IopInitializePlugPlayServices
VOID __fastcall IopInitializePlugPlayServices(_LOADER_PARAMETER_BLOCK *LoaderBlock, INT64 a2){
_KEY_VALUE_FULL_INFORMATION *v3;
unsigned int *v4;
INT64 v5;
INT64 v6;
INT64 v7;
INT64 v8;
int v9;
INT64 v10;
INT64 v11;
INT64 v12;
VOID *v13;
_DEVICE_OBJECT *v14;
_DEVICE_OBJECT *v15;
int DeviceNode;
_UNICODE_STRING *v17;
INT64 v18;
INT64 v19;
INT64 v20;
INT64 v21;
_LOADER_PERFORMANCE_DATA *p_LoaderPerformanceData;
_LOADER_PARAMETER_EXTENSION *Extension;
_UNICODE_STRING *Class;
_UNICODE_STRING *Classa;
_UNICODE_STRING *Classc;
_UNICODE_STRING *Classb;
UINT64 CreateOptions;
UINT8 *CreateOptionsa;
UINT64 *Disposition;
UINT64 *Dispositiona;
UINT64 *Dispositionb;
INT64 Flags;
UINT64 Flagsa;
UINT64 Flagsb;
UINT8 SystemFirmwareUpdated[8];
PVOID Handle;
PVOID P;
_UNICODE_STRING KeyName;
VOID *KeyHandle;
_KEY_VALUE_FULL_INFORMATION *Information;
INT64 LaunchVsmTime;
PVOID LoadVsmTime;
PVOID TcbLoaderStartTime;
PVOID PreloadEndTime;
INT64 DeviceKey;
PDEVICE_OBJECT DeviceObject;
UINT64 v48;
_UNICODE_STRING v49;
_UNICODE_STRING GuidString;
_UNICODE_STRING v51;
_UNICODE_STRING DestinationString;
_OBJECT_ATTRIBUTES ObjectAttributes;
_EVENT_DATA_DESCRIPTOR UserData;
_EVENT_DATA_DESCRIPTOR v55;
PDEVICE_OBJECT *p_DeviceObject;
__int64 v57;
INT64 *p_DeviceKey;
__int64 v59;
PVOID *p_PreloadEndTime;
__int64 v61;
PVOID *p_TcbLoaderStartTime;
__int64 v63;
PVOID *p_LoadVsmTime;
__int64 v65;
INT64 *p_LaunchVsmTime;
__int64 v67;
_KEY_VALUE_FULL_INFORMATION **p_Information;
__int64 v69;
PVOID *p_P;
__int64 v71;
_UNICODE_STRING *v72;
__int64 v73;
DeviceKey = 0i64;
Handle = 0i64;
LaunchVsmTime = 0i64;
*(_DWORD *)(&KeyName.MaximumLength + 1) = 0;
DeviceObject = 0i64;
LODWORD(v48) = 0;
*(&ObjectAttributes.Length + 1) = 0;
*(&ObjectAttributes.Attributes + 1) = 0;
Information = 0i64;
P = 0i64;
LoadVsmTime = 0i64;
TcbLoaderStartTime = 0i64;
PreloadEndTime = 0i64;
KeyHandle = 0i64;
*(_DWORD *)(&v49.MaximumLength + 1) = 0;
*(_DWORD *)(&GuidString.MaximumLength + 1) = 0;
SystemFirmwareUpdated[0] = 0;
DestinationString = 0i64;
v51 = 0i64;
if( (_DWORD)a2 )
{
if( (_DWORD)a2 == 1 && (int)PnpDiagInitialize((__int64)LoaderBlock, a2) >= 0 )
{
PnpTraceInitialize();
if( PiDcInit(1ui64) >= 0 && PiUEventInit(1ui64) >= 0 )
{
p_LoaderPerformanceData = &LoaderBlock->Extension->LoaderPerformanceData;
*(_QWORD *)&UserData.Size = 80i64;
UserData.Ptr = (unsigned __int64)p_LoaderPerformanceData;
PnpDiagnosticTrace(&stru_140010168 + 1, 1u, &UserData);
if( *(&stru_140C00F40 + 1980) > 4u && tlgKeywordOn((__int64)&stru_140C00F40 + 7920, 0x400000000000i64) )
{
Extension = LoaderBlock->Extension;
