NtQueryInformationFile
NTSTATUS __stdcall NtQueryInformationFile(
VOID *FileHandle,
IO_STATUS_BLOCK *IoStatusBlock,
VOID *FileInformation,
UINT64 Length,
FILE_INFORMATION_CLASS FileInformationClass){
unsigned int v5;
unsigned __int8 v9;
FILE_INFORMATION_CLASS v10;
NTSTATUS result;
NTSTATUS Status;
__int64 v13;
_DEVICE_OBJECT *RelatedDeviceObject;
_DEVICE_OBJECT *v15;
__int64 v16;
_ETHREAD *v17;
__int64 v18;
__int64 v19;
__int64 v20;
struct _DMA_ADAPTER *v21;
PIRP v22;
__int64(__fastcall *v23)(__int64, __int64, VOID *, IO_STATUS_BLOCK *, _DEVICE_OBJECT *);
void *v24;
char v25;
UINT8 v26;
IRP *v27;
IRP *v28;
struct _KEVENT *p_Event;
_ETHREAD *v30;
_WORD *PoolWithQuota;
_ETHREAD *v32;
UINT64 v33;
UINT64 *v34;
_ETHREAD *v35;
char v36;
NTSTATUS NumaNodeInformation;
int v38;
__int64 v39;
NTSTATUS v40;
unsigned __int8 CurrentIrql;
NTSTATUS v42;
NTSTATUS FileVolumeNameInformation;
int ModeInformation;
_DWORD *v45;
_ETHREAD *v46;
int *v47;
__int64 v48;
int v49;
int v50;
__int64 v51;
int v52;
int v53;
_FILE_PROCESS_IDS_USING_FILE_INFORMATION *v54;
PLARGE_INTEGER Timeout;
INT64 a6;
char v57;
char v58;
UINT8 v59;
NTSTATUS v60;
_WORD DmaAdapter[7];
UINT64 OutputSize;
PIRP Irp;
IO_STATUS_BLOCK *v64;
_DEVICE_OBJECT *v65;
OBJECT_HANDLE_INFORMATION pHandleInformation;
_ETHREAD *CurrentThread;
__int64 v68;
IO_STATUS_BLOCK v69;
__int64(__fastcall *v70)(__int64, __int64, VOID *, IO_STATUS_BLOCK *, _DEVICE_OBJECT *);
void *v71;
PIRP v72;
IO_STATUS_BLOCK *v73;
__int64 v74;
IO_STATUS_BLOCK v75;
struct _KEVENT Event;
VOID *retaddr;
unsigned int Size;
Size = Length;
v5 = Length;
v64 = IoStatusBlock;
v73 = IoStatusBlock;
*(_QWORD *)&DmaAdapter[3] = 0i64;
memset(&Event, 0, sizeof(Event));
v75 = 0i64;
pHandleInformation = 0i64;
v59 = 0;
v57 = 0;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v9 = *((_BYTE *)CurrentThread + 562);
v10 = FileInformationClass;
LODWORD(a6) = FileInformationClass;
LODWORD(Timeout) = Length;
result = IopValidateQueryInformationParameters(
v9,
(INT64)CurrentThread,
(UINT64)IoStatusBlock,
(UINT64)FileInformation,
(UINT64)Timeout,
a6);
if( result >= 0 )
{
if( !v9 && FileInformationClass == FileCaseSensitiveInformationForceAccessCheck )
{
v10 = FileCaseSensitiveInformation;
v57 = 1;
}
result = IopReferenceFileObject(
FileHandle,
(unsigned int)IopQueryOperationAccess[v10],
v9,
(FILE_OBJECT **)&DmaAdapter[3],
&pHandleInformation);
Status = result;
v60 = result;
if( result >= 0 )
{
if( v10 == FileAccessInformation )
{
