ObpCreateHandle
NTSTATUS __stdcall ObpCreateHandle(
_OB_OPEN_REASON OpenReason,
VOID *Object,
UINT64 DesiredAccess,
_ACCESS_STATE *AccessState,
UINT64 ObjectPointerBias,
UINT64 Attributes,
INT8 AccessMode,
_OBJECT_CREATE_INFORMATION *InsertObjectCreateInfo,
UINT64 MaxRelativeAccessMask,
VOID **ReferencedNewObject,
VOID **Handle){
INT16 v11;
char *v12;
_OBJECT_CREATE_INFORMATION *v13;
_ACCESS_STATE *v14;
_OB_OPEN_REASON v15;
_EPROCESS *v16;
_HANDLE_TABLE *ObjectTable;
int v18;
_EX_PUSH_LOCK *v19;
__int16 v20;
INT8 v21;
__int64 v22;
unsigned int *v23;
unsigned int v24;
signed __int64 bf_0;
signed __int64 v26;
signed __int64 v27;
unsigned int v28;
volatile signed __int64 *v29;
_ETHREAD *CurrentThread;
signed __int64 v31;
signed __int64 v32;
signed __int64 v33;
signed __int64 v34;
signed __int64 v35;
unsigned int v36;
volatile signed __int64 *PoolWithTag;
_ETHREAD *v38;
signed __int64 v39;
signed __int64 v40;
char v41;
char *v42;
_ETHREAD *v43;
PACCESS_STATE v44;
_ETHREAD *v45;
UINT8 v46;
unsigned int v47;
__int64 v48;
volatile signed __int64 *v49;
signed __int64 v50;
signed __int64 v51;
bool v52;
signed __int64 v53;
_ETHREAD *v54;
_EX_PUSH_LOCK *v55;
_EX_PUSH_LOCK *v56;
signed __int64 v57;
bool v58;
signed __int64 v59;
volatile signed __int64 *i;
int v61;
VOID *v62;
UINT64 v63;
_EPROCESS *v64;
_ADAPTER_OBJECT *v65;
unsigned __int64 v66;
_OBJECT_HEADER *v67;
signed __int64 v68;
signed __int64 v69;
signed __int64 v70;
unsigned int v71;
volatile signed __int64 *v72;
_ETHREAD *v73;
signed __int64 v74;
signed __int64 v75;
int v76;
volatile signed __int64 *v77;
signed __int64 v78;
signed __int64 v79;
bool v80;
signed __int64 v81;
_ETHREAD *v82;
_EX_PUSH_LOCK *v83;
_EX_PUSH_LOCK *v84;
signed __int64 v85;
signed __int64 v86;
int v87;
unsigned int v88;
_OBJECT_SYMBOLIC_LINK *v89;
_OBJECT_TYPE *v90;
volatile signed __int64 *j;
unsigned int v92;
int v93;
_HANDLE_TABLE *v94;
UINT64 v95;
$674F156C788F89EBCBFDC1492D6BA90B v96;
unsigned int Number;
unsigned int v98;
unsigned int NextHandleNeedingPool;
unsigned int v100;
$B8D03BF2206A96A45F90FFDFEB50D073 *v101;
_HANDLE_TABLE_ENTRY *FirstFreeHandleEntry;
__int64 HighValue;
signed int v104;
unsigned int v105;
_EX_PUSH_LOCK *p_HandleTableLock;
UINT8 HandleTableEntrySlow;
_HANDLE_TABLE_FREE_LIST *v108;
_HANDLE_TABLE *v109;
_ETHREAD *v110;
UINT8 v111;
VOID **Buffer;
PVOID v113;
_OBJECT_HEADER *v114;
PVOID *v115;
__int64 v116;
VOID **v117;
bool v118;
_ADAPTER_OBJECT *v119;
__int64 v120;
_UNICODE_STRING *v121;
__int16 v122;
_UNICODE_STRING *v123;
VOID *CurrentThreadProcessId;
PACCESS_STATE v125;
VOID *v126;
_UNICODE_STRING *v127;
int v128;
UINT64 *v129;
unsigned __int64 v130;
_ETHREAD *v131;
unsigned __int64 v132;
_ETHREAD *v133;
UINT64 v134;
_ETHREAD *v135;
unsigned __int64 v136;
VOID *v137;
_ACCESS_MASK PreviouslyGrantedAccess;
PPRIVILEGE_SET *Privileges;
PGENERIC_MAPPING GenericMapping;
UINT64 v142;
UINT64 v143;
int GrantedAccess;
PACCESS_MASK GrantedAccessa;
char v146;
bool v147;
UINT64 CurrentAccess;
VOID *Objecta;
PACCESS_STATE AccessStatea;
UINT64 NumberOfBytes;
_EPROCESS *Process;
int AccessStatus;
UINT64 AccessMask;
_KTHREAD *Thread;
UINT64 v156;
_HANDLE_TABLE *HandleTable;
int v158;
INT64 DesiredAccessa;
VOID *v160;
unsigned int v161;
_OBJECT_TYPE *ObjectType;
_HANDLE_TABLE_ENTRY_INFO ExtraInfo;
void *SecurityDescriptor;
VOID *TargetHandle;
_OBJECT_HEADER *v166;
PVOID P;
_LIST_ENTRY ThreadCallbackListHead;
PPRIVILEGE_SET v169;
