PspCaptureUserProcessParameters
INT64 __fastcall PspCaptureUserProcessParameters(
_RTL_USER_PROCESS_PARAMETERS **CapturedProcessParameters,
_RTL_USER_PROCESS_PARAMETERS *UserProcessParameters,
INT64 ControlFlags,
INT64 a4,
INT64 a5,
INT64 a6,
INT64 a7,
INT64 a8){
_RTL_USER_PROCESS_PARAMETERS *v9;
unsigned int v10;
char *Environment;
unsigned __int64 EnvironmentSize;
INT64 result;
unsigned __int64 v14;
UINT64 v15;
signed int v16;
_OWORD *PoolWithQuotaTag;
_OWORD *v18;
__int64 v19;
UINT8 *v20;
UINT8 *v21;
unsigned __int64 v22;
__int64 *ServerSiloGlobals;
char v24;
unsigned __int64 v25;
WCHAR *BufferStart;
UINT8 *v27[2];
unsigned int v28;
void *v29;
void *Src;
size_t Size;
unsigned __int64 v32;
_OWORD *v33;
UNICODE_STRING DestString;
UNICODE_STRING v35;
UNICODE_STRING SourceString;
UNICODE_STRING v37;
UNICODE_STRING v38;
UNICODE_STRING v39;
UNICODE_STRING v40;
UNICODE_STRING v41;
UNICODE_STRING v42;
char v44;
v44 = a4;
v9 = UserProcessParameters;
v38 = 0i64;
DestString = 0i64;
v40 = 0i64;
SourceString = 0i64;
v29 = 0i64;
v37 = 0i64;
v35 = 0i64;
*(_OWORD *)v27 = 0i64;
v41 = 0i64;
v39 = 0i64;
if( ((unsigned __int8)UserProcessParameters & 3) != 0 )
ExRaiseDatatypeMisalignment();
v10 = UserProcessParameters->Flags & 0xFFFFBFFF;
v28 = v10;
if( ((v10 ^ 1) & 0xF7010E11) != 0 )
return 3221225485i64;
if( ((unsigned __int8)v10 & (unsigned __int8)((v10 & 0xE0) - 1) & 0x60) != 0 )
return 3221225485i64;
Environment = (char *)UserProcessParameters->Environment;
Src = Environment;
v29 = Environment;
EnvironmentSize = UserProcessParameters->EnvironmentSize;
Size = EnvironmentSize;
if( !EnvironmentSize || (EnvironmentSize & 1) != 0 )
return 3221225485i64;
if( (unsigned __int64)&Environment[EnvironmentSize] > 0x7FFFFFFF0000i64
|| &Environment[EnvironmentSize] < Environment )
{
MEMORY[0x7FFFFFFF0000] = 0;
}
if( (a4 & 1) != 0 )
{
ServerSiloGlobals = PsGetServerSiloGlobals(a5);
DestString = *(UNICODE_STRING *)(ServerSiloGlobals + 125);
*(_OWORD *)v27 = PspProtectedRuntimeData;
if( (v24 & 2) == 0 )
{
Src = (void *)ServerSiloGlobals[128];
v29 = Src;
Size = *((unsigned __int16 *)ServerSiloGlobals + 509);
}
}
else
{
LODWORD(result) = PspCaptureAndValidateUnicodeString(&UserProcessParameters->CurrentDirectory.DosPath, &DestString);
if( (int)result < 0 )
return result;
if( DestString.Length >= 0x208u )
return 3221225485i64;
DestString.MaximumLength = 520;
*(_UNICODE_STRING *)v27 = v9->RuntimeData;
if( v27[1] )
{
WORD1(v27[0]) = v27[0];
if( LOWORD(v27[0]) && (&v27[1][LOWORD(v27[0])] > (UINT8 *)0x7FFFFFFF0000i64 || &v27[1][LOWORD(v27[0])] < v27[1]) )
MEMORY[0x7FFFFFFF0000] = 0;
}
else
{
if( LOWORD(v27[0]) )
return 3221225485i64;
LODWORD(v27[0]) = 0;
