IopValidateJunctionTarget

INT64 __stdcall IopValidateJunctionTarget(
        PVOID InputBuffer,
        UINT64 InputBufferLength,
        UINT64 OutputBufferLength,
        PVOID *VerifiedInputBuffer,
        UINT64 *VerifiedInputLength){
  UINT64 v5; 
  int v7; 
  void *v8; 
  wchar_t *PoolWithTag; 
  unsigned int v10; 
  UINT8 *PoolWithQuota_1; 
  UINT8 *v12; 
  UINT64 v13; 
  _REPARSE_DATA_BUFFER *v14; 
  int v15; 
  int appended; 
  _DMA_OPERATIONS *DmaOperations; 
  char v18; 
  unsigned int v19; 
  int v20; 
  unsigned int v21; 
  unsigned int v22; 
  unsigned int v23; 
  _OWORD *v24; 
  _OWORD *v25; 
  unsigned int Length; 
  char v28; 
  UNICODE_STRING v29; 
  UINT64 ReturnedLength; 
  PADAPTER_OBJECT DmaAdapter; 
  struct _UNICODE_STRING DestinationString; 
  UINT8 *v33; 
  UNICODE_STRING String2; 
  int v35; 
  _OWORD *v36; 
  void *FileHandle; 
  struct _UNICODE_STRING Destination; 
  UNICODE_STRING String1; 
  UNICODE_STRING EventHandle; 
  UNICODE_STRING Source; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  struct _IO_STATUS_BLOCK IoStatusBlock; 
  int v44; 
  int v46; 
  unsigned int v47; 
  unsigned int *v48; 
  v47 = (unsigned int)VerifiedInputBuffer;
  v46 = OutputBufferLength;
  v44 = (int)InputBuffer;
  v5 = (unsigned int)OutputBufferLength;
  v7 = (int)InputBuffer;
  String2 = 0i64;
  *(_QWORD *)&Source.Length = 1572886i64;
  Source.Buffer = L"\\??\\Global\\";
  *(_QWORD *)&EventHandle.Length = 2359330i64;
  EventHandle.Buffer = L"\\??\\Global\\Volume";
  IoStatusBlock = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  Destination = 0i64;
  DestinationString = 0i64;
  *(_QWORD *)&String1.Length = 1441812i64;
  String1.Buffer = (wchar_t *)L"\\??\\Volume";
  v33 = 0i64;
  v8 = 0i64;
  v36 = 0i64;
  FileHandle = 0i64;
  DmaAdapter = 0i64;
  PoolWithTag = 0i64;
  RtlInitUnicodeString(&DestinationString, 0i64, OutputBufferLength);
  if( v7 == 590860 )
  {
    v10 = v5 - 32;
    v35 = v5 - 32;
    PoolWithQuota_1 = (UINT8 *)IopVerifierExAllocatePoolWithQuota_1(NonPagedPoolNx, (unsigned int)(v5 - 32));
    v12 = (UINT8 *)(InputBufferLength + 32);
    v13 = (unsigned int)(v5 - 32);
  }
  else
  {
    v10 = v5;
    v35 = v5;
    PoolWithQuota_1 = (UINT8 *)IopVerifierExAllocatePoolWithQuota_1(NonPagedPoolNx, v5);
    v13 = v5;
    v12 = (UINT8 *)InputBufferLength;
  }
  v14 = (_REPARSE_DATA_BUFFER *)PoolWithQuota_1;
  v33 = PoolWithQuota_1;
  memmove(PoolWithQuota_1, v12, v13);
  FsRtlValidateReparsePointBuffer(v10, v14);
  appended = v15;
  if( v15 >= 0 )
  {
    String2.Buffer = v14->MountPointReparseBuffer.PathBuffer;
    String2.Length = v14->SymbolicLinkReparseBuffer.SubstituteNameLength & 0xFFFE;
    String2.MaximumLength = String2.Length;
    ObjectAttributes.Length = 48;
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.Attributes = 1536;
    ObjectAttributes.ObjectName = &String2;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    appended = ZwOpenFile((UNICODE_STRING *)&FileHandle, (PWCHAR)0x120116);
    if( appended >= 0 )
    {
      appended = IopReferenceFileObject(FileHandle, 0i64, 0, (FILE_OBJECT **)&DmaAdapter, 0i64);
      if( appended >= 0 )
      {
        DmaOperations = DmaAdapter->DmaOperations;
        if( (HIDWORD(DmaOperations->FreeAdapterChannel) & 0x10) != 0 )
        {
LABEL_8:
          appended = -1073741811;
          goto LABEL_46;
        }
        v18 = 0;
        v28 = 0;
        if( (unsigned __int8)RtlPrefixUnicodeString(&String1, (INT64 *)&String2)
          || (unsigned __int8)RtlPrefixUnicodeString(&EventHandle, (INT64 *)&String2)
          || (appended = IoVolumeDeviceToDosName(DmaOperations, &DestinationString), appended < 0) )
        {
          v18 = 1;
          v28 = 1;
        }
        if( v18 )
          appended = IoVolumeDeviceToGuidPath(DmaAdapter->DmaOperations, &DestinationString);
        if( appended >= 0 )
        {
          v19 = String2.Length + 8;
          do
          {
            PoolWithTag = (wchar_t *)ExAllocatePoolWithTag(NonPagedPoolNx, v19, 0x65546F49ui64);
            *(_QWORD *)&v29.Length = PoolWithTag;
            if( !PoolWithTag )
            {
              appended = -1073741670;