__int64 v170;
PVOID v171;
_UNICODE_STRING CapturedObjectTypeName;
unsigned __int64 v173;
__int64 v174;
VOID **v175;
PRIVILEGE_SET RequiredPrivileges;
v11 = Attributes;
v12 = (char *)Object;
v13 = InsertObjectCreateInfo;
v14 = AccessState;
v175 = ReferencedNewObject;
v15 = OpenReason;
CapturedObjectTypeName.Buffer = (wchar_t *)Handle;
ThreadCallbackListHead = 0i64;
LODWORD(AccessMask) = DesiredAccess;
LODWORD(CurrentAccess) = 0;
ExtraInfo.AuditMask = 0;
ExtraInfo.MaxRelativeAccessMask = MaxRelativeAccessMask;
Objecta = Object;
AccessStatea = AccessState;
HIDWORD(DesiredAccessa) = OpenReason;
v16 = KeGetCurrentThread()->ApcState.Process;
Process = v16;
LODWORD(v156) = Attributes;
Thread = (_ETHREAD *)InsertObjectCreateInfo;
LODWORD(DesiredAccessa) = 0;
v160 = 0i64;
v146 = 0;
P = 0i64;
BYTE4(CurrentAccess) = 0;
if( (Attributes & 0x200) != 0 )
{
ObjectTable = ::HandleTable;
Process = PsInitialSystemProcess;
LABEL_8:
HandleTable = ObjectTable;
goto LABEL_9;
}
if( KeGetCurrentThread()->ApcStateIndex != 1 )
{
ObjectTable = KeGetCurrentThread()->ApcState.Process->ObjectTable;
goto LABEL_8;
}
HandleTable = ObReferenceProcessHandleTable(v16);
ObjectTable = HandleTable;
if( !HandleTable )
return -1073741558;
v15 = HIDWORD(DesiredAccessa);
BYTE4(CurrentAccess) = 1;
LABEL_9:
v147 = ObjectTable == ::HandleTable;
if( !v14 || ObjectTable == ::HandleTable && !*((_DWORD *)v14 + 6) )
{
v61 = AccessMask;
if( (AccessMask & 0x2000000) != 0 )
{
v61 = AccessMask & 0xEDFFFFFF | 0x10000000;
LODWORD(AccessMask) = v61;
}
if( (v61 & 0xF0000000) != 0 )
{
RtlMapGenericMask(
&AccessMask,
(_GENERIC_MAPPING *)(ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ (unsigned __int8)*(v12 - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)v12 - 48) >> 8)]
+ 76));
v61 = AccessMask;
}
goto LABEL_114;
}
v19 = (_EX_PUSH_LOCK *)(v12 - 48);
AccessStatus = 0;
v20 = (_WORD)v12 - 48;
v21 = 1;
v22 = ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ LOBYTE(v19[3].Value) ^ (unsigned __int64)HIBYTE(v20)];
if( (v156 & 0x400) == 0 )
v21 = AccessMode;
if( (unsigned int)(v15 - 1) > 1 )
{
v23 = (unsigned int *)((char *)v14 + 16);
v24 = *((_DWORD *)v14 + 4);
memset(&RequiredPrivileges, 0, sizeof(RequiredPrivileges));
if( (v24 & 0x2000000) != 0 )
{
v24 = v24 & 0xEDFFFFFF | 0x10000000;
*v23 = v24;
}
if( (v24 & 0xF0000000) != 0 )
{
RtlMapGenericMask((UINT64 *)v14 + 2, (_GENERIC_MAPPING *)(v22 + 76));
v24 = *v23;
}
if( (v24 & 0x1000000) != 0 )
{
RequiredPrivileges.Privilege[0].Attributes = 0;
RequiredPrivileges.Privilege[0].Luid = SeSecurityPrivilege;
RequiredPrivileges.PrivilegeCount = 1;
RequiredPrivileges.Control = 1;
if( !SePrivilegeCheck((UINT64 *)&RequiredPrivileges.PrivilegeCount, (INT64)v14 + 32, v21) )
{
SePrivilegedServiceAuditAlarm(0i64, (_SECURITY_SUBJECT_CONTEXT *)v14 + 1, &RequiredPrivileges, 0);
v18 = -1073741727;
goto LABEL_289;
}
*v23 &= ~0x1000000u;
*((_DWORD *)v14 + 5) |= 0x1000000u;
SeAppendPrivileges(v14, &RequiredPrivileges);
}
*((_DWORD *)v14 + 5) |= *v23;
*v23 = 0;
*((_DWORD *)v14 + 5) &= *(_DWORD *)(v22 + 92) | 0x1000000;
_m_prefetchw(&v19[5]);
bf_0 = v19[5]._bf_0;
if( (bf_0 & 0xF) != 0 )
{
do
{
v26 = _InterlockedCompareExchange64(&v19[5]._bf_0, bf_0 - 1, bf_0);
if( bf_0 == v26 )
break;
bf_0 = v26;
}
while( (v26 & 0xF) != 0 );
}
v27 = bf_0;
v28 = bf_0 & 0xF;
v29 = (volatile signed __int64 *)(v27 & 0xFFFFFFFFFFFFFFF0ui64);
if( v28 <= 1 && v29 )
{
if( v28 == 1 )
{