DeviceObject = (PDEVICE_OBJECT)Extension->LoaderPerformanceData.StartTime;
p_DeviceObject = &DeviceObject;
v57 = 8i64;
DeviceKey = Extension->LoaderPerformanceData.EndTime;
p_DeviceKey = &DeviceKey;
v59 = 8i64;
PreloadEndTime = (PVOID)Extension->LoaderPerformanceData.PreloadEndTime;
p_PreloadEndTime = &PreloadEndTime;
v61 = 8i64;
TcbLoaderStartTime = (PVOID)Extension->LoaderPerformanceData.TcbLoaderStartTime;
p_TcbLoaderStartTime = &TcbLoaderStartTime;
v63 = 8i64;
LoadVsmTime = (PVOID)Extension->LoaderPerformanceData.LoadVsmTime;
p_LoadVsmTime = &LoadVsmTime;
v65 = 8i64;
LaunchVsmTime = Extension->LoaderPerformanceData.LaunchVsmTime;
p_LaunchVsmTime = &LaunchVsmTime;
v67 = 8i64;
Information = (_KEY_VALUE_FULL_INFORMATION *)Extension->LoaderPerformanceData.LoadHypervisorTime;
p_Information = &Information;
v69 = 8i64;
P = (PVOID)Extension->LoaderPerformanceData.LaunchHypervisorTime;
p_P = &P;
v71 = 8i64;
*(_QWORD *)&v49.Length = Extension->ProcessorCounterFrequency;
v72 = &v49;
v73 = 8i64;
tlgWriteTransfer_EtwWriteTransfer(
(__int64)&stru_140C00F40 + 7920,
(unsigned __int8 *)byte_14002408B,
0i64,
0i64,
0xBu,
&v55);
}
TraceLoggingUnregister_EtwUnregister((__int64)&stru_140C00F40 + 7920);
if( PiPnpRtlInit(1ui64) >= 0
&& PiCslInitialize() >= 0
&& PiDmaGuardInitialize(1) >= 0
&& PiKsrInitialize() >= 0 )
{
PnpRequestDeviceAction(*(PVOID *)(*(&PnpReplaceEvent + 831) + 32i64), 10, 0, 0i64, 0i64, 0i64, 0i64);
KeInitializeEvent((INT64)&PnpReplaceEvent + 6656, 0, 0);
if( (LoaderBlock->Extension->_bf_84 & 0x400) == 0 )
PpInitializeBootDDB(LoaderBlock, 1ui64);
}
}
}
}
else
{
*(&PnpReplaceEvent + 6004) = 0;
dword_140C50A50 = 80;
dword_140C50A54 = 90;
CmRegisterSystemHiveLimitCallback((__int64)LoaderBlock, a2, (__int64)&dword_140C50A50);
byte_140C50A48 = 0;
ObjectAttributes.ObjectName = &CmRegistryMachineHardwareDescriptionSystemName;
ObjectAttributes.Length = 48;
LODWORD(CreateOptions) = 0;
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.Attributes = 576;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
if( ZwCreateKey(&KeyHandle, 0xF003Fui64, &ObjectAttributes, 0i64, 0i64, CreateOptions, &v48) >= 0 )
{
if( IopGetRegistryValue(KeyHandle, (PWCHAR)L"OldSystemBiosDate", 0i64, &Information) >= 0 )
{
v3 = Information;
if( Information )
{
if( IopGetRegistryValue(KeyHandle, (PWCHAR)L"SystemBiosDate", 0i64, (_KEY_VALUE_FULL_INFORMATION **)&P) >= 0 )
{
v4 = (unsigned int *)P;
if( P )
{
RtlInitUnicodeString(&DestinationString, (PCWSTR)((char *)v3 + v3->DataOffset));
RtlInitUnicodeString(&v51, (PCWSTR)((char *)v4 + v4[2]));
PnpLogEvent((const VOID **)&DestinationString, (const VOID **)&v51, 1073741868, 0i64, 0);
ExFreePoolWithTag(v4, 0);
}
}
