PsDispatchIumService
VOID __fastcall PsDispatchIumService(INT64 a1, INT64 a2, INT64 a3, UINT64 a4){
VOID(__stdcall *v5)(LPCGUID, UINT32, UINT8, ULONGLONG, ULONGLONG, PEVENT_FILTER_DESCRIPTOR, PVOID);
unsigned int v6;
unsigned int v7;
unsigned int v8;
unsigned int v9;
unsigned int v10;
int PartitionState;
__int64 v12;
unsigned int v13;
unsigned int v14;
unsigned int v15;
unsigned int v16;
_ETHREAD *CurrentThread;
_EPROCESS *v18;
_KPROCESS *v19;
unsigned __int64 v20;
int VirtualMemory;
int v22;
unsigned int v23;
unsigned int v24;
unsigned int v25;
unsigned int v26;
_EPROCESS *v27;
_KPROCESS *v28;
int v29;
_KPROCESS *v30;
void *v31;
unsigned int v32;
unsigned int v33;
unsigned int v34;
GUID *v35;
unsigned int v36;
unsigned int v37;
unsigned int v38;
unsigned int v39;
struct _MDL *v40;
struct _MDL *v41;
struct _MDL *PoolWithTag;
struct _MDL *v43;
__int16 MdlFlags;
struct _MDL *v45;
int SecurePool;
INT64 v47;
UINT64 v48;
unsigned int v49;
unsigned int v50;
unsigned int v51;
unsigned int v52;
unsigned __int64 v53;
unsigned int v54;
unsigned int v55;
unsigned int v56;
unsigned int v57;
unsigned int v58;
unsigned int v59;
unsigned int v60;
LPCGUID ActivityId;
LPCGUID RelatedActivityId;
UINT64 UserDataCount;
char OldIrql[8];
ULONGLONG RegHandle[2];
__int128 v66;
__int128 v67;
__int64 v68;
_KAPC_STATE ApcState;
INT64 result[34];
__int128 v71[5];
__int64 v72;
int v73;
__int16 v74;
char v75;
RegHandle[1] = a1;
memset(&ApcState, 0, sizeof(ApcState));
v5 = 0i64;
OldIrql[0] = 0;
v66 = 0i64;
v67 = 0i64;
v68 = 0i64;
if( *(_BYTE *)(a1 + 1) == 5 )
{
if( *(_QWORD *)(a1 + 8) )
ZwTerminateProcess((PVOID)0xFFFFFFFFFFFFFFFFi64, *(unsigned int *)(a1 + 16));
else
PspTerminateThreadByPointer((ULONG_PTR)KeGetCurrentThread(), 0, 1);
}
v6 = *(unsigned __int16 *)(a1 + 2);
if( v6 > 0x17 )
{
if( v6 > 0x23 )
{
if( v6 <= 0x29 )
{
if( v6 == 41 )
{
MmUpdateSlabRangeProtection(*(PVOID *)(a1 + 8), *(PVOID *)(a1 + 16), (PVOID)*(unsigned int *)(a1 + 24));
return;
}
v54 = v6 - 36;
if( !v54 )
{
HalPutDmaAdapter(*(PADAPTER_OBJECT *)(a1 + 8));
return;
}
v55 = v54 - 1;
if( !v55 )
{
KeSetEvent(*(PRKEVENT *)(a1 + 8), 0);
return;
}
v56 = v55 - 1;
if( v56 )
{
v57 = v56 - 1;
if( v57 )
{
if( v57 == 1 )
{
PsTerminateVsmEnclave(*(_QWORD *)(a1 + 8), 0x80000000i64);
return;
}
goto LABEL_139;
}
*(_QWORD *)(a1 + 24) = 0i64;
if( PspIumReplenishPartitionPages(*(_QWORD *)(a1 + 8), *(unsigned int *)(a1 + 16)) )
*(_QWORD *)(a1 + 24) = 1i64;
return;
}
if( !*(_QWORD *)(a1 + 8) )
{
PspIumFreePartitionState(*(PVOID *)(a1 + 16));
return;
}
PartitionState = PspIumAllocatePartitionState(a1);
goto LABEL_22;
}
v58 = v6 - 42;
if( !v58 )
{
ExQueueWorkItem(&PspIumWorkItem, DelayedWorkQueue);
return;
}
v59 = v58 - 1;
