NtWriteFile
NTSTATUS __stdcall NtWriteFile(
_HANDLE FileHandle,
_HANDLE Event,
PIO_APC_ROUTINE ApcRoutine,
PVOID ApcContext,
PIO_STATUS_BLOCK IoStatusBlock,
PVOID Buffer,
ULONG Length,
PLARGE_INTEGER ByteOffset,
PULONG Key){
VOID *v9;
INT8 PreviousMode;
int v11;
_ADAPTER_OBJECT *v12;
_DEVICE_OBJECT *v13;
PDEVICE_OBJECT v14;
__int64 v15;
_DWORD *v16;
PVOID v17;
PLARGE_INTEGER v18;
__int64 v19;
int SectorSize;
int v21;
int v22;
unsigned int v23;
_ADAPTER_OBJECT *v24;
_FAST_IO_DISPATCH *FastIoDispatch;
unsigned int Offset;
bool v27;
_ETHREAD *v28;
volatile __int32 *v29;
_BYTE *v30;
UINT8 SynchronousIo;
unsigned __int8(__fastcall *FastIoWrite)(_FILE_OBJECT *, _LARGE_INTEGER *, unsigned int, unsigned __int8, unsigned int, void *, _IO_STATUS_BLOCK *, _DEVICE_OBJECT *);
VOID *v33;
unsigned __int8 v34;
_ETHREAD *v35;
_ETHREAD *v36;
unsigned __int64 v37;
_ADAPTER_OBJECT *v38;
_IRP *Irp;
_IRP *v41;
INT8 RequestorMode;
PIO_STATUS_BLOCK v43;
_IO_STACK_LOCATION *CurrentStackLocation;
_DEVICE_OBJECT *v45;
unsigned int Flags;
_DWORD *v47;
int v48;
_MDL *Mdl;
_MDL *v50;
__int64 MajorFunction;
_ADAPTER_OBJECT *v52;
UINT8 v53;
ULONG v54;
VOID *PoolWithQuota_0;
int v56;
unsigned __int8 v57;
char v58[15];
PVOID FileObject;
PVOID EventObject;
unsigned int v61;
PDEVICE_OBJECT DeviceObject;
int v63;
PVOID Object;
__int128 v65;
_OBJECT_HANDLE_INFORMATION v66;
_ETHREAD *CurrentThread;
unsigned int *p_Offset;
VOID *retaddr;
INT64 v70;
PVOID v71;
v71 = ApcContext;
v70 = (INT64)ApcRoutine;
v9 = *(VOID **)&Event;
FileObject = 0i64;
v66 = 0i64;
EventObject = 0i64;
v61 = 0;
*(_QWORD *)&v58[7] = 0i64;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
PreviousMode = CurrentThread->Tcb.PreviousMode;
v57 = PreviousMode;
v11 = ObReferenceFileObjectForWrite(*(VOID **)&FileHandle, PreviousMode, &FileObject, &v66);
v12 = (_ADAPTER_OBJECT *)FileObject;
if( v11 >= 0 && IopFileObjectRevoked((INT64)FileObject) )
{
HalPutDmaAdapter(v12);
return -1073739504;
}
if( v11 < 0 )
return v11;
LODWORD(v13) = IoGetRelatedDeviceObject((INT64)v12);
v14 = v13;
DeviceObject = v13;
if( PreviousMode )
{
v63 = 0;
v15 = (__int64)IoStatusBlock;
if( (unsigned __int64)IoStatusBlock >= 0x7FFFFFFF0000i64 )
v15 = 0x7FFFFFFF0000i64;
*(_DWORD *)v15 = *(_DWORD *)v15;
v12 = (_ADAPTER_OBJECT *)FileObject;
v16 = (char *)FileObject + 80;
IopMarkApcRoutineIfAsynchronousIo32((UINT64 **)&IoStatusBlock, &v70, *((_BYTE *)FileObject + 80) & 2);
v17 = Buffer;
if( Length && ((unsigned __int64)Buffer + Length > 0x7FFFFFFF0000i64 || (char *)Buffer + Length < Buffer) )
MEMORY[0x7FFFFFFF0000] = 0;
if( v12->WaitQueueEntry[1].Flink && (v70 & 0xFFFFFFFFFFFFFFFEui64) != 0 )
goto LABEL_119;
v18 = ByteOffset;
if( ByteOffset )
{
if( ((unsigned __int8)ByteOffset & 3) != 0 )
ExRaiseDatatypeMisalignment();
*(_LARGE_INTEGER *)&v58[7] = *ByteOffset;
v12 = (_ADAPTER_OBJECT *)FileObject;
}
if( (*v16 & 8) == 0 )
{
LABEL_13:
v19 = (__int64)Key;
if( Key )
{
if( (unsigned __int64)Key >= 0x7FFFFFFF0000i64 )
v19 = 0x7FFFFFFF0000i64;
v61 = *(_DWORD *)v19;
v12 = (_ADAPTER_OBJECT *)FileObject;
}
goto LABEL_42;
}