v46 = (_ETHREAD *)KeGetCurrentThread();
++*((_QWORD *)v46 + 114);
__incgsdword(0x2EE4u);
if( v5 >= 4 )
{
*(_DWORD *)FileInformation = pHandleInformation.GrantedAccess;
IoStatusBlock->Status = 0;
IoStatusBlock->Information = 4i64;
Status = v60;
}
else
{
Status = -1073741820;
}
v21 = *(struct _DMA_ADAPTER **)&DmaAdapter[3];
goto LABEL_19;
}
v13 = *(_QWORD *)&DmaAdapter[3];
if( (*(_DWORD *)(*(_QWORD *)&DmaAdapter[3] + 80i64) & 0x800) != 0 )
IoGetAttachedDevice(*(_DEVICE_OBJECT **)(*(_QWORD *)&DmaAdapter[3] + 8i64));
else
RelatedDeviceObject = IoGetRelatedDeviceObject(*(_FILE_OBJECT **)&DmaAdapter[3]);
v15 = RelatedDeviceObject;
v65 = RelatedDeviceObject;
v16 = *(_QWORD *)(*((_QWORD *)RelatedDeviceObject + 1) + 80i64);
if( v10 == FileIsRemoteDeviceInformation )
{
if( Size )
{
*(_BYTE *)FileInformation = (*(_BYTE *)(*(_QWORD *)(v13 + 8) + 52i64) & 0x10) != 0;
IoStatusBlock->Status = 0;
IoStatusBlock->Information = 1i64;
}
else
{
Status = -1073741820;
}
goto LABEL_18;
}
if( v10 == FileVolumeNameInformation )
{
FileVolumeNameInformation = IopGetFileVolumeNameInformation(
*(DEVICE_OBJECT **)(v13 + 8),
IoStatusBlock,
(FILE_VOLUME_NAME_INFORMATION *)FileInformation,
Size);
HalPutDmaAdapter((PADAPTER_OBJECT)v13);
return FileVolumeNameInformation;
}
if( (*(_DWORD *)(v13 + 80) & 2) != 0 )
{
v17 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v17 + 242);
v18 = *(_QWORD *)&DmaAdapter[3];
LODWORD(v19) = KeAbPreAcquire((PVOID)(*(_QWORD *)&DmaAdapter[3] + 128i64), 0i64, 0i64);
if( _InterlockedExchange((volatile __int32 *)(v18 + 116), 1) )
{
v13 = *(_QWORD *)&DmaAdapter[3];
Status = IopWaitAndAcquireFileObjectLock(*(PVOID *)&DmaAdapter[3], v9);
}
else
{
if( v19 )
*(_BYTE *)(v19 + 26) |= 1u;
v13 = *(_QWORD *)&DmaAdapter[3];
ObfReferenceObject(*(PVOID *)&DmaAdapter[3]);
Status = 0;
}
if( v10 == FilePositionInformation )
{
if( Size < 8 )
{
Status = -1073741820;
}
else
{
*(_QWORD *)FileInformation = *(_QWORD *)(v13 + 104);
IoStatusBlock->Status = 0;
IoStatusBlock->Information = 8i64;
}
LABEL_17:
IopReleaseFileObjectLock((PADAPTER_OBJECT)v13);
LABEL_18:
v21 = (struct _DMA_ADAPTER *)v13;
LABEL_19:
HalPutDmaAdapter(v21);
return Status;
}
if( v16 )
{
if( (v22 = *(PIRP *)(v16 + 32),
Irp = v22,
v72 = v22,
v23 = *(__int64(__fastcall **)(__int64, __int64, VOID *, IO_STATUS_BLOCK *, _DEVICE_OBJECT *))(v16 + 40),
v70 = v23,
v10 == FileBasicInformation)
&& v22
|| v10 == FileStandardInformation && v23 )
{
v69 = 0i64;
if( (MmVerifierData & 0x10) != 0 )
{
