NtQueryDirectoryObject
NTSTATUS __stdcall NtQueryDirectoryObject(
VOID *DirectoryHandle,
VOID *Buffer,
UINT64 Length,
UINT8 ReturnSingleEntry,
UINT8 RestartScan,
UINT64 *Context,
UINT64 *ReturnLength){
__int64 v7;
KPROCESSOR_MODE v9;
int v10;
UINT8 *PoolWithQuotaTag;
UINT8 *v12;
int v13;
unsigned int v14;
int v15;
NTSTATUS v16;
unsigned int v17;
_QWORD *v18;
_QWORD *v19;
unsigned int v20;
int v21;
int v22;
UINT8 *v23;
int v24;
UINT8 *v25;
UINT8 **v26;
UINT8 *v27;
UINT8 *v28;
struct _DMA_ADAPTER *v29;
unsigned int v30;
__int64 v31;
__int64 v32;
unsigned int v33;
unsigned __int16 v34;
__int64 v36;
__int64 v37;
int v38;
int v39;
int v40;
int v41;
__int64 v42;
unsigned int v43;
UINT8 *v44;
UINT8 *Src;
PVOID Object;
int v47;
struct _UNICODE_STRING DestinationString;
_OBP_LOOKUP_CONTEXT LookupContext;
unsigned int Size;
Size = Length;
v7 = (unsigned int)Length;
DestinationString = 0i64;
*(&LookupContext.LockStateSignature + 1) = 0;
memset(&LookupContext, 0, 32);
LookupContext.LockStateSignature = -60876;
v9 = *((_BYTE *)KeGetCurrentThread() + 562);
if( v9 )
{
ProbeForWrite(Buffer, (unsigned int)Length, 2ui64);
v36 = (__int64)Context;
if( (unsigned __int64)Context >= 0x7FFFFFFF0000i64 )
v36 = 0x7FFFFFFF0000i64;
*(_DWORD *)v36 = *(_DWORD *)v36;
if( ReturnLength )
{
v37 = (__int64)ReturnLength;
if( (unsigned __int64)ReturnLength >= 0x7FFFFFFF0000i64 )
v37 = 0x7FFFFFFF0000i64;
*(_DWORD *)v37 = *(_DWORD *)v37;
}
if( RestartScan )
{
v10 = 0;
v47 = 0;
}
else
{
v10 = *(_DWORD *)Context;
v47 = *(_DWORD *)Context;
}
}
else if( RestartScan )
{
v10 = 0;
}
else
{
v10 = *(_DWORD *)Context;
}
if( (unsigned int)v7 > (int)v7 + 32 )
return -1073741811;
PoolWithQuotaTag = (UINT8 *)ExAllocatePoolWithQuotaTag((POOL_TYPE)9, v7 + 32, 0x6D4E624Fui64);
v12 = PoolWithQuotaTag;
Src = PoolWithQuotaTag;
if( !PoolWithQuotaTag )
return -1073741670;
memset((INT64)PoolWithQuotaTag, 0i64);
Object = 0i64;
v13 = ObReferenceObjectByHandle(DirectoryHandle, 1u, ObpDirectoryObjectType, v9, &Object, 0i64);
if( v13 < 0 )
{
ExFreePoolWithTag(v12, 0);
return v13;
}
else
{
v44 = v12;
v14 = 32;
v15 = 0;
v39 = 0;
v16 = -2147483622;
v41 = -2147483622;
ObpLockDirectoryShared(&LookupContext, (_OBJECT_DIRECTORY *)Object);
v17 = 0;
v43 = 0;
v18 = Object;
do
{
v19 = (_QWORD *)*v18;
if( *v18 )
{
while( 1 )
{
v20 = v14;
v21 = v15;
v22 = v15++;
if( v10 == v22 )
{
v31 = v19[1] - 48i64;
