PiCMCreateDevice
INT64 __stdcall PiCMCreateDevice(
PVOID IoctlInputBuffer,
UINT64 IoctlInputBufferSize,
PVOID IoctlOutputBuffer,
UINT64 IoctlOutputBufferSize,
UINT64 *BytesUsed){
unsigned int v6;
WCHAR *PoolWithTag;
char v8;
int v9;
_WORD *v10;
int DeviceInputData;
int inited;
wchar_t *v13;
char v14;
int v15;
__int64 v16;
_BYTE *v17;
int v18;
int v19;
_ETHREAD *CurrentThread;
__int64 v21;
int v22;
__int64 v23;
_ETHREAD *v24;
INT8 v25;
__int64 v27;
struct _DMA_ADAPTER *v28;
INT64 v29;
unsigned __int8(__fastcall *FlushAdapterBuffers)(_DMA_ADAPTER *, _MDL *, void *, void *, unsigned int, unsigned __int8);
__int64 v31;
int DeviceRegProp;
UINT64 *v33;
int v34;
NTSTATUS DeviceInstanceCsConfigFlags;
INT64 v36;
__int64 v37;
__int64 v38;
int v39;
_ETHREAD *v40;
size_t *pcchRemaining;
UINT64 dwFlags;
UINT64 IoctlOutputBufferSizea;
__int64 v44;
_WORD *v45;
unsigned int v46;
int v47;
int v48;
HANDLE v49;
size_t pcchLength;
int v51;
unsigned int v52;
int v53;
HANDLE v54;
PADAPTER_OBJECT DmaAdapter;
PVOID P;
UNICODE_STRING DeviceInstance;
NTSTRSAFE_PCWSTR pszSrc[2];
PCWSTR SourceString[2];
UINT64 ExpectedOutputSize;
struct _UNICODE_STRING DestinationString;
unsigned int v63;
UINT64 *v64;
v63 = IoctlOutputBufferSize;
ExpectedOutputSize = 0i64;
v46 = 0;
v6 = IoctlOutputBufferSize;
v47 = 0;
v54 = 0i64;
*(_DWORD *)v64 = 0;
PoolWithTag = 0i64;
v53 = 0;
v8 = 0;
v51 = 0;
v9 = 0;
v48 = 0;
v10 = 0i64;
v52 = 0;
DmaAdapter = 0i64;
v49 = 0i64;
P = 0i64;
pcchLength = 0i64;
v45 = 0i64;
DeviceInstance = 0i64;
*(_OWORD *)pszSrc = 0i64;
*(_OWORD *)SourceString = 0i64;
DestinationString = 0i64;
DeviceInputData = PiCMCaptureCreateDeviceInputData(
(UINT64)IoctlInputBuffer,
IoctlInputBufferSize,
(unsigned int)BytesUsed,
(INT64)pszSrc);
if( DeviceInputData < 0 )
goto LABEL_47;
if( !PiAuDoesClientHaveAccess(2ui64) )
{
inited = -1073741790;
goto LABEL_36;
}
v13 = (wchar_t *)pszSrc[1];
if( !pszSrc[1] || LODWORD(SourceString[0]) < 2 || !SourceString[1] || (unsigned int)ExpectedOutputSize < 2 )
{
inited = -1073741811;
v10 = 0i64;
goto LABEL_58;
}
if( !IoctlOutputBuffer || v6 < 0x14 || (v14 = BYTE4(pszSrc[0]), (HIDWORD(pszSrc[0]) & 0xFFFFFFF0) != 0) )
{
inited = -1073741811;
LABEL_12:
v10 = 0i64;
goto LABEL_36;
}
v15 = BYTE4(pszSrc[0]) & 2;
if( !CmIsRootDevice(SourceString[1]) )
{
inited = -1073741811;
LABEL_15:
v10 = 0i64;
goto LABEL_36;
}
inited = PiPnpRtlBeginOperation((__int64 **)&P);
if( inited < 0 )
goto LABEL_15;
PoolWithTag = (WCHAR *)ExAllocatePoolWithTag(PagedPool, 0x190ui64, 0x34706E50ui64);
if( !PoolWithTag )
{
inited = -1073741670;
goto LABEL_12;
}
v18 = v14 & 4;
if( !v18 )
{
inited = CmValidateDeviceName(v16, v13);
goto LABEL_23;
}
PiCMGenerateDeviceInstance(v13, v15 != 0, PoolWithTag, v17, (INT64)pcchRemaining, dwFlags);
inited = v19;
if( !v15 )
{
LABEL_23:
if( inited < 0 )
goto LABEL_15;
if( !v18 )
{
LODWORD(dwFlags) = 2048;
inited = RtlStringCchCopyExW(PoolWithTag, 0xC8ui64, v13, 0i64, 0i64, dwFlags);
if( inited < 0 )
goto LABEL_15;
}
inited = CmOpenDeviceRegKey(PiPnpRtlCtx, PoolWithTag, 16, 0, 131103, 0, (__int64)&v49, 0i64);
if( (int)(inited + 0x80000000) >= 0 && inited != -1073741810 )
goto LABEL_21;
if( v15 )
{
if( v49 )
{
LABEL_30:
inited = -1073741771;
goto LABEL_15;
}
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
ExAcquireResourceExclusiveLite(&PnpRegistryDeviceResource, 1u);
LOBYTE(v44) = 0;
v8 = 1;
inited = CmCreateDevice(PiPnpRtlCtx, PoolWithTag, 131078, &v54, &v44, 0);
if( inited < 0 )
goto LABEL_34;
if( !(_BYTE)v44 )
{
inited = -1073741771;
PnpCtxRegCloseKey(v21, v54);
LABEL_34:
v9 = pcchLength;
goto LABEL_35;
}
v51 = 1;
inited = PnpCtxRegSetValue(v21, v54, L"Phantom", 4u, &v51, 4u);
PnpCtxRegCloseKey(v27, v54);
if( inited < 0 )
goto LABEL_34;
ExReleaseResourceLite(&PnpRegistryDeviceResource);
KeLeaveCriticalRegion();
v9 = pcchLength;
}
else
{
if( v49 )
{
if( (int)RtlInitUnicodeStringEx(&DestinationString, PoolWithTag) >= 0 )
{
PpDevNodeLockTree(0);
v28 = (struct _DMA_ADAPTER *)PnpDeviceObjectFromDeviceInstanceWithTag(
(INT64)&DestinationString,
0x746C6644ui64);
DmaAdapter = v28;
v29 = (INT64)v28;
if( v28 )
FlushAdapterBuffers = v28[19].DmaOperations->FlushAdapterBuffers;
else
FlushAdapterBuffers = 0i64;
PpDevNodeUnlockTree(0);
if( FlushAdapterBuffers )
{
if( IopIsRootEnumeratedDeviceObjectActive(v29) )
goto LABEL_30;
}
else
{
PiPnpRtlEnsureObjectCached(v31, PoolWithTag);
}
}
}
else
{
v40 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v40 + 242);
ExAcquireResourceExclusiveLite(&PnpRegistryDeviceResource, 1u);
LOBYTE(v44) = 0;
v8 = 1;
inited = CmCreateDevice(PiPnpRtlCtx, PoolWithTag, 131103, &v49, &v44, 0);
if( inited < 0 )
goto LABEL_34;
ExReleaseResourceLite(&PnpRegistryDeviceResource);
KeLeaveCriticalRegion();
v8 = 0;
v9 = pcchLength;
if( !(_BYTE)v44 )
{
inited = -1073741771;
goto LABEL_35;
}
}
inited = RtlInitUnicodeStringEx(&DeviceInstance, PoolWithTag);
v8 = 0;
if( inited < 0 )
goto LABEL_35;
v46 = 4;
DeviceRegProp = CmGetDeviceRegProp(
PiPnpRtlCtx,
PoolWithTag,
(__int64)v49,
11,
(__int64)&v47,
(__int64)&v48,
(__int64)&v46,
0);
v34 = v48;
if( DeviceRegProp < 0 )
v34 = 0;
v48 = v34;
DeviceInstanceCsConfigFlags = PnpGetDeviceInstanceCsConfigFlags(&DeviceInstance, v33);