v24 = VfFastIoSnapState();
v23 = v70;
v22 = Irp;
}
else
{
v24 = 0i64;
}
v71 = v24;
LOBYTE(v20) = 1;
if( v10 == FileBasicInformation )
v25 = ((__int64(__fastcall *)(__int64, __int64, VOID *, IO_STATUS_BLOCK *, _DEVICE_OBJECT *))v22)(
v13,
v20,
FileInformation,
&v69,
v15);
else
v25 = v23(v13, v20, FileInformation, &v69, v15);
v58 = v25;
if( v24 )
{
VfFastIoCheckState(v24, Irp);
v25 = v58;
}
if( v25 )
{
Status = v69.Status;
*IoStatusBlock = v69;
}
if( v25 )
goto LABEL_17;
}
}
v26 = 1;
}
else
{
KeInitializeEvent(&Event, SynchronizationEvent, 0);
v26 = 0;
}
IopResetEvent((FILE_OBJECT *)v13);
v27 = IopAllocateIrpExReturn(v15, *((_BYTE *)v15 + 76), 0, retaddr);
v28 = v27;
Irp = v27;
if( !v27 )
{
IopAllocateIrpCleanup((PUNICODE_STRING)v13);
return -1073741670;
}
*((_QWORD *)v27 + 24) = v13;
*((_QWORD *)v27 + 19) = CurrentThread;
*((_BYTE *)v27 + 64) = v9;
if( v26 )
{
*((_BYTE *)v27 + 71) |= 2u;
p_Event = 0i64;
}
else
{
if( v9 == 1 )
v59 = KeSetKernelStackSwapEnable(0);
*((_DWORD *)v28 + 4) = 4;
v64 = &v75;
p_Event = &Event;
}
*((_QWORD *)v28 + 10) = p_Event;
*((_QWORD *)v28 + 9) = v64;
*((_QWORD *)v28 + 11) = 0i64;
v30 = (_ETHREAD *)(*((_QWORD *)v28 + 23) - 72i64);
CurrentThread = v30;
*(_BYTE *)v30 = 5;
*((_QWORD *)v30 + 6) = v13;
*((_QWORD *)v28 + 14) = FileInformation;
*((_QWORD *)v28 + 3) = 0i64;
*((_QWORD *)v28 + 1) = 0i64;
PoolWithQuota = IopVerifierExAllocatePoolWithQuota((POOL_TYPE)v28, Size);
*((_QWORD *)v28 + 3) = PoolWithQuota;
if( !IopDisableBufferedIoInit )
memset((INT64)PoolWithQuota, 0i64);
*((_DWORD *)v28 + 4) |= 0x870u;
v32 = CurrentThread;
*((_DWORD *)CurrentThread + 2) = Size;
*((_DWORD *)v32 + 4) = v10;
if( v57 )
*((_BYTE *)v32 + 2) |= 1u;
IopQueueThreadIrp(v28);
v35 = (_ETHREAD *)KeGetCurrentThread();
++*((_QWORD *)v35 + 114);
__incgsdword(0x2EE4u);
v36 = 0;
NumaNodeInformation = 0;
if( v10 == FileModeInformation )
{
ModeInformation = IopGetModeInformation(*(FILE_OBJECT **)&DmaAdapter[3]);
*v45 = ModeInformation;
*((_QWORD *)v28 + 7) = 4i64;
*((_DWORD *)v28 + 12) = 0;
}
else
{
switch( v10 )
{
case FileAlignmentInformation:
**((_DWORD **)v28 + 3) = *((_DWORD *)v15 + 38);
*((_QWORD *)v28 + 7) = 4i64;
break;
case FileIoCompletionNotificationInformation:
v47 = (int *)*((_QWORD *)v28 + 3);
*v47 = 0;
v48 = *(_QWORD *)&DmaAdapter[3];
v49 = *(_DWORD *)(*(_QWORD *)&DmaAdapter[3] + 80i64);
v50 = 0;
if( (v49 & 0x4000000) != 0 )
{
v50 = 2;
*v47 = 2;
v49 = *(_DWORD *)(v48 + 80);
}
if( (v49 & 0x8000000) != 0 )
{
v50 |= 4u;
