PspInitializeSystemPartitionPhase0
NTSTATUS __stdcall PspInitializeSystemPartitionPhase0(
INT64 a1,
INT64 a2,
INT64 a3,
INT64 a4,
UINT64 Request,
UINT64 *Actual){
int Acl;
unsigned int v7;
VOID **PoolWithTag;
UINT64 v9;
_ACL *v10;
__int64 v12[2];
__int128 SecurityDescriptor[2];
__int64 v14;
_OBJECT_ATTRIBUTES ObjectAttributes;
*(&ObjectAttributes.Length + 1) = 0;
*(&ObjectAttributes.Attributes + 1) = 0;
v14 = 0i64;
v12[0] = 4194366i64;
v12[1] = (__int64)L"\\KernelObjects\\MemoryPartition0";
memset(SecurityDescriptor, 0, sizeof(SecurityDescriptor));
Acl = RtlCreateSecurityDescriptor(SecurityDescriptor, 1ui64);
if( Acl >= 0 )
{
v7 = 4 * *((unsigned __int8 *)SeAliasAdminsSid + 1) + 28;
PoolWithTag = ExAllocatePoolWithTag(1ui64, v7, 1818452292i64);
v10 = (_ACL *)PoolWithTag;
if( PoolWithTag )
{
Acl = RtlCreateAcl((PACL)PoolWithTag, (_ACL)v7, 2ui64, v9);
if( Acl >= 0 )
{
Acl = RtlAddAccessAllowedAce(v10, 2ui64, 2031619, SeAliasAdminsSid);
if( Acl >= 0 )
{
Acl = RtlSetDaclSecurityDescriptor(SecurityDescriptor, 1u, v10, 0);
if( Acl >= 0 )
{
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.SecurityQualityOfService = 0i64;
ObjectAttributes.ObjectName = (_UNICODE_STRING *)v12;
ObjectAttributes.Length = 48;
ObjectAttributes.SecurityDescriptor = SecurityDescriptor;
ObjectAttributes.Attributes = 512;
Acl = PspAllocatePartition(&ObjectAttributes, 0x1F0003ui64, 0, 0i64, 1, (INT64)&PspSystemPartition, 0i64);
}
}
}
ExFreePoolWithTag(v10, 0);
}
else
{
return -1073741670;
}
}
return Acl;
}Referenced by:
PspInitPhase0