
LABEL_63:
*(_QWORD *)(v47 + 4192) = v10;
}
v44 += 25;
if( --v45 )
continue;
break;
}
*(_QWORD *)(*(_QWORD *)&CmpMasterHive + 4192i64) = v10;
++*(_DWORD *)(v10 + 64);
LABEL_52:
*(_QWORD *)(v10 + 80) = CmHive;
LOCK_CM_RM_LIST();
v41 = (__int64 *)qword_140C47878;
if( *(INT64 **)qword_140C47878 != &CmpRmListHead )
__fastfail(3u);
*(_QWORD *)v10 = &CmpRmListHead;
*(_QWORD *)(v10 + 8) = v41;
*v41 = v10;
qword_140C47878 = v10;
UNLOCK_CM_RM_LIST(v40, (INT64)&CmpRmListHead);
if( v65 )
CmpStartRMLog((char *)v10, 0i64, v42);
return 0;
}Referenced by:
CmpFinishSystemHivesLoad
CmpLoadKeyCommon
CmpMountPreloadedHives