IopTrackLink
INT64 __fastcall IopTrackLink(
_FILE_OBJECT *FileObject,
_IO_STATUS_BLOCK *IoStatusBlock,
_FILE_TRACKING_INFORMATION *FileInformation,
UINT64 Length,
_KEVENT *Event,
CHAR RequestorMode){
unsigned int v6;
_FILE_OBJECT *v9;
_FILE_TRACKING_INFORMATION *PoolWithQuota_1;
void *v11;
__int64 ObjectInformationLength;
int v13;
char v14;
int v15;
struct _KEVENT *v16;
__int64 v17;
int v18;
__int64 v19;
int v20;
__int64 v21;
UINT64 v22;
UINT64 v23;
_FILE_OBJECTID_BUFFER::$4EB4437D15F0A234FEA10B093945F87F *BirthVolumeId;
int VolumeId;
int v26;
int v27;
int SetObjectId;
FILE_TRACKING_INFORMATION *v29;
ULONG pulResult[2];
PVOID P;
_IO_STATUS_BLOCK *IoStatusBlocka;
_FILE_OBJECT *v34;
_KEVENT *v35;
_FILE_OBJECTID_BUFFER SourceObjectId;
LINK_TRACKING_INFORMATION ObjectId;
_FILE_OBJECTID_BUFFER result;
LINK_TRACKING_INFORMATION SourceVolumeId;
_FILE_OBJECTID_BUFFER Buffer;
_FILE_OBJECTID_BUFFER v41;
_FILE_TRACKING_INFORMATION Src[17];
v6 = Length;
IoStatusBlocka = IoStatusBlock;
v35 = Event;
P = 0i64;
v9 = 0i64;
v34 = 0i64;
memset(&SourceVolumeId, 0, sizeof(SourceVolumeId));
memset((INT64)&result, 0i64);
memset((INT64)&Buffer, 0i64);
memset(&ObjectId, 0, sizeof(ObjectId));
memset((INT64)&v41, 0i64);
memset((INT64)Src, 0i64);
pulResult[0] = 0;
if( RequestorMode )
{
PoolWithQuota_1 = (_FILE_TRACKING_INFORMATION *)IopVerifierExAllocatePoolWithQuota_1(PagedPool, v6);
P = PoolWithQuota_1;
memmove((UINT8 *)PoolWithQuota_1, (UINT8 *)FileInformation, v6);
}
else
{
PoolWithQuota_1 = FileInformation;
P = FileInformation;
}
if( !PoolWithQuota_1->DestinationFile && RequestorMode == 1 )
{
LABEL_92:
ExFreePoolWithTag(PoolWithQuota_1, 0);
return 3221225485i64;
}
if( RtlULongSub(v6, 0xCui64, (UINT64 *)pulResult) < 0 )
{
if( RequestorMode )
ExFreePoolWithTag(PoolWithQuota_1, 0);
return 3221225621i64;
}
else
{
ObjectInformationLength = PoolWithQuota_1->ObjectInformationLength;
if( pulResult[0] < (unsigned int)ObjectInformationLength )
{
if( !RequestorMode )
return 3221225485i64;
goto LABEL_92;
}
if( (unsigned __int64)(ObjectInformationLength + 36) <= 0x100 )
{
if( v11 )
{
*(_QWORD *)pulResult = 0i64;
v13 = ObReferenceObjectByHandle(
v11,
2u,
(POBJECT_TYPE)IoFileObjectType,
RequestorMode,
(PVOID *)pulResult,
0i64);
v9 = *(_FILE_OBJECT **)pulResult;
v34 = *(_FILE_OBJECT **)pulResult;
if( v13 < 0 )
{
if( RequestorMode )
ExFreePoolWithTag(PoolWithQuota_1, 0);
return(unsigned int)v13;
}
}
if( (*((_DWORD *)FileObject->DeviceObject + 13) & 0x10) != 0 )
{
SetObjectId = IopGetSetObjectId(FileObject, &result, 0x40ui64, 0x9009Cui64);
v13 = SetObjectId;
if( SetObjectId == -1073741772 )
goto LABEL_39;
if( SetObjectId < 0 )
goto LABEL_14;
if( RtlCompareMemoryUlong(&result.ExtendedInfo[16], 0x10ui64, 0) == 16 )