ExFreePoolWithTag(v3, 0);
}
}
ZwClose((_HANDLE)KeyHandle);
}
if( (int)PnpDeviceCompletionQueueInitialize() >= 0 )
{
PiInitFirmwareResources(LoaderBlock);
if( (LoaderBlock->Extension->_bf_84 & 0x400) == 0 )
PpInitializeBootDDB(LoaderBlock, 0i64);
PipInitDeviceOverrideCache();
KeInitializeEvent((INT64)&stru_140C452E0 + 576, 0, 0);
if( PiInitCacheGroupInformation() >= 0 )
{
KeInitializeSemaphore((PRKSEMAPHORE)&PnpReplaceEvent + 188, 1, 1);
if( (int)PnpInitializeLegacyBusInformationTable() >= 0 )
{
IopInitializeResourceMap(LoaderBlock);
*(&PnpReplaceEvent + 683) = IopReportBootResources;
IopInitReservedResourceList = 0i64;
PnpDefaultInterfaceType = 1;
ArbInitializeOsInaccessibleRange(*(&stru_140C4DB30 + 60));
if( IopPortInitialize(v6, v5) >= 0 )
{
IopMemInitialize();
if( v9 >= 0
&& IopDmaInitialize(v8, v7) >= 0
&& IopIrqInitialize(v11, v10) >= 0
&& IopBusNumberInitialize() >= 0
&& PiPnpRtlInit(0i64) >= 0 )
{
PipMigratePnpState();
if( PiDmInit() >= 0
&& PnpCtxGetCachedContextBaseKey(
*(&stru_140CF2E80 + 607),
PNPCTX_BASE_KEY_TYPE_CONTROLSET,
(VOID **)&LaunchVsmTime) >= 0 )
{
KeyName.Buffer = L"Control\\Pnp";
*(_DWORD *)&KeyName.Length = 1572886;
LODWORD(Class) = 0;
if( IopCreateRegistryKeyEx(&Handle, (PVOID)LaunchVsmTime, &KeyName, 0xF003Fui64, (UINT64)Class, 0i64) >= 0 )
{
if( IopGetRegistryValue(
Handle,
(PWCHAR)L"AsynchronousOptions",
0i64,
(_KEY_VALUE_FULL_INFORMATION **)&LoadVsmTime) >= 0 )
{
if( *((_DWORD *)LoadVsmTime + 1) == 4 && *((_DWORD *)LoadVsmTime + 3) == 4 )
PnpAsyncOptions = *(_DWORD *)((char *)LoadVsmTime + *((unsigned int *)LoadVsmTime + 2));
ExFreePoolWithTag(LoadVsmTime, 0);
}
if( IopGetRegistryValue(
Handle,
(PWCHAR)L"BootOptions",
0i64,
(_KEY_VALUE_FULL_INFORMATION **)&TcbLoaderStartTime) >= 0 )
{
if( *((_DWORD *)TcbLoaderStartTime + 1) == 4 && *((_DWORD *)TcbLoaderStartTime + 3) == 4 )
PnpBootOptions = *(_DWORD *)((char *)TcbLoaderStartTime + *((unsigned int *)TcbLoaderStartTime + 2));
ExFreePoolWithTag(TcbLoaderStartTime, 0);
}
if( IopGetRegistryValue(
Handle,
(PWCHAR)L"FindBestConfigurationTimeout",
0i64,
(_KEY_VALUE_FULL_INFORMATION **)&PreloadEndTime) >= 0 )
{
if( *((_DWORD *)PreloadEndTime + 1) == 4 && *((_DWORD *)PreloadEndTime + 3) == 4 )
PnpFindBestConfigurationTimeout = *(_DWORD *)((char *)PreloadEndTime
+ *((unsigned int *)PreloadEndTime + 2));
ExFreePoolWithTag(PreloadEndTime, 0);
}
PiDmaGuardProcessRegistry(Handle);
IopQueryDeviceResetRegistrySettings(Handle);
ZwClose((_HANDLE)Handle);
}
*(_DWORD *)&KeyName.Length = 4063292;
KeyName.Buffer = L"\\Registry\\Machine\\System\\Setup";
if( IopOpenRegistryKeyEx(&Handle, 0i64, &KeyName, 0x20019ui64) >= 0 )
{
PipUpdateSetupInProgress((_HANDLE)Handle);
