MiValidateSectionCreate
NTSTATUS __stdcall MiValidateSectionCreate(
PVOID File,
_CONTROL_AREA *ControlArea,
UINT64 SessionId,
VOID *ProcessToken,
UINT64 SeSecureType,
UINT8 SeRequestedSigningLevel){
unsigned int v7;
_ETHREAD *CurrentThread;
int v9;
void *v10;
_EPROCESS *v11;
_MI_IMAGE_SECURITY_REFERENCE *SeImageStub;
signed __int64 PageHashes;
int v14;
_MI_SYSTEM_SPACE_IMAGE v15;
UINT64 v16;
_QWORD *DynamicRelocations;
unsigned int v18;
_EPROCESS *Pool;
_EPROCESS *v20;
_EPROCESS *v21;
unsigned int v22;
unsigned int v23;
NTSTATUS v24;
int v25;
int v26;
unsigned int v27;
__int64 v28;
NTSTATUS result;
signed __int64 v30;
bool v31;
signed __int64 v32;
INT64 v33;
INT64 v34;
unsigned int v35;
unsigned __int64 v36;
signed __int64 v37;
int v38;
NTSTATUS v39;
VOID *ProcessTokena;
UINT64 SecureType;
UINT8 *SeValidatedSigningLevel;
_SE_IMAGE_SIGNATURE_TYPE SeSignatureType[2];
UINT64 v44;
int v45;
int v46;
int SizeOfHeaders;
unsigned int SizeOfHeaders_4;
_MI_SYSTEM_SPACE_IMAGE BugCheckParameter4;
int BugCheckParameter4_4;
unsigned int PreviousSystemPagePriority;
int PreviousSystemPagePriority_4;
int v53;
int v54;
_MI_SYSTEM_SPACE_IMAGE v55;
unsigned int v56;
UINT64 SessionIda;
_EPROCESS *CallingProcess;
_MI_IMAGE_SECURITY_REFERENCE *v59;
int v60;
_MI_SYSTEM_SPACE_IMAGE v61;
int v62;
VOID *PageBase;
_FILE_OBJECT *Filea;
_ETHREAD *Thread;
UINT8 v66[8];
PVOID *SePool;
_EPROCESS *v68;
PVOID *v69;
__int64 v70;
_MI_IMAGE_SECURITY_REFERENCE *v71;
PVOID v72;
_CONTROL_AREA *v73;
VOID *v74;
_MI_SYSTEM_SPACE_IMAGE SystemImageInfo[20];
*(_QWORD *)v66 = ProcessToken;
SessionIda = (unsigned int)SessionId;
Filea = (_FILE_OBJECT *)File;
v72 = File;
v73 = ControlArea;
v60 = SessionId;
v74 = ProcessToken;
*(_QWORD *)SeSignatureType = 0i64;
memset(SystemImageInfo, 0i64, sizeof(SystemImageInfo));
v45 = 0;
v53 = 1;
v7 = 6;
v44 = 0x600000000i64;
PreviousSystemPagePriority = 0;
CurrentThread = 0i64;
Thread = 0i64;
if( (ControlArea->u.LongFlags & 0x800) != 0 )
{
if( (SeSecureType & 0x40000000) != 0 )
{
dword_140C4C958 = 115;
return -1073740749;
}
LODWORD(SeSecureType) = SeSecureType | 0x10000000;
}
if( (SeSecureType & 0x40000000) != 0 && !*(_QWORD *)&ControlArea[1].gap8[8] )
{
dword_140C4C958 = 116;
return -1073741701;
}
if( (SeSecureType & 5) != 0 )
{
v7 = 7;
v44 = 0x700000002i64;
}
BugCheckParameter4_4 = 0;
SePool = (PVOID *)KeGetCurrentThread()->ApcState.Process;
v69 = SePool;
while( 1 )
{
v9 = v7 & 1;
PreviousSystemPagePriority_4 = v9;
v54 = v9;
if( (v7 & 1) != 0 )
{
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
Thread = CurrentThread;
v35 = PsSetSystemPagePriorityThread(CurrentThread, 1ui64);
PreviousSystemPagePriority = v35;
if( (ControlArea->u.LongFlags & 0x4000000) != 0 )
{
MiCreatePerSessionProtos(ControlArea, 0xFFFFFFFFui64, v33, v34, (CHAR)ProcessTokena, SecureType);
v39 = v38;
if( v38 < 0 )
{
PsRevertToUserPagePriorityThread(CurrentThread, v35);
return v39;
}
BugCheckParameter4_4 = 1;
v7 = HIDWORD(v44);
}
if( v53 )
{
LODWORD(SecureType) = -1;
LODWORD(ProcessTokena) = 0;
