KsepPatchDriverImportsTable
INT64 __fastcall KsepPatchDriverImportsTable(__int64 a1, __int64 a2){
UINT64 *v4;
UINT64 *v5;
INT64 result;
__int64 v7;
__int64 v8;
__int64 v9;
int v10;
UINT64 v11;
UINT64 v12;
INT64 v13;
INT64 v14;
UINT64 HookAddressForOriginal;
UINT64 v16;
UINT64 ImportSize;
LODWORD(ImportSize) = 0;
if( a1 && a2 )
{
LODWORD(v4) = RtlImageDirectoryEntryToData(*(PVOID *)(a1 + 48), 1u, 0xCu, &ImportSize);
v5 = v4;
if( !v4 )
return 3221225473i64;
v7 = *(_QWORD *)(a2 + 48);
if( v7 )
{
LODWORD(v8) = 0;
while( 1 )
{
if( *(_DWORD *)v7 == 4 )
return 0i64;
if( *(_DWORD *)v7 <= 2u )
break;
LABEL_24:
v8 = (unsigned int)(v8 + 1);
v7 = *(_QWORD *)(a2 + 48) + 24 * v8;
if( !v7 )
return 0i64;
}
v9 = *(_QWORD *)(v7 + 16);
if( v9 )
{
v10 = 0;
while( 1 )
{
if( *(_DWORD *)v9 == 2 )
goto LABEL_24;
v11 = *(_QWORD *)(v9 + 16);
if( !v11 )
return 3221225485i64;
v12 = *(_QWORD *)(v9 + 24);
if( !v12 || *(_DWORD *)v9 )
return 3221225485i64;
result = KsepPatchImportTableEntry(v5, (unsigned int)ImportSize, v12, v11);
if( (_DWORD)result == -1073741275 )
{
if( !(unsigned int)VfIsVerifierEnabled() )
goto LABEL_23;
if( !(unsigned int)VfIsVerificationEnabledForImage(a1, v13, v14) )
goto LABEL_23;
HookAddressForOriginal = VfGetHookAddressForOriginal(*(PSTR *)(v9 + 8));
v16 = HookAddressForOriginal;
if( !HookAddressForOriginal )
goto LABEL_23;
result = KsepPatchImportTableEntry(
v5,
(unsigned int)ImportSize,
HookAddressForOriginal,
*(_QWORD *)(v9 + 16));
if( (int)result < 0 )
goto LABEL_22;
*(_QWORD *)(v9 + 24) = v16;
}
if( (int)result < 0 )
{
LABEL_22:
if( (_DWORD)result != -1073741275 )
return result;
}
LABEL_23:
v9 = *(_QWORD *)(v7 + 16) + 32i64 * (unsigned int)++v10;
if( !v9 )
goto LABEL_24;
}
}
}
}
return 3221225485i64;
}Referenced by:
KsepApplyShimsToDriver