if( IopGetRegistryValue(Handle, (PWCHAR)L"Upgrade", 0i64, (_KEY_VALUE_FULL_INFORMATION **)&P) >= 0 )
{
if( *((_DWORD *)P + 1) == 4
&& *((_DWORD *)P + 3) == 4
&& *(_DWORD *)((char *)P + *((unsigned int *)P + 2)) )
{
BYTE4(qword_140C50A2C) = 1;
}
ExFreePoolWithTag(P, 0);
}
if( IopGetRegistryValue(Handle, (PWCHAR)L"RollbackActive", 0i64, (_KEY_VALUE_FULL_INFORMATION **)&P) >= 0 )
{
if( *((_DWORD *)P + 1) == 4
&& *((_DWORD *)P + 3) == 4
&& *(_DWORD *)((char *)P + *((unsigned int *)P + 2)) )
{
BYTE5(qword_140C50A2C) = 1;
}
ExFreePoolWithTag(P, 0);
}
if( HIWORD(qword_140C50A2C) )
{
*(&stru_140C452E0 + 66) = PipUpdateSetupInProgressCallback;
*(&stru_140C452E0 + 67) = Handle;
*(&stru_140C452E0 + 64) = 0i64;
PipUpdateSetupInProgressNotify((_HANDLE)Handle);
}
else
{
ZwClose((_HANDLE)Handle);
}
Handle = 0i64;
}
if( PipHardwareConfigInit(&LoaderBlock->Extension->HardwareConfigurationId) >= 0 )
{
PipCheckSystemFirmwareUpdated(SystemFirmwareUpdated);
if( PiDcInit(0i64) >= 0 && PiAuCreateSecurityObjects() >= 0 && PiDqInit() >= 0 && PpDevCfgInit() >= 0 )
{
PipResetDevices(v12);
LODWORD(CreateOptionsa) = 0;
if( CmCreateDevice(
*(&stru_140CF2E80 + 607),
(WCHAR *)L"HTREE\\ROOT\\0",
(WCHAR *)0xF003F,
(INT64)&DeviceKey,
0i64,
CreateOptionsa,
(INT64)Disposition,
Flags,
*(INT64 *)SystemFirmwareUpdated) >= 0 )
{
v13 = (VOID *)DeviceKey;
LODWORD(Flagsa) = 0;
LODWORD(Dispositiona) = 78;
LODWORD(Classa) = 1;
CmSetDeviceRegProp(
*(&stru_140CF2E80 + 607),
(WCHAR *)L"HTREE\\ROOT\\0",
(VOID *)DeviceKey,
CM_REG_PROP_BASE_CONTAINERID,
(UINT64)Classa,
(UINT8 *)L"{00000000-0000-0000-FFFF-FFFFFFFFFFFF}",
(UINT64)Dispositiona,
Flagsa);
LODWORD(Flagsb) = 0;
LODWORD(Dispositionb) = 4;
LODWORD(Classc) = 4;
HIDWORD(v48) = 0;
CmSetDeviceRegProp(
*(&stru_140CF2E80 + 607),
(WCHAR *)L"HTREE\\ROOT\\0",
v13,
CM_REG_PROP_CONFIGFLAGS,
(UINT64)Classc,
(UINT8 *)&v48 + 4,
(UINT64)Dispositionb,
Flagsb);
ZwClose((_HANDLE)v13);
*(&PnpReplaceEvent + 787) = (char *)&PnpReplaceEvent + 6288;
*(&PnpReplaceEvent + 786) = (char *)&PnpReplaceEvent + 6288;
*(&PnpReplaceEvent + 789) = (char *)&PnpReplaceEvent + 6304;
*(&PnpReplaceEvent + 788) = (char *)&PnpReplaceEvent + 6304;
ExInitializeResourceLite((INT64)&PnpReplaceEvent + 6048);
ExInitializeResourceLite((INT64)&PnpReplaceEvent + 6176);
ExInitializeResourceLite((INT64)&PnpReplaceEvent + 7968);
ExInitializeResourceLite((INT64)&PnpReplaceEvent + 6400);
*(&PnpReplaceEvent + 50) = 0i64;
KeInitializeGuardedMutex((PKGUARDED_MUTEX)((char *)&PnpReplaceEvent + 6336));
*(&PnpReplaceEvent + 1632) = 1;
*(&PnpReplaceEvent + 821) = (char *)&PnpReplaceEvent + 6560;
*(&PnpReplaceEvent + 820) = (char *)&PnpReplaceEvent + 6560;
