ObOpenObjectByNameEx
NTSTATUS __stdcall ObOpenObjectByNameEx(
_OBJECT_ATTRIBUTES *ObjectAttributes,
_OBJECT_TYPE *ObjectType,
CHAR AccessMode,
_ACCESS_STATE *AccessState,
UINT64 DesiredAccess,
PVOID ParseContext,
_EJOB *Silo,
PVOID *Handle){
struct _KPRCB *CurrentPrcb;
__int64 v13;
PSLIST_ENTRY v14;
NTSTATUS Information;
void *v16;
_ETHREAD *CurrentThread;
_EX_FAST_REF *v18;
_EX_FAST_REF *v19;
_QWORD *v20;
int v21;
_SLIST_ENTRY *Next;
struct _SLIST_ENTRY *v23;
int v24;
struct _DMA_ADAPTER *v25;
struct _DMA_ADAPTER *v26;
PADAPTER_OBJECT v27;
__int64 v28;
void *v29;
struct _KPRCB *v30;
__int64 v31;
int v32;
struct _DMA_ADAPTER *v33;
struct _DMA_ADAPTER *v34;
_SLIST_ENTRY *v35;
struct _SLIST_ENTRY *v36;
struct _KPRCB *v37;
__int64 v38;
struct _KPRCB *v39;
__int64 v40;
struct _DMA_ADAPTER *v42;
INT64 v43;
__int64 v44;
__int64 v45;
__int64(__fastcall *v46)(__int64, __int64, __int64);
__int64 v47;
__int64 v48;
INT64 *v49;
__int64 v50;
struct _KPRCB *v51;
__int64 v52;
__int64 v53;
_OBJECT_CREATE_INFORMATION *ObjectCreateInfo;
INT64 UseLookaside;
_SECURITY_QUALITY_OF_SERVICE *SecurityQos;
PVOID InsertObject;
PADAPTER_OBJECT DmaAdapter;
PVOID Lock;
_ETHREAD *v60;
void *v61;
INT64 v62;
PSLIST_ENTRY ListEntry[2];
_SECURITY_SUBJECT_CONTEXT SubjectContext;
INT64 v65[2];
__int128 v66;
__int128 v67;
__int64 v68;
UINT64 MaxRelativeAccessMask;
v68 = 0i64;
DmaAdapter = 0i64;
LODWORD(MaxRelativeAccessMask) = 0;
v61 = 0i64;
*Handle = 0i64;
v62 = 0i64;
*(_OWORD *)ListEntry = 0i64;
*(_OWORD *)v65 = 0i64;
v66 = 0i64;
v67 = 0i64;
if( ObjectAttributes && ObjectType )
{
CurrentPrcb = KeGetCurrentPrcb();
v13 = *((_QWORD *)CurrentPrcb + 272);
++*(_DWORD *)(v13 + 20);
v14 = RtlpInterlockedPopEntrySList((PSLIST_HEADER)v13);
if( !v14 )
{
++*(_DWORD *)(v13 + 24);
v44 = *((_QWORD *)CurrentPrcb + 273);
++*(_DWORD *)(v44 + 20);
v14 = RtlpInterlockedPopEntrySList((PSLIST_HEADER)v44);
if( !v14 )
{
v45 = *(unsigned int *)(v44 + 44);
v46 = *(__int64(__fastcall **)(__int64, __int64, __int64))(v44 + 48);
v47 = *(unsigned int *)(v44 + 40);
v48 = *(unsigned int *)(v44 + 36);
++*(_DWORD *)(v44 + 24);
v14 = (PSLIST_ENTRY)v46(v48, v45, v47);
if( !v14 )
return -1073741670;
}
}
LODWORD(v14->Next) = *((_DWORD *)CurrentPrcb + 9);
LODWORD(UseLookaside) = 1;
Information = ObpCaptureObjectCreateInformation(
(unsigned __int8)AccessMode,
(unsigned __int8)AccessMode,
ObjectAttributes,
(_UNICODE_STRING *)ListEntry,
(_OBJECT_CREATE_INFORMATION *)&v14[10],
UseLookaside,
(INT64)SecurityQos,
(INT64)InsertObject);
if( Information < 0 )
{
v51 = KeGetCurrentPrcb();
v52 = *((_QWORD *)v51 + 272);
++*(_DWORD *)(v52 + 28);