}
}
LODWORD(result) = PspCaptureAndValidateUnicodeString(&v9->DllPath, &SourceString);
if( (int)result < 0 )
return result;
LODWORD(result) = PspCaptureAndValidateUnicodeString(&v9->ImagePathName, &v37);
if( (int)result < 0 )
return result;
LODWORD(result) = PspCaptureAndValidateUnicodeString(&v9->CommandLine, &v38);
if( (int)result < 0 )
return result;
LODWORD(result) = PspCaptureAndValidateUnicodeString(&v9->WindowTitle, &v39);
if( (int)result < 0 )
return result;
LODWORD(result) = PspCaptureAndValidateUnicodeString(&v9->DesktopInfo, &v40);
if( (int)result < 0 )
return result;
LODWORD(result) = PspCaptureAndValidateUnicodeString(&v9->ShellInfo, &v41);
if( (int)result < 0 )
return result;
if( ControlFlags && (*(_DWORD *)(ControlFlags + 4) & 2) != 0 )
{
v35 = *(UNICODE_STRING *)(ControlFlags + 8);
}
else
{
LODWORD(result) = PspCaptureAndValidateUnicodeString(&v9->RedirectionDllName, &v35);
if( (int)result < 0 )
return result;
}
if( ControlFlags && (*(_DWORD *)(ControlFlags + 4) & 4) != 0 )
v42 = *(UNICODE_STRING *)(ControlFlags + 24);
else
v42 = 0i64;
v14 = (WORD1(v27[0])
+ SourceString.MaximumLength
+ v37.MaximumLength
+ v38.MaximumLength
+ v39.MaximumLength
+ v40.MaximumLength
+ v41.MaximumLength
+ v35.MaximumLength
+ (unsigned __int64)v42.MaximumLength
+ DestString.MaximumLength
+ 1089i64) & 0xFFFFFFFFFFFFFFFEui64;
v32 = v14;
if( ControlFlags && (*(_DWORD *)(ControlFlags + 4) & 1) != 0 )
{
v25 = (v14 + 3) & 0xFFFFFFFFFFFFFFFCui64;
v14 = v25 + 8i64 * *(unsigned int *)(ControlFlags + 48);
if( v14 >= v25 )
{
v32 = v25 + 8i64 * *(unsigned int *)(ControlFlags + 48);
goto LABEL_31;
}
return 3221225485i64;
}
LABEL_31:
v15 = -1i64;
if( v14 + Size >= v14 )
v15 = v14 + Size;
v16 = v14 + Size < v14 ? 0xC0000095 : 0;
if( v14 + Size < v14 )
return 3221225485i64;
PoolWithQuotaTag = ExAllocatePoolWithQuotaTag((POOL_TYPE)520, v15, 0x62507350ui64);
v18 = PoolWithQuotaTag;
v33 = PoolWithQuotaTag;
if( !PoolWithQuotaTag )
return 3221225626i64;
v19 = 8i64;
do
{
*PoolWithQuotaTag = *(_OWORD *)&v9->MaximumLength;
PoolWithQuotaTag[1] = *(_OWORD *)&v9->ConsoleHandle;
PoolWithQuotaTag[2] = *(_OWORD *)&v9->StandardInput;
PoolWithQuotaTag[3] = *(_OWORD *)&v9->StandardError;
PoolWithQuotaTag[4] = *(_OWORD *)&v9->CurrentDirectory.DosPath.Buffer;
PoolWithQuotaTag[5] = v9->DllPath;
PoolWithQuotaTag[6] = v9->ImagePathName;
PoolWithQuotaTag += 8;
*(PoolWithQuotaTag - 1) = v9->CommandLine;
v9 = (_RTL_USER_PROCESS_PARAMETERS *)((char *)v9 + 128);
--v19;
}
while( v19 );
*PoolWithQuotaTag = *(_OWORD *)&v9->MaximumLength;
PoolWithQuotaTag[1] = *(_OWORD *)&v9->ConsoleHandle;
PoolWithQuotaTag[2] = *(_OWORD *)&v9->StandardInput;
PoolWithQuotaTag[3] = *(_OWORD *)&v9->StandardError;
