IopInitializeBuiltinDriver
NTSTATUS __stdcall IopInitializeBuiltinDriver(
_UNICODE_STRING *DriverName,
INT64 a2,
INT64 a3,
INT64 a4,
CHAR a5,
INT64 a6){
void *v6;
unsigned __int16 *p_Length;
char PreviousMode;
int inserted;
_DRIVER_OBJECT *v13;
INT64 i;
__int64 v15;
VOID **Pool_1;
VOID **v17;
_DRIVER_EXTENSION *DriverExtension;
unsigned __int64 v19;
_WORD *v20;
__int64 v21;
_WORD *v22;
_WORD *v23;
unsigned __int16 v24;
unsigned __int16 v25;
VOID **v26;
_UNICODE_STRING *p_ServiceKeyName;
size_t v28;
unsigned __int16 v29;
_UNICODE_STRING *v30;
NTSTATUS Image;
int v32;
UINT64 v33;
_UNICODE_STRING *v34;
__int64 v35;
INT64 v36;
VOID *ParseContext;
UINT64 ObjectBodySize;
UINT64 PagedPoolCharge;
UINT64 NonPagedPoolCharge;
PVOID KeyHandle;
PVOID Handle;
PVOID Object;
PVOID v45;
_OBJECT_ATTRIBUTES ObjectAttributes;
__int64 v47;
_UNICODE_STRING *KeyName;
KeyName = (_UNICODE_STRING *)a2;
v6 = 0i64;
Handle = 0i64;
Object = 0i64;
p_Length = (unsigned __int16 *)a2;
*(&ObjectAttributes.Length + 1) = 0;
*(_QWORD *)a6 = 0i64;
*(&ObjectAttributes.Attributes + 1) = 0;
KeyHandle = 0i64;
LODWORD(v47) = 0;
if( *(&stru_140CF2E80 + 920) && *(_QWORD *)(*(&stru_140CF2E80 + 920) + 8i64) )
HdlspKernelAddLogEntry(1ui64, DriverName);
ObjectAttributes.Length = 48;
ObjectAttributes.RootDirectory = 0i64;
PreviousMode = KeGetCurrentThread()->PreviousMode;
LODWORD(NonPagedPoolCharge) = 0;
LODWORD(PagedPoolCharge) = 0;
LODWORD(ObjectBodySize) = 416;
ObjectAttributes.Attributes = 80;
ObjectAttributes.ObjectName = DriverName;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
inserted = ObCreateObject(
PreviousMode,
IoDriverObjectType,
&ObjectAttributes,
0,
0i64,
ObjectBodySize,
PagedPoolCharge,
NonPagedPoolCharge,
&Object);
if( inserted >= 0 )
{
v13 = (_DRIVER_OBJECT *)Object;
memset(Object, 0i64, 0x1A0u);
v13->DriverExtension = (_DRIVER_EXTENSION *)&v13[1];
*(_QWORD *)&v13[1].Type = v13;
memset64(v13->MajorFunction, (unsigned __int64)IopInvalidDeviceRequest, 0x1Cui64);
*(_DWORD *)&v13->Type = 22020100;
v13->DriverInit = (int(__fastcall *)(_DRIVER_OBJECT *, _UNICODE_STRING *))a3;
inserted = ObInsertObject(v13, 0i64, 1, 0i64, 0i64, &Handle);
if( inserted >= 0 )
{
ObReferenceObjectByHandle(Handle, 0i64, IoDriverObjectType, 0, &v45, 0i64);
for( i = PsLoadedModuleList; (INT64 *)i != &PsLoadedModuleList && a4; i = *(_QWORD *)i )
{
if( RtlEqualString((_STRING *)(a4 + 88), (_STRING *)(i + 88), 1u) )
{
v13->DriverSection = (void *)i;
break;
}
}
InbvIndicateProgress();
if( !a4
|| (v6 = *(void **)(a4 + 48),
LODWORD(v15) = RtlImageNtHeader((UINT64)v6),
v13->DriverStart = v6,
v13->DriverSize = *(_DWORD *)(v15 + 80),
(*(_WORD *)(v15 + 94) & 0x2000) == 0) )
{
v13->Flags |= 2u;
}
Pool_1 = IopVerifierExAllocatePool_1(0x200ui64, DriverName->MaximumLength + 2i64);
v17 = Pool_1;
if( Pool_1 )
{
v13->DriverName.Buffer = (wchar_t *)Pool_1;
v13->DriverName.MaximumLength = DriverName->MaximumLength;
v13->DriverName.Length = DriverName->Length;
memmove(v13->DriverName.Buffer, DriverName->Buffer, DriverName->MaximumLength);
*((_WORD *)v17 + ((unsigned __int64)DriverName->Length >> 1)) = 0;
