NtLoadEnclaveData
NTSTATUS __stdcall NtLoadEnclaveData(
VOID *ProcessHandle,
VOID *BaseAddress,
const VOID *Buffer,
UINT64 BufferSize,
UINT64 Protect,
const VOID *PageInformation,
UINT64 PageInformationLength,
UINT64 *NumberOfBytesWritten,
UINT64 *EnclaveError){
VOID *v9;
UINT64 *v10;
UINT64 *v11;
_MMVAD_SHORT *v12;
INT64 v13;
char PreviousMode;
INT64 v15;
__int64 v16;
__int64 v17;
NTSTATUS DataIntoVsmEnclave;
UINT64 v19;
_MDL *Pool;
int v21;
INT64 v22;
_EPROCESS *Process;
PVOID v24;
INT64 v25;
_ADAPTER_OBJECT *v26;
int v27;
VOID *v28;
UINT64 *v29;
INT32 *v30;
UINT64 Tag;
PVOID *Object;
UINT64 *HandleInformation;
INT64 v35;
char AccessMode;
INT64 v37;
UINT64 *v38;
_HANDLE Handle[2];
PVOID TargetProcess;
int v41;
UINT64 v42;
_MDL *MemoryDescriptorList;
UINT64 *v44;
INT64 v45[4];
INT64 v46;
PVOID Base;
INT32 *v48;
_KAPC_STATE ApcState;
INT64 v50[4];
v46 = BufferSize;
Base = (PVOID)Buffer;
v42 = (UINT64)BaseAddress;
v9 = ProcessHandle;
*(_QWORD *)Handle = ProcessHandle;
v45[3] = (INT64)ProcessHandle;
v10 = NumberOfBytesWritten;
v44 = NumberOfBytesWritten;
v11 = EnclaveError;
v38 = EnclaveError;
v45[1] = (INT64)EnclaveError;
memset(&ApcState, 0, sizeof(ApcState));
v37 = 0i64;
v45[0] = 0i64;
v41 = 0;
v12 = 0i64;
TargetProcess = 0i64;
v13 = 0i64;
v48 = 0i64;
PreviousMode = KeGetCurrentThread()->PreviousMode;
AccessMode = PreviousMode;
if( PreviousMode == 1 )
{
v15 = 0x7FFFFFFF0000i64;
if( EnclaveError )
{
v16 = (__int64)EnclaveError;
if( (unsigned __int64)EnclaveError >= 0x7FFFFFFF0000i64 )
v16 = 0x7FFFFFFF0000i64;
*(_DWORD *)v16 = *(_DWORD *)v16;
}
if( NumberOfBytesWritten )
{
v17 = (__int64)NumberOfBytesWritten;
if( (unsigned __int64)NumberOfBytesWritten >= 0x7FFFFFFF0000i64 )
v17 = 0x7FFFFFFF0000i64;
*(_QWORD *)v17 = *(_QWORD *)v17;
}
}
else
{
v15 = 0x7FFFFFFF0000i64;
}
if( !(_DWORD)PageInformationLength )
goto LABEL_26;
if( (unsigned int)PageInformationLength <= 0xFFFF )
{
if( PreviousMode == 1
&& ((unsigned __int64)PageInformation + (unsigned int)PageInformationLength > 0x7FFFFFFF0000i64
|| (char *)PageInformation + (unsigned int)PageInformationLength < PageInformation) )
{
MEMORY[0x7FFFFFFF0000] = 0;
}
if( (unsigned int)PageInformationLength <= 0x20 )
memmove(v50, PageInformation, PageInformationLength);
if( (unsigned int)PageInformationLength > 0x20 )
{
LODWORD(v19) = MmSizeOfMdl((PVOID)PageInformation, PageInformationLength);
Pool = (_MDL *)MiAllocatePool(64i64, v19, 0x6C646D4Dui64);
v13 = (INT64)Pool;
MemoryDescriptorList = Pool;
if( !Pool )
{
DataIntoVsmEnclave = -1073741670;
goto LABEL_15;
}
Pool->Next = 0i64;
Pool->Size = 8
* (((((unsigned __int16)PageInformation & 0xFFF)
+ (unsigned __int64)(unsigned int)PageInformationLength
+ 4095) >> 12)
+ 6);
Pool->MdlFlags = 0;
Pool->StartVa = (void *)((unsigned __int64)PageInformation & 0xFFFFFFFFFFFFF000ui64);
v21 = (unsigned __int16)PageInformation & 0xFFF;
Pool->ByteOffset = v21;