MiPrefetchControlArea(ControlArea, RtlpInterceptorRoutines, 0i64, 1ui64, (UINT64)ProcessTokena, SecureType);
}
}
LODWORD(v10) = MiMapImageInSystemSpace(ControlArea, v7, SystemImageInfo);
if( (int)v10 < 0 )
{
if( BugCheckParameter4_4 == 1 )
MiDereferencePerSessionProtos(ControlArea, 0xFFFFFFFFui64);
if( v9 )
PsRevertToUserPagePriorityThread(CurrentThread, PreviousSystemPagePriority);
return(int)v10;
}
v11 = *(_EPROCESS **)SystemImageInfo;
CallingProcess = *(_EPROCESS **)SystemImageInfo;
SeImageStub = ControlArea->u2.SeImageStub;
v59 = SeImageStub;
v71 = SeImageStub;
PageHashes = (signed __int64)SeImageStub->SecurityContext.PageHashes;
v70 = PageHashes;
*(_QWORD *)SeSignatureType = PageHashes;
if( PageHashes )
{
if( (PageHashes & 0xFFFFFFFFFFFFFFF8ui64) == 8 )
{
v14 = 1;
v46 = 1;
*(_QWORD *)SeSignatureType = PageHashes & 3;
goto LABEL_11;
}
v36 = PageHashes;
if( (PageHashes & 3) != 0 )
{
v36 = PageHashes & 0xFFFFFFFFFFFFFFFCui64;
v14 = ((PageHashes & 3) != 1) + 2;
}
else
{
v14 = 4;
}
*(_QWORD *)SeSignatureType = v36 & 0xFFFFFFFFFFFFFFFBui64;
}
else
{
v14 = 0;
}
v46 = v14;
LABEL_11:
SizeOfHeaders = SystemImageInfo[4];
v15 = SystemImageInfo[4] << 12;
BugCheckParameter4 = SystemImageInfo[4] << 12;
v61 = SystemImageInfo[4] << 12;
v16 = (unsigned int)(SystemImageInfo[4] << 12);
SizeOfHeaders_4 = SystemImageInfo[4] << 12;
DynamicRelocations = SeImageStub->DynamicRelocations;
if( !DynamicRelocations || DynamicRelocations[5] == DynamicRelocations[6] )
{
v20 = *(_EPROCESS **)SystemImageInfo;
if( (_DWORD)v44 == 1 )
LODWORD(v44) = 2;
}
else
{
if( (_DWORD)v44 == 2 )
{
v55 = SystemImageInfo[4];
}
else
{
v18 = ControlArea->Segment->u2.ImageInformation->InternalImageInformation.SizeOfHeaders;
SizeOfHeaders = (v18 >> 12) + ((v18 & 0xFFF) != 0);
v55 = SizeOfHeaders;
LODWORD(v16) = SizeOfHeaders << 12;
SizeOfHeaders_4 = SizeOfHeaders << 12;
}
Pool = (_EPROCESS *)MiAllocatePool(256i64, (unsigned int)v16, 0x68496D4Dui64);
v20 = Pool;
v68 = Pool;
if( Pool )
{
LODWORD(v10) = 0;
v62 = 0;
v21 = Pool;
PageBase = Pool;
v22 = 0;
v23 = SizeOfHeaders;
while( 1 )
{
v56 = v22;
if( v22 >= v23 )
break;
KeCopyPage(v21);
v23 = SizeOfHeaders;
v22 = v56 + 1;
v21 = (_EPROCESS *)((char *)PageBase + 4096);
PageBase = (char *)PageBase + 4096;
}
MiRevertRelocations((INT64)v20, ControlArea, v23);
}
else
{
LODWORD(v10) = -1073741670;
}
v16 = SizeOfHeaders_4;
v11 = CallingProcess;
v15 = BugCheckParameter4;
}
v54 = v44;
if( (int)v10 >= 0 )
{
LODWORD(SeValidatedSigningLevel) = SeSecureType;
LODWORD(ProcessTokena) = v15;
v24 = SeValidateImageHeader(
Filea,
v20,
v16,
v11,
ProcessTokena,
(UINT64)&v44,
SePool,
v66[0],
SeValidatedSigningLevel,
SeSignatureType);
v10 = (void *)v24;
if( v24 == 301 )
{
MiImageCantMove(ControlArea);
v45 = 1;
LABEL_96:
if( (ControlArea->u.LongFlags & 0x40000000) != 0 )
KeBugCheckEx(0x1Au, (PVOID)0x5150E, Filea, v10, 0i64);
MiStrongCodeImage(ControlArea, 1ui64);
goto LABEL_26;
}
v25 = v45;
if( v24 == 302 )
v25 = 1;
v45 = v25;
if( v25 )
goto LABEL_96;
}
LABEL_26:
if( v20 != CallingProcess && v20 )
ExFreePoolWithTag(v20, 0);
MiUnmapImageInSystemSpace(SystemImageInfo);
