NtSetVolumeInformationFile
INT64 __fastcall NtSetVolumeInformationFile(
VOID *FileHandle,
_IO_STATUS_BLOCK *IoStatusBlock,
VOID *FsInformation,
UINT64 Length,
_FSINFOCLASS FsInformationClass){
UINT64 v5;
KEVENT *v8;
_ETHREAD *CurrentThread;
INT8 v10;
unsigned int v11;
__int64 v12;
__int64 v13;
__int16 v14;
INT64 result;
PADAPTER_OBJECT v16;
NTSTATUS RelatedTargetDevice;
UINT64 v18;
POOL_TYPE v19;
struct _DMA_ADAPTER *v20;
_ETHREAD *v21;
PADAPTER_OBJECT v22;
__int64 v23;
INT64 v24;
UINT64 v25;
UINT8 v26;
UINT8 v27;
unsigned int v28;
IRP *v29;
IRP *v30;
_IO_STATUS_BLOCK *p_LocalIoStatus;
KEVENT *v32;
__int64 v33;
UINT8 *PoolWithQuota;
CHAR v35;
int v36;
unsigned int v37;
__int64 v38;
CHAR v39;
struct _DMA_ADAPTER *v40;
_KEVENT *Pool;
IRP *pHandleInformation;
UINT64 v43;
CHAR Size;
CHAR Size_1;
unsigned int Size_4;
PADAPTER_OBJECT v47;
PADAPTER_OBJECT DmaAdapter;
_ETHREAD *v49;
struct _DMA_ADAPTER *v50;
_IO_STATUS_BLOCK *IoStatusBlocka;
PVOID P;
PDEVICE_OBJECT DeviceObject;
PIRP Irp;
_IO_STATUS_BLOCK LocalIoStatus;
int NotificationStructure;
GUID v57;
int v58;
__int64 v59;
int v60;
int v61;
VOID *retaddr;
v5 = (unsigned int)Length;
Size_4 = Length;
IoStatusBlocka = IoStatusBlock;
v47 = 0i64;
v8 = 0i64;
P = 0i64;
DmaAdapter = 0i64;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v49 = CurrentThread;
v10 = *((_BYTE *)CurrentThread + 562);
Size_1 = v10;
if( v10 )
{
if( (unsigned int)FsInformationClass >= FileFsMaximumInformation )
return 3221225475i64;
v11 = *((unsigned __int8 *)IopSetFsOperationLength + (int)FsInformationClass);
if( !(_BYTE)v11 )
return 3221225475i64;
if( (unsigned int)v5 < v11 )
return 3221225476i64;
v12 = (__int64)IoStatusBlock;
if( (unsigned __int64)IoStatusBlock >= 0x7FFFFFFF0000i64 )
v12 = 0x7FFFFFFF0000i64;
*(_DWORD *)v12 = *(_DWORD *)v12;
v13 = *(_QWORD *)(*((_QWORD *)CurrentThread + 23) + 1408i64);
if( v13 && ((v14 = *(_WORD *)(v13 + 8), v14 == 332) || v14 == 452) )
{
if( (_DWORD)v5 )
{
if( ((unsigned __int8)FsInformation & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( (unsigned __int64)FsInformation + v5 > 0x7FFFFFFF0000i64 || (char *)FsInformation + v5 < FsInformation )
MEMORY[0x7FFFFFFF0000] = 0;
}
}
else if( (_DWORD)v5 )
{
if( ((*((unsigned __int8 *)IopQuerySetFsAlignmentRequirement + (int)FsInformationClass) - 1i64) & (unsigned __int64)FsInformation) != 0 )
ExRaiseDatatypeMisalignment();
if( (unsigned __int64)FsInformation + v5 > 0x7FFFFFFF0000i64 || (char *)FsInformation + v5 < FsInformation )
MEMORY[0x7FFFFFFF0000] = 0;
}
}
LODWORD(result) = IopReferenceFileObject(
FileHandle,
(unsigned int)IopSetFsOperationAccess[FsInformationClass],
v10,
(FILE_OBJECT **)&v47,
0i64);
if( (int)result < 0 )
return result;
v16 = v47;
RelatedTargetDevice = IoGetRelatedTargetDevice((FILE_OBJECT *)v47, (DEVICE_OBJECT **)&DmaAdapter);
v20 = DmaAdapter;
if( RelatedTargetDevice < 0 )
v20 = 0i64;
DmaAdapter = v20;
v50 = v16 + 5;
if( (*(_DWORD *)&v16[5].Version & 2) != 0 )
