NtSetInformationFile
NTSTATUS __fastcall NtSetInformationFile(UINT64 a1, UINT64 a2, INT8 *a3, UINT64 a4, UINT64 FileInformationClass){
UINT64 v5;
_ETHREAD *CurrentThread;
INT8 PreviousMode;
int v10;
unsigned int v11;
UINT64 v12;
_EWOW64PROCESS *WoW64Process;
unsigned __int16 Machine;
__int64 v15;
unsigned int v16;
NTSTATUS result;
int Status;
_ADAPTER_OBJECT *v19;
unsigned int *p_Flags;
unsigned int Flags;
_DEVICE_OBJECT *v22;
bool v23;
_ETHREAD *v24;
_FILE_OBJECT *v25;
_BYTE *v26;
__int64 v27;
_ETHREAD *v28;
_FILE_OBJECT *v29;
char v30;
_IRP *v31;
_IRP *v32;
_IO_STATUS_BLOCK *p_IoStatusBlock;
__int128 *p_Event;
__int64 v35;
_ETHREAD *PoolWithQuota;
PIRP v37;
__int64 v38;
_ETHREAD *v39;
unsigned __int64 v40;
__int64 v41;
UINT8 v42;
int v43;
unsigned __int8 v44;
unsigned __int8 CurrentIrql;
INT8 v46;
int SectorSize;
_IRP *v48;
bool v49;
VOID **v50;
_FILE_OBJECT *v51;
VOID *v52;
VOID **PoolWithTag;
unsigned __int8 v54;
unsigned __int64 *p_IrpListLock;
_IRP *v56;
unsigned int v57;
int v58;
_IRP *v59;
unsigned int v60;
char Type;
NTSTATUS v62;
char v63;
UINT8 v64;
NTSTATUS v65;
union {_IRP *MasterIrp;int IrpCount;void *SystemBuffer;} v66;
_KEVENT *p_MasterAdapter;
NTSTATUS v68;
NTSTATUS v69;
_IRP *v70;
int v71;
VOID **v72;
_ADAPTER_OBJECT *v73;
VOID *v74;
_IRP *MasterIrp;
int v76;
unsigned int v77;
unsigned int v78;
unsigned int v79;
_KPROCESSOR_MODE HandleInformation;
CHAR v81;
char v82;
INT8 v83;
char v84;
_FILE_OBJECT *pFileObject;
char v86;
char v87;
_DEVICE_OBJECT *DeviceObject;
PIRP Irp;
PVOID Object;
__int128 Event;
__int64 v92;
_ETHREAD *v93;
__int64 v94;
PVOID v95;
VOID *FoExt;
__int64 v97;
VOID *Handle;
_IO_STATUS_BLOCK IoStatusBlock;
PVOID v100;
__int64 v101;
_SECURITY_SUBJECT_CONTEXT SubjectContext;
__int64 v103;
VOID *retaddr;
v5 = (unsigned int)a4;
pFileObject = 0i64;
Event = 0i64;
v92 = 0i64;
IoStatusBlock = 0i64;
Handle = 0i64;
v83 = 0;
v84 = 0;
v87 = 0;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v93 = CurrentThread;
PreviousMode = CurrentThread->Tcb.PreviousMode;
v81 = PreviousMode;
if( PreviousMode )
{
v10 = FileInformationClass;
if( (unsigned int)FileInformationClass >= 0x4C )
return -1073741821;
v11 = *((unsigned __int8 *)IopSetOperationLength + (int)FileInformationClass);
if( !(_BYTE)v11 )
return -1073741821;
if( (unsigned int)a4 < v11 )
return -1073741820;
v12 = a2;
if( a2 >= 0x7FFFFFFF0000i64 )
v12 = 0x7FFFFFFF0000i64;
*(_DWORD *)v12 = *(_DWORD *)v12;
WoW64Process = CurrentThread->Tcb.ApcState.Process->WoW64Process;
if( WoW64Process && ((Machine = WoW64Process->Machine, Machine == 332) || Machine == 452) )
{
if( !(_DWORD)a4 )
goto LABEL_26;
if( (_DWORD)a4 == 1 )
v15 = 0i64;
else
v15 = 3i64;
if( (v15 & (unsigned __int64)a3) != 0 )
ExRaiseDatatypeMisalignment();
