ObpReferenceObjectByHandleWithTag

NTSTATUS __stdcall ObpReferenceObjectByHandleWithTag(
        VOID *Handle,
        UINT64 DesiredAccess,
        _OBJECT_TYPE *ObjectType,
        CHAR AccessMode,
        UINT64 Tag,
        VOID **Object,
        _OBJECT_HANDLE_INFORMATION *HandleInformation,
        _HANDLE_TABLE_ENTRY_INFO *ObjectInfo){
  _ETHREAD *CurrentThread; 
  NTSTATUS v11; 
  _EPROCESS *Process; 
  _HANDLE_TABLE *ObjectTable; 
  _HANDLE_TABLE_ENTRY *v15; 
  _HANDLE_TABLE_ENTRY *v16; 
  __int64 LowValue; 
  __int64 HighValue; 
  __int64 v19; 
  __int64 v20; 
  _HANDLE_TABLE_ENTRY v21; 
  unsigned __int8 v22; 
  _OBJECT_HEADER *v23; 
  unsigned __int8 v24; 
  int v25; 
  unsigned int v26; 
  __int64 v27; 
  char v28; 
  _HANDLE_TABLE *v29; 
  char *v31; 
  PVOID v32; 
  NTSTATUS v33; 
  unsigned int v34; 
  INT64 v35; 
  unsigned __int64 v36; 
  __int64 v37; 
  __int64 v38; 
  __int64 v39; 
  _EPROCESS *v40; 
  __int64 v41; 
  NTSTATUS v42; 
  _HANDLE_TABLE_ENTRY_INFO *HandleExtraInfo; 
  int v44[8]; 
  PVOID BugCheckParameter4; 
  _HANDLE_TABLE_ENTRY CurrentValue; 
  _EX_RUNDOWN_REF *v47; 
  int DesiredAccessa; 
  char Objecta; 
  _HANDLE_TABLE *ObjectInfoa; 

  DesiredAccessa = DesiredAccess;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v11 = 0;
  Objecta = 0;
  Process = CurrentThread->Tcb.ApcState.Process;
  v47 = (_EX_RUNDOWN_REF *)Process;
  *Object = 0i64;
  if( ObjectInfo )
    *ObjectInfo = 0i64;
  if( ((unsigned __int64)Handle & 0xFFFFFFFF80000000ui64) == 0xFFFFFFFF80000000ui64 )
  {
    if( Handle == (VOID *)-1i64 )
    {
      if( ObjectType != (_OBJECT_TYPE *)PsProcessType && ObjectType )
        return -1073741788;
      v40 = CurrentThread->Tcb.ApcState.Process;
      if( (DesiredAccess & 0xFFE00000) != 0 && AccessMode )
        return -1073741790;
      if( HandleInformation )
      {
        HandleInformation->GrantedAccess = 0x1FFFFF;
        HandleInformation->HandleAttributes = 0;
      }
      if( ObpTraceFlags )
      {
        ObpPushStackInfo((_OBJECT_HEADER *)&v40[-1].DynamicEnforcedCetCompatibleRanges, 1u, 1ui64, (unsigned int)Tag);
        v11 = 0;
      }
      v41 = _InterlockedIncrement64((volatile signed __int64 *)&v40[-1].DynamicEnforcedCetCompatibleRanges);
      if( v41 <= 1 )
        KeBugCheckEx(0x18u, 0i64, v40, (PVOID)0x10, (PVOID)v41);
      *Object = v40;
      return v11;
    }
    if( Handle == (VOID *)-2i64 )
    {
      if( ObjectType != (_OBJECT_TYPE *)PsThreadType && ObjectType )
        return -1073741788;
      if( (DesiredAccess & 0xFFE00000) != 0 && AccessMode )
        return -1073741790;
      if( HandleInformation )
      {
        HandleInformation->GrantedAccess = 0x1FFFFF;
        HandleInformation->HandleAttributes = 0;
      }
      if( ObpTraceFlags )
      {
        ObpPushStackInfo(
          (_OBJECT_HEADER *)(&CurrentThread[-1].LockEntries[5].CpuPriorityKey + 8),
          1u,
          1ui64,
          (unsigned int)Tag);
        v11 = 0;
      }
      v39 = _InterlockedIncrement64((volatile signed __int64 *)&CurrentThread[-1].LockEntries[5].OwnerTree.Min);
