NtQueryEaFile
INT64 __fastcall NtQueryEaFile(
VOID *FileHandle,
_IO_STATUS_BLOCK *IoStatusBlock,
VOID *Buffer,
UINT64 Length,
UINT8 ReturnSingleEntry,
VOID *EaList,
UINT64 EaListLength,
UINT64 *EaIndex,
UINT8 RestartScan){
INT8 v11;
__int64 v12;
char *v13;
UINT8 *v14;
int v15;
unsigned int v16;
__int64 v17;
__int64 v18;
INT64 result;
NTSTATUS v20;
FILE_OBJECT *v21;
_DWORD *v22;
_ETHREAD *v23;
volatile __int32 *v24;
__int64 v25;
INT64 v26;
CHAR v27;
PVOID v28;
_DEVICE_OBJECT *RelatedDeviceObject;
IRP *v30;
IRP *Irp;
_IO_STATUS_BLOCK *p_LocalIoStatus;
PVOID v33;
__int64 v34;
int v35;
CHAR v36;
char v37;
_KEVENT *Pool_3;
_WORD *v39;
MDL *Mdl;
UINT64 v41;
char v42;
char a2;
UINT8 *PoolWithQuota;
int v45;
PVOID Object;
PVOID P;
UINT8 *v48;
PIRP v49;
_ETHREAD *CurrentThread;
_IO_STATUS_BLOCK LocalIoStatus;
VOID *retaddr;
ULONG Size;
Size = Length;
Object = 0i64;
P = 0i64;
PoolWithQuota = 0i64;
v42 = 0;
v45 = 0;
LocalIoStatus = 0i64;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v11 = *((_BYTE *)CurrentThread + 562);
a2 = v11;
if( !v11 )
{
if( EaList && (_DWORD)EaListLength )
{
v42 = 1;
PoolWithQuota = (UINT8 *)IopVerifierExAllocatePoolWithQuota((POOL_TYPE)FileHandle, (unsigned int)EaListLength);
memmove(PoolWithQuota, (UINT8 *)EaList, (unsigned int)EaListLength);
}
if( EaIndex )
v45 = *(_DWORD *)EaIndex;
LABEL_30:
v20 = IopReferenceFileObject(FileHandle, 8ui64, v11, (FILE_OBJECT **)&Object, 0i64);
if( v20 < 0 )
{
if( v42 )
ExFreePoolWithTag(PoolWithQuota, 0);
}
else
{
v21 = (FILE_OBJECT *)Object;
v22 = (char *)Object + 80;
if( (*((_DWORD *)Object + 20) & 2) != 0 )
{
v23 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v23 + 242);
v24 = (volatile __int32 *)Object;
LODWORD(v25) = KeAbPreAcquire((char *)Object + 128, 0i64, 0i64);
if( _InterlockedExchange(v24 + 29, 1) )
{
LOBYTE(v26) = v11;
v21 = (FILE_OBJECT *)Object;
IopWaitAndAcquireFileObjectLock(Object, v26);
}
else
{
if( v25 )
*(_BYTE *)(v25 + 26) |= 1u;
v21 = (FILE_OBJECT *)Object;
ObfReferenceObject(Object);
}
v27 = 1;
v28 = P;
LABEL_37:
IopResetEvent(v21);
RelatedDeviceObject = IoGetRelatedDeviceObject(v21);
v30 = IopAllocateIrpExReturn(RelatedDeviceObject, *((_BYTE *)RelatedDeviceObject + 76), 0, retaddr);
Irp = v30;
v49 = v30;
if( !v30 )
{
if( (*v22 & 2) == 0 )
ExFreePoolWithTag(v28, 0);
IopAllocateIrpCleanup((PUNICODE_STRING)v21);
if( v42 )
ExFreePoolWithTag(PoolWithQuota, 0);
return 3221225626i64;
}
*((_QWORD *)v30 + 24) = v21;
*((_QWORD *)v30 + 19) = CurrentThread;
*((_BYTE *)v30 + 64) = a2;
if( v27 )
{
p_LocalIoStatus = IoStatusBlock;
v33 = 0i64;
}
else
{
*((_DWORD *)v30 + 4) = 4;
p_LocalIoStatus = &LocalIoStatus;
v33 = v28;
}
*((_QWORD *)Irp + 10) = v33;
*((_QWORD *)Irp + 9) = p_LocalIoStatus;
*((_QWORD *)Irp + 11) = 0i64;
v34 = *((_QWORD *)Irp + 23);
*(_BYTE *)(v34 - 72) = 7;
*(_QWORD *)(v34 - 24) = v21;
if( v42 )
{
*((_QWORD *)Irp + 20) = PoolWithQuota;
*(_QWORD *)(v34 - 56) = PoolWithQuota;
*(_DWORD *)(v34 - 48) = EaListLength;
}