v42 = v31;
if( (*(_BYTE *)(v31 + 26) & 2) == 0
|| (v32 = *((unsigned __int8 *)ObpInfoMaskToOffset + (*(_BYTE *)(v31 + 26) & 3)), v31 == v32) )
{
RtlInitUnicodeString(&DestinationString, 0i64, v31);
v31 = v42;
}
else
{
DestinationString = *(struct _UNICODE_STRING *)(v31 - v32 + 8);
}
v33 = (unsigned __int8)ObHeaderCookie;
v34 = DestinationString.Length;
v14 += DestinationString.Length
+ 36
+ *(unsigned __int16 *)(ObTypeIndexTable[*(unsigned __int8 *)(v31 + 24) ^ BYTE1(v31) ^ (unsigned __int64)(unsigned __int8)ObHeaderCookie]
+ 16);
if( v14 > Size )
{
v15 = v21;
v38 = -1073741789;
if( !ReturnSingleEntry )
v38 = 261;
v41 = v38;
if( !ReturnSingleEntry )
v14 = v20;
v16 = v38;
goto LABEL_13;
}
*(_WORD *)v44 = DestinationString.Length;
*((_WORD *)v44 + 1) = v34 + 2;
*((_QWORD *)v44 + 1) = DestinationString.Buffer;
*((_WORD *)v44 + 8) = *(_WORD *)(ObTypeIndexTable[*(unsigned __int8 *)(v31 + 24) ^ BYTE1(v31) ^ (unsigned __int64)v33]
+ 16);
*((_WORD *)v44 + 9) = *(_WORD *)(ObTypeIndexTable[*(unsigned __int8 *)(v31 + 24) ^ BYTE1(v31) ^ (unsigned __int64)v33]
+ 16)
+ 2;
*((_QWORD *)v44 + 3) = *(_QWORD *)(ObTypeIndexTable[*(unsigned __int8 *)(v31 + 24) ^ BYTE1(v31) ^ (unsigned __int64)v33]
+ 24);
v16 = 0;
v41 = 0;
v23 = v44 + 32;
v44 += 32;
v24 = ++v39;
if( ReturnSingleEntry )
goto LABEL_14;
++v10;
}
v19 = (_QWORD *)*v19;
if( !v19 )
{
v17 = v43;
v16 = v41;
break;
}
}
}
v43 = ++v17;
++v18;
}
while( v17 < 0x25 );
LABEL_13:
v23 = v44;
v24 = v39;
LABEL_14:
if( v16 >= 0 )
{
*(_OWORD *)v23 = 0i64;
*((_OWORD *)v23 + 1) = 0i64;
v25 = v23 + 32;
if( v24 )
{
v26 = (UINT8 **)(Src + 24);
do
{
v40 = v24 - 1;
memmove(v25, *(v26 - 2), *((unsigned __int16 *)v26 - 12));
*(v26 - 2) = (UINT8 *)Buffer + v25 - Src;
v27 = &v25[*((unsigned __int16 *)v26 - 12)];
*(_WORD *)v27 = 0;
v27 += 2;
memmove(v27, *v26, *((unsigned __int16 *)v26 - 4));
*v26 = (UINT8 *)Buffer + v27 - Src;
v28 = &v27[*((unsigned __int16 *)v26 - 4)];
*(_WORD *)v28 = 0;
v25 = v28 + 2;
v26 += 4;
v24 = v40;
}
while( v40 );
v16 = v41;
}
}
v29 = (struct _DMA_ADAPTER *)Object;
ObpUnlockDirectory((INT64)Object, (INT64)&LookupContext);
v30 = Size;
if( v14 <= Size )
v30 = v14;
memmove((UINT8 *)Buffer, Src, v30);
if( ReturnLength )
*(_DWORD *)ReturnLength = v14;
if( v16 >= 0 )
*(_DWORD *)Context = v15;
HalPutDmaAdapter(v29);
ExFreePoolWithTag(Src, 0);
return v16;
}
}Referenced by:
No references.