KsepResolveApplicableShimsForDriver
INT64 __fastcall KsepResolveApplicableShimsForDriver(INT64 a1, INT64 a2){
_ETHREAD *CurrentThread;
int LoadedModulesList;
int v4;
int v5;
unsigned int v6;
INT64 v8;
INT64 v9;
_QWORD *v10;
__int64 v11;
int v12;
__int64 v13;
_QWORD *v14;
_ETHREAD *v15;
INT64 v16;
__int64 v17;
__int64 *v18;
__int64 v19;
_ETHREAD *v20;
INT8 v21;
__int64 v22;
INT64 v23;
__int64 v24;
__int64 v26;
__int64 v27;
__int64 v28;
int v29;
_RTL_PROCESS_MODULES *LoadedModules;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
LoadedModulesList = 0;
LoadedModules = 0i64;
v4 = 0;
v5 = 0;
v6 = a2;
v29 = 0;
--*((_WORD *)CurrentThread + 242);
ExAcquirePushLockExclusiveEx((UINT64)&qword_140C50350, 0i64);
if( v6 )
{
v9 = a1 + 72;
v10 = (_QWORD *)a1;
v11 = v6;
do
{
if( (unsigned int)KsepIsShimRegistered((INT64)KseEngine, v10, v8, v10 + 9) == 1 )
{
v12 = *(_DWORD *)(*(_QWORD *)v9 + 24i64);
if( !v12 )
v5 = 1;
*(_DWORD *)(*(_QWORD *)v9 + 24i64) = v12 + 1;
}
else
{
*(_QWORD *)v9 = 0i64;
v5 = 1;
v29 = 1;
}
v10 += 10;
v9 += 80i64;
--v11;
}
while( v11 );
v4 = v29;
LoadedModulesList = 0;
}
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&qword_140C50350, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)&qword_140C50350);
KeAbPostRelease(&qword_140C50350);
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
if( !v4 )
{
LABEL_25:
if( v5 )
{
LoadedModulesList = KsepGetLoadedModulesList(&LoadedModules);
if( LoadedModulesList < 0 )
goto LABEL_38;
v20 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v20 + 242);
ExAcquirePushLockExclusiveEx((UINT64)&qword_140C50350, 0i64);
v22 = 0i64;
if( v6 )
{
v23 = a1 + 72;
while( 1 )
{
LoadedModulesList = KsepResolveShimHooks(
(INT64)LoadedModules,
*(INT64 **)(*(_QWORD *)(*(_QWORD *)v23 + 16i64) + 48i64),
v21);
if( LoadedModulesList < 0 )
break;
v22 = (unsigned int)(v22 + 1);
v23 += 80i64;
if( (unsigned int)v22 >= v6 )
goto LABEL_31;
}
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&qword_140C50350, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)&qword_140C50350);
KeAbPostRelease(&qword_140C50350);
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
v28 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
dword_140C2A864[2 * v28] = LoadedModulesList;
KsepHistoryErrors[2 * v28] = 459292;
if( (KsepDebugFlag & 2) != 0 )
KsepDebugPrint(
6i64,
"KSE: Failed to resolve hooks for shim [0x%08X]. Status 0x%x.\n",
*(unsigned int *)(a1 + 80 * v22),
(unsigned int)LoadedModulesList);
KsepLogError(
6,
"KSE: Failed to resolve hooks for shim [0x%08X]. Status 0x%x.\n",
*(unsigned int *)(a1 + 80 * v22),
(unsigned int)LoadedModulesList);
}
else
{
LABEL_31:
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&qword_140C50350, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)&qword_140C50350);
KeAbPostRelease(&qword_140C50350);
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
}
}
goto LABEL_34;
}
v13 = 0i64;
if( v6 )
{
v14 = (_QWORD *)(a1 + 72);
while( 1 )
{
if( !*v14 )
{
LoadedModulesList = KsepLoadShimProvider(a1 + 80 * v13);
if( LoadedModulesList < 0 )
break;
}
v13 = (unsigned int)(v13 + 1);
v14 += 10;
if( (unsigned int)v13 >= v6 )
goto LABEL_18;
}
v26 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
dword_140C2A864[2 * v26] = LoadedModulesList;
KsepHistoryErrors[2 * v26] = 459215;
if( (KsepDebugFlag & 2) != 0 )
KsepDebugPrint(
6i64,
"KSE: Failed to load provider for shim [0x%08X]. Status: 0x%x\n",
*(unsigned int *)(a1 + 80 * v13),
(unsigned int)LoadedModulesList);
KsepLogError(
6,
"KSE: Failed to load provider for shim [0x%08X]. Status: 0x%x\n",
*(unsigned int *)(a1 + 80 * v13),
(unsigned int)LoadedModulesList);
LABEL_34:
if( LoadedModulesList >= 0 )
{
v24 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryMessagesIndex, 1u) + 1) & 0x3F;
HIDWORD(KsepHistoryMessages[v24]) = 0;
LODWORD(KsepHistoryMessages[v24]) = 459306;
if( (KsepDebugFlag & 1) != 0 )
KsepDebugPrint(6i64, "KSE: Successfully resolved %d shim(s).\n", v6);
KsepLogInfo(6, "KSE: Successfully resolved %d shim(s).\n", v6);
}
goto LABEL_38;
}
LABEL_18:
v15 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v15 + 242);
ExAcquirePushLockExclusiveEx((UINT64)&qword_140C50350, 0i64);
v17 = 0i64;
if( !v6 )
{
LABEL_22:
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&qword_140C50350, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)&qword_140C50350);
KeAbPostRelease(&qword_140C50350);
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
goto LABEL_25;
}
v18 = (__int64 *)(a1 + 72);
while( (unsigned int)KsepIsShimRegistered(
(INT64)KseEngine,
(_QWORD *)(a1 + 80 * v17),
v16,
(_QWORD *)(a1 + 80 * v17 + 72)) )
{
v19 = *v18;
v17 = (unsigned int)(v17 + 1);
v18 += 10;
++*(_DWORD *)(v19 + 24);
if( (unsigned int)v17 >= v6 )
goto LABEL_22;
}
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&qword_140C50350, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)&qword_140C50350);
KeAbPostRelease(&qword_140C50350);
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
LoadedModulesList = -1073740782;
v27 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
dword_140C2A864[2 * v27] = -1073740782;
KsepHistoryErrors[2 * v27] = 459244;
if( (KsepDebugFlag & 2) != 0 )
KsepDebugPrint(6i64, "KSE: The provider did not register shim [0x%08X] in time\n", *(unsigned int *)(a1 + 80 * v17));
KsepLogError(6, "KSE: The provider did not register shim [0x%08X] in time\n", *(unsigned int *)(a1 + 80 * v17));
LABEL_38:
KsepPoolFreePaged(LoadedModules);
return(unsigned int)LoadedModulesList;
}Referenced by:
KsepGetShimsForDriver