v36 = v52;
if( DeviceInstanceCsConfigFlags < 0 )
v36 = 0i64;
if( (v48 & 0x12) != 0 || (v36 & 2) != 0 )
{
inited = -1073741808;
goto LABEL_35;
}
inited = PiInitializeDevice(&DeviceInstance, v36);
if( inited < 0 )
{
LABEL_35:
v10 = v45;
goto LABEL_36;
}
v46 = 4;
if( (int)PnpCtxRegQueryValue(v37, v49, L"Phantom", &v47, &v53, (__int64)&v46) < 0
|| v47 != 4
|| (v39 = v53, v46 != 4) )
{
v39 = 0;
}
if( v39 )
PnpCtxRegDeleteValue(v38, v49, L"Phantom");
if( (BYTE4(pszSrc[0]) & 8) != 0 )
{
v46 = 512;
v10 = ExAllocatePoolWithTag(PagedPool, 0x200ui64, 0x34706E50ui64);
if( !v10 )
{
inited = -1073741670;
v8 = 0;
goto LABEL_36;
}
if( (int)CmGetDeviceRegProp(
PiPnpRtlCtx,
PoolWithTag,
(__int64)v49,
5,
(__int64)&v47,
(__int64)v10,
(__int64)&v46,
0) >= 0
&& v47 == 1
&& v46 <= 0x200 )
{
if( *v10 )
{
inited = RtlInitUnicodeStringEx(&DeviceInstance, PoolWithTag);
if( inited >= 0 )
inited = PpDeviceRegistration(&DeviceInstance, 1u, 0i64, 0);
}
}
goto LABEL_57;
}
}
v10 = v45;
goto LABEL_57;
}
LABEL_21:
v10 = 0i64;
LABEL_57:
v6 = v63;
LABEL_58:
v8 = 0;
if( inited >= 0 )
{
inited = RtlStringCchLengthW(PoolWithTag, 0xC8ui64, &pcchLength);
if( inited < 0 )
{
v9 = 0;
}
else
{
v9 = pcchLength + 1;
if( (unsigned __int64)v6 - 20 < 2 * (pcchLength + 1) )
inited = -1073741789;
}
if( inited >= 0 )
{
LODWORD(IoctlOutputBufferSizea) = v6;
LODWORD(dwFlags) = HIDWORD(ExpectedOutputSize);
LODWORD(pcchRemaining) = 2 * v9;
v22 = PiCMReturnBufferResultData(
(unsigned int)inited,
(unsigned int)(2 * v9),
0i64,
(UINT8 *)PoolWithTag,
(UINT64)pcchRemaining,
dwFlags,
IoctlOutputBuffer,
IoctlOutputBufferSizea,
v64);
goto LABEL_37;
}
}
LABEL_36:
LODWORD(IoctlOutputBufferSizea) = v63;
LODWORD(dwFlags) = HIDWORD(ExpectedOutputSize);
LODWORD(pcchRemaining) = 0;
v22 = PiCMReturnBufferResultData(
(unsigned int)inited,
(unsigned int)(2 * v9),
0i64,
0i64,
(UINT64)pcchRemaining,
dwFlags,
IoctlOutputBuffer,
IoctlOutputBufferSizea,
v64);
LABEL_37:
DeviceInputData = v22;
if( v49 )
PnpCtxRegCloseKey(v23, v49);
if( PoolWithTag )
ExFreePoolWithTag(PoolWithTag, 0x34706E50u);
if( v10 )
ExFreePoolWithTag(v10, 0x34706E50u);
if( DmaAdapter )
HalPutDmaAdapter(DmaAdapter);
if( v8 )
{
ExReleaseResourceLite(&PnpRegistryDeviceResource);
KeLeaveCriticalRegion();
}
LABEL_47:
v24 = (_ETHREAD *)KeGetCurrentThread();
v25 = *((_BYTE *)v24 + 562);
if( pszSrc[1] )
PiControlFreeUserModeCallersBuffer(*((_BYTE *)v24 + 562), (PVOID)pszSrc[1]);
if( SourceString[1] )
PiControlFreeUserModeCallersBuffer(v25, (PVOID)SourceString[1]);
if( P )
PiPnpRtlEndOperation(P);
return(unsigned int)DeviceInputData;
}Referenced by:
No references.