if( _InterlockedExchangeAdd64(v29 - 3, 0xFui64) <= 0 )
__fastfail(0xEu);
}
else
{
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
ExAcquirePushLockSharedEx(v19 + 2, 0i64);
v29 = (volatile signed __int64 *)(v19[5]._bf_0 & 0xFFFFFFFFFFFFFFF0ui64);
if( _InterlockedExchangeAdd64(v29 - 3, 0x10ui64) <= 0 )
__fastfail(0xEu);
if( _InterlockedCompareExchange64(&v19[2]._bf_0, 0i64, 17i64) != 17 )
ExfReleasePushLockShared(v19 + 2);
KeAbPostRelease(&v19[2]);
KeLeaveCriticalRegion();
v14 = AccessStatea;
}
_m_prefetchw(&v19[5]);
v31 = v19[5]._bf_0;
while( (v31 & 0xF) == 0 )
{
if( v29 != (volatile signed __int64 *)(v31 & 0xFFFFFFFFFFFFFFF0ui64) )
break;
v32 = v31;
v31 = _InterlockedCompareExchange64(&v19[5]._bf_0, v31 + 15, v31);
if( v32 == v31 )
goto LABEL_41;
}
ObDereferenceSecurityDescriptor((VOID *)v29, 0xFui64);
}
LABEL_41:
*((_DWORD *)v14 + 5) &= ~(unsigned int)SeComputeCreatorDeniedRights(
(_SECURITY_SUBJECT_CONTEXT *)v14 + 1,
v14,
*((unsigned int *)v14 + 5),
(VOID *)v29);
if( v29 )
ObDereferenceSecurityDescriptor((VOID *)v29, 1ui64);
goto LABEL_109;
}
v161 = 0;
v169 = 0i64;
LODWORD(NumberOfBytes) = 0;
v158 = 0;
if( *(NTSTATUS(__stdcall **)(VOID *, _SECURITY_OPERATION_CODE, UINT64 *, VOID *, UINT64 *, VOID **, POOL_TYPE, _GENERIC_MAPPING *, INT8))(v22 + 152) == SeDefaultObjectMethod )
{
_m_prefetchw(&v19[5]);
v33 = v19[5]._bf_0;
if( (v33 & 0xF) != 0 )
{
do
{
v34 = _InterlockedCompareExchange64(&v19[5]._bf_0, v33 - 1, v33);
if( v33 == v34 )
break;
v33 = v34;
}
while( (v34 & 0xF) != 0 );
}
v35 = v33;
v36 = v33 & 0xF;
PoolWithTag = (volatile signed __int64 *)(v35 & 0xFFFFFFFFFFFFFFF0ui64);
if( v36 <= 1 && PoolWithTag )
{
if( v36 == 1 )
{
if( _InterlockedExchangeAdd64(PoolWithTag - 3, 0xFui64) <= 0 )
__fastfail(0xEu);
}
else
{
v38 = (_ETHREAD *)KeGetCurrentThread();
--v38->Tcb.KernelApcDisable;
ExAcquirePushLockSharedEx(v19 + 2, 0i64);
PoolWithTag = (volatile signed __int64 *)(v19[5]._bf_0 & 0xFFFFFFFFFFFFFFF0ui64);
if( _InterlockedExchangeAdd64(PoolWithTag - 3, 0x10ui64) <= 0 )
__fastfail(0xEu);
if( _InterlockedCompareExchange64(&v19[2]._bf_0, 0i64, 17i64) != 17 )
ExfReleasePushLockShared(v19 + 2);
KeAbPostRelease(&v19[2]);
KeLeaveCriticalRegion();
}
_m_prefetchw(&v19[5]);
v39 = v19[5]._bf_0;
while( (v39 & 0xF) == 0 )
{
if( PoolWithTag != (volatile signed __int64 *)(v39 & 0xFFFFFFFFFFFFFFF0ui64) )
break;
v40 = v39;
v39 = _InterlockedCompareExchange64(&v19[5]._bf_0, v39 + 15, v39);
if( v40 == v39 )
goto LABEL_62;
}
ObDereferenceSecurityDescriptor((VOID *)PoolWithTag, 0xFui64);
}
LABEL_62:
v41 = 0;
if( !PoolWithTag && ((*(_BYTE *)(v22 + 66) & 8) != 0 || (v19[3].Value & 0x20000) != 0) )
KeBugCheckEx(0x189u, v19, (PVOID)v22, (PVOID)1, 0i64);
v18 = 0;
}
else
{
v158 = 447;
LODWORD(NumberOfBytes) = ObpDefaultSecurityDescriptorLength;
PoolWithTag = (volatile signed __int64 *)ExAllocatePoolWithTag(
1ui64,
(unsigned int)ObpDefaultSecurityDescriptorLength,
1901290063i64);
if( !PoolWithTag )
{
v18 = -1073741670;
AccessStatus = -1073741670;
goto LABEL_101;
}
v42 = (char *)&v19[5];
v18 = (*(__int64(__fastcall **)(VOID *, __int64, int *, volatile signed __int64 *, UINT64 *, _EX_PUSH_LOCK *, _DWORD, __int64, INT8))(v22 + 152))(
Objecta,
1i64,
&v158,
PoolWithTag,
&NumberOfBytes,
v19 + 5,
*(_DWORD *)(v22 + 100),
v22 + 76,
v21);
if( v18 == -1073741789 )
{
ExFreePoolWithTag((PVOID)PoolWithTag, 0);
LODWORD(ObpDefaultSecurityDescriptorLength) = NumberOfBytes;