*(&PnpReplaceEvent + 817) = 0i64;
*(&PnpReplaceEvent + 1636) = 0;
*(&PnpReplaceEvent + 3276) = 1;
*(&PnpReplaceEvent + 6554) = 6;
*(&PnpReplaceEvent + 1639) = 0;
if( PiDeviceDependencyInit() >= 0 && (int)PnpInitializeDeviceActions() >= 0 )
{
PpProfileInit();
*(&PnpReplaceEvent + 824) = 0i64;
KeInitializeEvent((INT64)&PnpReplaceEvent + 6624, 1, 1u);
*(_DWORD *)&KeyName.Length = 2490404;
KeyName.Buffer = L"\\Driver\\PnpManager";
if( IoCreateDriver((OWORD *)&KeyName.Length, (UINT64)PipPnPDriverEntry) >= 0 )
{
LODWORD(Classb) = 0;
if( IoCreateDevice(
*(&PnpReplaceEvent + 823),
0i64,
0i64,
4ui64,
(UINT64)Classb,
0,
&DeviceObject) >= 0 )
{
v14 = DeviceObject;
v15 = DeviceObject;
DeviceObject->Flags |= 0x1000u;
DeviceNode = PipAllocateDeviceNode(v15, (PDEVICE_NODE *)&PnpReplaceEvent + 1662);
if( *(&PnpReplaceEvent + 831) )
{
PipSetDevNodeFlags(*(&PnpReplaceEvent + 831), 0x131ui64);
PipSetDevNodeUserFlags(*(&PnpReplaceEvent + 831), 0xAui64);
*(_DWORD *)(*(&PnpReplaceEvent + 831) + 660i64) = -2;
if( (int)PnpAllocateDeviceInstancePath(*(&PnpReplaceEvent + 831), 0x1Au) < 0 )
return;
*(_DWORD *)&v49.Length = 1703960;
v49.Buffer = (wchar_t *)L"HTREE\\ROOT\\0";
PnpCopyDeviceInstancePath(*(&PnpReplaceEvent + 831), &v49, v17);
DeviceNode = PnpMapDeviceObjectToDeviceInstance(
*(_QWORD *)(*(&PnpReplaceEvent + 831) + 32i64),
*(&PnpReplaceEvent + 831) + 40i64);
if( DeviceNode < 0 )
return;
*(_DWORD *)&GuidString.Length = 5111884;
GuidString.Buffer = (wchar_t *)L"{00000000-0000-0000-FFFF-FFFFFFFFFFFF}";
RtlGUIDFromString(&GuidString, (_GUID *)(*(&PnpReplaceEvent + 831) + 664i64));
PnpQueryAndSaveDeviceNodeCapabilities(*(&PnpReplaceEvent + 831));
PipSetDevNodeState(*(&PnpReplaceEvent + 831), DeviceNodeStarted);
}
else
{
IoDeleteDevice(v14);
IoDeleteDriver(*(&PnpReplaceEvent + 823));
}
if( DeviceNode >= 0
&& CmAddDeviceToContainer(
*(&stru_140CF2E80 + 607),
(WCHAR *)L"{00000000-0000-0000-FFFF-FFFFFFFFFFFF}",
(WCHAR *)L"{00000000-0000-0000-FFFF-FFFFFFFFFFFF}",
(WCHAR *)L"HTREE\\ROOT\\0",
0i64) >= 0 )
{
if( SystemFirmwareUpdated[0] )
PiDcHandleSystemFirmwareUpdate();
PnpInitializePnpWatchdogs();
if( (int)PnpInitializeDeviceEvents() >= 0 )
{
PnpInitializeNotification();
if( (int)PnpBusTypeGuidInitialize() >= 0 )
{
KeInitializeEvent((INT64)&PnpReplaceEvent, 1, 1u);
if( PiSwInit() >= 0
&& PiUEventInit(0i64) >= 0
&& PiDaInit(v19, v18, v20, v21) >= 0
&& PiDmaGuardInitialize(0) >= 0 )
{
PipProcessPendingOperations();
PnpRequestDeviceAction(
*(PVOID *)(*(&PnpReplaceEvent + 831) + 32i64),
10,
0,
0i64,
0i64,
0i64,
0i64);
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}Referenced by:
IoInitSystemPreDrivers