IopXxxControlFile
NTSTATUS IopXxxControlFile(void *a1, void *a2, __int64 a3, __int64 a4, __int64 a5, UINT64 a6, void *Src, ...){
void *v8;
unsigned int v9;
INT8 v10;
__int64 v11;
ULONG v12;
unsigned int v13;
NTSTATUS result;
int v15;
__int64 v16;
unsigned int v17;
UINT64 v18;
UINT8 v19;
UINT8 v20;
struct _DMA_ADAPTER *v21;
unsigned __int8 v22;
_EPROCESS *v23;
int v24;
PIRP v25;
_ETHREAD *CurrentThread;
__int64 v27;
__int64 v28;
_DEVICE_OBJECT *RelatedDeviceObject;
__int64 v30;
__int64 v31;
IRP *v32;
char *v33;
void *v34;
char v35;
_DWORD *v36;
INT64 v37;
NTSTATUS v38;
int v39;
PDEVICE_OBJECT v40;
IRP *v41;
IRP *v42;
__int64 v43;
char v44;
POOL_TYPE v45;
unsigned int v46;
UINT8 *v47;
_MDL *Mdl;
UINT64 v49;
UINT8 *PoolWithQuota_1;
char v51;
KEVENT *v52;
_DWORD *v53;
IRP *Object;
PVOID *Objecta;
POBJECT_HANDLE_INFORMATION HandleInformation;
UINT64 v57;
unsigned __int8 v58;
CHAR v59;
char IsSandboxedToken;
char v61;
_DWORD DmaAdapter[3];
PADAPTER_OBJECT v63;
unsigned int v64;
int v65;
PVOID P;
UINT64 IoStatusInformation[2];
PVOID v68;
PIRP Irp;
PADAPTER_OBJECT v70;
PDEVICE_OBJECT DeviceObject;
int v72;
void *v73;
_ETHREAD *Thread;
OBJECT_HANDLE_INFORMATION pHandleInformation;
PVOID VirtualAddress;
PVOID KeyContext;
struct _SECURITY_SUBJECT_CONTEXT SubjectContext;
VOID *retaddr;
INT64 v81;
PVOID ApcContext;
size_t Size;
va_list Sizea;
volatile void *Address;
SIZE_T Length;
__int64 v87;
va_list va1;
va_start(va1, Src);
va_start(Sizea, Src);
Size = va_arg(va1, _QWORD);
Address = va_arg(va1, volatile void *);
Length = va_arg(va1, _QWORD);
v87 = va_arg(va1, _QWORD);
ApcContext = (PVOID)a4;
v81 = a3;
v72 = a6;
v8 = 0i64;
*(_QWORD *)&DmaAdapter[1] = 0i64;
v63 = 0i64;
pHandleInformation = 0i64;
*(_OWORD *)IoStatusInformation = 0i64;
memset(&SubjectContext, 0, sizeof(SubjectContext));
v9 = a6 & 3;
v64 = v9;
Thread = (_ETHREAD *)KeGetCurrentThread();
v10 = *((_BYTE *)Thread + 562);
v58 = v10;
if( v10 )
{
v11 = a5;
if( (unsigned __int64)a5 >= 0x7FFFFFFF0000i64 )
v11 = 0x7FFFFFFF0000i64;
*(_DWORD *)v11 = *(_DWORD *)v11;
if( v9 )
{
v12 = Length;
}
else if( Address )
{
v12 = Length;
ProbeForWrite((VOID *)Address, (unsigned int)Length, 1ui64);
}
else
{
v12 = 0;
LODWORD(Length) = 0;
}
if( v9 == 3 )
{
v13 = Size;
}
else if( Src )
{
v13 = Size;
if( (_DWORD)Size
&& ((unsigned __int64)Src + (unsigned int)Size > 0x7FFFFFFF0000i64 || (char *)Src + (unsigned int)Size < Src) )
{
MEMORY[0x7FFFFFFF0000] = 0;
}
}
else
{
v13 = 0;
LODWORD(Size) = 0;
}
}
else
{
v12 = Length;
v13 = Size;
}
result = IopReferenceFileObject(a1, 0i64, v10, (FILE_OBJECT **)&DmaAdapter[1], &pHandleInformation);
v15 = result;
if( result >= 0 )
{
v16 = *(_QWORD *)&DmaAdapter[1];
if( *(_QWORD *)(*(_QWORD *)&DmaAdapter[1] + 176i64) && (v81 & 0xFFFFFFFFFFFFFFFEui64) != 0 )