if( *(_WORD *)v52 < *(_WORD *)(v52 + 16)
|| (++*(_DWORD *)(v52 + 32),
v52 = *((_QWORD *)v51 + 273),
++*(_DWORD *)(v52 + 28),
*(_WORD *)v52 < *(_WORD *)(v52 + 16)) )
{
RtlpInterlockedPushEntrySList((PSLIST_HEADER)v52, v14);
}
else
{
++*(_DWORD *)(v52 + 32);
(*(void(__fastcall **)(PSLIST_ENTRY))(v52 + 56))(v14);
}
return Information;
}
if( !AccessState )
{
v16 = 0i64;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
*(_QWORD *)&SubjectContext.ImpersonationLevel = 0i64;
v18 = (_EX_FAST_REF *)*((_QWORD *)CurrentThread + 23);
SubjectContext.ProcessAuditId = v18[136].Object;
if( CurrentThread && (*((_DWORD *)CurrentThread + 324) & 8) != 0 )
{
v60 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v60 + 242);
Lock = (char *)CurrentThread + 1280;
ExAcquirePushLockSharedEx((UINT64)CurrentThread + 1280, 0i64);
if( (*((_DWORD *)CurrentThread + 324) & 8) != 0 )
{
v16 = (void *)(*((_QWORD *)CurrentThread + 149) & 0xFFFFFFFFFFFFFFF8ui64);
ObfReferenceObject(v16);
SubjectContext.ImpersonationLevel = *((_DWORD *)CurrentThread + 298) & 3;
}
if( _InterlockedCompareExchange64((volatile signed __int64 *)Lock, 0i64, 17i64) != 17 )
ExfReleasePushLockShared((INT64 *)Lock);
KeAbPostRelease(Lock);
KeLeaveCriticalRegionThread((__int64)v60);
}
SubjectContext.ClientToken = v16;
v19 = v18 + 151;
v20 = ObFastReferenceObject((INT64 *)&v18[151]);
if( !v20 )
{
v60 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v60 + 242);
v49 = (INT64 *)&v18[135];
ExAcquirePushLockSharedEx((UINT64)v49, 0i64);
v20 = (_QWORD *)ObFastReferenceObjectLocked(v19);
if( _InterlockedCompareExchange64(v49, 0i64, 17i64) != 17 )
ExfReleasePushLockShared(v49);
KeAbPostRelease(v49);
KeLeaveCriticalRegionThread((__int64)v60);
}
SubjectContext.PrimaryToken = v20;
if( SeTokenLeakTracking )
{
if( v20 )
{
_InterlockedIncrement((volatile signed __int32 *)(v20[143] + 284i64));
if( v20 == (_QWORD *)SepTokenLeakToken )
__debugbreak();
}
if( SubjectContext.ClientToken )
{
_InterlockedIncrement((volatile signed __int32 *)(*((_QWORD *)SubjectContext.ClientToken + 143) + 284i64));
if( SubjectContext.ClientToken == (void *)SepTokenLeakToken )
__debugbreak();
}
}
SepCreateAccessStateFromSubjectContext(
&SubjectContext,
(_ACCESS_STATE *)v14,
(_AUX_ACCESS_DATA *)&v14[14],
(unsigned int)DesiredAccess,
&ObjectType->TypeInfo.GenericMapping);
Information = v21;
if( v21 < 0 )
goto LABEL_33;
AccessState = (_ACCESS_STATE *)v14;
}
Next = v14[12].Next;
if( Next )
*((_QWORD *)AccessState + 8) = Next;
else
Next = (_SLIST_ENTRY *)*((_QWORD *)AccessState + 8);
if( Next )
{
if( !RtlValidSecurityDescriptor(Next) )
{
Information = -1073741703;