if( (unsigned __int64)&a3[(unsigned int)a4] <= 0x7FFFFFFF0000i64 && &a3[(unsigned int)a4] >= a3 )
goto LABEL_26;
}
else
{
if( !(_DWORD)a4 )
goto LABEL_26;
if( ((*((unsigned __int8 *)IopQuerySetAlignmentRequirement + (int)FileInformationClass) - 1i64) & (unsigned __int64)a3) != 0 )
ExRaiseDatatypeMisalignment();
if( (unsigned __int64)&a3[(unsigned int)a4] <= 0x7FFFFFFF0000i64 && &a3[(unsigned int)a4] >= a3 )
goto LABEL_26;
}
MEMORY[0x7FFFFFFF0000] = 0;
LABEL_26:
v16 = IopSetOperationAccess[(int)FileInformationClass];
if( (_DWORD)FileInformationClass == 11 || (_DWORD)FileInformationClass == 72 )
{
memset(&SubjectContext, 0, sizeof(SubjectContext));
SeCaptureSubjectContextEx(CurrentThread, CurrentThread->Tcb.Process, &SubjectContext);
v63 = RtlIsSandboxedToken((_KNOWN_CONTROLLER_TYPE)&SubjectContext);
SeReleaseSubjectContext(&SubjectContext);
if( v63 )
v16 |= 0x100u;
}
goto LABEL_28;
}
v10 = FileInformationClass;
switch( (_DWORD)FileInformationClass )
{
case '8':
v10 = 10;
v84 = 1;
break;
case 'B':
v10 = 65;
v84 = 1;
break;
case '9':
v10 = 11;
v84 = 1;
break;
case 'I':
v10 = 72;
v84 = 1;
break;
case 'K':
v10 = 71;
v87 = 1;
break;
}
v16 = IopSetOperationAccess[v10];
LABEL_28:
result = IopReferenceFileObject((VOID *)a1, v16, PreviousMode, &pFileObject, 0i64);
Status = result;
if( result < 0 )
return result;
v19 = (_ADAPTER_OBJECT *)pFileObject;
p_Flags = &pFileObject->Flags;
Flags = pFileObject->Flags;
if( (Flags & 0x800) != 0 )
{
LODWORD(v22) = IoGetAttachedDevice((INT64)pFileObject->DeviceObject);
}
else
{
LODWORD(v22) = IoGetRelatedDeviceObject((INT64)pFileObject);
Flags = *p_Flags;
}
DeviceObject = v22;
if( (Flags & 2) != 0 )
{
v23 = (Flags & 4) != 0;
v24 = (_ETHREAD *)KeGetCurrentThread();
--v24->Tcb.KernelApcDisable;
v25 = pFileObject;
v26 = KeAbPreAcquire(pFileObject->gap80, 0i64, 0i64);
v86 = 0;
if( _InterlockedExchange((volatile __int32 *)&v25->Busy, 1) )
{
v64 = v23;
v19 = (_ADAPTER_OBJECT *)pFileObject;
Status = IopWaitAndAcquireFileObjectLock(pFileObject, v81, v64, v26, (INT64)&v86);
}
else
{
if( v26 )
v26[26] |= 1u;
v19 = (_ADAPTER_OBJECT *)pFileObject;
ObfReferenceObject(pFileObject);
Status = 0;
}
LODWORD(Irp) = Status;
if( v86 )
{
v29 = (_FILE_OBJECT *)v19;
LABEL_43:
HalPutDmaAdapter((PADAPTER_OBJECT)v29);
return Status;
}
if( v10 == 14 )
{
if( (unsigned int)v5 >= 8 )
{
v27 = *(_QWORD *)a3;
v103 = *(_QWORD *)a3;
if( (*p_Flags & 8) != 0
&& (SectorSize = DeviceObject->SectorSize, (_WORD)SectorSize)
&& ((SectorSize - 1) & (unsigned int)v27) != 0
|| v27 < 0 )
{
Status = -1073741811;
}
else
{
v19->AdapterObject.CrashDump.ScatterHint.Buffer = (_HALP_DMA_TRANSLATION_BUFFER *)v27;
*(_DWORD *)a2 = 0;
*(_QWORD *)(a2 + 8) = 0i64;
}
v28 = (_ETHREAD *)KeGetCurrentThread();
v28->Tcb.OtherTransferCount += (unsigned int)v5;