}
DriverExtension = v13->DriverExtension;
if( p_Length )
{
v19 = *p_Length;
if( (_WORD)v19 )
{
v20 = (_WORD *)*((_QWORD *)p_Length + 1);
v21 = 0x7FFFFFFFFFFFFFFEi64;
v22 = &v20[v19 >> 1];
if( *(v22 - 1) != 92 )
v21 = 0x7FFFFFFFFFFFFFFFi64;
v23 = &v22[v21];
v24 = 0;
if( v23 != v20 )
{
while( *v23 != 92 )
{
v24 += 2;
if( --v23 == v20 )
goto LABEL_30;
}
++v23;
}
LABEL_30:
v25 = v24 + 2;
if( v23 != v20 )
v25 = v24;
Object = (PVOID)v25;
v26 = IopVerifierExAllocatePool_1(0x200ui64, v25 + 2i64);
v45 = v26;
p_ServiceKeyName = &DriverExtension->ServiceKeyName;
if( v26 )
{
v28 = (unsigned int)Object;
v29 = (_WORD)Object + 2;
DriverExtension->ServiceKeyName.Buffer = (wchar_t *)v26;
DriverExtension->ServiceKeyName.MaximumLength = v29;
p_ServiceKeyName->Length = v28;
memmove(v26, v23, v28);
v30 = KeyName;
*((_WORD *)v45 + ((unsigned __int64)p_ServiceKeyName->Length >> 1)) = 0;
inserted = IopOpenRegistryKeyEx(&KeyHandle, 0i64, v30, 0xF003Fui64);
if( inserted >= 0 )
{
inserted = PnpPrepareDriverLoading(p_ServiceKeyName, KeyHandle, v6, (unsigned __int8)a5, (__int64)&v47);
NtClose((UINT64)KeyHandle);
if( inserted >= 0 )
{
p_Length = &KeyName->Length;
LABEL_38:
if( (v47 & 1) != 0 )
v13->Flags |= 0x100u;
v13->HardwareDatabase = &CmRegistryMachineHardwareDescriptionSystemName;
VfDifCaptureDriverEntry(v13);
Image = KseDriverLoadImage((_KLDR_DATA_TABLE_ENTRY *)a4);
inserted = Image;
if( Image >= 0 )
{
v32 = v13->DriverInit(v13, (_UNICODE_STRING *)p_Length);
inserted = v32;
if( v32 < 0 )
{
if( v32 == -1073741218 )
{
LODWORD(ParseContext) = -1073741218;
DbgPrintEx(
0x65u,
3u,
"IOINIT: Built-in driver %wZ failed to initialize with status - 0x%lX\n",
DriverName,
ParseContext);
}
else
{
LODWORD(ParseContext) = v32;
DbgPrintEx(
0x65u,
0,
"IOINIT: Built-in driver %wZ failed to initialize with status - 0x%lX\n",
DriverName,
ParseContext);
}
}
else
{
VfDifCaptureIoCallbacks((INT64 *)&v13->Type, v33);
KseShimDriverIoCallbacks(v13, v34);
}
}
else
{
LODWORD(ParseContext) = Image;
DbgPrintEx(
0x65u,
3u,
"IOINIT: Built-in driver %wZ blocked with status - 0x%lX\n",
DriverName,
ParseContext);
}
}
}
}
else
{
DriverExtension->ServiceKeyName.Buffer = 0i64;
inserted = -1073741670;
p_ServiceKeyName->Length = 0;
}
NtClose((UINT64)Handle);
if( inserted < 0 )
{
if( inserted != -1073741218 )
PnpDriverLoadingFailed(0i64, &v13->DriverExtension->ServiceKeyName, v35, v36);
if( *(&stru_140CF2E80 + 920) && *(_QWORD *)(*(&stru_140CF2E80 + 920) + 8i64) )
HdlspKernelAddLogEntry(3ui64, 0i64);
ObMakeTemporaryObject(v13);
ObfDereferenceObjectWithTag(v13, 0x746C6644ui64);
}
else
{
IopReadyDeviceObjects(v13);
if( *(&stru_140CF2E80 + 920) && *(_QWORD *)(*(&stru_140CF2E80 + 920) + 8i64) )
HdlspKernelAddLogEntry(2ui64, 0i64);
*(_QWORD *)a6 = v13;
}
return inserted;
}
}
*(_DWORD *)&DriverExtension->ServiceKeyName.Length = 0;
DriverExtension->ServiceKeyName.Buffer = 0i64;
goto LABEL_38;
}
}
if( *(&stru_140CF2E80 + 920) && *(_QWORD *)(*(&stru_140CF2E80 + 920) + 8i64) )
HdlspKernelAddLogEntry(3ui64, 0i64);
return inserted;
}Referenced by:
PnpInitializeBootStartDriver