LABEL_33:
if( AccessState == (_ACCESS_STATE *)v14 )
{
SepDeleteAccessState(AccessState);
if( SeTokenLeakTracking )
{
v53 = *((_QWORD *)AccessState + 6);
if( v53 )
{
_InterlockedDecrement((volatile signed __int32 *)(*(_QWORD *)(v53 + 1144) + 284i64));
if( *((_QWORD *)AccessState + 6) == SepTokenLeakToken )
__debugbreak();
}
v50 = *((_QWORD *)AccessState + 4);
if( v50 )
{
_InterlockedDecrement((volatile signed __int32 *)(*(_QWORD *)(v50 + 1144) + 284i64));
if( *((_QWORD *)AccessState + 4) == SepTokenLeakToken )
__debugbreak();
}
}
ObFastDereferenceObject(
(INT64 *)(*((_QWORD *)KeGetCurrentThread() + 23) + 1208i64),
*((struct DMA_ADAPTER **)AccessState + 6));
v34 = (struct _DMA_ADAPTER *)*((_QWORD *)AccessState + 4);
*((_QWORD *)AccessState + 6) = 0i64;
if( v34 )
HalPutDmaAdapter(v34);
*((_QWORD *)AccessState + 4) = 0i64;
}
v35 = v14[12].Next;
if( v35 )
{
SeReleaseSecurityDescriptor(v35, (INT8)v14[11].Next, 1u);
v14[12].Next = 0i64;
}
v36 = ListEntry[1];
if( ListEntry[1] )
{
if( WORD1(ListEntry[0]) == 248 )
{
v37 = KeGetCurrentPrcb();
v38 = *((_QWORD *)v37 + 266);
++*(_DWORD *)(v38 + 28);
if( *(_WORD *)v38 < *(_WORD *)(v38 + 16)
|| (++*(_DWORD *)(v38 + 32),
v38 = *((_QWORD *)v37 + 267),
++*(_DWORD *)(v38 + 28),
*(_WORD *)v38 < *(_WORD *)(v38 + 16)) )
{
RtlpInterlockedPushEntrySList((PSLIST_HEADER)v38, v36);
}
else
{
++*(_DWORD *)(v38 + 32);
(*(void(__fastcall **)(struct _SLIST_ENTRY *))(v38 + 56))(v36);
}
}
else
{
ExFreePoolWithTag(ListEntry[1], 0);
}
}
SeClearLearningModeObjectInformation();
v39 = KeGetCurrentPrcb();
v40 = *((_QWORD *)v39 + 272);
++*(_DWORD *)(v40 + 28);
if( *(_WORD *)v40 < *(_WORD *)(v40 + 16)
|| (++*(_DWORD *)(v40 + 32),
v40 = *((_QWORD *)v39 + 273),
++*(_DWORD *)(v40 + 28),
*(_WORD *)v40 < *(_WORD *)(v40 + 16)) )
{
RtlpInterlockedPushEntrySList((PSLIST_HEADER)v40, v14);
}
else
{
++*(_DWORD *)(v40 + 32);
(*(void(__fastcall **)(PSLIST_ENTRY))(v40 + 56))(v14);
}
return Information;
}
if( (BYTE2(Next->Next) & 0x10) != 0 && (*((_DWORD *)AccessState + 5) & 0x1000000) == 0 )
*((_DWORD *)AccessState + 4) |= SeObjectCreateSaclAccessBits(Next);
}
v23 = v14 + 28;
v24 = 0;
LOBYTE(ObjectCreateInfo) = AccessMode;
Information = ObpLookupObjectName(
*((VOID **)&v14[10].Next + 1),
(_UNICODE_STRING *)ListEntry,
LODWORD(v14[10].Next),
ObjectType,
(INT64)ObjectCreateInfo,
ParseContext,
*((_SECURITY_QUALITY_OF_SERVICE **)&v14[12].Next + 1),
0i64,
Silo,
AccessState,
(_OBP_LOOKUP_CONTEXT *)&v14[28],
&MaxRelativeAccessMask,
(VOID **)&DmaAdapter);
if( Information >= 0 )
{
if( *((_BYTE *)&v14[29].Next + 14) )
{
v43 = *((_QWORD *)&v14[28].Next + 1) - 48i64;