Pool->ByteCount = PageInformationLength;
LOBYTE(v21) = PreviousMode;
MmProbeAndLockPages(Pool, v21, IoReadAccess);
}
LABEL_26:
if( (v42 & 0xFFF) != 0 )
{
DataIntoVsmEnclave = -1073741584;
}
else
{
v22 = v46;
if( (v46 & 0xFFF) == 0 )
{
Process = KeGetCurrentThread()->ApcState.Process;
if( *(_QWORD *)Handle == -1i64 )
{
TargetProcess = Process;
}
else
{
LODWORD(Tag) = 1834380621;
DataIntoVsmEnclave = ObReferenceObjectByHandleWithTag(
*(VOID **)Handle,
8ui64,
(_OBJECT_TYPE *)PsProcessType,
PreviousMode,
Tag,
&TargetProcess,
0i64);
LODWORD(v37) = DataIntoVsmEnclave;
if( DataIntoVsmEnclave < 0 )
{
LABEL_46:
v9 = *(VOID **)Handle;
goto LABEL_47;
}
v22 = v46;
}
v24 = TargetProcess;
KeStackAttachProcess((PRKPROCESS)TargetProcess, &ApcState);
HIDWORD(v37) = 1;
LODWORD(v25) = MiObtainReferencedVadEx(v42, 0, &v37);
v12 = (_MMVAD_SHORT *)v25;
if( !v25 || (v15 = *(_DWORD *)(v25 + 48) & 0x3100000, (_DWORD)v15 != 34603008) )
{
DataIntoVsmEnclave = -1073741800;
goto LABEL_45;
}
v15 = *(unsigned int *)(v25 + 64);
if( (v15 & 1) == 0 )
{
if( *(_BYTE *)(*(_QWORD *)(v25 + 72) + 76i64) )
{
LODWORD(v35) = Protect;
LODWORD(Object) = PageInformationLength;
LOBYTE(v10) = AccessMode;
DataIntoVsmEnclave = MiLoadDataIntoVsmEnclave(
(INT64)TargetProcess,
(INT64)Process,
v25,
(INT64)v10,
v42,
(INT64)Object,
(INT64)v50,
Base,
v22,
v35,
(INT64)v45);
}
else
{
v26 = (_ADAPTER_OBJECT *)PsReferencePrimaryToken(Process);
DataIntoVsmEnclave = MiLoadSectionIntoVsmEnclave(
(__int64)v24,
(__int64)v12,
AccessMode,
(INT64)v26,
(char *)v42,
PageInformationLength,
(VOID **)v50,
(_MDL *)v13,
&v48);
v12 = 0i64;
HalPutDmaAdapter(v26);
}
goto LABEL_45;
}
if( (_DWORD)PageInformationLength )
{
DataIntoVsmEnclave = -1073741820;
goto LABEL_45;
}
if( v22 )
{
KeUnstackDetachProcess(&ApcState);
v27 = 0;
LODWORD(HandleInformation) = Protect;
LOBYTE(v28) = AccessMode;
DataIntoVsmEnclave = MiCopyPagesIntoEnclave(
TargetProcess,
(INT64)v12,
v28,
(VOID *)v42,
(UINT64)Base,
v22,
HandleInformation,
(UINT64 *)v45);
LODWORD(v37) = DataIntoVsmEnclave;
v9 = *(VOID **)Handle;
goto LABEL_48;
}
}
DataIntoVsmEnclave = -1073741582;
}
LABEL_45:
LODWORD(v37) = DataIntoVsmEnclave;
goto LABEL_46;
}
DataIntoVsmEnclave = -1073741820;
LABEL_15:
LODWORD(v37) = DataIntoVsmEnclave;
LABEL_47:
v27 = HIDWORD(v37);
LABEL_48:
v29 = v38;
if( v12 )
MiUnlockAndDereferenceVad(v12);
if( v27 )
KeUnstackDetachProcess(&ApcState);
if( TargetProcess && v9 != (VOID *)-1i64 )
ObfDereferenceObjectWithTag(TargetProcess, 0x6D566D4Dui64);
if( v13 )
{
if( (*(_BYTE *)(v13 + 10) & 2) != 0 )
MmUnlockPages(v13, v15, (INT64)v11);
ExFreePoolWithTag((PVOID)v13, 0);
}
v30 = v48;
if( v48 )
{
DbgkMapViewOfSection((_EPROCESS *)TargetProcess, 0i64, *((VOID **)v48 + 2), (UINT64)v10, Tag);
MiDereferenceEnclaveModule(v30);
}
if( v44 )
*v44 = v45[0];
if( v29 )
*(_DWORD *)v29 = v41;
return DataIntoVsmEnclave;
}Referenced by:
No references.