PoolWithTag = (volatile signed __int64 *)ExAllocatePoolWithTag(1ui64, (unsigned int)NumberOfBytes, 1901290063i64);
if( !PoolWithTag )
{
v18 = -1073741670;
AccessStatus = -1073741670;
goto LABEL_101;
}
LOBYTE(GrantedAccess) = v21;
v18 = (*(__int64(__fastcall **)(VOID *, __int64, int *, volatile signed __int64 *, UINT64 *, char *, _DWORD, __int64, int))(v22 + 152))(
Objecta,
1i64,
&v158,
PoolWithTag,
&NumberOfBytes,
v42,
*(_DWORD *)(v22 + 100),
v22 + 76,
GrantedAccess);
}
v41 = 1;
if( v18 < 0 )
{
ExFreePoolWithTag((PVOID)PoolWithTag, 0);
AccessStatus = v18;
goto LABEL_101;
}
}
if( PoolWithTag )
{
v43 = (_ETHREAD *)KeGetCurrentThread();
v44 = AccessStatea;
--v43->Tcb.KernelApcDisable;
ExAcquireResourceSharedLite(*(_QWORD *)(*((_QWORD *)v44 + 6) + 48i64), 1);
if( *((_QWORD *)v44 + 4) )
{
v45 = (_ETHREAD *)KeGetCurrentThread();
--v45->Tcb.KernelApcDisable;
ExAcquireResourceSharedLite(*(_QWORD *)(*((_QWORD *)v44 + 4) + 48i64), 1);
}
LOBYTE(v142) = v21;
v46 = (unsigned __int8)SeAccessCheck(
(PSECURITY_DESCRIPTOR)PoolWithTag,
(PSECURITY_SUBJECT_CONTEXT)v44 + 1,
1u,
*((_DWORD *)v44 + 4),
*((_DWORD *)v44 + 5),
&v169,
(PGENERIC_MAPPING)(v22 + 76),
v142,
&v161,
&AccessStatus);
if( v169 )
{
SeAppendPrivileges(v44, v169);
CmSiFreeMemory(v169);
}
if( v46 )
{
v47 = v161;
*((_DWORD *)v44 + 5) |= v161;
*((_DWORD *)v44 + 4) &= ~(v47 | 0x2000000);
}
if( v21 )
SeOpenObjectAuditAlarmWithTransaction(
(_UNICODE_STRING *)(v22 + 16),
Objecta,
0i64,
(VOID *)PoolWithTag,
v44,
0,
v46,
v21,
0i64,
(UINT8 *)v44 + 10);
ExReleaseResourceLite(*(PERESOURCE *)(*((_QWORD *)v44 + 6) + 48i64));
KeLeaveCriticalRegion();
v48 = *((_QWORD *)v44 + 4);
if( v48 )
{
ExReleaseResourceLite(*(PERESOURCE *)(v48 + 48));
KeLeaveCriticalRegion();
}
if( v41 )
{
ExFreePoolWithTag((PVOID)PoolWithTag, 0);
}
else
{
v49 = PoolWithTag - 4;
_m_prefetchw((const void *)(v49 + 1));
v50 = *((_QWORD *)v49 + 1);
v51 = v50 - 1;
v52 = v50 == 1;
if( v50 - 1 <= 0 )
{
LABEL_91:
if( !v52 )
__fastfail(0xEu);
v54 = (_ETHREAD *)KeGetCurrentThread();
v55 = (_EX_PUSH_LOCK *)((char *)&ObsSecurityDescriptorCache + 16 * (unsigned __int8)*((_DWORD *)v49 + 4));
--v54->Tcb.KernelApcDisable;
v56 = v55 + 1;
ExAcquirePushLockExclusiveEx(v55, 0i64);
v57 = _InterlockedExchangeAdd64(v49 + 1, 0xFFFFFFFFFFFFFFFFui64);
v58 = v57 <= 1;
v59 = v57 - 1;
if( v58 )
{
if( v59 )
__fastfail(0xEu);
for( i = (volatile signed __int64 *)v56->_bf_0; i != v49; i = (volatile signed __int64 *)*i )
v56 = (_EX_PUSH_LOCK *)i;
v56->_bf_0 = *(__int64 *)v49;
if( (_InterlockedExchangeAdd64(&v55->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(v55);
KeAbPostRelease(v55);
KeLeaveCriticalRegionThread(&v54->Tcb);
ExFreePoolWithTag((PVOID)v49, 0x6353624Fu);
}
else
{
if( (_InterlockedExchangeAdd64(&v55->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(v55);
KeAbPostRelease(v55);
KeLeaveCriticalRegionThread(&v54->Tcb);
}
}
else
{
while( 1 )
{
v53 = v50;
v50 = _InterlockedCompareExchange64(v49 + 1, v51, v50);
if( v53 == v50 )
break;
v51 = v50 - 1;
v52 = v50 == 1;
if( v50 - 1 <= 0 )
goto LABEL_91;
}
}
}
v52 = v46 == 0;
v13 = (_OBJECT_CREATE_INFORMATION *)Thread;
if( !v52 )
{
v14 = AccessStatea;
goto LABEL_109;
}
v18 = AccessStatus;
LABEL_101:
if( v18 < 0 )
goto LABEL_289;
v14 = AccessStatea;
v11 = v156;
v12 = (char *)Objecta;
goto LABEL_115;
}
v14 = AccessStatea;
AccessStatus = v18;
*((_DWORD *)AccessStatea + 5) |= *((_DWORD *)AccessStatea + 4);
*((_DWORD *)v14 + 4) = 0;
LABEL_109:
v61 = *((_DWORD *)v14 + 5);