v35 = *((_DWORD *)RelatedDeviceObject + 12);
if( (v35 & 4) != 0 )
{
if( !Size )
{
*((_QWORD *)Irp + 3) = 0i64;
*((_DWORD *)Irp + 4) |= 0x50u;
goto LABEL_45;
}
v39 = IopVerifierExAllocatePoolWithQuota((POOL_TYPE)v33, Size);
*((_QWORD *)Irp + 3) = v39;
if( !IopDisableBufferedIoInit )
memset((INT64)v39, 0i64);
*((_DWORD *)Irp + 4) |= 0x70u;
}
else if( (v35 & 0x10) != 0 )
{
if( Size )
{
Mdl = IoAllocateMdl(Buffer, Size, 0, 1u, Irp);
if( !Mdl )
RtlRaiseStatus(-1073741670);
v36 = a2;
IopProbeAndLockPages_2(Mdl, a2, 1, RelatedDeviceObject, *(unsigned __int8 *)(v34 - 72));
goto LABEL_46;
}
LABEL_45:
v36 = a2;
LABEL_46:
*(_DWORD *)(v34 - 64) = Size;
*(_DWORD *)(v34 - 40) = v45;
*(_BYTE *)(v34 - 70) = 0;
v37 = 0;
if( RestartScan )
{
*(_BYTE *)(v34 - 70) = 1;
v37 = 1;
}
if( ReturnSingleEntry )
{
v37 |= 2u;
*(_BYTE *)(v34 - 70) = v37;
}
if( EaIndex )
*(_BYTE *)(v34 - 70) = v37 | 4;
LODWORD(v41) = 2;
result = IopSynchronousServiceTail(RelatedDeviceObject, Irp, v21, 0, v36, v27, v41);
if( !v27 )
LODWORD(result) = IopSynchronousApiServiceTail(
(unsigned int)result,
(_KEVENT *)P,
Irp,
v36,
&LocalIoStatus,
IoStatusBlock);
return result;
}
*((_QWORD *)Irp + 14) = Buffer;
goto LABEL_45;
}
Pool_3 = (_KEVENT *)IopVerifierExAllocatePool_3();
v28 = Pool_3;
P = Pool_3;
if( Pool_3 )
{
KeInitializeEvent(Pool_3, SynchronizationEvent, 0);
v27 = 0;
goto LABEL_37;
}
if( v42 )
ExFreePoolWithTag(PoolWithQuota, 0);
v20 = -1073741670;
HalPutDmaAdapter((PADAPTER_OBJECT)v21);
}
return(unsigned int)v20;
}
v12 = 0x7FFFFFFF0000i64;
if( (unsigned __int64)IoStatusBlock < 0x7FFFFFFF0000i64 )
v12 = (__int64)IoStatusBlock;
*(_DWORD *)v12 = *(_DWORD *)v12;
ProbeForWrite(Buffer, (unsigned int)Length, 4ui64);
if( EaIndex )
{
v18 = 0x7FFFFFFF0000i64;
if( (unsigned __int64)EaIndex < 0x7FFFFFFF0000i64 )
v18 = (__int64)EaIndex;
v45 = *(_DWORD *)v18;
}
if( !EaList || !(_DWORD)EaListLength )
goto LABEL_30;
v48 = 0i64;
v42 = 1;
if( ((unsigned __int8)EaList & 3) != 0 )
ExRaiseDatatypeMisalignment();
v13 = (char *)EaList + (unsigned int)EaListLength;
if( (unsigned __int64)v13 > 0x7FFFFFFF0000i64 || v13 < EaList )
MEMORY[0x7FFFFFFF0000] = 0;
v14 = (UINT8 *)IopVerifierExAllocatePoolWithQuota((POOL_TYPE)-65536, (unsigned int)EaListLength);
PoolWithQuota = v14;
memmove(v14, (UINT8 *)EaList, (unsigned int)EaListLength);
v48 = v14;
v15 = EaListLength;
while( 1 )
{
if( v15 < 5 )
{
ExFreePoolWithTag(PoolWithQuota, 0);
IoStatusBlock->Status = -2147483628;
IoStatusBlock->Information = 0i64;
return 2147483668i64;
}
v16 = v14[4] + 6;
if( v15 < v16 )
break;
v17 = *(unsigned int *)v14;
if( !(_DWORD)v17 )
{
if( (int)(v15 - v16) >= 0 )
goto LABEL_30;
break;
}
if( ((v14[4] + 9) & 0xFFFFFFFC) != (_DWORD)v17 )
break;
if( (int)v17 < 0 )
break;
v15 -= v17;
if( v15 < 0 )
break;
v14 += v17;
v48 = v14;
}
ExFreePoolWithTag(PoolWithQuota, 0);
IoStatusBlock->Status = -2147483628;
IoStatusBlock->Information = (int)v14 - (int)PoolWithQuota;
return 2147483668i64;
}Referenced by:
No references.