goto LABEL_39;
if( IoGetTransactionParameterBlock(FileObject) )
goto LABEL_83;
if( PoolWithQuota_1->DestinationFile )
{
if( IoGetTransactionParameterBlock(v9) )
goto LABEL_83;
if( PoolWithQuota_1->DestinationFile )
{
if( (*((_DWORD *)v9->DeviceObject + 13) & 0x10) != 0 )
{
v13 = IopGetSetObjectId(v9, &ObjectId, 0x14ui64, 0x1400E8ui64);
if( v13 < 0 )
goto LABEL_14;
v13 = IopGetSetObjectId(v9, &v41, 0x40ui64, 0x900C0ui64);
if( v13 < 0 )
goto LABEL_14;
IopMarshalIds((INT64)Src, (INT64)&ObjectId, &v41, (INT64)PoolWithQuota_1);
v16 = Event;
v26 = IopTrackLink(FileObject, IoStatusBlocka, Src, Src[0].ObjectInformationLength + 12, Event, 0);
goto LABEL_57;
}
VolumeId = IopGetVolumeId(v9, &ObjectId);
LABEL_53:
v13 = VolumeId;
if( VolumeId < 0 )
goto LABEL_14;
v13 = IopGetSetObjectId(v9, &v41, 0x40ui64, 0x900C0ui64);
if( v13 < 0 )
goto LABEL_14;
IopMarshalIds((INT64)Src, (INT64)&ObjectId, &v41, (INT64)PoolWithQuota_1);
v16 = Event;
v13 = IopTrackLink(FileObject, IoStatusBlocka, Src, Src[0].ObjectInformationLength + 12, Event, 0);
if( v13 < 0 )
goto LABEL_84;
v26 = IopGetSetObjectId(FileObject, 0i64, 0i64, 0x900A0ui64);
LABEL_57:
v13 = v26;
if( v26 >= 0 )
{
Buffer = result;
Buffer.BirthVolumeId[0] = _mm_cvtsi128_si32(*(__m128i *)result.BirthVolumeId) | 1;
v13 = IopGetSetObjectId(v9, Buffer.BirthVolumeId, 0x30ui64, 0x900BCui64);
if( v13 < 0 )
IopGetSetObjectId(FileObject, &result, 0x40ui64, 0x90098ui64);
}
goto LABEL_84;
}
}
if( IoGetTransactionParameterBlock(FileObject)
|| PoolWithQuota_1->DestinationFile && IoGetTransactionParameterBlock(v9) )
{
goto LABEL_83;
}
v27 = IopSetRemoteLink(FileObject, v29);
}
else
{
if( PoolWithQuota_1->DestinationFile )
{
if( (*((_DWORD *)v9->DeviceObject + 13) & 0x10) == 0 )
{
v14 = 0;
v15 = IopGetSetObjectId(FileObject, &result, 0x40ui64, 0x9009Cui64);
v13 = v15;
if( v15 != -1073741772 )
{
if( v15 < 0 )
{
LABEL_14:
v16 = Event;
LABEL_84:
if( RequestorMode )
ExFreePoolWithTag(PoolWithQuota_1, 0);
if( v9 )
HalPutDmaAdapter((PADAPTER_OBJECT)v9);
KeSetEvent(v16, 0);
return(unsigned int)v13;
}
if( RtlCompareMemoryUlong(&result.ExtendedInfo[16], 0x10ui64, 0) != 16 )
{
if( !IoGetTransactionParameterBlock(FileObject)
&& (!PoolWithQuota_1->DestinationFile || !IoGetTransactionParameterBlock(v9)) )
{
v13 = IopGetVolumeId(v9, &ObjectId);
if( v13 >= 0 )
{
v13 = IopGetVolumeId(FileObject, &SourceVolumeId);
if( v13 >= 0 )
{
v13 = IopGetSetObjectId(FileObject, 0i64, 0i64, 0x900A0ui64);
if( v13 >= 0 )
{
v41 = result;
Buffer = result;
v17 = *(_QWORD *)ObjectId.VolumeId - *(_QWORD *)SourceVolumeId.VolumeId;
if( *(_QWORD *)ObjectId.VolumeId == *(_QWORD *)SourceVolumeId.VolumeId )
v17 = *(_QWORD *)&ObjectId.VolumeId[8] - *(_QWORD *)&SourceVolumeId.VolumeId[8];
if( v17 )