if( !v59 )
{
PartitionState = PsAdjustBasicEnclaveThreadList(
*(_QWORD *)(a1 + 8),
*(_QWORD *)(a1 + 16),
*(unsigned int *)(a1 + 24));
goto LABEL_22;
}
v60 = v59 - 1;
if( v60 )
{
if( v60 == 1 )
{
MmFreeSecurePoolMemory(*(PVOID *)(a1 + 24), *(PVOID *)(a1 + 32));
return;
}
goto LABEL_139;
}
SecurePool = PspIumAllocateSecurePool(a1);
}
else
{
if( v6 == 35 )
{
PartitionState = PspMapView(a1);
goto LABEL_22;
}
if( v6 > 0x1D )
{
v49 = v6 - 30;
if( v49 )
{
v50 = v49 - 1;
if( v50 )
{
v51 = v50 - 1;
if( v51 )
{
v52 = v51 - 1;
if( !v52 )
{
LODWORD(ActivityId) = *(_DWORD *)(a1 + 40);
DbgkPostModuleMessage(
*(PVOID *)(a1 + 8),
*(PVOID *)(a1 + 16),
*(PVOID *)(a1 + 24),
*(unsigned int *)(a1 + 32),
(INT64)ActivityId,
*(KEVENT **)(a1 + 48));
return;
}
if( v52 == 1 )
{
DbgkMapViewOfSection(
*(_EPROCESS **)(a1 + 8),
*(PVOID *)(a1 + 16),
*(PVOID *)(a1 + 24),
a4,
(UINT64)ActivityId);
return;
}
goto LABEL_139;
}
if( *(_QWORD *)(a1 + 8) )
{
MmLockLoadedModuleListExclusive((UINT8 *)OldIrql);
}
else
{
v53 = *(unsigned __int8 *)(a1 + 16);
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)PsLoadedModuleSpinLock);
__writecr8(v53);
}
return;
}
PartitionState = MmUnmapViewOfSection(PsSecureSystemProcess, *(_QWORD *)(a1 + 8));
}
else
{
PartitionState = MmMapViewOfSection(*(_LOADER_PARAMETER_BLOCK **)(a1 + 8), PsSecureSystemProcess);
}
goto LABEL_22;
}
if( v6 == 29 )
{
v47 = *(_QWORD *)(a1 + 24);
v48 = *(_QWORD *)(a1 + 8);
if( v47 )
MmMapHotPatchTablePage(v48, *(_QWORD *)(a1 + 16), v47);
else
MmChangeKernelCfgBitmap(v48);
return;
}
v36 = v6 - 24;
if( !v36 )
{
PartitionState = HvlpDepositPages(0);
goto LABEL_22;
}
v37 = v36 - 1;
if( v37 )
{
v38 = v37 - 1;
if( v38 )
{
v39 = v38 - 1;
if( !v39 )
{
PoolWithTag = (struct _MDL *)ExAllocatePoolWithTag(NonPagedPoolNx, 0x38ui64, 0x646C6D4Dui64);
v43 = PoolWithTag;
if( PoolWithTag )
{
PoolWithTag->Next = 0i64;
*(_DWORD *)&PoolWithTag->Size = 56;
PoolWithTag->StartVa = 0i64;
*(_QWORD *)&PoolWithTag->ByteCount = 4096i64;
PoolWithTag[1].Next = *(_MDL **)(a1 + 8);
PoolWithTag->MdlFlags |= 2u;
MdlFlags = PoolWithTag->MdlFlags;
if( (MdlFlags & 5) == 0 )
{
MmMapLockedPagesSpecifyCache(v43, 0, MmCached, 0i64, 0, 0x40000010u);
MdlFlags = v43->MdlFlags;
}
if( (MdlFlags & 1) != 0 )
{
*(_QWORD *)(a1 + 8) = 0i64;
*(_QWORD *)(a1 + 16) = v43;
*(_QWORD *)(a1 + 24) = v43->MappedSystemVa;
return;
}
ExFreePoolWithTag(v43, 0);
}
v12 = 3221225626i64;
LABEL_25:
*(_QWORD *)(a1 + 8) = v12;
return;
}
if( v39 != 1 )
goto LABEL_139;
v40 = *(struct _MDL **)(a1 + 8);
MmUnmapLockedPages(v40->MappedSystemVa, v40);
v41 = v40;
}
else
{
LODWORD(v45) = VslFreePoolTransferObject(*(PVOID *)(a1 + 8));
v41 = v45;
}
ExFreePoolWithTag(v41, 0);
return;
}