__addgsqword(0x2EF8u, (unsigned int)v5);
IopReleaseFileObjectLock((PADAPTER_OBJECT)pFileObject);
v29 = pFileObject;
goto LABEL_43;
}
IopReleaseFileObjectLock(v19);
HalPutDmaAdapter(v19);
return -1073741820;
}
v30 = 1;
}
else
{
LOWORD(Event) = 1;
BYTE2(Event) = 6;
DWORD1(Event) = 0;
v92 = (__int64)&Event + 8;
*((_QWORD *)&Event + 1) = (char *)&Event + 8;
v30 = 0;
}
v82 = v30;
IopResetEvent((_FILE_OBJECT *)v19);
if( v10 != 36 )
{
v31 = IopAllocateIrpExReturn(DeviceObject, DeviceObject->StackSize, v30 ^ 1u, retaddr);
v32 = v31;
Irp = v31;
if( !v31 )
{
IopAllocateIrpCleanup(v19, 0i64);
return -1073741670;
}
v31->Tail.OriginalFileObject = (_FILE_OBJECT *)v19;
v31->Tail.Thread = v93;
v31->RequestorMode = v81;
if( v82 )
{
v31->AllocationFlags |= 2u;
p_IoStatusBlock = (_IO_STATUS_BLOCK *)a2;
p_Event = 0i64;
}
else
{
if( v81 == 1 )
v83 = KeSetKernelStackSwapEnable(0);
v32->Flags = 4;
p_IoStatusBlock = &IoStatusBlock;
p_Event = &Event;
}
v32->UserEvent = (_KEVENT *)p_Event;
v32->UserIosb = p_IoStatusBlock;
v32->Overlay.UserApcRoutine = 0i64;
v35 = (__int64)&v32->Tail.CurrentStackLocation[-1];
v94 = v35;
*(_BYTE *)v35 = 6;
*(_QWORD *)(v35 + 48) = v19;
v32->AssociatedIrp.MasterIrp = 0i64;
v32->MdlAddress = 0i64;
PoolWithQuota = (_ETHREAD *)IopVerifierExAllocatePoolWithQuota(0i64, v5);
v93 = PoolWithQuota;
v37 = Irp;
Irp->AssociatedIrp.MasterIrp = (_IRP *)PoolWithQuota;
memmove(PoolWithQuota, a3, v5);
if( ((unsigned int)(v10 - 19) <= 1 || v10 == 14) && *(int *)&v93->Tcb.gap0[4] < 0 )
RtlRaiseStatus(-1073741811);
v37->Flags |= 0x830u;
v38 = v94;
*(_DWORD *)(v94 + 8) = v5;
*(_DWORD *)(v38 + 16) = v10;
if( v84 || v87 )
*(_BYTE *)(v38 + 2) |= 1u;
IopQueueThreadIrp(v37);
v39 = (_ETHREAD *)KeGetCurrentThread();
++v39->Tcb.OtherOperationCount;
__incgsdword(0x2EE4u);
if( v10 == 16 )
{
MasterIrp = v37->AssociatedIrp.MasterIrp;
v76 = *(_DWORD *)&MasterIrp->Type;
if( (*(_DWORD *)&MasterIrp->Type & 0xFFFFFFC9) != 0
|| (v76 & 0x30) != 0 && (*p_Flags & 2) == 0
|| (v76 & 0x30) == 0 && (*p_Flags & 2) != 0
|| (*(_DWORD *)&MasterIrp->Type & 0x30) == 48 )
{
Status = -1073741811;
}
else
{
v77 = *p_Flags;
if( (*p_Flags & 8) == 0 )
{
if( (v76 & 2) != 0 )
v77 |= 0x10u;
else
v77 &= ~0x10u;
*p_Flags = v77;
}
if( (*(_DWORD *)&MasterIrp->Type & 4) != 0 )
v78 = v77 | 0x20;
else
v78 = v77 & 0xFFFFFFDF;
*p_Flags = v78;
if( (v78 & 2) != 0 )
{
if( (*(_DWORD *)&MasterIrp->Type & 0x10) != 0 )
v79 = v78 | 4;
else
v79 = v78 & 0xFFFFFFFB;
*p_Flags = v79;
}
Status = 0;
}
v37->IoStatus.Status = Status;
v37->IoStatus.Information = 0i64;
v42 = v82;
goto LABEL_71;
}
v40 = (unsigned int)(v10 - 10);
if( (unsigned int)v40 <= 0x3E && (v41 = 0x4080000000200003i64, _bittest64(&v41, v40)) )
{
v59 = v37->AssociatedIrp.MasterIrp;
v60 = v59->Flags;
if( !v60 || (v60 & 1) != 0 || (int)v5 - 20 < v60 )
{
Status = -1073741811;