              goto LABEL_46;
            }
            appended = IopQueryXxxInformation(
                         (FILE_OBJECT *)DmaAdapter,
                         9ui64,
                         v19,
                         0,
                         PoolWithTag,
                         &ReturnedLength,
                         1u);
            if( appended == -2147483643 )
            {
              v19 = *(_DWORD *)PoolWithTag + 8;
              ExFreePoolWithTag(PoolWithTag, 0);
              PoolWithTag = 0i64;
              *(_QWORD *)&v29.Length = 0i64;
            }
          }
          while( appended == -2147483643 );
          if( appended < 0 )
            goto LABEL_46;
          if( !*(_DWORD *)PoolWithTag || PoolWithTag[2] != 92 )
            goto LABEL_8;
          v20 = DestinationString.Length + *(_DWORD *)PoolWithTag + 14;
          if( !v28 )
            v20 = DestinationString.Length + *(_DWORD *)PoolWithTag + 22;
          v21 = v20 - 2;
          if( DestinationString.Buffer[((unsigned __int64)DestinationString.Length >> 1) - 1] != 92 )
            v21 = v20;
          if( v21 >= 0xFFFD )
            goto LABEL_8;
          v22 = v46 + v21 - String2.Length;
          v23 = v47;
          if( v22 > v47 )
            v23 = v46 + v21 - String2.Length;
          v24 = IopVerifierExAllocatePoolWithQuota_1(NonPagedPoolNx, v23);
          v8 = v24;
          v36 = v24;
          if( v44 == 590860 )
          {
            *v24 = *(_OWORD *)InputBufferLength;
            v24[1] = *(_OWORD *)(InputBufferLength + 16);
            v25 = v24 + 2;
            LODWORD(ReturnedLength) = v22 - 32;
          }
          else
          {
            v25 = v24;
            LODWORD(ReturnedLength) = v22;
          }
          Destination.Buffer = (wchar_t *)(v25 + 1);
          Destination.Length = 0;
          Destination.MaximumLength = v21;
          appended = RtlAppendUnicodeStringToString(&Destination, &Source);
          if( appended >= 0 )
          {
            v29 = DestinationString;
            if( v28 )
            {
              v29.Length = DestinationString.Length - 8;
              v29.Buffer += 4;
            }
            if( v29.Buffer[((unsigned __int64)v29.Length >> 1) - 1] == 92 )
              v29.Length -= 2;
            if( !v29.Length || v29.Length > DestinationString.Length )
              goto LABEL_8;
            appended = RtlAppendUnicodeStringToString(&Destination, &v29);
            if( appended >= 0 )
            {
              v29.Buffer = PoolWithTag + 2;
              v29.Length = *PoolWithTag;
              v29.MaximumLength = v29.Length;
              appended = RtlAppendUnicodeStringToString(&Destination, &v29);
              if( appended >= 0 )
              {
                *(_DWORD *)v25 = -1610612733;
                *(_DWORD *)((char *)v25 + 6) = 0;
                *((_WORD *)v25 + 2) = ReturnedLength - 8;
                Length = Destination.Length;
                *((_WORD *)v25 + 5) = Destination.Length;
                *((_WORD *)v25 + ((unsigned __int64)Length >> 1) + 8) = 0;
                LOWORD(Length) = Length + 2;
                *((_WORD *)v25 + 6) = Length;
                memmove(
                  (UINT8 *)v25 + (unsigned __int16)Length + 16,
                  (UINT8 *)&v14->GenericReparseBuffer + v14->SymbolicLinkReparseBuffer.PrintNameOffset + 8,
                  v14->SymbolicLinkReparseBuffer.PrintNameLength + 2i64);
                *((_WORD *)v25 + 7) = v14->SymbolicLinkReparseBuffer.PrintNameLength;
                *VerifiedInputLength = (UINT64)v8;
                *v48 = v22;
                v8 = 0i64;
              }
            }
          }
        }
        else
        {
          DestinationString.Buffer = 0i64;
        }
      }
    }
  }
LABEL_46:
  if( v8 )
    ExFreePoolWithTag(v8, 0);
  if( v14 )
    ExFreePoolWithTag(v14, 0);
  if( PoolWithTag )
    ExFreePoolWithTag(PoolWithTag, 0);
  if( DestinationString.Buffer )
    ExFreePoolWithTag(DestinationString.Buffer, 0);
  if( DmaAdapter )
    HalPutDmaAdapter(DmaAdapter);
  if( FileHandle )
    ZwClose(FileHandle);
  return(unsigned int)appended;
}

Referenced by: