SmKmStoreFileOpenVolume
NTSTATUS __stdcall SmKmStoreFileOpenVolume(
_FILE_OBJECT *FileObject,
_FILE_OBJECT **VolumeFileObjectOut,
PDEVICE_OBJECT *VolumeDeviceObjectOut){
char v6;
char v7;
int v8;
NTSTATUS v9;
_FILE_OBJECT *v10;
_DEVICE_OBJECT *v11;
INT16 v12;
UINT64 v14;
UINT64 ShareAccess;
UINT64 CreateDisposition;
UINT64 CreateOptions;
UINT64 v18;
UINT64 ReturnLength;
VOID *FileHandle;
PVOID Object;
_OBJECT_ATTRIBUTES ObjectAttributes;
_IO_STATUS_BLOCK IoStatusBlock;
char v24[528];
LODWORD(ReturnLength) = 0;
IoStatusBlock = 0i64;
memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
memset(v24, 0i64, 0x208u);
FileHandle = 0i64;
IoSetThreadHardErrorMode(0);
v7 = v6;
v8 = ObQueryNameStringMode(FileObject->DeviceObject, (_OBJECT_NAME_INFORMATION *)v24, 0x208ui64, &ReturnLength, 0);
if( v8 >= 0 )
{
LODWORD(v18) = 0;
ObjectAttributes.RootDirectory = 0i64;
LODWORD(CreateOptions) = 32;
LODWORD(CreateDisposition) = 1;
LODWORD(ShareAccess) = 7;
LODWORD(v14) = 0;
ObjectAttributes.Length = 48;
ObjectAttributes.Attributes = 576;
ObjectAttributes.ObjectName = (_UNICODE_STRING *)v24;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
v8 = ZwCreateFile(
&FileHandle,
0x100080ui64,
&ObjectAttributes,
&IoStatusBlock,
0i64,
v14,
ShareAccess,
CreateDisposition,
CreateOptions,
0i64,
v18);
if( v8 >= 0 )
{
Object = 0i64;
v9 = ObReferenceObjectByHandle(FileHandle, 3ui64, 0i64, 0, &Object, 0i64);
v10 = (_FILE_OBJECT *)Object;
v8 = v9;
if( v9 >= 0 )
{
LODWORD(v11) = IoGetRelatedDeviceObject((INT64)Object);
*VolumeFileObjectOut = v10;
v10 = 0i64;
*VolumeDeviceObjectOut = v11;
}
if( v10 )
HalPutDmaAdapter((PADAPTER_OBJECT)v10);
}
}
HIBYTE(v12) = BYTE1(FileHandle);
if( FileHandle )
ZwClose((_HANDLE)FileHandle);
LOBYTE(v12) = v7;
IoSetThreadHardErrorMode(v12);
return v8;
}Referenced by:
SmKmEtwAppendProductName
SmKmStoreFileCreate
SmcCacheStart