v62 = v43;
ObfReferenceObject((PVOID)(v43 + 48));
_InterlockedIncrement((volatile signed __int32 *)(v43
- *((unsigned __int8 *)ObpInfoMaskToOffset
+ (*(_BYTE *)(v43 + 26) & 3))
+ 24));
v24 = 0;
}
if( *((_BYTE *)&v14[29].Next + 14) )
{
ExReleasePushLockEx((UINT64)(&v23->Next[18].Next + 1), 0i64);
v42 = (struct _DMA_ADAPTER *)v23->Next;
LODWORD(v14[30].Next) = -286387660;
HalPutDmaAdapter(v42);
v23->Next = 0i64;
*((_WORD *)&v14[29].Next + 7) = 0;
KeLeaveCriticalRegion();
}
v25 = (struct _DMA_ADAPTER *)*((_QWORD *)&v14[28].Next + 1);
if( v25 )
{
HalPutDmaAdapter(v25);
*((_QWORD *)&v14[28].Next + 1) = 0i64;
}
v26 = DmaAdapter;
v27 = DmaAdapter - 3;
if( (BYTE3(DmaAdapter[-2].DmaOperations) & 1) != 0 )
{
v28 = *(_QWORD *)&v27[2].Version;
if( v28 )
{
v29 = *(void **)(v28 + 32);
if( v29 )
{
SeReleaseSecurityDescriptor(v29, *(_BYTE *)(v28 + 16), 1u);
*(_QWORD *)(*(_QWORD *)&v27[2].Version + 32i64) = 0i64;
v28 = *(_QWORD *)&v27[2].Version;
}
v30 = KeGetCurrentPrcb();
v31 = *((_QWORD *)v30 + 264);
++*(_DWORD *)(v31 + 28);
if( *(_WORD *)v31 < *(_WORD *)(v31 + 16)
|| (++*(_DWORD *)(v31 + 32),
v31 = *((_QWORD *)v30 + 265),
++*(_DWORD *)(v31 + 28),
*(_WORD *)v31 < *(_WORD *)(v31 + 16)) )
{
RtlpInterlockedPushEntrySList((PSLIST_HEADER)v31, (PSLIST_ENTRY)v28);
}
else
{
++*(_DWORD *)(v31 + 32);
(*(void(__fastcall **)(__int64))(v31 + 56))(v28);
}
*(_QWORD *)&v27[2].Version = 0i64;
v26 = DmaAdapter;
}
}
else
{
v24 = 1;
}
if( (*(_DWORD *)(ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ LOBYTE(v27[1].DmaOperations) ^ (unsigned __int64)BYTE1(v27)]
+ 72) & (__int64)v14[10].Next) != 0 )
{
HalPutDmaAdapter(v26);
Information = -1073741811;
}
else
{
*((_QWORD *)&v66 + 1) = ListEntry;
*(_QWORD *)&v66 = &ObjectType->Name;
*(_QWORD *)&v67 = *((_QWORD *)&v14[10].Next + 1);
SeSetLearningModeObjectInformation((INT64)v65);
v32 = ObpCreateHandle(
v24,
(char *)DmaAdapter,
0,
AccessState,
0,
(unsigned int)v14[10].Next,
AccessMode,
0i64,
MaxRelativeAccessMask,
0i64,
(__int64 *)&v61);
if( v32 < 0 )
{
HalPutDmaAdapter(DmaAdapter);
Information = v32;
}
else
{
*Handle = v61;
}
}
v33 = (struct _DMA_ADAPTER *)v62;
if( v62 )
{
if( _InterlockedExchangeAdd(
(volatile signed __int32 *)(v62
- *((unsigned __int8 *)ObpInfoMaskToOffset + (*(_BYTE *)(v62 + 26) & 3))
+ 24),
0xFFFFFFFF) == 1 )
ObpDeleteNameCheck((INT64)v33);
HalPutDmaAdapter(v33 + 3);
}
}
goto LABEL_33;
}
return -1073741811;
}Referenced by:
IoQueryInformationByName
IoRevokeHandlesForProcess
IopCreateFile
IopFastQueryNetworkAttributes
NtDeleteFile
NtOpenSymbolicLinkObject
NtQueryAttributesFile
NtQueryFullAttributesFile
ObOpenObjectByName