SectorSize = v14->SectorSize;
if( (_WORD)SectorSize )
{
v21 = v14->SectorSize;
v22 = v21;
v23 = v21;
if( ((SectorSize - 1) & Length) != 0 )
{
LABEL_33:
if( (_WORD)SectorSize && Length % v23 || (v14->AlignmentRequirement & (unsigned int)Buffer) != 0 )
goto LABEL_119;
LABEL_22:
if( ByteOffset
&& (*(_DWORD *)&v58[7] != -1 || *(_DWORD *)&v58[11] != -1)
&& (*(_DWORD *)&v58[7] != -2 || *(_DWORD *)&v58[11] != -1 || (*v16 & 2) == 0)
&& (_WORD)SectorSize
&& ((v21 - 1) & *(_DWORD *)&v58[7]) != 0 )
{
goto LABEL_119;
}
goto LABEL_13;
}
}
else
{
v21 = 0;
v22 = 0;
}
v23 = v22;
if( (v14->AlignmentRequirement & (unsigned int)Buffer) == 0 )
goto LABEL_22;
goto LABEL_33;
}
v18 = ByteOffset;
if( ByteOffset )
*(_LARGE_INTEGER *)&v58[7] = *ByteOffset;
v17 = Buffer;
if( Key )
v61 = *Key;
LABEL_42:
if( (v66.GrantedAccess & 6) == 4 )
*(_QWORD *)&v58[7] = -1i64;
if( v9 )
{
Object = 0i64;
v48 = ObReferenceObjectByHandle(v9, 2ui64, (_OBJECT_TYPE *)ExEventObjectType, PreviousMode, &Object, 0i64);
v24 = (_ADAPTER_OBJECT *)Object;
EventObject = Object;
if( v48 < 0 )
{
HalPutDmaAdapter(v12);
return v48;
}
KeResetEvent((_KEVENT *)Object);
v14 = DeviceObject;
}
else
{
v24 = (_ADAPTER_OBJECT *)EventObject;
}
FastIoDispatch = v14->DriverObject->FastIoDispatch;
p_Offset = &v12->AdapterObject.ScatterTranslationEnd.Offset;
Offset = v12->AdapterObject.ScatterTranslationEnd.Offset;
if( (Offset & 2) == 0 )
{
if( v18 || (Offset & 0x280) != 0 )
{
SynchronousIo = 0;
goto LABEL_67;
}
if( v24 )
HalPutDmaAdapter(v24);
LABEL_119:
HalPutDmaAdapter(v12);
return -1073741811;
}
v27 = (Offset & 4) != 0;
v28 = (_ETHREAD *)KeGetCurrentThread();
--v28->Tcb.KernelApcDisable;
v29 = (volatile __int32 *)FileObject;
v30 = KeAbPreAcquire((char *)FileObject + 128, 0i64, 0i64);
v58[0] = 0;
if( _InterlockedExchange(v29 + 29, 1) )
{
v53 = v27;
v12 = (_ADAPTER_OBJECT *)FileObject;
v11 = IopWaitAndAcquireFileObjectLock(FileObject, PreviousMode, v53, v30, (INT64)v58);
}
else
{
if( v30 )
v30[26] |= 1u;
v12 = (_ADAPTER_OBJECT *)FileObject;
ObfReferenceObject(FileObject);
v11 = 0;
}
if( v58[0] )
{
if( EventObject )
HalPutDmaAdapter((PADAPTER_OBJECT)EventObject);
HalPutDmaAdapter(v12);
return v11;
}
SynchronousIo = 1;
if( !v18 && !*(_DWORD *)&v58[7] || *(_DWORD *)&v58[7] == -2 && *(_DWORD *)&v58[11] == -1 )
*(_QWORD *)&v58[7] = v12->AdapterObject.CrashDump.ScatterHint.Buffer;
if( v12->AdapterObject.ScatterTranslations )
{
v65 = 0i64;
FastIoWrite = FastIoDispatch->FastIoWrite;
if( *(int *)&v58[11] < 0 && (*(_DWORD *)&v58[11] != -1 || *(_DWORD *)&v58[7] != -1) )
{
if( EventObject )
HalPutDmaAdapter((PADAPTER_OBJECT)EventObject);
LABEL_113:
IopReleaseFileObjectLock(v12);
LABEL_114:
HalPutDmaAdapter(v12);
return -1073741811;
}
if( (MmVerifierData & 0x10) != 0 )
v33 = VfFastIoSnapState();
else
v33 = 0i64;
v34 = FastIoWrite(
(_FILE_OBJECT *)v12,
(_LARGE_INTEGER *)&v58[7],
Length,
1u,
v61,
v17,
(_IO_STATUS_BLOCK *)&v65,
DeviceObject);
if( v33 )
VfFastIoCheckState(v33, FastIoWrite);
if( v34 && !(_DWORD)v65 )
{
v35 = (_ETHREAD *)KeGetCurrentThread();
++v35->Tcb.WriteOperationCount;