v37->IoStatus.Status = -1073741811;
v42 = v82;
goto LABEL_71;
}
if( v10 == 31 )
{
*(_DWORD *)(v38 + 32) = *(_DWORD *)&v59->Type;
}
else
{
if( v10 == 65 || v10 == 72 )
Type = v59->Type & 1;
else
Type = v59->Type;
*(_BYTE *)(v38 + 32) = Type;
}
if( *((_WORD *)&v59->Flags + 2) == 92 || v59->MdlAddress )
{
v62 = IopOpenLinkOrRenameTarget(&Handle, v37, v59, pFileObject);
Status = v62;
v42 = v82;
if( v62 < 0 )
{
v37->IoStatus.Status = v62;
goto LABEL_71;
}
LABEL_70:
IopCallDriverReference(DeviceObject, v37, v42, pFileObject, OtherTransfer);
Status = v43;
LABEL_71:
v44 = v81;
goto LABEL_72;
}
}
else
{
if( v10 == 40 )
{
v66.MasterIrp = (_IRP *)v37->AssociatedIrp;
v42 = v82;
if( (unsigned int)(v5 - 4) < *(_DWORD *)v66.MasterIrp )
{
Status = -1073741811;
v37->IoStatus.Status = -1073741811;
goto LABEL_71;
}
if( v66.MasterIrp->AllocationProcessorNumber == 92 )
{
Status = -1073741811;
v37->IoStatus.Status = -1073741811;
goto LABEL_71;
}
goto LABEL_70;
}
if( v10 != 64 && v10 != 13 )
{
switch( v10 )
{
case 30:
v50 = (VOID **)v37->AssociatedIrp.MasterIrp;
v94 = (__int64)v50;
v51 = pFileObject;
if( pFileObject->CompletionContext || (*p_Flags & 2) != 0 )
{
Status = -1073741811;
}
else
{
v52 = *v50;
Object = 0i64;
Status = ObReferenceObjectByHandle(v52, 2ui64, IoCompletionObjectType, v81, &Object, 0i64);
if( Status >= 0 )
{
PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x18ui64, 1665363785i64);
if( PoolWithTag )
{
v54 = KeAcquireSpinLockRaiseToDpc(&v51->IrpListLock);
p_IrpListLock = &v51->IrpListLock;
if( v51->CompletionContext )
{
KeReleaseSpinLock(p_IrpListLock, v54);
ExFreePoolWithTag(PoolWithTag, 0);
HalPutDmaAdapter((PADAPTER_OBJECT)Object);
Status = -1073741752;
}
else
{
*p_Flags &= ~0x400u;
*PoolWithTag = Object;
PoolWithTag[1] = *(VOID **)(v94 + 8);
PoolWithTag[2] = 0i64;
v51->CompletionContext = (_IO_COMPLETION_CONTEXT *)PoolWithTag;
Status = 0;
KeReleaseSpinLock(p_IrpListLock, v54);
}
}
else
{
HalPutDmaAdapter((PADAPTER_OBJECT)Object);
Status = -1073741670;
}
}
}
v37->IoStatus.Status = Status;
v37->IoStatus.Information = 0i64;
v42 = v82;
goto LABEL_71;
case 61:
v72 = (VOID **)v37->AssociatedIrp.MasterIrp;
v73 = 0i64;
v100 = 0i64;
if( pFileObject->CompletionContext )
{
v74 = *v72;
if( *v72 )
{
v95 = 0i64;
Status = ObReferenceObjectByHandle(v74, 2ui64, IoCompletionObjectType, v81, &v95, 0i64);
v73 = (_ADAPTER_OBJECT *)v95;
v100 = v95;
}
if( Status >= 0 )
{
Status = IopReplaceCompletionPort(pFileObject, v73, v72[1]);
if( v73 )
HalPutDmaAdapter(v73);
}
goto LABEL_152;
}
break;
case 41:
v56 = v37->AssociatedIrp.MasterIrp;
v57 = *p_Flags;
if( (*p_Flags & 2) != 0 )
{
Status = -1073741811;
}
else
{
Status = 0;
v58 = *(_DWORD *)&v56->Type;
if( (*(_DWORD *)&v56->Type & 1) != 0 )
{
v57 |= 0x2000000u;
*p_Flags = v57;
v58 = *(_DWORD *)&v56->Type;