Buffer.BirthVolumeId[0] = result.BirthVolumeId[0] | 1;
v18 = IopGetSetObjectId(v9, &Buffer, 0x40ui64, 0x90098ui64);
v13 = v18;
if( v18 == -1073741635 || v18 == -1073741771 )
{
v13 = IopGetSetObjectId(v9, &v41, 0x40ui64, 0x900C0ui64);
if( v13 >= 0 )
v13 = IopGetSetObjectId(v9, Buffer.BirthVolumeId, 0x30ui64, 0x900BCui64);
}
if( v13 < 0 )
goto LABEL_34;
v14 = 1;
v19 = *(_QWORD *)ObjectId.VolumeId - *(_QWORD *)SourceVolumeId.VolumeId;
if( *(_QWORD *)ObjectId.VolumeId == *(_QWORD *)SourceVolumeId.VolumeId )
v19 = *(_QWORD *)&ObjectId.VolumeId[8] - *(_QWORD *)&SourceVolumeId.VolumeId[8];
if( v19 )
{
IopMarshalIds((INT64)Src, (INT64)&ObjectId, &v41, (INT64)PoolWithQuota_1);
SourceObjectId = result;
SourceObjectId.BirthVolumeId[0] = _mm_cvtsi128_si32(*(__m128i *)result.BirthVolumeId) & 0xFE;
v13 = IopSendMessageToTrackService(&SourceVolumeId, &SourceObjectId, Src);
}
if( v13 < 0 )
{
LABEL_34:
v20 = 0;
if( v14 )
{
v21 = *(_QWORD *)v41.ObjectId - *(_QWORD *)result.ObjectId;
if( *(_QWORD *)v41.ObjectId == *(_QWORD *)result.ObjectId )
v21 = *(_QWORD *)&v41.ObjectId[8] - *(_QWORD *)&result.ObjectId[8];
if( v21 )
{
v22 = 590012i64;
v23 = 48i64;
BirthVolumeId = (_FILE_OBJECTID_BUFFER::$4EB4437D15F0A234FEA10B093945F87F *)v41.BirthVolumeId;
}
else
{
v22 = 589984i64;
v23 = 0i64;
BirthVolumeId = 0i64;
}
v20 = IopGetSetObjectId(v9, BirthVolumeId, v23, v22);
}
if( v20 >= 0 )
IopGetSetObjectId(FileObject, &result, 0x40ui64, 0x90098ui64);
}
}
}
}
goto LABEL_14;
}
goto LABEL_83;
}
}
LABEL_39:
v13 = 0;
goto LABEL_14;
}
if( (int)IopGetSetObjectId(FileObject, &result, 0x40ui64, 0x9009Cui64) < 0
|| RtlCompareMemoryUlong(&result.ExtendedInfo[16], 0x10ui64, 0) == 16 )
{
goto LABEL_39;
}
if( !IoGetTransactionParameterBlock(FileObject)
&& (!PoolWithQuota_1->DestinationFile || !IoGetTransactionParameterBlock(v9)) )
{
VolumeId = IopGetSetObjectId(v9, &ObjectId, 0x14ui64, 0x1400E8ui64);
goto LABEL_53;
}
LABEL_83:
v13 = -1072103335;
goto LABEL_14;
}
v13 = IopGetVolumeId(FileObject, &SourceVolumeId);
if( v13 < 0 )
goto LABEL_14;
v13 = IopGetSetObjectId(FileObject, &result, 0x40ui64, 0x9009Cui64);
if( v13 < 0 )
goto LABEL_14;
if( RtlCompareMemoryUlong(&result.ExtendedInfo[16], 0x10ui64, 0) == 16 )
goto LABEL_39;
if( IoGetTransactionParameterBlock(FileObject)
|| PoolWithQuota_1->DestinationFile && IoGetTransactionParameterBlock(v9) )
{
goto LABEL_83;
}
SourceObjectId = result;
SourceObjectId.BirthVolumeId[0] = _mm_cvtsi128_si32(*(__m128i *)result.BirthVolumeId) & 0xFE;
v27 = IopSendMessageToTrackService(&SourceVolumeId, &SourceObjectId, PoolWithQuota_1);
}
v13 = v27;
goto LABEL_14;
}
if( RequestorMode )
ExFreePoolWithTag(PoolWithQuota_1, 0);
return 2147483653i64;
}
}Referenced by:
IopTrackLink
NtSetInformationFile