IopGetSetSecurityObject
NTSTATUS __stdcall IopGetSetSecurityObject(
VOID *Object,
_SECURITY_OPERATION_CODE OperationCode,
UINT64 *SecurityInformation,
VOID *SecurityDescriptor,
UINT64 *CapturedLength,
VOID **ObjectsSecurityDescriptor,
POOL_TYPE PoolType,
_GENERIC_MAPPING *GenericMapping,
INT8 Mode){
_DEVICE_OBJECT *v12;
char *v13;
_ETHREAD *v14;
CHAR PreviousMode;
int v16;
bool v17;
_ETHREAD *v18;
_BYTE *v19;
int v20;
char v21;
_DEVICE_OBJECT *v22;
UINT64 v23;
_IRP *Irp;
_IRP *v25;
__int128 *p_Objecta;
_IO_STACK_LOCATION *CurrentStackLocation;
UINT64 *v28;
UINT64 *v29;
_ETHREAD *v30;
NTSTATUS v31;
_ETHREAD *CurrentThread;
INT64 v34;
_ETHREAD *v35;
void *v36;
UINT64 *v37;
UINT64 *v38;
_DEVICE_OBJECT *DevicePDO;
_ETHREAD *v40;
PSECURITY_DESCRIPTOR SecurityDescriptora;
PVOID OutputSecurityDescriptor;
__int128 v43;
__int128 Objecta;
__int64 v45;
VOID *retaddr;
INT64 v47;
UINT64 *SecurityInformationa;
SecurityInformationa = SecurityInformation;
OutputSecurityDescriptor = 0i64;
if( *(_WORD *)Object == 3 )
v12 = (_DEVICE_OBJECT *)Object;
else
v12 = (_DEVICE_OBJECT *)*((_QWORD *)Object + 1);
v13 = 0i64;
if( *(_WORD *)Object != 3 )
v13 = (char *)Object;
if( !v13 || !*((_WORD *)v13 + 44) && !*((_QWORD *)v13 + 8) || (*((_DWORD *)v13 + 20) & 0x800) != 0 )
{
if( OperationCode == AssignSecurityDescriptor )
{
v20 = 0;
if( !v13 || (*((_DWORD *)v13 + 20) & 0x100) == 0 )
{
v20 = ObLogSecurityDescriptor(SecurityDescriptor, &OutputSecurityDescriptor, 1ui64);
if( v20 >= 0 )
{
ExFreePoolWithTag(SecurityDescriptor, 0);
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
ExAcquireResourceExclusiveLite((UINT64)&stru_140C452E0 + 1408, 1, v34);
if( v12->SecurityDescriptor )
v12->DeviceObjectExtension->ExtensionFlags &= ~0x800u;
v12->SecurityDescriptor = OutputSecurityDescriptor;
ExReleaseResourceLite((PERESOURCE)((char *)&stru_140C452E0 + 1408));
KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
}
}
return v20;
}
if( OperationCode )
{
if( OperationCode == QuerySecurityDescriptor )
{
v35 = (_ETHREAD *)KeGetCurrentThread();
--v35->Tcb.KernelApcDisable;
ExAcquireResourceSharedLite((UINT64)&stru_140C452E0 + 1408, 1);
v36 = v12->SecurityDescriptor;
SecurityDescriptora = v36;
if( v36 && _InterlockedExchangeAdd64((volatile signed __int64 *)v36 - 3, 1ui64) <= 0 )
__fastfail(0xEu);
ExReleaseResourceLite((PERESOURCE)((char *)&stru_140C452E0 + 1408));
KeLeaveCriticalRegionThread(&v35->Tcb);
v37 = CapturedLength;
v38 = SecurityInformation;
goto LABEL_51;
}
return 0;
}
DevicePDO = IopGetDevicePDO(v12);
v13 = (char *)DevicePDO;
if( !DevicePDO )
return IopSetDeviceSecurityDescriptor(v12, SecurityInformation, SecurityDescriptor, PoolType, GenericMapping);
v20 = IopSetDeviceSecurityDescriptors(
(PVOID *)v12,
(PVOID *)DevicePDO,
SecurityInformation,
SecurityDescriptor,
PoolType,
GenericMapping);
goto LABEL_56;
}
if( OperationCode == DeleteSecurityDescriptor )
return 0;
v43 = 0i64;
Objecta = 0i64;
v45 = 0i64;
v14 = (_ETHREAD *)KeGetCurrentThread();
PreviousMode = v14->Tcb.PreviousMode;
ObfReferenceObject(v13);
v16 = *((_DWORD *)v13 + 20);
if( (v16 & 2) != 0 )
{
v17 = (v16 & 4) != 0;
v18 = (_ETHREAD *)KeGetCurrentThread();
--v18->Tcb.KernelApcDisable;
v19 = KeAbPreAcquire(v13 + 128, 0i64, 0i64);
LOBYTE(v47) = 0;