SecurePool = VslAllocatePool(*(_QWORD *)(a1 + 8), *(_DWORD *)(a1 + 16), a1 + 16);
}
*(_DWORD *)(a1 + 8) = SecurePool;
return;
}
if( v6 == 23 )
{
VslHandleKsrCall(a1);
return;
}
if( v6 > 0xC )
{
if( v6 <= 0x12 )
{
if( v6 == 18 )
{
RegHandle[0] = 0i64;
v31 = *(void **)(a1 + 24);
if( v31 )
v5 = VslIumEtwEnableCallback;
*(_QWORD *)(a1 + 8) = EtwRegister((LPCGUID)(a1 + 8), v5, v31, RegHandle);
*(_QWORD *)(a1 + 16) = RegHandle[0];
return;
}
v23 = v6 - 13;
if( v23 )
{
v24 = v23 - 1;
if( !v24 )
{
v27 = (_EPROCESS *)*((_QWORD *)KeGetCurrentThread() + 23);
v28 = *(_EPROCESS **)(a1 + 8);
if( v27 != v28 )
{
KiStackAttachProcess((_KPROCESS *)v28, 0i64, &ApcState);
v28 = *(_EPROCESS **)(a1 + 8);
}
LODWORD(ActivityId) = *(_DWORD *)(a1 + 40);
v29 = MmProtectVirtualMemory(
*(VOID **)(a1 + 16),
(LARGE_INTEGER *)v28,
(INT64 *)(a1 + 24),
(UINT64 *)(a1 + 32),
(INT64)ActivityId,
(KENLISTMENT *)(a1 + 40));
if( v27 != *(_EPROCESS **)(a1 + 8) )
KiUnstackDetachProcess(&ApcState, 0i64);
*(_DWORD *)(a1 + 8) = v29;
return;
}
v25 = v24 - 1;
if( !v25 )
{
LOBYTE(v12) = DbgkpSuspendProcess(*(_EPROCESS **)(a1 + 8));
goto LABEL_24;
}
v26 = v25 - 1;
if( !v26 )
{
DbgkpResumeProcess(*(_QWORD *)(a1 + 8));
return;
}
if( v26 != 1 )
goto LABEL_139;
memset((INT64)result, 0i64);
PartitionState = DbgkpSendErrorMessage(*(_QWORD *)(a1 + 8), *(_DWORD *)(a1 + 16), (__int64)result);
goto LABEL_22;
}
v18 = (_EPROCESS *)*((_QWORD *)KeGetCurrentThread() + 23);
v30 = *(_EPROCESS **)(a1 + 8);
if( v18 != v30 )
KiStackAttachProcess((_KPROCESS *)v30, 0i64, &ApcState);
LODWORD(RelatedActivityId) = 0x10000000;
VirtualMemory = MmFreeVirtualMemory(
-1i64,
(UINT64 *)(a1 + 24),
(INT64 *)(a1 + 32),
*(unsigned int *)(a1 + 40),
0,
(INT64)RelatedActivityId);
LABEL_42:
v22 = VirtualMemory;
if( v18 != *(_EPROCESS **)(a1 + 8) )
KiUnstackDetachProcess(&ApcState, 0i64);
*(_DWORD *)(a1 + 8) = v22;
return;
}
v32 = v6 - 19;
if( !v32 )
{
PartitionState = EtwUnregister(*(_QWORD *)(a1 + 8));
goto LABEL_22;
}
v33 = v32 - 1;
if( !v33 )
{
PartitionState = EtwSetInformation(
*(_QWORD *)(a1 + 8),
(EVENT_INFO_CLASS)*(_DWORD *)(a1 + 16),
*(PVOID *)(a1 + 24),
*(unsigned int *)(a1 + 32));
goto LABEL_22;
}
v34 = v33 - 1;
if( !v34 )
{
v35 = (GUID *)(a1 + 32);
if( !*(_QWORD *)(a1 + 32) && !*(_QWORD *)(a1 + 40) )
v35 = 0i64;
if( *(_QWORD *)(a1 + 48) || *(_QWORD *)(a1 + 56) )
v5 = (VOID(__stdcall *)(LPCGUID, UINT32, UINT8, ULONGLONG, ULONGLONG, PEVENT_FILTER_DESCRIPTOR, PVOID))(a1 + 48);
LODWORD(UserDataCount) = *(_DWORD *)(a1 + 64);
PartitionState = EtwWriteEx(
*(_QWORD *)(a1 + 8),
(EVENT_DESCRIPTOR *)(a1 + 16),
0i64,
0i64,
v35,
(GUID *)v5,
UserDataCount,
*(EVENT_DATA_DESCRIPTOR **)(a1 + 72));
goto LABEL_22;
}
if( v34 == 1 )
{
