IoReportTargetDeviceChange
NTSTATUS __stdcall IoReportTargetDeviceChange(_DEVICE_OBJECT *PhysicalDeviceObject, VOID *NotificationStructure){
_DWORD *DeviceNode;
GUID *v5;
int v6;
int v7;
NTSTATUS result;
_DRIVER_OBJECT *DriverObject;
_UNICODE_STRING *p_DriverName;
VOID **v11;
VOID **v12;
_DEVOBJ_EXTENSION *DeviceObjectExtension;
_WORD *v14;
__int64 v15;
_WORD *v16;
__int64 v17;
__int128 Object;
__int64 v19;
NTSTATUS v20;
v19 = 0i64;
v20 = 0;
Object = 0i64;
if( !PhysicalDeviceObject )
goto LABEL_29;
DeviceNode = PhysicalDeviceObject->DeviceObjectExtension->DeviceNode;
if( !DeviceNode || (DeviceNode[99] & 0x20000) != 0 )
{
IoAddTriageDumpDataBlock(PhysicalDeviceObject, (_BYTE *)PhysicalDeviceObject->Size);
DriverObject = PhysicalDeviceObject->DriverObject;
if( DriverObject )
{
IoAddTriageDumpDataBlock(DriverObject, (_BYTE *)(unsigned int)DriverObject->Size);
p_DriverName = &PhysicalDeviceObject->DriverObject->DriverName;
if( p_DriverName->Length )
{
IoAddTriageDumpDataBlock(p_DriverName, (_BYTE *)2);
IoAddTriageDumpDataBlock(
PhysicalDeviceObject->DriverObject->DriverName.Buffer,
(_BYTE *)PhysicalDeviceObject->DriverObject->DriverName.Length);
}
}
v11 = (VOID **)PhysicalDeviceObject->DeviceObjectExtension->DeviceNode;
if( v11 )
{
v12 = v11 + 5;
IoAddTriageDumpDataBlock(v11, (_BYTE *)0x310);
if( *(_WORD *)v12 )
{
IoAddTriageDumpDataBlock(v12, (_BYTE *)2);
IoAddTriageDumpDataBlock(v12[1], (_BYTE *)*(unsigned __int16 *)v12);
}
DeviceObjectExtension = PhysicalDeviceObject->DeviceObjectExtension;
v14 = (char *)DeviceObjectExtension->DeviceNode + 56;
if( *v14 )
{
IoAddTriageDumpDataBlock(v14, (_BYTE *)2);
IoAddTriageDumpDataBlock(
*((VOID **)PhysicalDeviceObject->DeviceObjectExtension->DeviceNode + 8),
(_BYTE *)*((unsigned __int16 *)PhysicalDeviceObject->DeviceObjectExtension->DeviceNode + 28));
DeviceObjectExtension = PhysicalDeviceObject->DeviceObjectExtension;
}
v15 = *((_QWORD *)DeviceObjectExtension->DeviceNode + 2);
if( v15 )
{
v16 = (_WORD *)(v15 + 56);
if( *v16 )
{
IoAddTriageDumpDataBlock(v16, (_BYTE *)2);
v17 = *((_QWORD *)PhysicalDeviceObject->DeviceObjectExtension->DeviceNode + 2);
IoAddTriageDumpDataBlock(*(VOID **)(v17 + 64), (_BYTE *)*(unsigned __int16 *)(v17 + 56));
}
}
}
LABEL_29:
KeBugCheckEx(0xCAu, (PVOID)2, PhysicalDeviceObject, 0i64, 0i64);
}
v5 = (GUID *)((char *)NotificationStructure + 4);
if( (char *)NotificationStructure + 4 == (char *)&GUID_TARGET_DEVICE_QUERY_REMOVE )
return -1073741808;
if( RtlCompareMemory(v5, &GUID_TARGET_DEVICE_QUERY_REMOVE, 16) == (_SIZE_T *)16 )
return -1073741808;
if( v5 == &GUID_TARGET_DEVICE_REMOVE_CANCELLED )
return -1073741808;
if( RtlCompareMemory(v5, &GUID_TARGET_DEVICE_REMOVE_CANCELLED, 16) == (_SIZE_T *)16 )
return -1073741808;
if( v5 == &GUID_TARGET_DEVICE_REMOVE_COMPLETE )
return -1073741808;
if( RtlCompareMemory(v5, &GUID_TARGET_DEVICE_REMOVE_COMPLETE, 16) == (_SIZE_T *)16 )
return -1073741808;
v6 = *((unsigned __int16 *)NotificationStructure + 1);
if( (unsigned __int16)v6 < 0x24u )
return -1073741808;
v7 = *((_DWORD *)NotificationStructure + 8);
if( v7 != -1 && v7 > v6 - 36 )
return -1073741808;
KeInitializeEvent((INT64)&Object, 0, 0);
result = PnpSetCustomTargetEvent(PhysicalDeviceObject, (__int64)&Object, &v20, 0i64, 0i64, NotificationStructure);
if( result >= 0 )
{
KeWaitForSingleObject((UINT64)&Object, 0, 0, 0, 0i64);
return v20;
}
return result;
}Referenced by:
FsRtlNotifyVolumeEventEx
NtSetVolumeInformationFile