v11 = v156;
v12 = (char *)Objecta;
LABEL_114:
LODWORD(CurrentAccess) = v61;
LABEL_115:
v62 = 0i64;
SecurityDescriptor = 0i64;
if( v13 )
{
v62 = v13->SecurityDescriptor;
SecurityDescriptor = v62;
}
v18 = ObpIncrementHandleCountEx(SHIDWORD(DesiredAccessa), &CurrentAccess, Process, v12, AccessMode, v11, v62);
if( v18 < 0 )
goto LABEL_289;
if( v14 )
{
if( v13 )
{
LOBYTE(PreviouslyGrantedAccess) = AccessMode;
v64 = Process;
v18 = ObpInsertOrLocateNamedObject(
(ULONG_PTR)Process,
v12,
&CurrentAccess,
v14,
PreviouslyGrantedAccess,
v13,
&v160);
if( v18 < 0 )
goto LABEL_290;
v65 = (_ADAPTER_OBJECT *)v160;
if( v160 == v12 )
{
v65 = 0i64;
v160 = 0i64;
}
else
{
v12 = (char *)v160;
Objecta = v160;
v146 = 1;
}
}
else
{
v65 = (_ADAPTER_OBJECT *)v160;
}
if( *((_BYTE *)v14 + 10) )
LOBYTE(v11) = v11 | 4;
}
else
{
v65 = (_ADAPTER_OBJECT *)v160;
}
v66 = (unsigned __int8)*(v12 - 24);
v67 = (_OBJECT_HEADER *)(v12 - 48);
v166 = v67;
v170 = BYTE1(v67);
ObjectType = (_OBJECT_TYPE *)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ BYTE1(v67) ^ v66];
LODWORD(CurrentAccess) = (ObjectType->TypeInfo.ValidAccessMask | 0x1000000) & CurrentAccess;
if( v14 )
{
_m_prefetchw(&v67->SecurityDescriptor);
v68 = (signed __int64)v67->SecurityDescriptor;
if( (v68 & 0xF) != 0 )
{
do
{
v69 = _InterlockedCompareExchange64((volatile signed __int64 *)&v67->SecurityDescriptor, v68 - 1, v68);
if( v68 == v69 )
break;
v68 = v69;
}
while( (v69 & 0xF) != 0 );
}
v70 = v68;
v71 = v68 & 0xF;
v72 = (volatile signed __int64 *)(v70 & 0xFFFFFFFFFFFFFFF0ui64);
if( v71 <= 1 && v72 )
{
if( v71 == 1 )
{
if( _InterlockedExchangeAdd64(v72 - 3, 0xFui64) <= 0 )
__fastfail(0xEu);
}
else
{
v73 = (_ETHREAD *)KeGetCurrentThread();
--v73->Tcb.KernelApcDisable;
ExAcquirePushLockSharedEx(&v67->Lock, 0i64);
v72 = (volatile signed __int64 *)((unsigned __int64)v67->SecurityDescriptor & 0xFFFFFFFFFFFFFFF0ui64);
if( _InterlockedExchangeAdd64(v72 - 3, 0x10ui64) <= 0 )
__fastfail(0xEu);
if( _InterlockedCompareExchange64(&v67->Lock._bf_0, 0i64, 17i64) != 17 )
ExfReleasePushLockShared(&v67->Lock);
KeAbPostRelease(&v67->Lock);
KeLeaveCriticalRegion();
}
_m_prefetchw(&v67->SecurityDescriptor);
v74 = (signed __int64)v67->SecurityDescriptor;
while( (v74 & 0xF) == 0 )
{
if( v72 != (volatile signed __int64 *)(v74 & 0xFFFFFFFFFFFFFFF0ui64) )
break;
v75 = v74;
v74 = _InterlockedCompareExchange64((volatile signed __int64 *)&v67->SecurityDescriptor, v74 + 15, v74);
if( v75 == v74 )
goto LABEL_147;
}
ObDereferenceSecurityDescriptor((VOID *)v72, 0xFui64);
}
LABEL_147:
v76 = SeComputeCreatorDeniedRights(
(_SECURITY_SUBJECT_CONTEXT *)v14 + 1,
v14,
(unsigned int)CurrentAccess,
(VOID *)v72);
if( v72 )
{
v77 = v72 - 4;
_m_prefetchw((const void *)(v77 + 1));
v78 = *((_QWORD *)v77 + 1);
v79 = v78 - 1;
v80 = v78 == 1;
if( v78 - 1 <= 0 )
{
LABEL_151:
if( !v80 )
__fastfail(0xEu);
v82 = (_ETHREAD *)KeGetCurrentThread();
v83 = (_EX_PUSH_LOCK *)((char *)&ObsSecurityDescriptorCache + 16 * (unsigned __int8)*((_DWORD *)v77 + 4));
--v82->Tcb.KernelApcDisable;
v84 = v83 + 1;
ExAcquirePushLockExclusiveEx(v83, 0i64);
v85 = _InterlockedExchangeAdd64(v77 + 1, 0xFFFFFFFFFFFFFFFFui64);
v58 = v85 <= 1;
v86 = v85 - 1;
if( v58 )
{
if( v86 )
__fastfail(0xEu);
for( j = (volatile signed __int64 *)v84->_bf_0; j != v77; j = (volatile signed __int64 *)*j )
v84 = (_EX_PUSH_LOCK *)j;
v84->_bf_0 = *(__int64 *)v77;
if( (_InterlockedExchangeAdd64(&v83->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(v83);
KeAbPostRelease(v83);
KeLeaveCriticalRegionThread(&v82->Tcb);
ExFreePoolWithTag((PVOID)v77, 0x6353624Fu);
}
else
{
if( (_InterlockedExchangeAdd64(&v83->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(v83);
KeAbPostRelease(v83);
KeLeaveCriticalRegionThread(&v82->Tcb);
}
v14 = AccessStatea;
}
else
{
while( 1 )
{
v81 = v78;
v78 = _InterlockedCompareExchange64(v77 + 1, v79, v78);
if( v81 == v78 )
break;
v79 = v78 - 1;
v80 = v78 == 1;
if( v78 - 1 <= 0 )
goto LABEL_151;
}
}
}
v65 = (_ADAPTER_OBJECT *)v160;
v87 = ~v76 & CurrentAccess;
v13 = (_OBJECT_CREATE_INFORMATION *)Thread;
LODWORD(CurrentAccess) = v87;
*((_DWORD *)v14 + 5) = v87;
ExtraInfo.AuditMask = *(_DWORD *)(*((_QWORD *)v14 + 9) + 28i64);
}
v88 = ObjectPointerBias;
v89 = (_OBJECT_SYMBOLIC_LINK *)Objecta;
if( (_DWORD)ObjectPointerBias )
ObReferenceObjectExWithTag(Objecta, (unsigned int)ObjectPointerBias, v63);
if( v65 )
HalPutDmaAdapter(v65);
v90 = ObjectType;
if( v13 && !v146 && ObjectType == ::ObjectType )
ObpCreateSymbolicLinkName(v89);
ThreadCallbackListHead.Blink = &ThreadCallbackListHead;
ThreadCallbackListHead.Flink = &ThreadCallbackListHead;
if( (v90->TypeInfo._bf_0 & 0x40) != 0 && v90->CallbackList.Flink != &v90->CallbackList )
{
LODWORD(DesiredAccessa) = CurrentAccess;
v18 = ObpPreInterceptHandleCreate(v89, v147, &DesiredAccessa, &ThreadCallbackListHead);
if( v18 < 0 )
{
ObpDecrementHandleCount(Process, v67);
if( (_DWORD)ObjectPointerBias )
{
if( (unsigned int)ObjectPointerBias > 1 )
_InterlockedExchangeAdd64(&v67->PointerCount, 1 - (int)ObjectPointerBias);
HalPutDmaAdapter((PADAPTER_OBJECT)v89);
}
goto LABEL_289;
}
if( !v147 )
{
LODWORD(CurrentAccess) = DesiredAccessa;
if( v14 )
*((_DWORD *)v14 + 5) = DesiredAccessa;
}
}
v92 = 0;
v174 = 0i64;
v93 = CurrentAccess & 0x1FFFFFF;
if( (v11 & 8) != 0 )
v93 |= 0x2000000u;
LODWORD(v174) = v93;
v173 = (((unsigned __int64)v67 & 0xFFFFFFFFFFFFFFF1ui64) << 16) | ((unsigned __int64)(v11 & 7) << 17) | 1;
Thread = (_ETHREAD *)KeGetCurrentThread();
--Thread->Tcb.KernelApcDisable;
v94 = HandleTable;
v95 = 0i64;
v96 = HandleTable->1;
if( (*(_BYTE *)&v96 & 4) != 0 )
{
LABEL_216:
v110 = Thread;
goto LABEL_217;
}
if( (*(_BYTE *)&v96 & 1) != 0 )
Number = 0;
else
Number = KeGetPcr()->Prcb.Number;
v98 = ExpFreeListCount;
LODWORD(v156) = Number;
LABEL_191:
NextHandleNeedingPool = v94->NextHandleNeedingPool;
v100 = Number;
while( 1 )
{
v101 = &v94->64 + v100;
if( v101->FreeLists[0].FirstFreeHandleEntry )
break;
LABEL_202:
v105 = v100 + 1;
++v92;
v100 = 0;
if( v105 != v98 )
v100 = v105;
if( v92 >= v98 )
{
p_HandleTableLock = &v94->HandleTableLock;
HandleTableEntrySlow = 1;
v108 = &v94->FreeLists[(unsigned int)v156];
ExAcquirePushLockExclusiveEx(&v94->HandleTableLock, 0i64);
if( NextHandleNeedingPool == HandleTable->NextHandleNeedingPool )
HandleTableEntrySlow = ExpAllocateHandleTableEntrySlow(HandleTable, v108);
if( (_InterlockedExchangeAdd64(&p_HandleTableLock->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(p_HandleTableLock);
KeAbPostRelease(p_HandleTableLock);
v92 = 0;
if( HandleTableEntrySlow )
{
Number = v156;
v94 = HandleTable;
goto LABEL_191;
}
goto LABEL_215;
}
}
ExAcquirePushLockExclusiveEx(&v94->FreeLists[v100].FreeListLock, 0i64);
FirstFreeHandleEntry = v101->FreeLists[0].FirstFreeHandleEntry;
if( FirstFreeHandleEntry )
{
HighValue = FirstFreeHandleEntry->HighValue;
v101->FreeLists[0].FirstFreeHandleEntry = (_HANDLE_TABLE_ENTRY *)HighValue;