{
HalPutDmaAdapter(*(PADAPTER_OBJECT *)&DmaAdapter[1]);
return -1073741811;
}
v17 = a6;
if( v10
&& (unsigned __int16)a6 >> 14
&& (((unsigned __int16)a6 >> 14) & pHandleInformation.GrantedAccess) != (unsigned __int16)a6 >> 14 )
{
HalPutDmaAdapter(*(PADAPTER_OBJECT *)&DmaAdapter[1]);
return -1073741790;
}
if( (_DWORD)a6 == 606820 || (_DWORD)a6 == 623208 )
{
v15 = IopCopyOffloadCapable(*(FILE_OBJECT **)&DmaAdapter[1], (unsigned int)a6);
if( v15 < 0 )
goto LABEL_31;
}
else if( (_DWORD)a6 == 590892 )
{
v15 = IopSetFileObjectExtensionFlag(*(FILE_OBJECT **)&DmaAdapter[1], 0x10ui64, 1u);
if( v15 < 0 )
goto LABEL_31;
}
if( !a2 )
{
v21 = v63;
v70 = v63;
LABEL_37:
v68 = 0i64;
P = 0i64;
IsSandboxedToken = 0;
v61 = 0;
v22 = v58;
if( v58 && (v17 == 589988 && v13 >= 4 || v17 == 590860 && v13 >= 0x24) )
{
IoThreadToProcess(Thread);
SeCaptureSubjectContextEx(Thread, v23, &SubjectContext);
IsSandboxedToken = RtlIsSandboxedToken(&SubjectContext, v58);
SeReleaseSubjectContext(&SubjectContext);
if( IsSandboxedToken )
{
v65 = 0;
v24 = v17 == 590860 ? *((_DWORD *)Src + 8) : *(_DWORD *)Src;
v65 = v24;
if( v15 < 0 )
goto LABEL_50;
if( v24 == -1610612733 )
{
v61 = 1;
va_copy((va_list)HandleInformation, Sizea);
v15 = IopValidateJunctionTarget((PVOID)v17, (UINT64)Src, v13, (PVOID *)v12, (UINT64 *)&P);
v13 = Size;
v68 = P;
}
if( v15 < 0 )
{
LABEL_50:
if( v21 )
HalPutDmaAdapter(v21);
goto LABEL_31;
}
}
v22 = v58;
}
v25 = (PIRP)(v16 + 80);
Irp = (PIRP)(v16 + 80);
if( (*(_DWORD *)(v16 + 80) & 2) != 0 )
{
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
v27 = *(_QWORD *)&DmaAdapter[1];
LODWORD(v28) = KeAbPreAcquire((PVOID)(*(_QWORD *)&DmaAdapter[1] + 128i64), 0i64, 0i64);
if( _InterlockedExchange((volatile __int32 *)(v27 + 116), 1) )
{
v16 = *(_QWORD *)&DmaAdapter[1];
IopWaitAndAcquireFileObjectLock(*(PVOID *)&DmaAdapter[1], v58);
}
else
{
if( v28 )
*(_BYTE *)(v28 + 26) |= 1u;
v16 = *(_QWORD *)&DmaAdapter[1];
ObfReferenceObject(*(PVOID *)&DmaAdapter[1]);
}
v59 = 1;
v12 = Length;
v13 = Size;
v21 = v63;
v70 = v63;
v68 = P;
v25 = Irp;
}
else
{
v59 = 0;
if( v22 )
IopMarkApcRoutineIfAsynchronousIo32((UINT64 **)&a5, &v81, 0);
}
if( (*(_DWORD *)v25 & 0x800) != 0 )
IoGetAttachedDevice(*(_DEVICE_OBJECT **)(v16 + 8));
else
RelatedDeviceObject = IoGetRelatedDeviceObject((_FILE_OBJECT *)v16);
DeviceObject = RelatedDeviceObject;
if( (_BYTE)v87 )
{
if( !IsSandboxedToken )
{
v31 = *(_QWORD *)(*((_QWORD *)RelatedDeviceObject + 1) + 80i64);
if( v31 )
{
v32 = *(IRP **)(v31 + 80);
Irp = v32;
if( v32 )
{
if( v58 && Address )
{
if( v64 == 1 )
{
if( v12 )
{
v33 = (char *)Address + v12;
if( (unsigned __int64)v33 > 0x7FFFFFFF0000i64 || v33 < Address )
MEMORY[0x7FFFFFFF0000] = 0;
}
}
else if( v64 == 2 )
{
ProbeForWrite((VOID *)Address, v12, 1ui64);