if( BugCheckParameter4_4 == 1 )
MiDereferencePerSessionProtos(ControlArea, 0xFFFFFFFFui64);
v26 = PreviousSystemPagePriority_4;
if( PreviousSystemPagePriority_4 )
{
if( (MiFlags & 0x40000) != 0 )
MiFlushEntireTbDueToAttributeChange();
CurrentThread = Thread;
PsRevertToUserPagePriorityThread(Thread, PreviousSystemPagePriority);
v26 = PreviousSystemPagePriority_4;
}
else
{
CurrentThread = Thread;
}
if( (int)v10 >= 0 )
break;
if( (_DWORD)v10 != -1073741789 || v54 >= (int)v44 )
{
dword_140C4C958 = 117;
return(int)v10;
}
v7 = HIDWORD(v44);
if( v26 )
{
v53 = 1;
}
else
{
v7 = HIDWORD(v44) | 1;
HIDWORD(v44) |= 1u;
if( (_DWORD)v44 == 1 )
v53 = 0;
}
}
if( !v14 || v14 == 1 && (*(_QWORD *)SeSignatureType & 0xFFFFFFFFFFFFFFF8ui64) != 0 )
{
if( (*(_QWORD *)SeSignatureType & 0xFFFFFFFFFFFFFFF8ui64) != 0 )
{
if( v14 )
v30 = *(_QWORD *)SeSignatureType & 0xFFFFFFFFFFFFFFFCui64 | 2;
else
v30 = *(_QWORD *)SeSignatureType & 0xFFFFFFFFFFFFFFFCui64 | 1;
}
else
{
v30 = SeSignatureType[0] & 7 | 8i64;
}
*(_QWORD *)SeSignatureType = v30;
if( SLOBYTE(ControlArea->Segment->u2.ImageInformation->ExportedImageInformation.DllCharacteristics) < 0 )
{
v30 |= 4ui64;
*(_QWORD *)SeSignatureType = v30;
}
v28 = (__int64)v59;
while( 1 )
{
v32 = _InterlockedCompareExchange64((volatile signed __int64 *)(v28 + 40), v30, PageHashes);
v31 = PageHashes == v32;
PageHashes = v32;
if( v31 )
break;
if( (*(_QWORD *)SeSignatureType & 0xFFFFFFFFFFFFFFF8ui64) <= 8 )
goto LABEL_78;
if( (v32 & 0xFFFFFFFFFFFFFFF8ui64) != 8 )
{
*(_QWORD *)SeSignatureType &= 0xFFFFFFFFFFFFFFF8ui64;
SeReleaseImageValidationContext(*(VOID **)SeSignatureType);
LABEL_78:
*(_QWORD *)SeSignatureType = PageHashes;
break;
}
v30 = *(_QWORD *)SeSignatureType & 0xFFFFFFFFFFFFFFFCui64 | 2;
*(_QWORD *)SeSignatureType = v30;
}
PageHashes = *(_QWORD *)SeSignatureType;
}
else
{
v27 = v14 - 2;
v28 = (__int64)v59;
if( v27 <= 1 )
*(_QWORD *)SeSignatureType ^= (LOBYTE(SeSignatureType[0]) ^ (unsigned __int8)PageHashes) & 3;
}
if( (SeSignatureType[0] & 3) == 0 )
{
LABEL_40:
ControlArea->Segment->SegmentFlags.UChar2 = ControlArea->Segment->SegmentFlags.UChar2 & 1 | (2
* (BYTE4(SessionIda) & 7 | 8));
if( v45 )
MiStrongCodeImage(ControlArea, 2ui64);
return(int)v10;
}
if( (MiFlags & 0x4000) != 0
&& (ControlArea->u2.WritableUserReferences & 0xC0000) != 0
&& *(_QWORD *)(v28 + 32)
&& (result = MiCaptureSecureImageBaseAddress(ControlArea), result < 0) )
{
dword_140C4C958 = 118;
}
else
{
result = MiWalkEntireImage(ControlArea, 0i64, 1i64, (unsigned int)SessionIda);
LODWORD(v10) = result;
if( result >= 0 )
{
v37 = *(_QWORD *)SeSignatureType & 0xFFFFFFFFFFFFFFFCui64;
*(_QWORD *)SeSignatureType &= 0xFFFFFFFFFFFFFFFCui64;
if( SLOBYTE(ControlArea->Segment->u2.ImageInformation->ExportedImageInformation.DllCharacteristics) < 0 )
{
v37 |= 4ui64;
*(_QWORD *)SeSignatureType = v37;
}
_InterlockedCompareExchange64((volatile signed __int64 *)(v28 + 40), v37, PageHashes);
goto LABEL_40;
}
dword_140C4C958 = 119;
}
return result;
}Referenced by:
MiMapImageForEnclaveUse
MiPromoteControlAreaToStrongCode
MiValidateSectionSigningPolicy