BiGetPartitionVhdFilePathFromUnicodeString
WCHAR *__stdcall BiGetPartitionVhdFilePathFromUnicodeString(_UNICODE_STRING *NtDeviceVolumePath, WCHAR *OutputBuffer){
wchar_t *Buffer;
ULONG OutputBufferLength;
int i;
wchar_t *PoolWithTag;
NTSTATUS v6;
struct _IO_STATUS_BLOCK IoStatusBlock;
struct _OBJECT_ATTRIBUTES ObjectAttributes;
int InputBuffer;
UNICODE_STRING FileHandle;
*(&ObjectAttributes.Length + 1) = 0;
memset(&ObjectAttributes.Attributes + 1, 0, 20);
InputBuffer = 0;
FileHandle.Buffer = 0i64;
Buffer = 0i64;
ObjectAttributes.RootDirectory = 0i64;
*(_QWORD *)&FileHandle.Length = 0i64;
ObjectAttributes.ObjectName = NtDeviceVolumePath;
IoStatusBlock = 0i64;
ObjectAttributes.Length = 48;
ObjectAttributes.Attributes = 576;
if( ZwOpenFile(&FileHandle, (PWCHAR)0xC0100000i64) >= 0 )
{
OutputBufferLength = 520;
for( i = 1; ; i = 2 )
{
PoolWithTag = (wchar_t *)ExAllocatePoolWithTag(PagedPool, OutputBufferLength, 0x4B444342ui64);
Buffer = PoolWithTag;
if( !PoolWithTag )
break;
InputBuffer = 1;
v6 = ZwDeviceIoControlFile(
*(HANDLE *)&FileHandle.Length,
0i64,
0i64,
0i64,
&IoStatusBlock,
0x2D5928u,
&InputBuffer,
4u,
PoolWithTag,
OutputBufferLength);
if( v6 != -1073741789 )
goto LABEL_5;
if( i != 1 )
goto LABEL_6;
OutputBufferLength = *(_DWORD *)Buffer;
ExFreePoolWithTag(Buffer, 0x4B444342u);
}
v6 = -1073741801;
LABEL_5:
if( v6 < 0 )
{
LABEL_6:
if( Buffer )
{
ExFreePoolWithTag(Buffer, 0x4B444342u);
Buffer = 0i64;
}
goto LABEL_8;
}
if( (int)BiTranslateSymbolicLinkFile(Buffer, &FileHandle.Buffer) >= 0 )
{
ExFreePoolWithTag(Buffer, 0x4B444342u);
Buffer = FileHandle.Buffer;
}
}
LABEL_8:
if( *(_QWORD *)&FileHandle.Length )
ZwClose(*(HANDLE *)&FileHandle.Length);
return Buffer;
}Referenced by:
BiGetPartitionVhdFilePath