      if( v39 <= 1 )
        KeBugCheckEx(0x18u, 0i64, CurrentThread, (PVOID)0x10, (PVOID)v39);
      *Object = CurrentThread;
      return v11;
    }
    if( AccessMode )
      return -1073741816;
    ObjectTable = HandleTable;
    Handle = (VOID *)((unsigned __int64)Handle ^ 0xFFFFFFFF80000000ui64);
    --CurrentThread->Tcb.KernelApcDisable;
    ObjectInfoa = ObjectTable;
    goto LABEL_10;
  }
  if( (MmVerifierData & 0x100) != 0 && !AccessMode )
    VfCheckUserHandle(Handle);
  --CurrentThread->Tcb.KernelApcDisable;
  if( Process == CurrentThread->Tcb.Process )
  {
    if( (Process->Flags & 0x4000000) == 0 )
    {
LABEL_110:
      v33 = -1073741816;
      goto LABEL_81;
    }
    ObjectTable = Process->ObjectTable;
  }
  else
  {
    ObjectTable = ObReferenceProcessHandleTable(Process);
    Objecta = 1;
  }
  ObjectInfoa = ObjectTable;
  if( !ObjectTable )
    goto LABEL_110;
  if( ObjectTable == HandleTable )
  {
LABEL_85:
    v33 = -1073741816;
    goto LABEL_79;
  }
LABEL_10:
  if( ((unsigned __int16)Handle & 0x3FC) == 0
    || (v15 = ExpLookupHandleTableEntry(ObjectTable, (_EXHANDLE)Handle), (v16 = v15) == 0i64) )
  {
LABEL_83:
    if( Handle )
      ExHandleLogBadReference(ObjectTable, Handle, KeGetCurrentThread()->PreviousMode);
    goto LABEL_85;
  }
  _m_prefetchw(v15);
  LowValue = v15->LowValue;
  HighValue = v15->HighValue;
  CurrentValue.HighValue = HighValue;
  CurrentValue.LowValue = LowValue;
  v19 = LowValue;
  if( (LowValue & 0x1FFFE) == 0 )
    goto LABEL_46;
  while( 1 )
  {
    if( (v19 & 1) == 0 )
    {
      ExpBlockOnLockedHandleEntry(ObjectTable, v16, v19);
      _m_prefetchw(v16);
      HighValue = v16->HighValue;
      ObjectTable = ObjectInfoa;
      CurrentValue.LowValue = v16->LowValue;
      v19 = CurrentValue.LowValue;
      CurrentValue.HighValue = HighValue;
      goto LABEL_75;
    }
    v21.LowValue = v19;
    v21.HighValue = HighValue;
    v22 = _InterlockedCompareExchange128(&v16->VolatileLowValue, HighValue, v19 - 2, &v21.LowValue);
    v20 = v21.LowValue;
    v19 = v21.LowValue;
    CurrentValue = v21;
    HighValue = v21.HighValue;
    if( v22 )
      break;
LABEL_75:
    if( (v19 & 0x1FFFE) == 0 )
    {
      do
      {
LABEL_46:
        while( 1 )
        {
          _m_prefetchw(v16);
          v35 = v16->LowValue;
          if( (v16->LowValue & 1) != 0 )
            break;
          if( !v35 )
            goto LABEL_83;
          ExpBlockOnLockedHandleEntry(ObjectTable, v16, v35);
          ObjectTable = ObjectInfoa;
        }
      }
      while( v35 != _InterlockedCompareExchange64(&v16->VolatileLowValue, v35 - 1, v35) );
      v23 = (_OBJECT_HEADER *)((v16->LowValue >> 16) & 0xFFFFFFFFFFFFFFF0ui64);
      CurrentValue = *v16;
      v36 = ExSlowReplenishHandleTableEntry(v16) + 1;
      v38 = _InterlockedExchangeAdd64(&v23->PointerCount, v36);
      if( v38 <= 0 )
        KeBugCheckEx(0x18u, 0i64, &v23->Body, (PVOID)0x10, (PVOID)(v36 + v38));
      _InterlockedExchangeAdd64(&v16->VolatileLowValue, 1ui64);
      _InterlockedOr(v44, 0);
