IopAllocRealFileObject
__int64 __fastcall IopAllocRealFileObject(
_FILE_OBJECT **FileObject,
_DEVICE_OBJECT *DeviceObject,
_DEVICE_OBJECT *ParseDeviceObject,
unsigned int Attributes,
void *AccessMode,
_OPEN_PACKET *Op,
_OB_EXTENDED_PARSE_PARAMETERS *ExtendedParameters,
int CopyOldFileObject,
unsigned int DesiredAccess){
struct _KPRCB *CurrentPrcb;
POBJECT_TYPE *v10;
char v12;
__int64 v13;
_DEVICE_OBJECT *v14;
_FILE_OBJECT *p_Body;
_OBJECT_CREATE_INFORMATION *v16;
unsigned int v17;
char v18;
INT64 v19;
int v20;
unsigned int v21;
_OBJECT_HEADER *v22;
int TransactionParameters;
_OPEN_PACKET *v24;
unsigned int v25;
_OB_EXTENDED_PARSE_PARAMETERS *v26;
_FILE_OBJECT *RelatedFileObject;
_DEVICE_OBJECT *v28;
int v29;
unsigned int CreateOptions;
_LIST_ENTRY *p_IrpList;
void *FileObjectExtension;
unsigned __int64 v34;
__int64 v35;
_EJOB *Silo;
_OB_EXTENDED_PARSE_PARAMETERS *v37;
__int64 v38;
__int64 v39;
__int64(__fastcall *v40)(__int64, __int64, __int64);
__int64 v41;
__int64 v42;
struct _KPRCB *v43;
__int64 v44;
void *SecurityDescriptor;
struct _KPRCB *v46;
__int64 v47;
_OBJECT_CREATE_INFORMATION *ObjectCreateInfo;
INT64 UseLookaside;
INT64 v50;
INT64 v51;
_OBJECT_HEADER *ObjectHeader;
_UNICODE_STRING CapturedObjectName;
_OBJECT_ATTRIBUTES ObjectAttributes;
__int16 v57;
CurrentPrcb = KeGetCurrentPrcb();
v10 = IoFileObjectType;
*(_QWORD *)&ObjectAttributes.Length = 48i64;
*(&ObjectAttributes.Attributes + 1) = 0;
v12 = Attributes;
v13 = *((_QWORD *)CurrentPrcb + 264);
v14 = ParseDeviceObject;
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.Attributes = Attributes;
p_Body = 0i64;
ObjectAttributes.ObjectName = 0i64;
++*(_DWORD *)(v13 + 20);
v57 = 1;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
CapturedObjectName = 0i64;
ObjectHeader = 0i64;
v16 = (_OBJECT_CREATE_INFORMATION *)RtlpInterlockedPopEntrySList((PSLIST_HEADER)v13);
if( !v16 )
{
++*(_DWORD *)(v13 + 24);
v38 = *((_QWORD *)CurrentPrcb + 265);
++*(_DWORD *)(v38 + 20);
v16 = (_OBJECT_CREATE_INFORMATION *)RtlpInterlockedPopEntrySList((PSLIST_HEADER)v38);
if( !v16 )
{
v39 = *(unsigned int *)(v38 + 44);
v40 = *(__int64(__fastcall **)(__int64, __int64, __int64))(v38 + 48);
v41 = *(unsigned int *)(v38 + 40);
v42 = *(unsigned int *)(v38 + 36);
++*(_DWORD *)(v38 + 24);
v16 = (_OBJECT_CREATE_INFORMATION *)v40(v42, v39, v41);
if( !v16 )
{
TransactionParameters = -1073741670;
LABEL_56:
if( !(_BYTE)CopyOldFileObject )
*FileObject = 0i64;
return(unsigned int)TransactionParameters;
}
}
}
v17 = *((_DWORD *)CurrentPrcb + 9);
v18 = (char)AccessMode;
v19 = (unsigned __int8)AccessMode;
LODWORD(UseLookaside) = 0;
v16->Attributes = v17;
v20 = ObpCaptureObjectCreateInformation(
0i64,
v19,
&ObjectAttributes,
&CapturedObjectName,
v16,
UseLookaside,
v50,
v51);
if( v20 < 0 )
{
v43 = KeGetCurrentPrcb();
v44 = *((_QWORD *)v43 + 264);
++*(_DWORD *)(v44 + 28);
if( *(_WORD *)v44 < *(_WORD *)(v44 + 16)
|| (++*(_DWORD *)(v44 + 32),
v44 = *((_QWORD *)v43 + 265),
++*(_DWORD *)(v44 + 28),
*(_WORD *)v44 < *(_WORD *)(v44 + 16)) )
{
RtlpInterlockedPushEntrySList((PSLIST_HEADER)v44, (PSLIST_ENTRY)v16);
}
else
{
++*(_DWORD *)(v44 + 32);
(*(void(__fastcall **)(_OBJECT_CREATE_INFORMATION *))(v44 + 56))(v16);
}
goto LABEL_9;
}
if( (v16->Attributes & (_DWORD)v10[9]) != 0 )
{
v20 = -1073741811;
goto LABEL_65;
}
if( (v16->Attributes & 0x10) != 0 && !SeSinglePrivilegeCheck(*(_QWORD *)&SeCreatePermanentPrivilege, 0) )
{
v20 = -1073741727;
goto LABEL_65;
}
v21 = *((_DWORD *)v10 + 27);
v16->PagedPoolCharge = *((_DWORD *)v10 + 26);
v16->NonPagedPoolCharge = v21;
v20 = ObpAllocateObject((int *)v16, v18, (__int64)v10, &CapturedObjectName, 216, &ObjectHeader, &v57);
if( v20 < 0 )
{
