DrvDbGetObjectDatabaseNode
NTSTATUS __stdcall DrvDbGetObjectDatabaseNode(
_ETHREAD *Thread,
PVOID Token,
UINT8 CopyOnOpen,
UINT8 EffectiveOnly,
_SECURITY_IMPERSONATION_LEVEL ImpersonationLevel){
int DatabaseNode;
_DRVDB_NODE **v6;
bool v7;
_QWORD *v8;
PVOID v11;
wchar_t *v13;
WORD *v14;
_UNICODE_STRING StringIn;
_UNICODE_STRING StringOut[2];
DatabaseNode = 0;
*(_DWORD *)(&StringIn.MaximumLength + 1) = 0;
v6 = (_DRVDB_NODE **)EffectiveOnly;
v7 = *(_WORD *)Token == 64;
v8 = (_QWORD *)CopyOnOpen;
StringOut[0] = 0i64;
if( !v7
|| (v13 = (wchar_t *)((char *)Token + 2), (v14 = wcschr((WORD *)Token + 1, 58)) == 0i64)
|| (StringIn.Buffer = v13,
StringIn.Length = 2 * (v14 - v13),
StringIn.MaximumLength = StringIn.Length,
v11 = v14 + 1,
v14 == (WORD *)-2i64) )
{
v11 = Token;
LABEL_3:
*v6 = (_DRVDB_NODE *)Thread->Tcb.InitialStack;
goto LABEL_4;
}
if( v11 == Token )
goto LABEL_3;
DatabaseNode = RtlDuplicateUnicodeString(1ui64, &StringIn, StringOut);
if( DatabaseNode < 0 )
return DatabaseNode;
DatabaseNode = DrvDbFindDatabaseNode((_DRVDB_CONTEXT *)Thread, StringOut[0].Buffer, v6);
RtlFreeAnsiString(StringOut);
if( DatabaseNode == -1073741772 )
return -1073741766;
if( DatabaseNode < 0 )
return DatabaseNode;
LABEL_4:
*v8 = v11;
return DatabaseNode;
}Referenced by:
DrvDbDeleteObjectRegKey
DrvDbOpenObjectRegKey