}
if( (v58 & 2) != 0 )
{
v57 |= 0x4000000u;
*p_Flags = v57;
v58 = *(_DWORD *)&v56->Type;
}
if( (v58 & 4) != 0 )
*p_Flags = v57 | 0x8000000;
}
v37->IoStatus.Status = Status;
v37->IoStatus.Information = 0i64;
v42 = v82;
goto LABEL_71;
case 42:
if( SeSinglePrivilegeCheck(*(_QWORD *)&SeLockMemoryPrivilege, v81) )
{
if( (*p_Flags & 2) != 0 )
Status = -1073741811;
else
Status = IopSetFileObjectIosbRange(pFileObject, v37);
}
else
{
Status = -1073741727;
}
v37->IoStatus.Status = Status;
v37->IoStatus.Information = 0i64;
v42 = v82;
goto LABEL_71;
case 43:
FoExt = 0i64;
v70 = v37->AssociatedIrp.MasterIrp;
if( *(_DWORD *)&v70->Type <= 2u )
{
IopAllocateFileObjectExtension(pFileObject, &FoExt);
Status = v71;
if( v71 >= 0 )
*((_DWORD *)FoExt + 20) = *(_DWORD *)&v70->Type + 1;
goto LABEL_152;
}
break;
case 69:
v44 = v81;
if( v81 )
{
Status = -1073741790;
}
else
{
Status = IopSetFileMemoryPartitionInformation(
pFileObject,
(INT64)v37->AssociatedIrp.MasterIrp,
(unsigned int)v5);
v44 = 0;
}
v37->IoStatus.Status = Status;
v37->IoStatus.Information = 0i64;
v42 = v82;
LABEL_72:
if( Status == 259 )
{
if( !v42 )
{
v65 = KeWaitForSingleObject((UINT64)&Event, 0, v44, 0, 0i64);
if( v65 == 257 || v65 == 192 )
IopCancelAlertedRequest(&Event, v37);
Status = IoStatusBlock.Status;
*(_IO_STATUS_BLOCK *)a2 = IoStatusBlock;
v46 = v83;
goto LABEL_78;
}
Status = IopWaitForSynchronousIo(v37, pFileObject, v44);
}
else
{
v101 = 0i64;
v97 = 0i64;
if( !v42 )
v37->UserEvent = 0i64;
v37->UserIosb = (_IO_STATUS_BLOCK *)a2;
CurrentIrql = KeGetCurrentIrql();
__writecr8(1ui64);
IopCompleteRequest((__int64)&v37->Tail, (__int64)&v101, &v97, (_KAPC **)&pFileObject, &v97);
__writecr8(CurrentIrql);
if( !v42 )
goto LABEL_77;
}
IopReleaseFileObjectLock((PADAPTER_OBJECT)pFileObject);
LABEL_77:
v46 = v83;
LABEL_78:
if( v46 )
KeSetKernelStackSwapEnable(1);
if( Handle )
ObCloseHandle(Handle, 0);
return Status;
default:
goto LABEL_69;
}
Status = -1073741811;
LABEL_152:
v37->IoStatus.Status = Status;
v37->IoStatus.Information = 0i64;
v42 = v82;
goto LABEL_71;
}
v48 = v37->AssociatedIrp.MasterIrp;
if( v10 == 64 )
v49 = (*(_DWORD *)&v48->Type & 1) == 0;
else
v49 = LOBYTE(v48->Type) == 0;
if( !v49 )
*(_QWORD *)(v38 + 32) = a1;
}
LABEL_69:
v42 = v82;
goto LABEL_70;
}
if( (unsigned int)v5 < 0x10 )
{
v69 = -1073741820;
}
else
{
if( v30 )
p_MasterAdapter = (_KEVENT *)&v19->MasterAdapter;
else
p_MasterAdapter = (_KEVENT *)&Event;
LOBYTE(HandleInformation) = v81;
v68 = IopTrackLink((_FILE_OBJECT *)v19, &IoStatusBlock, a3, (unsigned int)v5, p_MasterAdapter, HandleInformation);
v69 = v68;
LODWORD(Irp) = v68;
if( v68 >= 0 )
{
*(_QWORD *)(a2 + 8) = 0i64;
*(_DWORD *)a2 = v68;
}
}
if( v30 )
IopReleaseFileObjectLock(v19);
HalPutDmaAdapter(v19);
return v69;
}Referenced by:
No references.