PiQueryRemovableDeviceOverride
NTSTATUS __stdcall PiQueryRemovableDeviceOverride(
_DEVICE_NODE *DeviceNode,
WCHAR *HardwareIds,
WCHAR *CompatibleIds,
UINT8 *Removable){
int v4;
UINT8 *v5;
UINT8 *v6;
wchar_t *v8;
NTSTATUS DeviceRegProp;
char OverrideFlags;
const wchar_t *v12;
NTSTATUS DeviceOverrideEntry;
char v14;
_DEVICE_NODE *Parent;
int *v16;
int v17;
unsigned int v18;
unsigned int i;
VOID **PoolWithTag;
void *v21;
_DEVICE_NODE *v22;
unsigned __int8 v23;
NTSTATUS v25;
NTSTATUS v26;
VOID **v27;
WCHAR v28;
INT64 v29;
UINT64 *CmRegPropType;
UINT8 *PropertyBuffer;
UINT64 *PropertySize;
UINT64 v33;
UINT64 NumberOfBytes;
VOID *KeyHandle;
_UNICODE_STRING ValueName;
int v37;
__int128 v38;
VOID *Handle[2];
VOID *BaseKeyHandle;
int v41;
char ResultLength[12];
int v43[2];
UINT8 *v44;
_OBJECT_ATTRIBUTES ObjectAttributes;
char KeyValueInformation[4];
int v47;
int v48;
int v49;
BaseKeyHandle = 0i64;
v4 = 0;
memset(ResultLength, 0, sizeof(ResultLength));
v5 = 0i64;
v41 = 0;
v6 = Removable;
NumberOfBytes = 0i64;
v8 = HardwareIds;
v44 = Removable;
DeviceRegProp = -1073741772;
v37 = 0;
ValueName = 0i64;
if( qword_140C50A20 )
{
OverrideFlags = DeviceNode->OverrideFlags;
v12 = L"ChildLocationPaths";
DeviceOverrideEntry = -1073741772;
LOBYTE(HardwareIds) = OverrideFlags;
v38 = 0i64;
*(_OWORD *)Handle = 0i64;
if( (OverrideFlags & 1) == 0 )
{
LODWORD(v38) = 2490404;
v14 = OverrideFlags;
*((_QWORD *)&v38 + 1) = L"ChildLocationPaths";
if( v8 )
{
DeviceOverrideEntry = PipFindDeviceOverrideEntry(v8, HardwareIds);
LOBYTE(HardwareIds) = DeviceNode->OverrideFlags;
v14 = (char)HardwareIds;
}
OverrideFlags = v14;
if( DeviceOverrideEntry >= 0 )
goto LABEL_40;
if( CompatibleIds )
{
DeviceOverrideEntry = PipFindDeviceOverrideEntry(CompatibleIds, HardwareIds);
OverrideFlags = DeviceNode->OverrideFlags;
LOBYTE(HardwareIds) = OverrideFlags;
}
if( DeviceOverrideEntry >= 0 )
{
LABEL_40:
ZwClose((_HANDLE)Handle[0]);
DeviceNode->OverrideFlags |= 4u;
OverrideFlags = DeviceNode->OverrideFlags;
LOBYTE(HardwareIds) = OverrideFlags;
}
}
if( (OverrideFlags & 3) != 1 )
{
LODWORD(v38) = 1835034;
*((_QWORD *)&v38 + 1) = L"LocationPaths";
if( v8 )
{
v25 = PipFindDeviceOverrideEntry(v8, HardwareIds);
OverrideFlags = DeviceNode->OverrideFlags;
DeviceRegProp = v25;
LOBYTE(HardwareIds) = OverrideFlags;
}
if( DeviceRegProp >= 0 )
goto LABEL_41;
if( CompatibleIds )
{
v26 = PipFindDeviceOverrideEntry(CompatibleIds, HardwareIds);
OverrideFlags = DeviceNode->OverrideFlags;
DeviceRegProp = v26;
LOBYTE(HardwareIds) = OverrideFlags;
}
if( DeviceRegProp >= 0 )
LABEL_41:
OverrideFlags = (unsigned __int8)HardwareIds | 2;
}
DeviceNode->OverrideFlags = OverrideFlags | 1;
if( DeviceRegProp < 0 )
{
Parent = DeviceNode->Parent;
if( (Parent->OverrideFlags & 5) != 1 )
{
LODWORD(v38) = 2490404;
*((_QWORD *)&v38 + 1) = L"ChildLocationPaths";
DeviceRegProp = PnpDeviceObjectToDeviceInstance((__int64)Parent->PhysicalDeviceObject, &BaseKeyHandle, 131097);
if( DeviceRegProp < 0 )
return DeviceRegProp;
v43[0] = 2;
v16 = v43;
v17 = 256;
v43[1] = 3;
LODWORD(NumberOfBytes) = 256;
v18 = 256;
for( i = 0; i < 2; ++i )
{
DeviceRegProp = 0;
if( !v5 )
{
