IopGetVolumeId

NTSTATUS __stdcall IopGetVolumeId(FILE_OBJECT *FileObject, LINK_TRACKING_INFORMATION *ObjectId){
  _DEVICE_OBJECT *RelatedDeviceObject; 
  PIRP v5; 
  IRP *v6; 
  __int64 v7; 
  NTSTATUS Status; 
  __int128 v9; 
  struct _KEVENT Event; 
  struct _IO_STATUS_BLOCK IoStatusBlock; 
  _OWORD result[4]; 
  IoStatusBlock = 0i64;
  memset(&Event, 0, sizeof(Event));
  memset((INT64)result, 0i64);
  KeInitializeEvent(&Event, NotificationEvent, 0);
  RelatedDeviceObject = IoGetRelatedDeviceObject(FileObject);
  v5 = IoBuildDeviceIoControlRequest(0, RelatedDeviceObject, 0i64, 0, 0i64, 0, 0, &Event, &IoStatusBlock);
  v6 = v5;
  if( !v5 )
    return -1073741670;
  *((_DWORD *)v5 + 4) |= 4u;
  *((_QWORD *)v5 + 24) = FileObject;
  *((_QWORD *)v5 + 14) = result;
  *((_QWORD *)v5 + 3) = result;
  v7 = *((_QWORD *)v5 + 23);
  *(_QWORD *)(v7 - 24) = FileObject;
  *(_BYTE *)(v7 - 72) = 10;
  *(_DWORD *)(v7 - 64) = 64;
  *(_DWORD *)(v7 - 56) = 8;
  ObfReferenceObject(FileObject);
  Status = IofCallDriver(RelatedDeviceObject, v6);
  if( Status == 259 )
  {
    KeWaitForSingleObject(&Event, Executive, 0, 0, 0i64);
    Status = IoStatusBlock.Status;
  }
  if( Status >= 0 )
  {
    v9 = result[0];
    ObjectId->Type = NtfsLinkTrackingInformation;
    *(_OWORD *)ObjectId->VolumeId = v9;
  }
  return Status;
}

Referenced by: