MiResolveImageReferences
INT64 __fastcall MiResolveImageReferences(
void *ImageBase,
_UNICODE_STRING *ImageName,
_UNICODE_STRING *OriginalFileDirectory,
_UNICODE_STRING *NamePrefix,
_LOAD_IMPORTS **LoadedImports){
_UNICODE_STRING *v5;
char *v6;
unsigned int *v7;
unsigned int *v8;
char v9;
UNICODE_STRING *v10;
int v11;
INT8 v12;
_LOAD_IMPORTS *v13;
int v14;
INT8 *v15;
const char *v16;
unsigned int v17;
_DWORD *CurrentApiSetSchema;
PVOID *v19;
__int64 *v20;
PVOID v21;
int v22;
__int64 v23;
IMAGE_THUNK_DATA32 *v24;
IMAGE_THUNK_DATA32 *v25;
UINT64 *v26;
wchar_t *v28;
_UNICODE_STRING *v29;
INT64 v30;
char v31;
char a4[7];
PVOID p_String1;
INT8 *v34;
UINT64 Size;
struct _UNICODE_STRING UnicodeString;
PVOID P[2];
PVOID ImageHandle[2];
UNICODE_STRING String1;
PVOID ImageBaseAddress;
__int64 v41[2];
UNICODE_STRING *ImageFileDirectory;
struct _STRING DestinationString;
v41[0] = 3932218i64;
v41[1] = (__int64)L"\\SystemRoot\\System32\\drivers\\";
v5 = NamePrefix;
*(_QWORD *)&String1.Length = 0i64;
v6 = (char *)*((_QWORD *)ImageBase + 6);
*((_QWORD *)ImageBase + 17) = -2i64;
ImageHandle[0] = 0i64;
ImageBaseAddress = 0i64;
a4[0] = 0;
DestinationString = 0i64;
UnicodeString = 0i64;
*(_OWORD *)P = 0i64;
LODWORD(v7) = RtlImageDirectoryEntryToData(v6, 1u, 1u, &Size);
v8 = v7;
if( !v7 )
return 0i64;
v31 = 0;
p_String1 = 0i64;
v9 = 0;
v34 = 0i64;
v10 = 0i64;
LODWORD(Size) = 0;
String1.Buffer = 0i64;
v11 = MiPrepareImportList(v7, &p_String1);
v13 = (_LOAD_IMPORTS *)p_String1;
v14 = v11;
v15 = 0i64;
if( v14 >= 0 )
{
while( 1 )
{
if( !v8[3] || !*v8 )
{
v26 = MiCompressImportList(&v13->Count);
if( (unsigned int)MiGetSystemRegionType((UINT64)v6) == 1 )
MiSessionLookupImage((UINT64)v6)[3].ParentValue = (unsigned __int64)v26;
else
*((_QWORD *)ImageBase + 17) = v26;
return 0i64;
}
v16 = &v6[v8[3]];
p_String1 = 0i64;
RtlInitAnsiString(&DestinationString, v16, v12);
v17 = 0;
v14 = RtlAnsiStringToUnicodeString(&UnicodeString, &DestinationString, 1u);
if( v14 < 0 )
goto LABEL_67;
if( !UnicodeString.Buffer )
{
LABEL_66:
v14 = -1073741670;
goto LABEL_67;
}
CurrentApiSetSchema = PsQueryCurrentApiSetSchema();
v14 = ApiSetResolveToHost(CurrentApiSetSchema, &UnicodeString.Length, (INT64)ImageName, a4, (INT64)P);
if( v14 < 0 )
goto LABEL_67;
if( a4[0] )
{
RtlFreeAnsiString(&UnicodeString);
if( !LOWORD(P[0]) )
goto LABEL_7;
ImageFileDirectory = (UNICODE_STRING *)v41;
v17 = 0x80000000;
v14 = RtlDuplicateUnicodeString(0i64, (UNICODE_STRING *)P, &UnicodeString);
v15 = 0i64;
if( v14 < 0 )
goto LABEL_68;
}
else
{
ImageFileDirectory = OriginalFileDirectory;
}
if( !v5 || !strnicmp(v16, "ntoskrnl", 8ui64) || !strnicmp(v16, "hal", 3ui64) )
{
String1 = UnicodeString;
}
else
{
String1.MaximumLength = UnicodeString.Length + v5->Length;
LODWORD(v28) = MiAllocatePool((struct _SLIST_ENTRY *)0x100);
String1.Buffer = v28;
if( !v28 )
goto LABEL_66;
String1.Length = 0;
