AlpcpCreateClientPort
INT64 __fastcall AlpcpCreateClientPort(
VOID **ClientPortHandle,
_ALPC_PORT **ClientPortObject,
UINT64 Flags,
_UNICODE_STRING *ConnectionPortName,
_OBJECT_ATTRIBUTES *ConnectionPortObjectAttributes,
_OBJECT_ATTRIBUTES *ClientPortObjectAttributes,
_ALPC_PORT_ATTRIBUTES *CapturedPortAttributes,
VOID *ServerSecurityRequirements,
VOID *CapturedServerSid,
_SECURITY_QUALITY_OF_SERVICE *CapturedSecurityQos,
UINT8 LegacyPort){
_EPROCESS *DmaOperations;
char v12;
INT64 result;
PADAPTER_OBJECT v14;
int v15;
INT64 *v16;
int v17;
__int64 v18;
char v19;
_DWORD *v20;
int v21;
_DWORD *v22;
CHAR *Blob;
__int64 *v24;
__int64 v25;
__int64 *v26;
__int64 **v27;
__int64 v28;
int Message;
PADAPTER_OBJECT v30;
NTSTATUS inserted;
VOID *v32;
volatile signed __int64 *v33;
INT64 Flagsa;
UINT64 Flagsb;
UINT64 Flagsc;
INT64 Waitable;
INT64 v38;
PADAPTER_OBJECT DmaAdapter;
PVOID Object;
CHAR *v41;
PVOID Handle;
int v45;
char ConnectionPortObjectAttributesa;
v45 = Flags;
DmaOperations = 0i64;
Object = 0i64;
DmaAdapter = 0i64;
v12 = *((_BYTE *)KeGetCurrentThread() + 562);
Handle = 0i64;
if( ConnectionPortObjectAttributes )
{
LOBYTE(Flagsa) = v12;
result = ObReferenceObjectByNameEx(
(__int64)ConnectionPortObjectAttributes,
0i64,
1u,
(__int64)AlpcPortObjectType,
Flagsa,
0i64,
&DmaAdapter);
}
else
{
LODWORD(result) = ObReferenceObjectByName(
(unsigned __int64)ConnectionPortName,
0,
0i64,
1u,
(__int64)AlpcPortObjectType,
v12,
0i64,
&DmaAdapter);
}
if( (int)result >= 0 )
{
v14 = DmaAdapter;
v15 = *(_DWORD *)&DmaAdapter[26].Version;
if( (v15 & 6) == 2 )
{
if( !LegacyPort && (v15 & 0x1000) != 0 )
{
v33 = (volatile signed __int64 *)&DmaAdapter[22];
ExAcquirePushLockExclusiveEx((UINT64)&DmaAdapter[22], 0i64);
*(_DWORD *)&v14[26].Version &= ~0x2000u;
if( (_InterlockedExchangeAdd64(v33, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)&v14[22]);
KeAbPostRelease(&v14[22]);
v14 = DmaAdapter;
}
if( !CapturedServerSid && !ServerSecurityRequirements )
goto LABEL_60;
v16 = (INT64 *)&v14[22];
ExAcquirePushLockSharedEx((UINT64)&v14[22], 0i64);
if( ((__int64)v14[1].DmaOperations & 1) == 0 )
DmaOperations = (_EPROCESS *)v14[1].DmaOperations;
if( DmaOperations )
ObfReferenceObjectWithTag(DmaOperations, 0x63706C41u);
if( _InterlockedCompareExchange64(v16, 0i64, 17i64) != 17 )
ExfReleasePushLockShared(v16);
KeAbPostRelease(v16);
if( DmaOperations )
{
v17 = AlpcpCheckConnectionSecurity(DmaOperations, v12, CapturedServerSid, ServerSecurityRequirements);
ObfDereferenceObjectWithTag(DmaOperations, 0x63706C41ui64);
}
else
{
v17 = -1073741152;
}
v14 = DmaAdapter;
if( v17 >= 0 )
{
LABEL_60:
v17 = AlpcpCreatePort(v12, (INT64)ClientPortObjectAttributes, &Object);
if( v17 >= 0 )
{
if( !CapturedPortAttributes || (v19 = 1, (CapturedPortAttributes->Flags & 0x40000) == 0) )
v19 = 0;
v20 = Object;
LOBYTE(v18) = v19;
ConnectionPortObjectAttributesa = v19;
