IoInitSystemPreDrivers
UINT8 __fastcall IoInitSystemPreDrivers(_LOADER_PARAMETER_BLOCK *LoaderBlock){
unsigned __int64 v2;
int v3;
unsigned int ActiveProcessorCount;
DEVICE_OBJECT *v5;
unsigned int v6;
_DWORD *v7;
unsigned int v8;
WCHAR v9;
INT64 v10;
INT64 v11;
WCHAR v12;
INT64 v13;
INT64 v14;
WCHAR v15;
__int64 v16;
int v17;
UINT32 v18;
PFILE_OBJECT v19;
PVOID v20;
PULONG v21;
UINT64 v22;
UINT8 v23;
UINT8 v24;
INT64 v25;
INT64 v26;
INT64 v27;
INT64 v28;
_BYTE *v29;
ULONG v30;
int SystemDlls;
bool IsStateSeparationDevModeEnabled;
SIZE_T Size;
SIZE_T Sizea;
__int64 OutputBuffer;
UNICODE_STRING KeyHandle;
PVOID Object;
struct _OBJECT_ATTRIBUTES ObjectAttributes;
struct _UNICODE_STRING DestinationString;
_STRING NtDeviceName;
_DRIVER_OBJECT *PreviousDriver;
int Context;
int Context_4;
__int128 v45;
__int64 v46;
struct _IO_STATUS_BLOCK IoStatusBlock;
INT64 v48[2];
__int128 v49;
*(_QWORD *)&NtDeviceName.Length = 0x1000000i64;
v46 = 0i64;
PreviousDriver = 0i64;
*(&ObjectAttributes.Length + 1) = 0;
*(&ObjectAttributes.Attributes + 1) = 0;
*(_QWORD *)&KeyHandle.Length = 0i64;
v45 = 0i64;
LOBYTE(OutputBuffer) = 0;
DestinationString = 0i64;
NtDeviceName.Buffer = (char *)IoInitSystem_deviceNameBuffer;
IoStatusBlock = 0i64;
*(_OWORD *)v48 = 0i64;
v49 = 0i64;
ExInitializeResourceLite(&IopDriverLoadResource);
ExInitializeResourceLite(&IopDatabaseResource);
ExInitializeResourceLite(&IopSecurityResource);
ExInitializeResourceLite(&IopCrashDumpLock);
ExInitializeResourceLite(&IopLiveDumpLock);
ExInitializePushLock((EX_RUNDOWN_REF *)&IopFilesystemDatabaseShutdownRundown);
IopPerfIoTrackingLock = 0i64;
IopDiskFileSystemQueueHead.Blink = &IopDiskFileSystemQueueHead;
IopDiskFileSystemQueueHead.Flink = &IopDiskFileSystemQueueHead;
qword_140C45908 = (__int64)IopCdRomFileSystemQueueHead;
*(_QWORD *)IopCdRomFileSystemQueueHead = IopCdRomFileSystemQueueHead;
IopTapeFileSystemQueueHead.Blink = &IopTapeFileSystemQueueHead;
IopTapeFileSystemQueueHead.Flink = &IopTapeFileSystemQueueHead;
IopNetworkFileSystemQueueHead.Blink = &IopNetworkFileSystemQueueHead;
IopNetworkFileSystemQueueHead.Flink = &IopNetworkFileSystemQueueHead;
IopBootDriverReinitializeQueueHead.Blink = &IopBootDriverReinitializeQueueHead;
IopBootDriverReinitializeQueueHead.Flink = &IopBootDriverReinitializeQueueHead;
IopDriverReinitializeQueueHead.Blink = &IopDriverReinitializeQueueHead;
IopDriverReinitializeQueueHead.Flink = &IopDriverReinitializeQueueHead;
qword_140C45918 = (__int64)&IopNotifyShutdownQueueHead;
IopNotifyShutdownQueueHead = &IopNotifyShutdownQueueHead;
qword_140C45928 = (__int64)&IopNotifyLastChanceShutdownQueueHead;
IopNotifyLastChanceShutdownQueueHead = &IopNotifyLastChanceShutdownQueueHead;
qword_140C45968 = (__int64)IopFsNotifyChangeQueueHead;
*(_QWORD *)IopFsNotifyChangeQueueHead = IopFsNotifyChangeQueueHead;
qword_140C45978 = (__int64)&IopPerfIoTrackingListHead;
IopPerfIoTrackingListHead = (__int64)&IopPerfIoTrackingListHead;
IoStatisticsLock = 0i64;
IopFunctionPointerLock = 0i64;
*(_OWORD *)&IopDiskIoAttributionTree = 0i64;
IopUniqueDeviceObjectNumber = 0;
IopIrpStackProfilerFlags = 0;
v2 = __rdtsc() >> 4;
v3 = 0;
IopUniqueDriverObjectNumber = v2 % 0x64 + 10;
if( !IopLargeIrpStackLocations )
{
IopLargeIrpStackLocations = 14;
v3 = 1;
IopIrpStackProfilerFlags = 1;
}
if( !IopMediumIrpStackLocations )
{
IopMediumIrpStackLocations = 4;
IopIrpStackProfilerFlags = v3 | 2;
}
if( (unsigned int)(IopIrpCompletionTimeoutInSeconds - 2) > 0x12A )