{
v21 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v21 + 242);
v22 = v47;
LODWORD(v23) = KeAbPreAcquire(&v47[8], 0i64, 0i64);
Size = 0;
if( _InterlockedExchange((volatile __int32 *)(&v22[7].Size + 1), 1) )
{
pHandleInformation = (IRP *)&Size;
LOBYTE(v24) = Size_1;
v16 = v47;
v28 = IopWaitAndAcquireFileObjectLock(v47, v24);
}
else
{
if( v23 )
*(_BYTE *)(v23 + 26) |= 1u;
v16 = v47;
ObfReferenceObject(v47);
v28 = 0;
}
if( Size )
{
HalPutDmaAdapter(v16);
v40 = DmaAdapter;
if( !DmaAdapter )
return v28;
goto LABEL_48;
}
Size = 1;
v20 = DmaAdapter;
v5 = Size_4;
}
else
{
Pool = (_KEVENT *)IopVerifierExAllocatePool(v19, v18);
v8 = Pool;
P = Pool;
if( !Pool )
{
HalPutDmaAdapter(v16);
LABEL_64:
if( v20 )
HalPutDmaAdapter(v20);
return 3221225626i64;
}
KeInitializeEvent(Pool, SynchronizationEvent, 0);
Size = 0;
}
if( (*(_DWORD *)&v50->Version & 0x4000000) == 0 )
KeResetEvent(&v16[9].DmaOperations, v25, v26, v27, pHandleInformation);
DeviceObject = IoGetRelatedDeviceObject((_FILE_OBJECT *)v16);
v29 = IopAllocateIrpExReturn(DeviceObject, *((_BYTE *)DeviceObject + 76), 0, retaddr);
v30 = v29;
Irp = v29;
if( !v29 )
{
if( (*(_DWORD *)&v50->Version & 2) == 0 )
ExFreePoolWithTag(v8, 0);
IopAllocateIrpCleanup((PUNICODE_STRING)v16);
goto LABEL_64;
}
*((_QWORD *)v29 + 24) = v16;
*((_QWORD *)v29 + 19) = v49;
*((_BYTE *)v29 + 64) = Size_1;
LocalIoStatus = 0i64;
if( Size )
{
p_LocalIoStatus = IoStatusBlocka;
v32 = 0i64;
}
else
{
*((_DWORD *)v29 + 4) = 4;
p_LocalIoStatus = &LocalIoStatus;
v32 = v8;
}
*((_QWORD *)v30 + 10) = v32;
*((_QWORD *)v30 + 9) = p_LocalIoStatus;
*((_QWORD *)v30 + 11) = 0i64;
v33 = *((_QWORD *)v30 + 23) - 72i64;
v49 = (_ETHREAD *)v33;
*(_BYTE *)v33 = 11;
*(_QWORD *)(v33 + 48) = v16;
*((_QWORD *)v30 + 3) = 0i64;
*((_QWORD *)v30 + 1) = 0i64;
PoolWithQuota = (UINT8 *)IopVerifierExAllocatePoolWithQuota((POOL_TYPE)v32, v5);
*((_QWORD *)v30 + 3) = PoolWithQuota;
memmove(PoolWithQuota, (UINT8 *)FsInformation, v5);
v35 = Size_1;
if( !Size_1 || FsInformationClass != FileFsLabelInformation )
{
v37 = Size_4;
LABEL_42:
*((_DWORD *)v30 + 4) |= 0x30u;
v38 = (__int64)v49;
*((_DWORD *)v49 + 2) = v37;
*(_DWORD *)(v38 + 16) = FsInformationClass;
LODWORD(v43) = 2;
v39 = Size;
v28 = IopSynchronousServiceTail(DeviceObject, v30, (FILE_OBJECT *)v16, 0, v35, Size, v43);
if( !v39 )
v28 = IopSynchronousApiServiceTail(v28, v8, v30, Size_1, &LocalIoStatus, IoStatusBlocka);
if( !v20 )
return v28;
if( (v28 & 0x80000000) == 0 )
{
v58 = 0;
v61 = 0;
NotificationStructure = 2359297;
v59 = 0i64;
v60 = -1;
v57 = GUID_IO_VOLUME_CHANGE;
IoReportTargetDeviceChange((PDEVICE_OBJECT)v20, &NotificationStructure);
}
v40 = v20;
LABEL_48:
HalPutDmaAdapter(v40);
return v28;
}
v36 = **((_DWORD **)v30 + 3);
if( v36 >= 0 )
{
v37 = Size_4;
if( v36 + 4 <= Size_4 )
goto LABEL_42;
}
IopExceptionCleanup((FILE_OBJECT *)v16, v30, 0i64, v8);
if( v20 )
HalPutDmaAdapter(v20);
return 3221225485i64;
}Referenced by:
No references.