v21 = AlpcpInitializePort(Object, 2i64, v18);
if( v21 >= 0 )
{
v22 = v20 + 104;
v20[104] |= 8u;
Blob = AlpcpAllocateBlob(&AlpcConnectionType, 0x50ui64, 1ui64);
v41 = Blob;
if( Blob )
{
*((_QWORD *)v20 + 2) = Blob;
v24 = (__int64 *)(Blob + 72);
*((_QWORD *)Blob + 9) = 0i64;
*((_QWORD *)Blob + 1) = 0i64;
*(_QWORD *)Blob = v14;
*((_QWORD *)Blob + 2) = v20;
ExAcquirePushLockExclusiveEx(*(_QWORD *)&v14[1].Version - 16i64, 0i64);
ExAcquirePushLockExclusiveEx((UINT64)&v14[22], 0i64);
v25 = *(_QWORD *)&v14[1].Version + 24i64;
v26 = (__int64 *)(v41 + 24);
v27 = *(__int64 ***)(*(_QWORD *)&v14[1].Version + 32i64);
if( *v27 != (__int64 *)v25 )
__fastfail(3u);
*v26 = v25;
v26[1] = (__int64)v27;
*v27 = v26;
*(_QWORD *)(v25 + 8) = v26;
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&v14[22], 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)&v14[22]);
KeAbPostRelease(&v14[22]);
v28 = *(_QWORD *)&v14[1].Version;
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)(v28 - 16), 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)(v28 - 16));
KeAbPostRelease((PVOID)(v28 - 16));
Message = AlpcInitializeHandleTable((INT64)(v41 + 40));
v20 = Object;
if( Message >= 0 )
{
v30 = DmaAdapter;
LOBYTE(v38) = LegacyPort;
LOBYTE(Waitable) = ConnectionPortObjectAttributesa;
LODWORD(Flagsb) = 0;
Message = AlpcpValidateAndSetPortAttributes(
(_ALPC_PORT *)Object,
CapturedPortAttributes,
(_ALPC_PORT *)DmaAdapter,
CapturedSecurityQos,
Flagsb,
Waitable,
v38);
if( Message >= 0 )
{
Message = AlpcpAllocateMessage(v24, 0x30ui64, 1ui64);
if( Message >= 0 )
{
++*(_WORD *)(*v24 - 30);
*(_DWORD *)(*v24 + 264) |= 0x80000000;
AlpcpUnlockMessage(*v24);
if( LegacyPort )
*v22 |= 0x1000u;
if( (v45 & 0x80000) != 0 )
*v22 |= 0x100u;
if( *((_BYTE *)v20 + 268) == 1 )
{
*v22 |= 0x400u;
LABEL_38:
AlpcpSetOwnerProcessPort((_ALPC_PORT *)v20, CapturedPortAttributes);
if( (*(_DWORD *)&v30[16].Version & 0x1000000) != 0 )
{
v20[64] |= 0x1000000u;
*((_QWORD *)v20 + 34) = *(_QWORD *)&v30[17].Version;
}
ObfReferenceObject(v20);
LODWORD(Flagsc) = 0;
inserted = ObInsertObjectEx(v20, 0i64, 0x1F0001ui64, 0i64, Flagsc, 0i64, &Handle);
if( inserted >= 0 )
{
v32 = Handle;
*((_QWORD *)v20 + 7) = Handle;
*ClientPortHandle = v32;
*ClientPortObject = (_ALPC_PORT *)v20;
return(unsigned int)inserted;
}
v21 = inserted;
LABEL_57:
HalPutDmaAdapter((PADAPTER_OBJECT)v20);
return(unsigned int)v21;
}
v20 = Object;
Message = SeCreateClientSecurity(
KeGetCurrentThread(),
(PSECURITY_QUALITY_OF_SERVICE)((char *)Object + 260),
0,
(PSECURITY_CLIENT_CONTEXT)((char *)Object + 64));
if( Message >= 0 )
{
v30 = DmaAdapter;
goto LABEL_38;
}
}
}
}
v21 = Message;
goto LABEL_57;
}
v21 = -1073741801;
}
HalPutDmaAdapter(v14);
goto LABEL_57;
}
}
}
else
{
v17 = -1073741758;
}
HalPutDmaAdapter(v14);
return(unsigned int)v17;
}
return result;
}Referenced by:
AlpcpConnectPort
NtSecureConnectPort