IopIrpCompletionTimeoutInSeconds = 300;
IopQueryProcessorInitValues((__int64)v48, (v2 * (unsigned __int128)0x47AE147AE147AE15ui64) >> 64);
ExInitializeSystemLookasideList(
(unsigned int)IopCompletionLookasideList,
512,
56,
544236361,
SHIWORD(v48[0]),
(__int64)&ExSystemLookasideListHead);
ExInitializeSystemLookasideList(
(unsigned int)IopLargeIrpLookasideList,
512,
DWORD1(v49),
1819308617,
SWORD2(v48[0]),
(__int64)&ExSystemLookasideListHead);
ExInitializeSystemLookasideList(
(unsigned int)IopMediumIrpLookasideList,
512,
v49,
1836085833,
SWORD1(v48[0]),
(__int64)&ExSystemLookasideListHead);
ExInitializeSystemLookasideList(
(unsigned int)IopSmallIrpLookasideList,
512,
HIDWORD(v48[1]),
1936749129,
v48[0],
(__int64)&ExSystemLookasideListHead);
ExInitializeSystemLookasideList(
(unsigned int)IopMdlLookasideList,
512,
DWORD2(v49),
543974477,
v48[1],
(__int64)&ExSystemLookasideListHead);
ExInitializeNPagedLookasideList(
(PNPAGED_LOOKASIDE_LIST)IopSafeCompletionLookasideList,
0i64,
0i64,
0x200u,
0x20ui64,
0x73556F49u,
0);
FsRtlInitExtraCreateParameterLookasideList(IopSymlinkInfoLookasideList, 0i64, 0x11Eui64, 0x69536F49ui64);
ExInitializeNPagedLookasideList(
(PNPAGED_LOOKASIDE_LIST)IopOplockFoExtLookasideList,
0i64,
0i64,
0x200u,
0x30ui64,
0x7443704Fu,
0);
ActiveProcessorCount = KeQueryActiveProcessorCountEx(0xFFFFu);
v5 = 0i64;
v6 = ActiveProcessorCount;
for( LODWORD(KeyHandle.Buffer) = 0; (unsigned int)v5 < v6; LODWORD(KeyHandle.Buffer) = (_DWORD)v5 )
{
IoInitializeProcessor((INT64)*(&KiProcessorBlock + (_QWORD)v5), v48);
v5 = (DEVICE_OBJECT *)(unsigned int)(LODWORD(KeyHandle.Buffer) + 1);
}
IopErrorLogLock = 0i64;
qword_140C459B8 = (__int64)IopErrorLogListHead;
*(_QWORD *)IopErrorLogListHead = IopErrorLogListHead;
if( IopInitializeReserveIrps(v5) )
{
if( (IopIrpStackProfilerFlags & 3) != 0 )
{
IopIrpStackProfilerMinSizeThreshold = 400;
IopIrpStackProfilerDpc.DeferredRoutine = (void(__fastcall *)(_KDPC *, void *, void *, void *))IopIrpStackProfilerDpcRoutine;
IopIrpStackProfilerFlags |= 4u;
IopIrpStackProfilerSampleSize = 2000;
IopIrpStackProfilerDpc.TargetInfoAsUlong = 275;
IopIrpStackProfilerDpc.DeferredContext = 0i64;
IopIrpStackProfilerDpc.DpcData = 0i64;
IopIrpStackProfilerDpc.ProcessorHistory = 0i64;
}
v7 = (_DWORD *)IopRevocationExtension;
memset(IopRevocationExtension, 0i64);
*v7 = 4;
v8 = IopDiskIoAttributionBaseIoSize;
if( (unsigned int)IopDiskIoAttributionBaseIoSize >= 0x400000 )
{
v8 = 0x400000;
IopDiskIoAttributionBaseIoSize = 0x400000;
}
if( v8 <= 0x1000 )
IopDiskIoAttributionBaseIoSize = 4096;
ObjectAttributes.Length = 48;
ObjectAttributes.ObjectName = &CmRegistryMachineSystemCurrentControlSetServicesEventLog;
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.Attributes = 576;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
if( ZwOpenKey((PHANDLE)&KeyHandle, 0x20019u, &ObjectAttributes) < 0 )
{
IopErrorLogDisabledThisBoot = 1;
}
else
{
RtlInitUnicodeString(&DestinationString, L"Start", v9);
LODWORD(Size) = 32;
IopErrorLogDisabledThisBoot = (int)NtQueryValueKey(
*(VOID **)&KeyHandle.Length,
&DestinationString,
KeyValuePartialInformation,
IoInitSystem_valueBuffer,
Size,
(UINT64 *)&KeyHandle.Buffer) < 0
|| dword_140D57944 != 4
|| dword_140D5794C == 4;
ObCloseHandle(*(PVOID *)&KeyHandle.Length, 0);
}
IopTimer = 9i64;
IopTimerQueueHead.Blink = &IopTimerQueueHead;
IopTimerQueueHead.Flink = &IopTimerQueueHead;
IopTimerLock = 0i64;
IopTimerDpc.DeferredRoutine = (void(__fastcall *)(_KDPC *, void *, void *, void *))IopTimerDispatch;