LABEL_65:
if( CapturedObjectName.Buffer )
ObpFreeObjectNameBuffer(&CapturedObjectName);
SecurityDescriptor = v16->SecurityDescriptor;
if( SecurityDescriptor )
{
SeReleaseSecurityDescriptor(SecurityDescriptor, v16->ProbeMode, 1u);
v16->SecurityDescriptor = 0i64;
}
v46 = KeGetCurrentPrcb();
v47 = *((_QWORD *)v46 + 264);
++*(_DWORD *)(v47 + 28);
if( *(_WORD *)v47 < *(_WORD *)(v47 + 16)
|| (++*(_DWORD *)(v47 + 32),
v47 = *((_QWORD *)v46 + 265),
++*(_DWORD *)(v47 + 28),
*(_WORD *)v47 < *(_WORD *)(v47 + 16)) )
{
RtlpInterlockedPushEntrySList((PSLIST_HEADER)v47, (PSLIST_ENTRY)v16);
}
else
{
++*(_DWORD *)(v47 + 32);
(*(void(__fastcall **)(_OBJECT_CREATE_INFORMATION *))(v47 + 56))(v16);
}
goto LABEL_9;
}
v22 = ObjectHeader;
if( ObpTraceFlags )
{
ObpRegisterObject(ObjectHeader);
ObpPushStackInfo((INT64)v22, 1, 1i64, 1953261124i64);
}
p_Body = (_FILE_OBJECT *)&v22->Body;
LABEL_9:
TransactionParameters = v20;
if( v20 < 0 )
goto LABEL_56;
memset((INT64)p_Body, 0i64);
v24 = Op;
if( (_BYTE)CopyOldFileObject )
{
p_Body->FsContext = (*FileObject)->FsContext;
p_Body->FsContext2 = (*FileObject)->FsContext2;
p_Body->FileName.Length = (*FileObject)->FileName.Length;
p_Body->FileName.MaximumLength = (*FileObject)->FileName.MaximumLength;
p_Body->FileName.Buffer = (*FileObject)->FileName.Buffer;
FileObjectExtension = (*FileObject)->FileObjectExtension;
if( FileObjectExtension )
p_Body->FileObjectExtension = FileObjectExtension;
}
else
{
v25 = DesiredAccess;
v26 = ExtendedParameters;
if( (Op->InternalFlags & 0x47) == 0
&& PsIsHostSilo(ExtendedParameters->Silo)
&& ((RelatedFileObject = v24->RelatedFileObject) == 0i64
|| (Silo = IoGetSilo(RelatedFileObject), PsIsHostSilo(Silo))) )
{
v28 = DeviceObject;
}
else
{
v37 = v26;
LODWORD(ObjectCreateInfo) = v25;
v28 = DeviceObject;
TransactionParameters = IopAllocateFoExtensionsOnCreate(p_Body, DeviceObject, v24, v37, (UINT64)ObjectCreateInfo);
}
if( TransactionParameters >= 0 )
{
if( v18 )
{
if( (v24->InternalFlags & 0x20) != 0 )
{
if( (*((_DWORD *)v28 + 12) & 0x40000) != 0
|| (v34 = *((unsigned int *)v28 + 18), (unsigned int)v34 <= 0x35)
&& (v35 = 0x20000100100108i64, _bittest64(&v35, v34)) )
{
TransactionParameters = IopRetrieveTransactionParameters(v28, (INT64)v24, v25, p_Body);
}
}
}
if( TransactionParameters >= 0 && v18 && (v24->CreateOptions & 0x20000) != 0 )
TransactionParameters = IopCheckInitiatorHint(p_Body, v24->RelatedFileObject);
}
v14 = ParseDeviceObject;
}
*FileObject = p_Body;
if( !v24->DeleteOnly && !v24->QueryOnly )
{
if( (v24->CreateOptions & 0x30) != 0 )
{
v29 = p_Body->Flags | 2;
p_Body->Flags = v29;
if( (v24->CreateOptions & 0x10) != 0 )
p_Body->Flags = v29 | 4;
}
if( (p_Body->Flags & 2) != 0 )
{
KeInitializeEvent(&p_Body->Lock, SynchronizationEvent, 0);
p_Body->Waiters = 0;
p_Body->CurrentByteOffset.QuadPart = 0i64;
}
CreateOptions = v24->CreateOptions;
if( (CreateOptions & 8) != 0 )
{
p_Body->Flags |= 8u;
CreateOptions = v24->CreateOptions;
}
if( (CreateOptions & 2) != 0 )
{
p_Body->Flags |= 0x10u;
CreateOptions = v24->CreateOptions;
}
if( (CreateOptions & 4) != 0 )
{
p_Body->Flags |= 0x20u;
CreateOptions = v24->CreateOptions;
}
if( (CreateOptions & 0x800) != 0 )
{
p_Body->Flags |= 0x100000u;
CreateOptions = v24->CreateOptions;
}
if( (CreateOptions & 0x20000) != 0 )
p_Body->Flags |= 0x2000000u;
}
if( (v12 & 0x40) == 0 )
p_Body->Flags |= 0x20000u;
*(_DWORD *)&p_Body->Type = 14155781;
p_Body->RelatedFileObject = v24->RelatedFileObject;
p_Body->DeviceObject = v14;
p_Body->IrpListLock = 0i64;
p_IrpList = &p_Body->IrpList;
p_IrpList->Blink = p_IrpList;
p_IrpList->Flink = p_IrpList;
return(unsigned int)TransactionParameters;
}Referenced by:
IopParseDevice