if( v16 < 0 )
goto LABEL_84;
*((_DWORD *)v18 + 2) = v10;
*((_DWORD *)v18 + 1) = v14;
*(_DWORD *)v18 = v14;
BufferStart = (WCHAR *)(v18 + 68);
if( ControlFlags && (*(_DWORD *)(ControlFlags + 4) & 8) != 0 )
*((_DWORD *)v18 + 271) = *(_DWORD *)(ControlFlags + 52);
v16 = PspCopyUnicodeString(&DestString, (UNICODE_STRING *)((char *)v18 + 56), &BufferStart);
if( v16 < 0 )
goto LABEL_84;
v16 = PspCopyUnicodeString(&SourceString, (UNICODE_STRING *)v18 + 5, &BufferStart);
if( v16 < 0 )
goto LABEL_84;
v16 = PspCopyUnicodeString(&v37, (UNICODE_STRING *)v18 + 6, &BufferStart);
if( v16 < 0 )
goto LABEL_84;
v16 = PspCopyUnicodeString(&v38, (UNICODE_STRING *)v18 + 7, &BufferStart);
if( v16 < 0 )
goto LABEL_84;
v16 = PspCopyUnicodeString(&v39, (UNICODE_STRING *)v18 + 11, &BufferStart);
if( v16 < 0 )
goto LABEL_84;
v16 = PspCopyUnicodeString(&v40, (UNICODE_STRING *)v18 + 12, &BufferStart);
if( v16 < 0 )
goto LABEL_84;
v16 = PspCopyUnicodeString(&v41, (UNICODE_STRING *)v18 + 13, &BufferStart);
if( v16 < 0 )
goto LABEL_84;
PspCopyUnicodeString(&v35, (UNICODE_STRING *)v18 + 65, &BufferStart);
if( ControlFlags && (*(_DWORD *)(ControlFlags + 4) & 4) != 0 )
PspCopyUnicodeString(&v42, (UNICODE_STRING *)v18 + 66, &BufferStart);
else
v18[66] = 0i64;
v18[14] = *(_OWORD *)v27;
v20 = v27[1];
v21 = (UINT8 *)BufferStart;
if( v27[1] )
{
*((_QWORD *)v18 + 29) = BufferStart;
memmove(v21, v20, LOWORD(v27[0]));
if( v21 )
{
v21 += LOWORD(v27[0]);
BufferStart = (WCHAR *)v21;
}
}
*((_QWORD *)v18 + 134) = 0i64;
*((_DWORD *)v18 + 270) = 0;
if( ControlFlags )
{
if( (*(_DWORD *)(ControlFlags + 4) & 1) != 0 )
{
v21 = (UINT8 *)((unsigned __int64)(v21 + 3) & 0xFFFFFFFFFFFFFFFCui64);
BufferStart = (WCHAR *)v21;
*((_QWORD *)v18 + 134) = v21;
*((_DWORD *)v18 + 270) = *(_DWORD *)(ControlFlags + 48);
memmove(v21, *(UINT8 **)(ControlFlags + 40), 8i64 * *(unsigned int *)(ControlFlags + 48));
if( v21 )
{
v21 += 8 * *(unsigned int *)(ControlFlags + 48);
BufferStart = (WCHAR *)v21;
}
}
}
v22 = (char *)v18 - (char *)v21 + v14;
if( v22 )
{
memset((INT64)v21, 0i64);
if( v21 )
{
v21 += v22;
BufferStart = (WCHAR *)v21;
}
}
memmove(v21, (UINT8 *)Src, Size);
if( (v44 & 3) == 1 || (v16 = PspValidateEnvironmentBlock((PWCHAR)v21, &Size), v16 >= 0) )
{
if( (v44 & 1) != 0 )
{
*((_QWORD *)v18 + 2) = 0i64;
*((_QWORD *)v18 + 4) = 0i64;
*((_QWORD *)v18 + 5) = 0i64;
*((_QWORD *)v18 + 6) = 0i64;
}
*((_QWORD *)v18 + 16) = v21;
*((_QWORD *)v18 + 126) = Size;
*((_QWORD *)v18 + 127) = 0i64;
*CapturedProcessParameters = (_RTL_USER_PROCESS_PARAMETERS *)v18;
return 0i64;
}
else
{
LABEL_84:
ExFreePoolWithTag(v18, 0);
return(unsigned int)v16;
}
}Referenced by:
No references.