CmGetSystemDriverList
VOID **__fastcall CmGetSystemDriverList(__int64 a1){
__int64 v1;
char v2;
VOID **v3;
VOID **v4;
char v5;
BOOL v6;
NTSTATUS v7;
const _UNICODE_STRING *v8;
PVOID *i;
_LIST_ENTRY *Flink;
int v11;
INT64 v12;
_LIST_ENTRY *v13;
int v14;
PVOID **v15;
PVOID **v16;
NTSTATUS v18;
VOID **v19;
VOID **v20;
PVOID *v21;
VOID **v22;
PVOID *v23;
PVOID *v24;
PVOID *v25;
PVOID *v26;
INT64 RestartScan;
UINT64 *Context;
UINT64 *Contexta;
UINT64 *ReturnLength;
UINT64 *ReturnLengtha;
__int64 v32;
__int64 v33;
__int64 v34;
_LIST_ENTRY DriverListHead;
PVOID P;
PVOID *p_P;
UINT64 v38;
PVOID v39;
PVOID *v40;
VOID *DirectoryHandle;
_OBJECT_ATTRIBUTES ObjectAttributes;
__int64 v43;
VOID **PoolWithTag;
_UNICODE_STRING DestinationString;
INT64 v46[8];
INT64 v47[8];
_KAPC_STATE ApcState;
v43 = a1;
v1 = a1;
v38 = 0i64;
v2 = 0;
DestinationString = 0i64;
memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
memset(&ApcState, 0, sizeof(ApcState));
memset(v46, 0i64, sizeof(v46));
LODWORD(v46[7]) = -1;
memset(v47, 0i64, sizeof(v47));
LODWORD(v47[7]) = -1;
p_P = &P;
DirectoryHandle = 0i64;
P = &P;
v3 = 0i64;
v40 = &v39;
v4 = 0i64;
v5 = 0;
v39 = &v39;
v6 = 0;
DriverListHead.Blink = &DriverListHead;
DriverListHead.Flink = &DriverListHead;
if( CmpOpenSystemDriverHiveContext(&CmpSystemHiveNameString) >= 0 )
{
if( !*(&stru_140CF2E80 + 1656)
|| (v18 = CmpOpenSystemDriverHiveContext(&CmpDevicesHiveNameString), (int)(v18 + 0x80000000) < 0)
|| v18 == -1073741772 )
{
RtlInitUnicodeString(&DestinationString, L"\\DriverStores");
ObjectAttributes.Length = 48;
ObjectAttributes.ObjectName = &DestinationString;
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.Attributes = 576;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
if( ZwOpenDirectoryObject(&DirectoryHandle, 1, &ObjectAttributes) >= 0 )
{
PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x400ui64, 538987843i64);
v3 = PoolWithTag;
if( PoolWithTag )
{
v7 = ZwQueryDirectoryObject(
DirectoryHandle,
PoolWithTag,
0x400ui64,
1u,
1u,
(UINT64 *)((char *)&v38 + 4),
&v38);
if( v7 == -2147483622 )
{
LABEL_12:
v6 = CmpAcquireShutdownRundown();
if( v6 )
{
CmpAttachToRegistryProcess(&ApcState);
v2 = 1;
CmpLockRegistryExclusive();
v5 = 1;
if( (int)CmpAcquireSystemDriverHiveContext((INT64)v46) >= 0
&& (!v47[4] || (int)CmpAcquireSystemDriverHiveContext((INT64)v47) >= 0) )
{
for( i = (PVOID *)P; i != &P; i = (PVOID *)*i )
{
if( (int)CmpAcquireSystemDriverHiveContext((INT64)i) >= 0 )
{
v22 = ExAllocatePoolWithTag(1ui64, 0x30ui64, 538987843i64);
v23 = v22;
if( !v22 )
goto LABEL_29;
*(_OWORD *)v22 = 0i64;
*((_OWORD *)v22 + 1) = 0i64;
*((_OWORD *)v22 + 2) = 0i64;
*((_OWORD *)v22 + 1) = *((_OWORD *)i + 1);
v22[4] = i[6];