if( _InterlockedExchange((volatile __int32 *)v13 + 29, 1) )
{
v20 = IopWaitAndAcquireFileObjectLock(v13, PreviousMode, v17, v19, (INT64)&v47);
}
else
{
if( v19 )
v19[26] |= 1u;
ObfReferenceObject(v13);
v20 = 0;
}
if( !(_BYTE)v47 )
{
v21 = 1;
goto LABEL_16;
}
LABEL_56:
HalPutDmaAdapter((PADAPTER_OBJECT)v13);
return v20;
}
KeInitializeEvent((INT64)&Objecta, 1, 0);
v21 = 0;
LABEL_16:
if( (*((_DWORD *)v13 + 20) & 0x4000000) == 0 )
KeResetEvent((_KEVENT *)(v13 + 152));
LODWORD(v22) = IoGetRelatedDeviceObject((INT64)v13);
v23 = (UINT64)v22;
Irp = IopAllocateIrpExReturn(v22, v22->StackSize, v21 ^ 1u, retaddr);
v25 = Irp;
if( Irp )
{
Irp->Tail.OriginalFileObject = (_FILE_OBJECT *)v13;
Irp->Tail.Thread = v14;
Irp->RequestorMode = Mode;
if( (*((_DWORD *)v13 + 20) & 2) != 0 )
{
Irp->AllocationFlags |= 2u;
p_Objecta = 0i64;
}
else
{
Irp->Flags = 4;
p_Objecta = &Objecta;
}
v25->UserEvent = (_KEVENT *)p_Objecta;
v25->UserIosb = (_IO_STATUS_BLOCK *)&v43;
v25->Overlay.UserApcRoutine = 0i64;
CurrentStackLocation = v25->Tail.CurrentStackLocation;
v28 = SecurityInformationa;
v29 = CapturedLength;
if( OperationCode == QuerySecurityDescriptor )
{
CurrentStackLocation[-1].MajorFunction = 20;
LODWORD(CurrentStackLocation[-1].Parameters.SecurityContext) = *(_DWORD *)v28;
CurrentStackLocation[-1].Parameters.Options = *(_DWORD *)v29;
v25->UserBuffer = SecurityDescriptor;
}
else
{
CurrentStackLocation[-1].MajorFunction = 21;
LODWORD(CurrentStackLocation[-1].Parameters.SecurityContext) = *(_DWORD *)v28;
*(_QWORD *)&CurrentStackLocation[-1].Parameters.Options = SecurityDescriptor;
}
CurrentStackLocation[-1].FileObject = (_FILE_OBJECT *)v13;
IopQueueThreadIrp(v25);
v30 = (_ETHREAD *)KeGetCurrentThread();
++v30->Tcb.OtherOperationCount;
__incgsdword(0x2EE4u);
v31 = IofCallDriver(v23, (UINT64)v25);
v20 = v31;
if( v21 )
{
if( v31 == 259 )
{
KeWaitForSingleObject((UINT64)(v13 + 152), 0, 0, 0, 0i64);
v20 = *((_DWORD *)v13 + 14);
}
IopReleaseFileObjectLock((PADAPTER_OBJECT)v13);
}
else if( v31 == 259 )
{
KeWaitForSingleObject((UINT64)&Objecta, 0, 0, 0, 0i64);
v20 = v43;
}
if( v20 != -1073741808 )
{
if( OperationCode == QuerySecurityDescriptor )
{
if( v20 == -2147483643 )
v20 = -1073741789;
*(_DWORD *)v29 = DWORD2(v43);
}
return v20;
}
if( OperationCode == QuerySecurityDescriptor )
{
if( (*(_DWORD *)(v23 + 52) & 0x100) != 0 )
{
v40 = (_ETHREAD *)KeGetCurrentThread();
--v40->Tcb.KernelApcDisable;
ExAcquireResourceSharedLite((UINT64)&stru_140C452E0 + 1408, 1);
v36 = *(void **)(v23 + 272);
SecurityDescriptora = v36;
if( v36 && _InterlockedExchangeAdd64((volatile signed __int64 *)v36 - 3, 1ui64) <= 0 )
__fastfail(0xEu);
ExReleaseResourceLite((PERESOURCE)((char *)&stru_140C452E0 + 1408));
KeLeaveCriticalRegionThread(&v40->Tcb);
v37 = v29;
v38 = SecurityInformationa;
LABEL_51:
v20 = SeQuerySecurityDescriptorInfo(v38, SecurityDescriptor, v37, &SecurityDescriptora);
if( v36 )
ObDereferenceSecurityDescriptor(SecurityDescriptora, 1ui64);
return v20;
}
return SeAssignWorldSecurityDescriptor(SecurityDescriptor, v29, SecurityInformationa);
}
if( OperationCode == SetSecurityDescriptor && (*(_DWORD *)(v23 + 48) & 0x100) != 0 )
return -1073741808;
return 0;
}
IopAllocateIrpCleanup(v13, 0i64);
return -1073741670;
}Referenced by:
No references.