RtlAppendUnicodeStringToString(&String1, v5);
RtlAppendUnicodeStringToString(&String1, &UnicodeString);
v31 = 1;
}
v19 = (PVOID *)PsLoadedModuleList;
p_String1 = &String1;
if( PsLoadedModuleList == &PsLoadedModuleList )
goto LABEL_20;
while( !RtlEqualUnicodeString(&String1, (UNICODE_STRING *)(v19 + 11), 1u) )
{
v19 = (PVOID *)*v19;
if( v19 == &PsLoadedModuleList )
goto LABEL_20;
}
v21 = v19[6];
if( !v21 )
break;
if( ((_DWORD)v19[13] & 0x1000) == 0 )
{
if( (unsigned int)MiGetSystemRegionType((UINT64)v19[6]) == 1 )
{
if( !(unsigned int)MiSessionReferenceImage(v21) )
v21 = 0i64;
}
else if( v19[17] != (PVOID)1 )
{
++*((_WORD *)v19 + 54);
}
}
if( !v21 )
break;
LABEL_31:
if( ((_DWORD)v19[13] & 0x1000) == 0 && v19[17] != (PVOID)1 )
{
v22 = Size;
v13->Entry[(unsigned int)Size] = (PLDR_DATA_TABLE_ENTRY)v19;
LODWORD(Size) = v22 + 1;
}
v23 = *v8;
if( (_DWORD)v23 )
{
v24 = (IMAGE_THUNK_DATA32 *)&v6[v23];
v25 = (IMAGE_THUNK_DATA32 *)&v6[v8[4]];
while( *(_QWORD *)&v24->u1.ForwarderString )
{
v14 = MiSnapThunk(v21, v6, v24, v25, 0i64);
if( v14 < 0 )
{
v15 = MiSnapUnresolvedImport(v6, v24, v21);
goto LABEL_68;
}
v24 += 2;
v25 += 2;
}
}
RtlFreeAnsiString(&UnicodeString);
if( v31 )
{
ExFreePoolWithTag(String1.Buffer, 0);
v31 = 0;
}
v5 = NamePrefix;
LABEL_7:
v8 += 5;
}
v5 = NamePrefix;
LABEL_20:
v20 = (__int64 *)ImageFileDirectory;
if( !(unsigned int)MiFormFullImageName(ImageFileDirectory, &UnicodeString, (UNICODE_STRING *)P) )
goto LABEL_66;
v14 = MiLoadImportDll((UNICODE_STRING *)P, v5, v17, ImageHandle, &ImageBaseAddress);
if( v14 == -1073741800 )
{
if( (unsigned int)MiGetSystemRegionType((UINT64)v6) != 1 )
{
LABEL_23:
ExFreePoolWithTag(P[1], 0);
v15 = 0i64;
if( v14 < 0 )
goto LABEL_68;
v19 = (PVOID *)ImageHandle[0];
v21 = (PVOID)*((_QWORD *)ImageHandle[0] + 6);
goto LABEL_31;
}
v14 = MiLoadImportDll((UNICODE_STRING *)P, v5, v17 | 1, ImageHandle, &ImageBaseAddress);
}
if( v14 == -1073741772 )
{
ExFreePoolWithTag(P[1], 0);
if( v20 == v41 )
{
if( !a4[0] )
{
v14 = -1073741772;
LABEL_67:
v15 = v34;
LABEL_68:
v10 = (UNICODE_STRING *)p_String1;
v9 = v31;
goto LABEL_69;
}
v29 = OriginalFileDirectory;
}
else
{
v29 = (_UNICODE_STRING *)v41;
}
if( !(unsigned int)MiFormFullImageName(v29, &UnicodeString, (UNICODE_STRING *)P) )
goto LABEL_66;
v14 = MiLoadImportDll((UNICODE_STRING *)P, v5, v17, ImageHandle, &ImageBaseAddress);
if( a4[0] && v14 == -1073741800 && (unsigned int)MiGetSystemRegionType((UINT64)v6) == 1 )
v14 = MiLoadImportDll((UNICODE_STRING *)P, v5, v17 | 1, ImageHandle, &ImageBaseAddress);
}
goto LABEL_23;
}
LABEL_69:
MiLogFailedDriverLoad(ImageName, v10, v15, (unsigned int)v14, v30);
if( v9 )
ExFreePoolWithTag(String1.Buffer, 0);
RtlFreeAnsiString(&UnicodeString);
if( v13 )
{
if( (unsigned int)Size != v13->Count )
v13->Count = (unsigned int)Size;
MiDereferenceImports(v13);
ExFreePoolWithTag(v13, 0);
}
return(unsigned int)v14;
}Referenced by:
MiResolveImageImports