PartitionState = PspIumVerifyParentSd(*(unsigned int *)(a1 + 8), a2, *(PVOID **)(a1 + 24));
goto LABEL_22;
}
LABEL_139:
PspTerminateThreadByPointer((ULONG_PTR)KeGetCurrentThread(), -1073741819, 1);
return;
}
if( v6 == 12 )
{
v18 = (_EPROCESS *)*((_QWORD *)KeGetCurrentThread() + 23);
v19 = *(_EPROCESS **)(a1 + 8);
if( v18 != v19 )
KiStackAttachProcess((_KPROCESS *)v19, 0i64, &ApcState);
v20 = *(_QWORD *)(a1 + 48);
if( v20 || *(_QWORD *)(a1 + 56) )
{
*(_QWORD *)&v66 = 1i64;
*((_QWORD *)&v66 + 1) = &v67;
v67 = v20;
v68 = *(_QWORD *)(a1 + 56);
}
VirtualMemory = MmAllocateVirtualMemory(
(PVOID *)0xFFFFFFFFFFFFFFFFi64,
a1 + 24,
(UINT64 *)(a1 + 32),
*(unsigned int *)(a1 + 40));
goto LABEL_42;
}
if( v6 > 6 )
{
v13 = v6 - 7;
if( !v13 )
{
LOBYTE(v12) = KeAlertThreadByThreadId(*(_QWORD *)(a1 + 8));
goto LABEL_24;
}
v14 = v13 - 1;
if( v14 )
{
v15 = v14 - 1;
if( !v15 )
{
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
KeLeaveCriticalRegion();
return;
}
v16 = v15 - 1;
if( !v16 )
{
memmove(*(UINT8 **)(a1 + 8), *(UINT8 **)(a1 + 16), *(unsigned int *)(a1 + 24));
*(_QWORD *)(a1 + 8) = 0i64;
return;
}
if( v16 != 1 )
goto LABEL_139;
PartitionState = MmGetSectionStrongImageReference(
*(VOID **)(a1 + 8),
*(_BYTE *)(a1 + 24),
0i64,
(_QWORD *)(a1 + 16));
}
else
{
PartitionState = KeWaitForAlertByThreadId(
*(_BYTE *)(a1 + 8),
(LARGE_INTEGER *)((a1 + 24) & ((unsigned __int128)-(__int128)*(unsigned __int64 *)(a1 + 16) >> 64)),
0i64);
}
LABEL_22:
*(_QWORD *)(a1 + 8) = PartitionState;
return;
}
if( v6 == 6 )
{
LOBYTE(v12) = DbgkForwardException(*(EXCEPTION_RECORD **)(a1 + 8), *(_BYTE *)(a1 + 16), *(_BYTE *)(a1 + 24));
LABEL_24:
v12 = (unsigned __int8)v12;
goto LABEL_25;
}
v7 = v6 - 1;
if( !v7 )
{
PartitionState = PspIumAllocatePhysicalPages(
*(unsigned int *)(a1 + 8),
*(VOID **)(a1 + 16),
*(unsigned int *)(a1 + 24),
(INT64 *)(a1 + 16),
(_DWORD *)(a1 + 24));
goto LABEL_22;
}
v8 = v7 - 1;
if( !v8 )
{
PspIumFreePhysicalPages(*(_QWORD *)(a1 + 16), *(unsigned int *)(a1 + 24), *(_QWORD *)(a1 + 8));
return;
}
v9 = v8 - 1;
if( v9 )
{
v10 = v9 - 1;
if( !v10 )
{
PspIumGetPhysicalPage(a1);
return;
}
if( v10 == 1 )
{
PspIumGetSystemData((_DWORD *)a1);
return;
}
goto LABEL_139;
}
v71[0] = *(_OWORD *)(a1 + 10);
v71[1] = *(_OWORD *)(a1 + 26);
v71[2] = *(_OWORD *)(a1 + 42);
v71[3] = *(_OWORD *)(a1 + 58);
v71[4] = *(_OWORD *)(a1 + 74);
v72 = *(_QWORD *)(a1 + 90);
v73 = *(_DWORD *)(a1 + 98);
v74 = *(_WORD *)(a1 + 102);
v75 = 0;
DbgPrintEx(
0,
0,
"IUM [VP:%u,TK:%#02x,LN:%04u] %s\n",
*(unsigned __int16 *)(a1 + 8) >> 13,
*(_DWORD *)(a1 + 4),
(*(unsigned __int16 *)(a1 + 8) >> 1) & 0xFFF,
(const char *)v71);
if( (*(_BYTE *)(a1 + 8) & 1) != 0 )
__debugbreak();
}Referenced by:
VslpEnterIumSecureMode