PoolWithTag = ExAllocatePoolWithTag(1ui64, v18, 1852403792i64);
v17 = NumberOfBytes;
v5 = (UINT8 *)PoolWithTag;
if( !PoolWithTag )
DeviceRegProp = -1073741670;
}
if( DeviceRegProp >= 0 )
{
LODWORD(v33) = 0;
DeviceRegProp = CmGetDeviceRegProp(
*(&stru_140CF2E80 + 607),
DeviceNode->Parent->InstancePath.Buffer,
BaseKeyHandle,
(unsigned int)*v16,
(UINT64 *)((char *)&NumberOfBytes + 4),
v5,
&NumberOfBytes,
v33);
if( DeviceRegProp == -1073741789 )
{
ExFreePoolWithTag(v5, 0);
v27 = ExAllocatePoolWithTag(1ui64, (unsigned int)NumberOfBytes, 1852403792i64);
v17 = NumberOfBytes;
v5 = (UINT8 *)v27;
if( !v27 )
DeviceRegProp = -1073741670;
}
else if( DeviceRegProp >= 0 )
{
if( HIDWORD(NumberOfBytes) == 7 )
DeviceRegProp = PipFindDeviceOverrideEntry((PWCHAR)v5, v21);
else
DeviceRegProp = -1073741823;
}
}
LODWORD(NumberOfBytes) = v17;
if( DeviceRegProp >= 0 )
break;
++v16;
v18 = v17;
}
if( v5 )
ExFreePoolWithTag(v5, 0);
ZwClose((_HANDLE)BaseKeyHandle);
v22 = DeviceNode->Parent;
v23 = v22->OverrideFlags;
if( (v23 & 1) == 0 )
{
if( DeviceRegProp >= 0 )
{
v22->OverrideFlags = v23 | 4;
v22 = DeviceNode->Parent;
}
v22->OverrideFlags |= 1u;
}
v6 = v44;
v4 = v37;
}
if( DeviceRegProp < 0 )
return DeviceRegProp;
}
KeyHandle = 0i64;
if( LODWORD(Handle[1]) != 1 )
goto LABEL_50;
*(&ObjectAttributes.Length + 1) = 0;
memset(&ObjectAttributes.Attributes + 1, 0, 20);
ObjectAttributes.RootDirectory = Handle[0];
*(_DWORD *)&ValueName.Length = 262146;
ObjectAttributes.ObjectName = &ValueName;
ValueName.Buffer = (wchar_t *)L"*";
ObjectAttributes.Length = 48;
ObjectAttributes.Attributes = 576;
DeviceRegProp = ZwOpenKey(
&KeyHandle,
0x20019ui64,
&ObjectAttributes,
(INT64)v12,
(INT64)CmRegPropType,
(INT64)PropertyBuffer,
(INT64)PropertySize,
v33);
if( DeviceRegProp < 0 )
{
LABEL_50:
DeviceRegProp = PnpGetDeviceLocationStrings((__int64)DeviceNode, (__int64 *)&ResultLength[4], &v41);
if( DeviceRegProp < 0
|| (DeviceRegProp = PnpOpenFirstMatchingSubKey(
*(WCHAR **)&ResultLength[4],
(INT64)Handle[0],
v28,
v29,
&KeyHandle),
ExFreePoolWithTag(*(PVOID *)&ResultLength[4], 0),
DeviceRegProp < 0) )
{
if( LODWORD(Handle[1]) > 1 )
{
*(&ObjectAttributes.Length + 1) = 0;
memset(&ObjectAttributes.Attributes + 1, 0, 20);
KeyHandle = 0i64;
ObjectAttributes.RootDirectory = Handle[0];
ObjectAttributes.ObjectName = &ValueName;
*(_DWORD *)&ValueName.Length = 262146;
ValueName.Buffer = (wchar_t *)L"*";
ObjectAttributes.Length = 48;
ObjectAttributes.Attributes = 576;
DeviceRegProp = ZwOpenKey(
&KeyHandle,
0x20019ui64,
&ObjectAttributes,
v29,
(INT64)CmRegPropType,
(INT64)PropertyBuffer,
(INT64)PropertySize,
v33);
}
}
}
ZwClose((_HANDLE)Handle[0]);
if( DeviceRegProp >= 0 )
{
*(_DWORD *)&ValueName.Length = 1310738;
ValueName.Buffer = L"Removable";
LODWORD(CmRegPropType) = 20;
DeviceRegProp = ZwQueryValueKey(
KeyHandle,
&ValueName,
KeyValuePartialInformation,
KeyValueInformation,
(UINT64)CmRegPropType,
(UINT64 *)ResultLength);
if( DeviceRegProp >= 0 )
{
if( v47 == 4 && v48 == 4 )
v4 = v49;
else
DeviceRegProp = -1073741823;
}
ZwClose((_HANDLE)KeyHandle);
*v6 = v4 != 0;
}
}
return DeviceRegProp;
}Referenced by:
PiProcessNewDeviceNode