__incgsdword(0x2EE0u);
v36 = (_ETHREAD *)KeGetCurrentThread();
v37 = DWORD2(v65);
v36->Tcb.WriteTransferCount += DWORD2(v65);
__addgsqword(0x2EF0u, v37);
*IoStatusBlock = (_IO_STATUS_BLOCK)v65;
v38 = (_ADAPTER_OBJECT *)FileObject;
if( v9 )
{
v52 = (_ADAPTER_OBJECT *)EventObject;
if( (*((_DWORD *)FileObject + 20) & 0x8000000) == 0 )
KeSetEvent((PRKEVENT)EventObject, 0, 0);
HalPutDmaAdapter(v52);
}
IopReleaseFileObjectLock(v38);
HalPutDmaAdapter(v38);
return v65;
}
}
v24 = (_ADAPTER_OBJECT *)EventObject;
LABEL_67:
if( *(int *)&v58[11] < 0 && (*(_DWORD *)&v58[11] != -1 || *(_DWORD *)&v58[7] != -1) )
{
if( v24 )
HalPutDmaAdapter(v24);
if( !SynchronousIo )
goto LABEL_114;
goto LABEL_113;
}
IopResetEvent((_FILE_OBJECT *)v12);
Irp = IopAllocateIrpExReturn(DeviceObject, DeviceObject->StackSize, SynchronousIo ^ 1u, retaddr);
v41 = Irp;
Object = Irp;
if( Irp )
{
Irp->Tail.OriginalFileObject = (_FILE_OBJECT *)v12;
Irp->Tail.Thread = CurrentThread;
Irp->Tail.AuxiliaryBuffer = 0i64;
RequestorMode = v57;
*(_WORD *)&Irp->RequestorMode = v57;
Irp->Cancel = 0;
Irp->CancelRoutine = 0i64;
Irp->UserEvent = (_KEVENT *)v24;
v43 = IoStatusBlock;
Irp->UserIosb = IoStatusBlock;
Irp->Overlay.UserApcRoutine = (void(__fastcall *)(void *, _IO_STATUS_BLOCK *, unsigned int))v70;
Irp->Overlay.UserApcContext = v71;
CurrentStackLocation = Irp->Tail.CurrentStackLocation;
*(_DWORD *)&CurrentStackLocation[-1].MajorFunction = 4;
CurrentStackLocation[-1].FileObject = (_FILE_OBJECT *)v12;
if( (*p_Offset & 0x10) != 0 )
CurrentStackLocation[-1].Flags = 4;
Irp->AssociatedIrp.MasterIrp = 0i64;
Irp->MdlAddress = 0i64;
v45 = DeviceObject;
Flags = DeviceObject->Flags;
if( (Flags & 4) != 0 )
{
if( Length )
{
v54 = Length;
PoolWithQuota_0 = IopVerifierExAllocatePoolWithQuota_0(NonPagedPoolNxCacheAligned, Length);
v41->AssociatedIrp.MasterIrp = (_IRP *)PoolWithQuota_0;
memmove(PoolWithQuota_0, v17, v54);
v56 = 48;
RequestorMode = v57;
v45 = DeviceObject;
}
else
{
v56 = 16;
}
v41->Flags = v56;
}
else
{
v41->Flags = 0;
if( (Flags & 0x10) != 0 )
{
if( Length )
{
Mdl = IoAllocateMdl(v17, Length, 0, 1u, v41);
v50 = Mdl;
if( !Mdl )
RtlRaiseStatus(-1073741670);
MajorFunction = CurrentStackLocation[-1].MajorFunction;
MmProbeAndLockPages(Mdl, v57, IoReadAccess);
if( (MmTrackLockedPages & 1) != 0 )
MmUpdateMdlTracker(v50, DeviceObject->DriverObject->MajorFunction[MajorFunction], DeviceObject);
RequestorMode = v57;
v45 = DeviceObject;
}
}
else
{
v41->UserBuffer = v17;
}
}
v41->Flags |= (v12->AdapterObject.ScatterTranslationEnd.Offset & 8 | 0x5000) >> 3;
LODWORD(CurrentStackLocation[-1].Parameters.SecurityContext) = Length;
CurrentStackLocation[-1].Parameters.Options = v61;
*(_QWORD *)&CurrentStackLocation[-1].Parameters.FileAttributes = *(_QWORD *)&v58[7];
v47 = *(_DWORD **)v12->gapD0;
if( v47 && (*v47 & 0x10) != 0 )
*(&CurrentStackLocation[-1].Parameters.Options + 1) = v43->Information;
return IopSynchronousServiceTail(v45, v41, (_FILE_OBJECT *)v12, 1u, RequestorMode, SynchronousIo, WriteTransfer);
}
else
{
IopAllocateIrpCleanup(v12, v24);
return -1073741670;
}
}Referenced by:
SmKmIssueFileIo