}
}
if( (_DWORD)a6 == 589856 )
{
_InterlockedIncrement((volatile signed __int32 *)&KUSER_SHARED_DATA.DismountCount);
v12 = Length;
v13 = Size;
v16 = *(_QWORD *)&DmaAdapter[1];
v21 = v63;
v70 = v63;
v68 = P;
}
if( (MmVerifierData & 0x10) != 0 )
v34 = VfFastIoSnapState();
else
v34 = 0i64;
LODWORD(HandleInformation) = v12;
LOBYTE(v30) = 1;
v35 = ((__int64(__fastcall *)(__int64, __int64, void *, _QWORD, volatile void *, POBJECT_HANDLE_INFORMATION, _DWORD, UINT64 *, PDEVICE_OBJECT))v32)(
v16,
v30,
Src,
v13,
Address,
HandleInformation,
a6,
IoStatusInformation,
DeviceObject);
if( v34 )
VfFastIoCheckState(v34, Irp);
if( v35 )
{
v73 = 0i64;
KeyContext = 0i64;
if( (v81 & 1) != 0 )
{
v36 = (_DWORD *)a5;
*(_DWORD *)(a5 + 4) = IoStatusInformation[1];
*v36 = IoStatusInformation[0];
}
else
{
*(_OWORD *)a5 = *(_OWORD *)IoStatusInformation;
}
v37 = LODWORD(IoStatusInformation[0]);
if( *(_QWORD *)(v16 + 176)
&& ((*(_DWORD *)(v16 + 80) & 0x2000000) == 0 || (IoStatusInformation[0] & 0xC0000000) == 0x80000000)
&& (IoStatusInformation[0] & 0xC0000000) != -1073741824 )
{
IopIncrementCompletionContextUsageCountAndReadData((PVOID)v16);
v37 = LODWORD(IoStatusInformation[0]);
v8 = v73;
}
if( a2 )
{
if( (*(_DWORD *)(v16 + 80) & 0x8000000) == 0 || v8 && (v37 & 0xC0000000) == 0x80000000 )
KeSetEvent((PRKEVENT)v21, 0);
HalPutDmaAdapter(v21);
v37 = LODWORD(IoStatusInformation[0]);
}
if( v59 )
{
IopReleaseFileObjectLock((PADAPTER_OBJECT)v16);
v37 = LODWORD(IoStatusInformation[0]);
}
if( v8 && ApcContext )
{
v38 = IoSetIoCompletion(v8, KeyContext, ApcContext, v37, IoStatusInformation[1], 1u);
v39 = IoStatusInformation[0];
if( v38 < 0 )
v39 = -1073741670;
if( (v39 & 0xC0000000) == 0x80000000 )
v39 = 259;
LODWORD(IoStatusInformation[0]) = v39;
}
HalPutDmaAdapter((PADAPTER_OBJECT)v16);
return IoStatusInformation[0];
}
}
}
}
}
IopResetEvent((FILE_OBJECT *)v16);
v40 = DeviceObject;
v41 = IopAllocateIrpExReturn(DeviceObject, *((_BYTE *)DeviceObject + 76), v59 ^ 1u, retaddr);
v42 = v41;
Irp = v41;
if( !v41 )
{
IopAllocateIrpCleanup((PUNICODE_STRING)v16);
if( v68 )
ExFreePoolWithTag(v68, 0);
return -1073741670;
}
*((_QWORD *)v41 + 24) = v16;
*((_QWORD *)v41 + 19) = Thread;
*((_QWORD *)v41 + 20) = 0i64;
*((_BYTE *)v41 + 64) = v58;
*((_BYTE *)v41 + 65) = 0;
*((_BYTE *)v41 + 68) = 0;
*((_QWORD *)v41 + 13) = 0i64;
*((_QWORD *)v41 + 10) = v21;
*((_QWORD *)v41 + 9) = a5;
*((_QWORD *)v41 + 11) = v81;
*((_QWORD *)v41 + 12) = ApcContext;
v43 = *((_QWORD *)v41 + 23);
v44 = v87;
*(_DWORD *)(v43 - 72) = ((_BYTE)v87 != 0) + 13;
*(_QWORD *)(v43 - 24) = v16;
*(_DWORD *)(v43 - 64) = v12;
*(_DWORD *)(v43 - 56) = v13;
*(_DWORD *)(v43 - 48) = a6;
v45 = NonPagedPoolNxCacheAligned;
if( !v44 )
v45 = NonPagedPoolNx;
*((_QWORD *)v41 + 1) = 0i64;