      if( *(_QWORD *)(v37 + 48) )
        ExfUnblockPushLock((INT64 *)(v37 + 48), 0i64);
      goto LABEL_51;
    }
  }
  if( (unsigned __int16)((unsigned __int64)v20 >> 1) != 16 )
  {
    v23 = (_OBJECT_HEADER *)((v20 >> 16) & 0xFFFFFFFFFFFFFFF0ui64);
    goto LABEL_17;
  }
  CurrentValue.LowValue = v20 ^ ((unsigned int)v20 ^ (2 * (unsigned int)((unsigned __int64)v20 >> 1) - 2)) & 0x1FFFE;
  v23 = (_OBJECT_HEADER *)((CurrentValue.LowValue >> 16) & 0xFFFFFFFFFFFFFFF0ui64);
  ObpIncrPointerCountEx(v23, 32752i64);
  v42 = ExFastReplenishHandleTableEntry(v16, &CurrentValue, 32752i64);
  if( v42 )
    _InterlockedExchangeAdd64(&v23->PointerCount, -v42);
LABEL_51:
  LODWORD(HighValue) = CurrentValue.LeafHandleValue.$E5B3C52FE72490EE6A49ADBB8529F30E::_bf_0;
  v19 = CurrentValue.LowValue;
LABEL_17:
  if( ObpTraceFlags )
    ObpPushStackInfo(v23, 1u, 1ui64, (unsigned int)Tag);
  v24 = ObHeaderCookie ^ v23->TypeIndex ^ BYTE1(v23);
  if( !ObjectType || ObjectType->Index != v24 )
  {
    v32 = (PVOID)ObTypeIndexTable[v24];
    if( !v32 || v32 == MmBadPointer )
      KeBugCheckEx(0x189u, v23, v32, 0i64, 0i64);
    if( ObjectType )
    {
      v33 = -1073741788;
      goto LABEL_78;
    }
  }
  v25 = DesiredAccessa;
  v26 = HighValue & 0x1FFFFFF;
  if( !AccessMode )
  {
LABEL_24:
    v27 = v19 >> 17;
    if( HandleInformation )
    {
      v34 = v27 & 7;
      HandleInformation->GrantedAccess = v26;
      HandleInformation->HandleAttributes = v34;
      if( (v34 & 4) == 0 )
        goto LABEL_26;
    }
    else if( (v27 & 4) == 0 )
    {
LABEL_26:
      v28 = 0;
      goto LABEL_27;
    }
    v28 = 1;
LABEL_27:
    v29 = ObjectInfoa;
    if( ObjectInfo )
    {
      if( ObjectInfoa->ExtraInfoPages )
      {
        HandleExtraInfo = ExpGetHandleExtraInfo(ObjectInfoa, Handle);
        v25 = DesiredAccessa;
        if( HandleExtraInfo )
          *ObjectInfo = *HandleExtraInfo;
      }
    }
    if( v28 )
    {
      if( v25 )
      {
        LODWORD(BugCheckParameter4) = v25;
        if( !ObpAuditObjectAccess(v29, Handle, v16, v23, (UINT64)BugCheckParameter4) )
        {
          v33 = -1073741816;
          goto LABEL_78;
        }
      }
    }
    *Object = &v23->Body;
    if( Objecta )
      ExReleaseRundownProtection(v47 + 139);
    KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
    return 0;
  }
  if( (~v26 & DesiredAccessa) != 0 )
  {
    v33 = -1073741790;
    goto LABEL_78;
  }
  if( (v23->InfoMask & 0x40) == 0 )
    goto LABEL_24;
  v31 = (char *)v23 - *((unsigned __int8 *)&dword_140C25D60 + (v23->InfoMask & 0x7F));
  if( !*(_BYTE *)(*(_QWORD *)v31 + 24i64) )
  {
LABEL_35:
    v25 = DesiredAccessa;
    goto LABEL_24;
  }
  if( *(_QWORD *)(*(_QWORD *)v31 + 16i64) != 1i64 )
  {
    v19 = CurrentValue.LowValue;
    goto LABEL_35;
  }
  v33 = -1073700858;
LABEL_78:
  ObfDereferenceObjectWithTag(&v23->Body, (unsigned int)Tag);
LABEL_79:
  if( Objecta )
    ExReleaseRundownProtection(v47 + 139);
LABEL_81:
  KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
  return v33;
}

Referenced by: