PfQuerySuperfetchInformation
INT64 __stdcall PfQuerySuperfetchInformation(
_SYSTEM_INFORMATION_CLASS SystemInformationClass,
PVOID SystemInformation,
UINT64 SystemInformationLength,
CHAR PreviousMode,
UINT64 *a5){
UINT64 *v6;
unsigned int v7;
int v8;
int v9;
_LUID v10;
_EX_FAST_REF *v11;
_ETHREAD *CurrentThread;
_ETHREAD *v13;
_TOKEN *ClientToken;
_EX_FAST_REF *v15;
_TOKEN *PrimaryToken;
INT64 v17;
CHAR AccessGranted;
_TOKEN *v19;
void *Sid;
unsigned int v21;
__int64 v23;
PSE_EXPORTS v24;
_ETHREAD *v25;
__int64 v26;
_QWORD *v27;
__int64 v28;
_ETHREAD *v29;
INT64 *v30;
_QWORD *v31;
INT64 a1[2];
volatile void *Address[2];
_SECURITY_SUBJECT_CONTEXT DmaAdapter;
__int128 v35;
UINT64 *v36;
volatile void *v37;
__int128 v38;
__int64 v39;
int v40;
_PRIVILEGE_SET PrivilegeSet;
__int128 v42;
__int128 v43;
v6 = a5;
v36 = a5;
v42 = 0i64;
v43 = 0i64;
v37 = 0i64;
if( (_DWORD)SystemInformationLength != 32 )
return(unsigned int)-1073741820;
v7 = 0;
*(_OWORD *)a1 = *(_OWORD *)SystemInformation;
*(_OWORD *)Address = *((_OWORD *)SystemInformation + 1);
if( a1[0] != 0x6B7568430000002Di64 )
return(unsigned int)-1073741811;
v8 = a1[1];
if( LODWORD(a1[1]) <= 0x1C )
{
v9 = 268501248;
if( _bittest(&v9, a1[1]) )
goto LABEL_29;
}
v10 = SeProfileSingleProcessPrivilege;
*(_QWORD *)&DmaAdapter.ImpersonationLevel = 0i64;
v11 = (_EX_FAST_REF *)*((_QWORD *)KeGetCurrentThread() + 23);
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
DmaAdapter.ProcessAuditId = v11[136].Object;
if( CurrentThread )
{
if( (*((_DWORD *)CurrentThread + 324) & 8) != 0 )
{
v13 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v13 + 242);
ExAcquirePushLockSharedEx((UINT64)CurrentThread + 1280, 0i64);
if( (*((_DWORD *)CurrentThread + 324) & 8) != 0 )
{
ClientToken = (_TOKEN *)(*((_QWORD *)CurrentThread + 149) & 0xFFFFFFFFFFFFFFF8ui64);
ObfReferenceObject(ClientToken);
DmaAdapter.ImpersonationLevel = *((_DWORD *)CurrentThread + 298) & 3;
}
else
{
ClientToken = 0i64;
}
if( _InterlockedCompareExchange64((volatile signed __int64 *)CurrentThread + 160, 0i64, 17i64) != 17 )
ExfReleasePushLockShared((INT64 *)CurrentThread + 160);
KeAbPostRelease((char *)CurrentThread + 1280);
KeLeaveCriticalRegionThread((__int64)v13);
}
else
{
ClientToken = 0i64;
}
DmaAdapter.ClientToken = ClientToken;
}
else
{
ClientToken = 0i64;
DmaAdapter.ClientToken = 0i64;
}
v15 = v11 + 151;
PrimaryToken = (_TOKEN *)ObFastReferenceObject((INT64 *)&v11[151]);
if( !PrimaryToken )
{
v29 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v29 + 242);
v30 = (INT64 *)&v11[135];
ExAcquirePushLockSharedEx((UINT64)v30, 0i64);
PrimaryToken = (_TOKEN *)ObFastReferenceObjectLocked(v15);
if( _InterlockedCompareExchange64(v30, 0i64, 17i64) != 17 )
ExfReleasePushLockShared(v30);
KeAbPostRelease(v30);
KeLeaveCriticalRegionThread((__int64)v29);
ClientToken = (_TOKEN *)DmaAdapter.ClientToken;
}
DmaAdapter.PrimaryToken = PrimaryToken;
if( SeTokenLeakTracking )
{
if( PrimaryToken )
{
_InterlockedIncrement(&PrimaryToken->DiagnosticInfo->CaptureCount);
if( PrimaryToken == (_TOKEN *)SepTokenLeakToken )
__debugbreak();
ClientToken = (_TOKEN *)DmaAdapter.ClientToken;
PrimaryToken = (_TOKEN *)DmaAdapter.PrimaryToken;
}
if( ClientToken )
{
_InterlockedIncrement(&ClientToken->DiagnosticInfo->CaptureCount);
ClientToken = (_TOKEN *)DmaAdapter.ClientToken;
if( DmaAdapter.ClientToken == (void *)SepTokenLeakToken )
__debugbreak();
PrimaryToken = (_TOKEN *)DmaAdapter.PrimaryToken;
}
}
PrivilegeSet.PrivilegeCount = 1;
PrivilegeSet.Control = 1;
PrivilegeSet.Privilege[0].Luid = v10;
PrivilegeSet.Privilege[0].Attributes = 0;
if( PreviousMode )
{
if( !ClientToken )
{
v17 = (INT64)PrimaryToken;
goto LABEL_19;
}
if( DmaAdapter.ImpersonationLevel >= SecurityImpersonation )
{
v17 = (INT64)ClientToken;
LABEL_19:
AccessGranted = SepPrivilegeCheck(v17, (INT64)PrivilegeSet.Privilege, 1ui64, 1, PreviousMode);
goto LABEL_20;
}
AccessGranted = 0;
}
else
{
AccessGranted = 1;
}
LABEL_20:
if( PreviousMode )
{
v19 = ClientToken ? ClientToken : PrimaryToken;
Sid = v19->UserAndGroups->Sid;
if( !RtlEqualSid(SeLocalSystemSid, Sid) )
{
if( (v24 = SeExports, !RtlEqualSid(SeExports->SeNetworkServiceSid, Sid))
&& !RtlEqualSid(v24->SeLocalServiceSid, Sid)
|| SepFilterPrivilegeAudits(1ui64, &PrivilegeSet) )
{
SepAdtPrivilegedServiceAuditAlarm(
&DmaAdapter,
(_UNICODE_STRING *)&SeSubsystemName,
0i64,
ClientToken,
PrimaryToken,
&PrivilegeSet,
AccessGranted);
PrimaryToken = (_TOKEN *)DmaAdapter.PrimaryToken;
ClientToken = (_TOKEN *)DmaAdapter.ClientToken;
}
}
}
if( SeTokenLeakTracking )
{
if( PrimaryToken )
{
_InterlockedDecrement(&PrimaryToken->DiagnosticInfo->CaptureCount);
if( DmaAdapter.PrimaryToken == (void *)SepTokenLeakToken )
__debugbreak();
ClientToken = (_TOKEN *)DmaAdapter.ClientToken;
}
if( ClientToken )
{
_InterlockedDecrement(&ClientToken->DiagnosticInfo->CaptureCount);
if( DmaAdapter.ClientToken == (void *)SepTokenLeakToken )
__debugbreak();
}
}
ObFastDereferenceObject(
(INT64 *)(*((_QWORD *)KeGetCurrentThread() + 23) + 1208i64),
(struct DMA_ADAPTER *)DmaAdapter.PrimaryToken);
DmaAdapter.PrimaryToken = 0i64;
if( DmaAdapter.ClientToken )
HalPutDmaAdapter((PADAPTER_OBJECT)DmaAdapter.ClientToken);
DmaAdapter.ClientToken = 0i64;
if( !AccessGranted )
return(unsigned int)-1073741790;
v8 = a1[1];
v7 = 0;
v6 = v36;
LABEL_29:
if( v8 == 6 )
{
return(unsigned int)PfpPfnPrioRequest((INT64)a1, PreviousMode, v6);
}
else
{
switch( v8 )
{
case 1:
PfGetCompletedTrace((VOID *)Address[0]);
return v21;
case 2:
if( LODWORD(Address[1]) != 28 )
goto LABEL_107;
v25 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v25 + 242);
ExAcquirePushLockSharedEx((UINT64)&qword_140C4FFF8, 0i64);
v38 = xmmword_140C4FE44;
v39 = qword_140C4FE54;
v40 = dword_140C4FE5C;
if( _InterlockedCompareExchange64((volatile signed __int64 *)&qword_140C4FFF8, 0i64, 17i64) != 17 )
ExfReleasePushLockShared((INT64 *)&qword_140C4FFF8);
KeAbPostRelease(&qword_140C4FFF8);
KeLeaveCriticalRegion();
if( PreviousMode )
{
v26 = (__int64)Address[0];
if( ((__int64)Address[0] & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( Address[0] >= (volatile void *)0x7FFFFFFF0000i64 )
v26 = 0x7FFFFFFF0000i64;
*(_BYTE *)v26 = *(_BYTE *)v26;
*(_BYTE *)(v26 + 27) = *(_BYTE *)(v26 + 27);
}
v27 = Address[0];
*(_OWORD *)Address[0] = v38;
v27[2] = v39;
*((_DWORD *)v27 + 6) = v40;
*(_DWORD *)v6 = 28;
v7 = 0;
break;
case 8:
return(unsigned int)PfpPrivSourceEnum((INT64)a1, PreviousMode, v6);
case 9:
if( LODWORD(Address[1]) != 4 )
goto LABEL_107;
if( PreviousMode )
{
v28 = (__int64)Address[0];
if( ((__int64)Address[0] & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( Address[0] >= (volatile void *)0x7FFFFFFF0000i64 )
v28 = 0x7FFFFFFF0000i64;
*(_BYTE *)v28 = *(_BYTE *)v28;
*(_BYTE *)(v28 + 3) = *(_BYTE *)(v28 + 3);
v7 = 0;
}
*(_DWORD *)Address[0] = dword_140CEBED0;
*(_DWORD *)v6 = 4;
break;
case 12:
return(unsigned int)PfpQueryScenarioInformation((__int64)a1, PreviousMode, v6);
case 16:
return(unsigned int)PfpMemoryListQuery((INT64)a1, PreviousMode, v6);
case 17:
return(unsigned int)PfpMemoryRangesQuery((INT64)a1, PreviousMode, v6);
case 20:
if( LODWORD(Address[1]) != 16 )
goto LABEL_107;
*(_QWORD *)&v35 = 0i64;
if( PreviousMode )
{
v23 = (__int64)Address[0];
if( ((__int64)Address[0] & 7) != 0 )
ExRaiseDatatypeMisalignment();
if( Address[0] >= (volatile void *)0x7FFFFFFF0000i64 )
v23 = 0x7FFFFFFF0000i64;
*(_BYTE *)v23 = *(_BYTE *)v23;
*(_BYTE *)(v23 + 15) = *(_BYTE *)(v23 + 15);
v7 = 0;
}
v35 = *(_OWORD *)Address[0];
if( (_DWORD)v35 == 1 )
{
*((_QWORD *)&v35 + 1) = qword_140C50170;
*(_OWORD *)Address[0] = v35;
*(_DWORD *)v6 = 16;
}
else
{
v7 = -1073741735;
}
break;
case 23:
return(unsigned int)PfpVirtualQuery((INT64)a1, PreviousMode, v6);
case 24:
if( LODWORD(Address[1]) == 16 )
{
MmLogQueryCombineStats(0i64, 0i64, &v42);
v31 = Address[0];
if( PreviousMode )
ProbeForWrite((VOID *)Address[0], 0x10ui64, 4ui64);
v37 = Address[0];
if( *(_DWORD *)Address[0] == 1 )
{
*((_DWORD *)Address[0] + 1) = DWORD1(v42);
v31[1] = *((_QWORD *)&v43 + 1);
}
else
{
v7 = -1073741811;
}
}
else
{
LABEL_107:
v7 = -1073741306;
}
break;
case 27:
return(unsigned int)PfpQueryFileExtentsRequest((INT64)a1, PreviousMode, v6);
case 28:
return(unsigned int)PfpQueryGpuUtilization((__int64)a1, PreviousMode, v6);
default:
v7 = -1073741821;
break;
}
}
return v7;
}Referenced by:
ExpQuerySystemInformation