IopFastQueryNetworkAttributes
UINT8 __stdcall IopFastQueryNetworkAttributes(
_OBJECT_ATTRIBUTES *ObjectAttributes,
UINT64 DesiredAccess,
UINT64 AccessMode,
UINT64 OpenOptions,
_IO_STATUS_BLOCK *IoStatus,
_FILE_NETWORK_OPEN_INFORMATION *Buffer,
UINT8 NoReparse,
UINT8 UseTeb,
_DEVICE_OBJECT *DeviceObjectHint,
VOID *ExtraCreateParameter){
INT8 v10;
int v11;
int v13;
_LOOKASIDE_LIST_EX *v14;
int v15;
UINT64 DesiredAccessa;
PVOID Handle;
__int128 ParseContext[14];
char v20[272];
v10 = AccessMode;
v11 = DesiredAccess;
Handle = 0i64;
v13 = OpenOptions;
memset(v20, 0i64, sizeof(v20));
memset(ParseContext, 0i64, 0xD8u);
LODWORD(ParseContext[0]) = 14155784;
WORD3(ParseContext[4]) = 7;
LODWORD(ParseContext[4]) = v13 | 0x200000;
*((_QWORD *)&ParseContext[6] + 1) = Buffer;
*(_QWORD *)&ParseContext[3] = ObjectAttributes;
*(_QWORD *)&ParseContext[9] = v20;
*(_QWORD *)((char *)&ParseContext[5] + 4) = 0x100000001i64;
BYTE9(ParseContext[8]) = 1;
BYTE11(ParseContext[8]) = 1;
*(_QWORD *)&ParseContext[12] = 1i64;
memset(&ParseContext[10], 0, 32);
LOWORD(ParseContext[10]) = 40;
if( !v10 )
ObjectAttributes->Attributes |= 0x200u;
*(_QWORD *)&ParseContext[12] = PsGetCurrentSilo();
LODWORD(DesiredAccessa) = v11;
v15 = ObOpenObjectByNameEx(
ObjectAttributes,
(_OBJECT_TYPE *)IoFileObjectType,
v10,
0i64,
DesiredAccessa,
ParseContext,
*(_EJOB **)&ParseContext[12],
&Handle);
if( *((_QWORD *)&ParseContext[10] + 1) )
FsRtlpCleanupEcps(*((_ECP_LIST **)&ParseContext[10] + 1), v14);
if( LODWORD(ParseContext[2]) == -1096154543 )
{
IoStatus->Status = ParseContext[1];
IoStatus->Information = *((_QWORD *)&ParseContext[1] + 1);
}
else
{
if( v15 >= 0 )
{
ObCloseHandle(Handle, v10);
v15 = -1073741788;
}
IoStatus->Status = v15;
}
return 1;
}Referenced by:
IoFastQueryNetworkAttributes