*((_DWORD *)v22 + 10) = *((_DWORD *)i + 14);
v24 = v40;
if( *v40 != &v39 )
goto LABEL_61;
v23[1] = v40;
*v23 = &v39;
*v24 = v23;
v40 = v23;
}
}
if( CmpFindDrivers(
(PVOID)v46[6],
LODWORD(v46[7]),
v47[6],
v47[7],
(__int64)&v39,
(INT64)Context,
(__int64)ReturnLength,
(__int64)&DriverListHead,
v33,
v1,
v34)
&& (unsigned __int8)CmpSortDriverList((_HHIVE *)v46[6], LODWORD(v46[7]), &DriverListHead) )
{
CmpUnlockRegistry();
Flink = DriverListHead.Flink;
v11 = 0;
v5 = 0;
while( Flink != &DriverListHead )
{
Flink = Flink->Flink;
++v11;
}
v4 = ExAllocatePoolWithTag(0x200ui64, 8i64 * (unsigned int)(v11 + 1), 842550595i64);
if( !v4 )
KeBugCheckEx(0x67u, (PVOID)2, (PVOID)1, 0i64, 0i64);
v13 = DriverListHead.Flink;
v14 = 0;
if( DriverListHead.Flink != &DriverListHead )
{
do
{
ObjectAttributes.Length = 48;
ObjectAttributes.ObjectName = (_UNICODE_STRING *)&v13[2];
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.Attributes = 576;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
if( ZwOpenKey(
&v4[v14],
0x2001Fui64,
&ObjectAttributes,
v12,
RestartScan,
(INT64)Contexta,
(INT64)ReturnLengtha,
v32) >= 0 )
++v14;
v13 = v13->Flink;
}
while( v13 != &DriverListHead );
v3 = PoolWithTag;
}
v4[v14] = 0i64;
}
}
}
}
else
{
while( v7 >= 0 )
{
v8 = (const _UNICODE_STRING *)v3;
if( *(_WORD *)v3 )
{
do
{
if( !(unsigned __int8)RtlEqualUnicodeString(v8, &CmpSystemFileName, 1u) )
{
v19 = ExAllocatePoolWithTag(1ui64, 0x40ui64, 538987843i64);
v20 = v19;
if( !v19 )
goto LABEL_29;
memset(v19, 0i64, 0x40u);
*((_DWORD *)v20 + 14) = -1;
if( CmpOpenSystemDriverHiveContext(v8) >= 0 )
{
v21 = p_P;
if( *p_P != &P )
LABEL_61:
__fastfail(3u);
v20[1] = p_P;
*v20 = &P;
*v21 = v20;
p_P = v20;
}
else
{
ExFreePoolWithTag(v20, 0);
}
}
v8 += 2;
}
while( v8->Length );
}
v7 = ZwQueryDirectoryObject(DirectoryHandle, v3, 0x400ui64, 1u, 0, (UINT64 *)((char *)&v38 + 4), &v38);
if( v7 == -2147483622 )
{
v1 = v43;
goto LABEL_12;
}
}
}
}
}
}
}
LABEL_29:
if( DriverListHead.Flink != &DriverListHead )
CmpFreeDriverList(v46[6], &DriverListHead);
if( v5 )
CmpUnlockRegistry();
if( v2 )
CmpDetachFromRegistryProcess(&ApcState);
if( v6 )
CmpReleaseShutdownRundown();
CmpCloseSystemDriverHiveContext((INT64)v46);
if( v47[4] )
CmpCloseSystemDriverHiveContext((INT64)v47);
if( DirectoryHandle )
ZwClose((_HANDLE)DirectoryHandle);
if( v3 )
ExFreePoolWithTag(v3, 0);
v15 = (PVOID **)P;
if( P != &P )
{
do
{
v25 = *v15;
CmpCloseSystemDriverHiveContext((INT64)v15);
ExFreePoolWithTag(v15, 0);
v15 = (PVOID **)v25;
}
while( v25 != &P );
}
v16 = (PVOID **)v39;
if( v39 != &v39 )
{
do
{
v26 = *v16;
ExFreePoolWithTag(v16, 0);
v16 = (PVOID **)v26;
}
while( v26 != &v39 );
}
return v4;
}Referenced by:
IopInitializeSystemDrivers