*v47 = v50;
v49 = *(_DWORD *)(v48 + 80);
}
if( (v49 & 0x2000000) != 0 )
*v47 = v50 | 1;
*((_QWORD *)v28 + 7) = 4i64;
break;
case FileIoPriorityHintInformation:
v51 = *(_QWORD *)(*(_QWORD *)&DmaAdapter[3] + 208i64);
if( v51 && (v52 = *(_DWORD *)(v51 + 80)) != 0 )
v53 = v52 - 1;
else
v53 = 2;
**((_DWORD **)v28 + 3) = v53;
*((_QWORD *)v28 + 7) = 4i64;
break;
default:
switch( v10 )
{
case FileProcessIdsUsingFileInformation:
v54 = (_FILE_PROCESS_IDS_USING_FILE_INFORMATION *)*((_QWORD *)v28 + 3);
LODWORD(OutputSize) = 0;
NumaNodeInformation = IopQueryProcessIdsUsingFile(
*(FILE_OBJECT **)&DmaAdapter[3],
v54,
Size,
&OutputSize);
v36 = 1;
if( NumaNodeInformation == -1073741820 )
IoStatusBlock->Information = (unsigned int)OutputSize;
else
*((_QWORD *)v28 + 7) = (unsigned int)OutputSize;
break;
case FileNumaNodeInformation:
NumaNodeInformation = IopGetNumaNodeInformation(
*(FILE_OBJECT **)&DmaAdapter[3],
*((_FILE_PROCESS_IDS_USING_FILE_INFORMATION **)v28 + 3),
v33,
v34);
v36 = 1;
if( NumaNodeInformation >= 0 )
*((_QWORD *)v28 + 7) = 2i64;
break;
case FileAllInformation:
*(_DWORD *)(*((_QWORD *)v28 + 3) + 76i64) = pHandleInformation.GrantedAccess;
v38 = IopGetModeInformation(*(FILE_OBJECT **)&DmaAdapter[3]);
*(_DWORD *)(v39 + 88) = v38;
*(_DWORD *)(v39 + 92) = *((_DWORD *)v15 + 38);
*((_QWORD *)v28 + 7) = 12i64;
break;
}
if( !v36 )
{
NumaNodeInformation = IopCallDriverReference(
v15,
v28,
v26,
*(_FILE_OBJECT **)&DmaAdapter[3],
OtherTransfer);
goto LABEL_57;
}
break;
}
*((_DWORD *)v28 + 12) = NumaNodeInformation;
}
LABEL_57:
if( NumaNodeInformation == 259 )
{
if( !v26 )
{
v42 = KeWaitForSingleObject(&Event, Executive, v9, 0, 0i64);
if( v42 == 257 || v42 == 192 )
IopCancelAlertedRequest(&Event, v28);
NumaNodeInformation = v75.Status;
*IoStatusBlock = v75;
goto LABEL_61;
}
IopWaitForSynchronousIo(v28, *(_FILE_OBJECT **)&DmaAdapter[3], v9);
NumaNodeInformation = v40;
}
else
{
v74 = 0i64;
v68 = 0i64;
if( !v26 )
*((_QWORD *)v28 + 10) = 0i64;
*((_QWORD *)v28 + 9) = IoStatusBlock;
CurrentIrql = KeGetCurrentIrql();
__writecr8(1ui64);
IopCompleteRequest((__int64)v28 + 120, (__int64)&v74, &v68, (ULONG_PTR *)&DmaAdapter[3], &v68);
__writecr8(CurrentIrql);
if( !v26 )
goto LABEL_61;
}
IopReleaseFileObjectLock(*(PADAPTER_OBJECT *)&DmaAdapter[3]);
LABEL_61:
if( v59 )
KeSetKernelStackSwapEnable(1u);
return NumaNodeInformation;
}
}
return result;
}Referenced by:
PfSnGetPrefetchInstructions
PfpFileCheckAttributesForPrefetch
RtlIsPartialPlaceholderFileHandle