if( !HighValue )
v101->FreeLists[0].LastFreeHandleEntry = 0i64;
v104 = ++v101->FreeLists[0].HandleCount;
if( v104 > (signed int)v101->FreeLists[0].HighWaterMark )
v101->FreeLists[0].HighWaterMark = v104;
}
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v101, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((_EX_PUSH_LOCK *)v101);
KeAbPostRelease(v101);
if( !FirstFreeHandleEntry )
{
v94 = HandleTable;
goto LABEL_202;
}
v95 = *(_QWORD *)(((unsigned __int64)FirstFreeHandleEntry & 0xFFFFFFFFFFFFF000ui64) + 8)
+ 4
* ((__int64)((__int64)FirstFreeHandleEntry - ((unsigned __int64)FirstFreeHandleEntry & 0xFFFFFFFFFFFFF000ui64)) >> 4);
if( ExtraInfo.AuditMask || (_DWORD)MaxRelativeAccessMask )
{
v109 = HandleTable;
if( ExpSetHandleExtraInfo(HandleTable, (VOID *)v95, &ExtraInfo) )
{
ExpFreeHandleTableEntry(v109, (_EXHANDLE)v95, FirstFreeHandleEntry);
v95 = 0i64;
LABEL_215:
v88 = ObjectPointerBias;
v14 = AccessStatea;
v67 = v166;
goto LABEL_216;
}
}
else
{
v109 = HandleTable;
}
v110 = Thread;
if( v109->DebugInfo )
ExpUpdateDebugInfo(v109, Thread, (VOID *)v95, 1ui64);
v67 = v166;
v88 = ObjectPointerBias;
FirstFreeHandleEntry->HighValue = v174;
FirstFreeHandleEntry->LowValue = v173;
v14 = AccessStatea;
LABEL_217:
KeLeaveCriticalRegionThread(&v110->Tcb);
if( !v95 )
{
ObpDecrementHandleCount(Process, v67);
if( v88 )
{
if( v88 > 1 )
_InterlockedExchangeAdd64(&v67->PointerCount, (int)(1 - v88));
HalPutDmaAdapter((PADAPTER_OBJECT)Objecta);
}
v111 = v147;
v18 = -1073741670;
Buffer = (VOID **)CapturedObjectTypeName.Buffer;
goto LABEL_284;
}
if( v14 )
{
v113 = 0i64;
if( (v67->InfoMask & 0x20) == 0
|| (v114 = (_OBJECT_HEADER *)*((unsigned __int8 *)&dword_140C25D60 + (v67->InfoMask & 0x3F)),
v115 = (PVOID *)((char *)v67 - (char *)v114),
v67 == v114) )
{
if( SecurityDescriptor )
v113 = SecurityDescriptor;
}
else if( *v115 )
{
v113 = *v115;
}
else if( SecurityDescriptor )
{
ObpSetObjectAuditInfo(v67, &SecurityDescriptor);
}
else if( (POBJECT_TYPE *)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ (unsigned __int8)v170 ^ (unsigned __int64)v67->TypeIndex] != IoFileObjectType
|| (*(_DWORD *)(*((_QWORD *)Objecta + 1) + 52i64) & 0x10) == 0 )
{
v116 = *((_QWORD *)v14 + 9);
if( !v116 || (v117 = *(VOID ***)(v116 + 56)) == 0i64 )
v117 = 0i64;
if( ObpAllocateAndQuerySecurityDescriptorInfo(Objecta, 0x20ui64, v117) >= 0 )
{
v113 = P;
ObpSetObjectAuditInfo(v67, &P);
}
}
v118 = 0;
TargetHandle = 0i64;
*(_QWORD *)&CapturedObjectTypeName.Length = v95;
v119 = 0i64;
v120 = *((_QWORD *)v14 + 9);
if( !v113 )
{
v113 = *(PVOID *)(v120 + 56);
if( !v113 )
v113 = (PVOID)*((_QWORD *)v14 + 8);
}
if( *((_BYTE *)v14 + 9) )
{
if( *((_BYTE *)v14 + 124) )
{
LODWORD(v142) = *((_DWORD *)v14 + 5);
SepAdtPrivilegeObjectAuditAlarm(
(_UNICODE_STRING *)&SeSubsystemName,
(_UNICODE_STRING *)v14 + 9,
(_UNICODE_STRING *)v14 + 8,
(VOID *)v95,
*((_TOKEN **)v14 + 4),
*((_TOKEN **)v14 + 6),
*((VOID **)v14 + 7),
v142,
*(_PRIVILEGE_SET **)v120,
1u);
goto LABEL_258;
}
}
else if( !*(_BYTE *)(v120 + 216) )
{
goto LABEL_258;
}
LODWORD(GenericMapping) = 2;
LODWORD(Privileges) = 512;
if( ZwDuplicateObject(
(VOID *)0xFFFFFFFFFFFFFFFFi64,
(VOID *)v95,
(VOID *)0xFFFFFFFFFFFFFFFFi64,
&TargetHandle,
0,
(UINT64)Privileges,
(UINT64)GenericMapping) >= 0 )
{
v171 = 0i64;
ObReferenceObjectByHandle(TargetHandle, 0i64, 0i64, 0, &v171, 0i64);
v119 = (_ADAPTER_OBJECT *)v171;
}
v121 = (_UNICODE_STRING *)((char *)v14 + 144);
