NtQueryObject
NTSTATUS __stdcall NtQueryObject(
PVOID Handle,
_OBJECT_INFORMATION_CLASS ObjectInformationClass,
PVOID ObjectInformation,
UINT64 ObjectInformationLength,
UINT64 *ReturnLength){
unsigned int v8;
KPROCESSOR_MODE v9;
UINT64 v10;
UINT64 *v11;
__int64 v12;
NTSTATUS result;
NTSTATUS v14;
struct _DMA_ADAPTER *v15;
unsigned int GrantedAccess;
_DWORD *v17;
INT64 v18;
NTSTATUS v19;
__int32 v20;
__int32 v21;
char v22;
unsigned int HandleAttributes;
char v24;
__int64 *v25;
__int64 v26;
_OBJECT_TYPE *v27;
__int64 v28;
_ETHREAD *CurrentThread;
INT64 *v30;
char *v31;
__int32 v32;
char *v33;
struct _DMA_ADAPTER *v34;
unsigned int i;
INT64 v36;
NTSTATUS v37;
int v38;
PADAPTER_OBJECT v39;
_ETHREAD *v40;
char *v41;
struct _DMA_ADAPTER *v42;
struct _DMA_ADAPTER *v43;
PVOID v44;
NTSTATUS v45;
UINT64 v46;
PVOID Lock;
unsigned int v48;
struct _DMA_ADAPTER *v49;
unsigned int v50;
int v51;
int v52;
struct _DMA_ADAPTER *v53;
struct _OBJECT_HANDLE_INFORMATION HandleInformation;
PADAPTER_OBJECT v55;
INT64 v56;
__int128 v57;
__m256i v58;
__int64 v59;
PVOID Object;
PADAPTER_OBJECT DmaAdapter;
PVOID v62;
__int64 v63;
unsigned int Length;
Length = ObjectInformationLength;
v8 = 0;
HandleInformation = 0i64;
v57 = 0i64;
memset(&v58, 0, sizeof(v58));
v59 = 0i64;
v52 = 0;
v51 = 0;
LODWORD(v46) = 0;
v9 = *((_BYTE *)KeGetCurrentThread() + 562);
if( v9 )
{
v10 = 4i64;
if( ObjectInformationClass == ObjectHandleFlagInformation )
v10 = 1i64;
ProbeForWrite(ObjectInformation, (unsigned int)ObjectInformationLength, v10);
v11 = ReturnLength;
if( ReturnLength )
{
v12 = (__int64)ReturnLength;
if( (unsigned __int64)ReturnLength >= 0x7FFFFFFF0000i64 )
v12 = 0x7FFFFFFF0000i64;
*(_DWORD *)v12 = *(_DWORD *)v12;
}
}
else
{
v11 = ReturnLength;
}
if( ObjectInformationClass == ObjectTypesInformation )
{
GrantedAccess = 0;
v50 = 0;
v15 = 0i64;
v49 = 0i64;
v17 = 0i64;
v18 = 0i64;
v56 = 0i64;
v14 = 0;
v45 = 0;
}
else
{
Object = 0i64;
result = ObReferenceObjectByHandle(Handle, 0, 0i64, v9, &Object, &HandleInformation);
v14 = result;
v15 = (struct _DMA_ADAPTER *)Object;
v49 = (struct _DMA_ADAPTER *)Object;
v45 = result;
if( result < 0 )
return result;
GrantedAccess = HandleInformation.GrantedAccess;
v50 = HandleInformation.GrantedAccess;
v17 = (char *)Object - 48;
v18 = ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ (unsigned __int8)*((char *)Object - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)Object - 48) >> 8)];
v56 = v18;
}
Lock = v17;
if( ObjectInformationClass == ObjectNameInformation )
{
v19 = ObQueryNameStringMode(v15, (OBJECT_NAME_INFORMATION *)ObjectInformation, Length, &v46, v9);
}
else
{
if( ObjectInformationClass == ObjectBasicInformation )
{
if( Length != 56 )
{
HalPutDmaAdapter(v15);
return -1073741820;
}
memset(&v58.m256i_u64[1], 0, 24);
HandleAttributes = HandleInformation.HandleAttributes;
LODWORD(v57) = HandleInformation.HandleAttributes;
v24 = *((_BYTE *)v17 + 27);
if( (v24 & 0x10) != 0 )
{
HandleAttributes = HandleInformation.HandleAttributes | 0x10;
LODWORD(v57) = HandleInformation.HandleAttributes | 0x10;
}
if( (v24 & 8) != 0 )
LODWORD(v57) = HandleAttributes | 0x20;
DWORD1(v57) = GrantedAccess;
DWORD2(v57) = v17[2];
HIDWORD(v57) = *v17;
v25 = (__int64 *)OBJECT_HEADER_TO_QUOTA_INFO((INT64)v17);
if( v25 )
v58.m256i_i64[0] = *v25;
else
v58.m256i_i64[0] = 0i64;
if( v27 == ObpSymbolicLinkObjectType )
v28 = *(_QWORD *)&v15->Version;
else
v28 = 0i64;
v59 = v28;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
v30 = (INT64 *)(v26 + 16);
ExAcquirePushLockSharedEx(v26 + 16, 0i64);
v31 = (char *)Lock;
if( (*((_BYTE *)Lock + 26) & 2) != 0
&& (v33 = (char *)*((unsigned __int8 *)ObpInfoMaskToOffset + (*((_BYTE *)Lock + 26) & 3)),
Lock = (PVOID)((_BYTE *)Lock - v33),
v31 != v33)
&& (v34 = *(struct _DMA_ADAPTER **)(v31 - v33), (v55 = v34) != 0i64) )
{
ObfReferenceObject(v34);
if( _InterlockedCompareExchange64(v30, 0i64, 17i64) != 17 )
ExfReleasePushLockShared(v30);
KeAbPostRelease(v30);
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
v38 = *((unsigned __int16 *)Lock + 4) + 2;
while( 1 )
{
DmaAdapter = v55;
if( !v55 )
break;
v39 = v55 - 3;
v53 = v55 - 3;
v40 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v40 + 242);
Lock = &v39[1];
ExAcquirePushLockSharedEx((UINT64)&v39[1], 0i64);
if( (BYTE2(v53[1].DmaOperations) & 2) == 0
|| (v41 = (char *)v53 - *((unsigned __int8 *)ObpInfoMaskToOffset + (BYTE2(v53[1].DmaOperations) & 3))) == 0i64
|| (v42 = *(struct _DMA_ADAPTER **)v41) == 0i64 )
{
if( _InterlockedCompareExchange64((volatile signed __int64 *)Lock, 0i64, 17i64) != 17 )
ExfReleasePushLockShared((INT64 *)Lock);
KeAbPostRelease(Lock);
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
if( v55 )
HalPutDmaAdapter(v55);
break;
}
v38 += *((unsigned __int16 *)v41 + 4) + 2;
v43 = *(struct _DMA_ADAPTER **)v41;
v55 = v42;
ObfReferenceObject(v43);
v44 = Lock;
if( _InterlockedCompareExchange64((volatile signed __int64 *)Lock, 0i64, 17i64) != 17 )
{
ExfReleasePushLockShared((INT64 *)Lock);
v44 = Lock;
}
KeAbPostRelease(v44);
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
HalPutDmaAdapter(DmaAdapter);
}
v32 = v38 + 18;
}
else
{
if( _InterlockedCompareExchange64(v30, 0i64, 17i64) != 17 )
ExfReleasePushLockShared(v30);
KeAbPostRelease(v30);
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
v32 = 0;
}
v58.m256i_i32[5] = v32;
v58.m256i_i32[6] = *(unsigned __int16 *)(v56 + 16) + 106;
if( (v50 & 0x20000) != 0 && *((_QWORD *)v31 + 5) )
{
v51 = 15;
v15 = v49;
(*(void(__fastcall **)(struct _DMA_ADAPTER *, __int64, int *))(v56 + 152))(v49, 1i64, &v51);
}
else
{
v15 = v49;
}
v58.m256i_i32[7] = v52;
*(_OWORD *)ObjectInformation = v57;
*(__m256i *)((char *)ObjectInformation + 16) = v58;
*((_QWORD *)ObjectInformation + 6) = v59;
LODWORD(v46) = 56;
v14 = v45;
goto LABEL_14;
}
v20 = ObjectInformationClass - 2;
if( v20 )
{
v21 = v20 - 1;
if( v21 )
{
if( v21 != 1 )
{
HalPutDmaAdapter(v15);
return -1073741821;
}
LODWORD(v46) = 2;
if( Length < 2 )
{
v14 = -1073741820;
}
else
{
*(_BYTE *)ObjectInformation = 0;
v22 = HandleInformation.HandleAttributes;
if( (HandleInformation.HandleAttributes & 2) != 0 )
*(_BYTE *)ObjectInformation = 1;
*((_BYTE *)ObjectInformation + 1) = 0;
if( (v22 & 1) != 0 )
*((_BYTE *)ObjectInformation + 1) = 1;
}
}
else
{
LODWORD(v46) = 8;
v62 = ObjectInformation;
if( Length >= 4 )
{
*(_DWORD *)ObjectInformation = 0;
for( i = 0; ; ++i )
{
v48 = i;
if( i >= 0x100 )
break;
v56 = ObpObjectTypes[i];
if( !v56 )
break;
++*(_DWORD *)ObjectInformation;
}
while( 1 )
{
v48 = v8;
if( v8 >= 0x100 )
break;
v63 = (__int64)ObjectInformation + (unsigned int)v46;
v36 = ObpObjectTypes[v8];
v56 = v36;
if( !v36 )
break;
v37 = ObQueryTypeInfo(v36, (INT64)ObjectInformation + (unsigned int)v46, Length, &v46);
v14 = v37;
if( ((v37 + 0x80000000) & 0x80000000) == 0 && v37 != -1073741820 )
break;
++v8;
}
}
else
{
v14 = -1073741820;
}
}
goto LABEL_14;
}
v19 = ObQueryTypeInfo(v18, (INT64)ObjectInformation, Length, &v46);
}
v14 = v19;
LABEL_14:
if( v11 )
*(_DWORD *)v11 = v46;
if( v15 )
HalPutDmaAdapter(v15);
return v14;
}Referenced by:
IopLoadDriver
IopQueryRegistryKeySystemPath