*((_QWORD *)v41 + 3) = 0i64;
if( (*((_DWORD *)v40 + 12) & 0x80000) != 0 && !IsSandboxedToken )
goto LABEL_122;
v46 = v64;
if( !v64 )
{
*(_QWORD *)(v43 - 40) = 0i64;
if( v13 || v12 )
{
if( v68 )
{
*((_QWORD *)v41 + 3) = v68;
}
else
{
v49 = v12;
if( v13 > v12 )
v49 = v13;
PoolWithQuota_1 = (UINT8 *)IopVerifierExAllocatePoolWithQuota_1(v45, v49);
*((_QWORD *)v42 + 3) = PoolWithQuota_1;
if( Src )
memmove(PoolWithQuota_1, (UINT8 *)Src, v13);
}
*((_DWORD *)v42 + 4) = 48;
*((_QWORD *)v42 + 14) = Address;
if( v12 )
*((_DWORD *)v42 + 4) = 112;
}
else
{
*((_DWORD *)v41 + 4) = 0;
*((_QWORD *)v41 + 14) = 0i64;
}
if( !IopDisableBufferedIoInit && v13 < v12 )
memset(*((_QWORD *)v42 + 3) + v13, 0i64);
goto LABEL_144;
}
if( v64 <= 2 )
{
*((_DWORD *)v41 + 4) = 0;
*(_QWORD *)(v43 - 40) = 0i64;
if( v13 && Src )
{
v47 = (UINT8 *)IopVerifierExAllocatePoolWithQuota_1(v45, v13);
*((_QWORD *)v42 + 3) = v47;
memmove(v47, (UINT8 *)Src, v13);
*((_DWORD *)v42 + 4) = 48;
v46 = v64;
}
if( v12 )
{
Mdl = IoAllocateMdl((PVOID)Address, v12, 0, 1u, v42);
*((_QWORD *)v42 + 1) = Mdl;
if( !Mdl )
RtlRaiseStatus(-1073741670);
LOBYTE(v8) = v46 != 1;
LODWORD(Objecta) = *(_DWORD *)(v43 - 72);
IopProbeAndLockPages_0(Mdl, v58, (unsigned int)v8, DeviceObject, (INT64)Objecta);
}
goto LABEL_144;
}
if( v64 == 3 )
{
LABEL_122:
*((_DWORD *)v41 + 4) = 0;
*((_QWORD *)v41 + 14) = Address;
*(_QWORD *)(v43 - 40) = Src;
}
LABEL_144:
*(_BYTE *)(v43 - 70) |= pHandleInformation.GrantedAccess & 1 | (unsigned __int8)(2
* (pHandleInformation.GrantedAccess & 2));
v51 = v87;
if( !(_BYTE)v87 )
*((_DWORD *)v42 + 4) |= 0x800u;
if( (_DWORD)a6 == 589856 )
{
_InterlockedIncrement((volatile signed __int32 *)&KUSER_SHARED_DATA.DismountCount);
v16 = *(_QWORD *)&DmaAdapter[1];
v52 = (KEVENT *)v63;
}
else
{
v52 = (KEVENT *)v70;
}
if( !IsSandboxedToken || v61 )
goto LABEL_155;
v53 = (_DWORD *)(*((_QWORD *)v42 + 3) + 32i64);
if( v72 != 590860 )
v53 = (_DWORD *)*((_QWORD *)v42 + 3);
if( *v53 != -1610612733 )
{
LABEL_155:
LODWORD(v57) = 2;
return IopSynchronousServiceTail(DeviceObject, v42, (FILE_OBJECT *)v16, v51 == 0, v58, v59, v57);
}
IopExceptionCleanup((FILE_OBJECT *)v16, v42, v52, 0i64);
return -1073741811;
}
VirtualAddress = 0i64;
v15 = ObReferenceObjectByHandle(a2, 2u, (POBJECT_TYPE)ExEventObjectType, v10, &VirtualAddress, 0i64);
v21 = (struct _DMA_ADAPTER *)VirtualAddress;
v70 = (PADAPTER_OBJECT)VirtualAddress;
v63 = (PADAPTER_OBJECT)VirtualAddress;
if( v15 >= 0 )
{
KeResetEvent(VirtualAddress, v18, v19, v20, Object);
goto LABEL_37;
}
LABEL_31:
HalPutDmaAdapter((PADAPTER_OBJECT)v16);
return v15;
}
return result;
}Referenced by:
NtDeviceIoControlFile
NtFsControlFile
PfSnPrefetchFileMetadata
PfpPrefetchDirectoryStream
PfpPrefetchEntireDirectory
PfpVolumePrefetchMetadata