LOWORD(NumberOfBytes) = SepAdtClassifyObjectIntoSubCategory(v119, (_UNICODE_STRING *)v14 + 9, 1u, 0);
v122 = NumberOfBytes;
if( v119 )
HalPutDmaAdapter(v119);
if( TargetHandle )
{
ZwClose((_HANDLE)TargetHandle);
TargetHandle = 0i64;
}
v123 = (_UNICODE_STRING *)((char *)v14 + 128);
CurrentThreadProcessId = PsGetCurrentThreadProcessId();
v125 = AccessStatea;
v118 = SepAdtOpenObjectAuditAlarm(
v122,
(__int64)&SeSubsystemName,
(PVOID *)&CapturedObjectTypeName,
&v121->Length,
(__int64)v123,
v113,
*((_QWORD *)AccessStatea + 4),
*((_QWORD *)AccessStatea + 6),
*((_DWORD *)AccessStatea + 6),
*((_DWORD *)AccessStatea + 5),
*(_QWORD *)v120,
1u,
(__int64)CurrentThreadProcessId,
2,
0i64,
0,
0i64,
v120 + 32,
(__int64)AccessStatea);
v126 = PsGetCurrentThreadProcessId();
LODWORD(GrantedAccessa) = *((_DWORD *)v125 + 5);
LODWORD(v143) = *((_DWORD *)v125 + 6);
SepAdtStagingEvent(
(unsigned __int16)NumberOfBytes,
v127,
(VOID **)&CapturedObjectTypeName,
v121,
v123,
*((_TOKEN **)v125 + 4),
*((_TOKEN **)v125 + 6),
v143,
(UINT64)GrantedAccessa,
1u,
v126,
v125);
v67 = v166;
v14 = v125;
LABEL_258:
v128 = HIDWORD(DesiredAccessa);
*((_BYTE *)v14 + 10) = v118;
if( !v128 )
{
v129 = (UINT64 *)**((_QWORD **)v14 + 9);
if( v129 )
{
if( *(_DWORD *)v129 )
SePrivilegeObjectAuditAlarm(
v95,
(INT64 *)v14 + 4,
*((unsigned int *)v14 + 5),
v129,
1,
KeGetCurrentThread()->PreviousMode);
}
}
if( P )
ExFreePoolWithTag(P, 0);
if( !v128 && (ObjectType == (_OBJECT_TYPE *)CmKeyObjectType || ObjectType == (_OBJECT_TYPE *)IoFileObjectType) )
{
v130 = *((_QWORD *)v14 + 4);
if( v130 )
{
v131 = (_ETHREAD *)KeGetCurrentThread();
v132 = *((_QWORD *)v14 + 6);
--v131->Tcb.KernelApcDisable;
if( v132 >= v130 )
{
ExAcquireResourceSharedLite(*(_QWORD *)(v130 + 48), 1);
v135 = (_ETHREAD *)KeGetCurrentThread();
--v135->Tcb.KernelApcDisable;
v134 = *(_QWORD *)(v132 + 48);
}
else
{
ExAcquireResourceSharedLite(*(_QWORD *)(v132 + 48), 1);
v133 = (_ETHREAD *)KeGetCurrentThread();
--v133->Tcb.KernelApcDisable;
v134 = *(_QWORD *)(v130 + 48);
}
ExAcquireResourceSharedLite(v134, 1);
if( (*(_DWORD *)(v130 + 200) & 0x4000) != 0
&& *(int *)(v130 + 196) >= 2
&& !RtlEqualSid(**(PVOID **)(v132 + 152), **(PVOID **)(v130 + 152))
&& OBJECT_HEADER_TO_HANDLE_REVOCATION_INFO(v67)
&& SepSidInTokenSidHash(
(_SID_AND_ATTRIBUTES_HASH *)(v132 + 808),
0i64,
SeConstrainedImpersonationCapabilitySid,
0,
1u,
0) )
{
ObHandleRevocationBlockAddObject((_OB_HANDLE_REVOCATION_BLOCK *)(*(_QWORD *)(v130 + 216) + 128i64), Objecta);
}
ExReleaseResourceLite(*(PERESOURCE *)(v132 + 48));
KeLeaveCriticalRegion();
ExReleaseResourceLite(*(PERESOURCE *)(v130 + 48));
KeLeaveCriticalRegion();
}
}
}
if( (_DWORD)ObjectPointerBias && v175 )
*v175 = Objecta;
v111 = v147;
Buffer = (VOID **)CapturedObjectTypeName.Buffer;
v136 = v95 | 0xFFFFFFFF80000000ui64;
if( !v147 )
v136 = v95;
*(_QWORD *)CapturedObjectTypeName.Buffer = v136;
v18 = v146 != 0 ? 0x40000000 : 0;
LABEL_284:
v137 = Objecta;
if( ThreadCallbackListHead.Flink != &ThreadCallbackListHead )
ObpPostInterceptHandleCreate(Objecta, v111, (unsigned int)v18, (unsigned int)CurrentAccess, &ThreadCallbackListHead);
if( (xmmword_140CFB490 & 0x40) != 0 && v18 >= 0 )
EtwpTraceHandle(0x1120u, *Buffer, v137, ObjectType);
LABEL_289:
v64 = Process;
LABEL_290:
if( BYTE4(CurrentAccess) )
ExReleaseRundownProtection(&v64->RundownProtect);
return v18;
}Referenced by:
ObInsertObjectEx
ObOpenObjectByNameEx
ObOpenObjectByPointer