IopTimerDpc.DeferredContext = &IopTimerCount;
qword_140C45B30 = (__int64)&qword_140C45B28;
qword_140C45B28 = (__int64)&qword_140C45B28;
qword_140C45B68 = (__int64)&IopDeadIrps;
IopDeadIrps = (__int64)&IopDeadIrps;
IopHardError.WorkerRoutine = (void(__fastcall *)(void *))IopHardErrorThread;
qword_140C45C68 = (__int64)&qword_140C45C60;
qword_140C45C60 = (__int64)&qword_140C45C60;
stru_140C45C78.Header.WaitListHead.Blink = &stru_140C45C78.Header.WaitListHead;
stru_140C45C78.Header.WaitListHead.Flink = &stru_140C45C78.Header.WaitListHead;
IopKeepAliveTracker.WorkerRoutine = (void(__fastcall *)(void *))IopKeepAliveWorker;
qword_140C45BE8 = (__int64)&qword_140C45BE0;
qword_140C45BE0 = &qword_140C45BE0;
IopTimerDpc.TargetInfoAsUlong = 275;
IopTimerDpc.DpcData = 0i64;
IopTimerDpc.ProcessorHistory = 0i64;
qword_140C45B38 = 0i64;
dword_140C45B5C = 0;
word_140C45B58 = 0;
IopHardError.Parameter = 0i64;
IopHardError.List.Flink = 0i64;
qword_140C45C70 = 0i64;
stru_140C45C78.Header.Type = 5;
stru_140C45C78.Header.Size = 8;
stru_140C45C78.Header.SignalState = 0;
stru_140C45C78.Limit = 0x7FFFFFFF;
byte_140C45C98 = 0;
IopKeepAliveTracker.Parameter = 0i64;
IopKeepAliveTracker.List.Flink = 0i64;
qword_140C45BF0 = 0i64;
byte_140C45C18 = 0;
IopErrorLogSessionPending = 1;
RtlInitUnicodeString(&DestinationString, L"\\Security\\TRKWKS_EVENT", v9);
ObjectAttributes.Length = 48;
ObjectAttributes.ObjectName = &DestinationString;
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.Attributes = 528;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
if( NtCreateEvent((PVOID *)&KeyHandle, 0x1F0003ui64, &ObjectAttributes, NotificationEvent, 0) < 0 )
{
HeadlessKernelAddLogEntry(4ui64, 0i64);
}
else
{
Object = 0i64;
ObReferenceObjectByHandle(*(HANDLE *)&KeyHandle.Length, 0, (POBJECT_TYPE)ExEventObjectType, 0, &Object, 0i64);
IopLinkTrackingServiceEvent = (__int64)Object;
IopMountCompletionEvent.Header.WaitListHead.Blink = &IopMountCompletionEvent.Header.WaitListHead;
IopMountCompletionEvent.Header.WaitListHead.Flink = &IopMountCompletionEvent.Header.WaitListHead;
stru_140C45CE0.Header.WaitListHead.Blink = &stru_140C45CE0.Header.WaitListHead;
stru_140C45CE0.Header.WaitListHead.Flink = &stru_140C45CE0.Header.WaitListHead;
IopLinkTrackingPortObject.Header.WaitListHead.Blink = &IopLinkTrackingPortObject.Header.WaitListHead;
IopLinkTrackingPortObject.Header.WaitListHead.Flink = &IopLinkTrackingPortObject.Header.WaitListHead;
LOWORD(IopMountCompletionEvent.Header.Lock) = 0;
IopMountCompletionEvent.Header.Size = 6;
IopMountCompletionEvent.Header.SignalState = 0;
LOWORD(stru_140C45CE0.Header.Lock) = 0;
stru_140C45CE0.Header.Size = 6;
stru_140C45CE0.Header.SignalState = 0;
LOWORD(IopLinkTrackingPortObject.Header.Lock) = 1;
IopLinkTrackingPortObject.Header.Size = 6;
IopLinkTrackingPortObject.Header.SignalState = 1;
ObCloseHandle(*(PVOID *)&KeyHandle.Length, 0);
if( IopCreateRootDirectories(v11, v10, v12) )
{
if( IopInitializeSessionNotifications(v14, v13, v15) < 0 )
{
IopInitFailCode = 15;
}
else if( IopInitializePlugPlayServices(LoaderBlock, 0i64) < 0 )
{
HeadlessKernelAddLogEntry(7ui64, 0i64);
IopInitFailCode = 4;
}
else
{
KseInitialize(LoaderBlock, 0i64);
PoInitDriverServices();
off_140C00AC0[0]();
PnpMarkHalDeviceNode();
if( WMIInitialize(0i64, LoaderBlock) )
{
if( !RtlIsStateSeparationEnabled()
|| (IsStateSeparationDevModeEnabled = CmIsStateSeparationDevModeEnabled(),
LOBYTE(v16) = 1,
IsStateSeparationDevModeEnabled) )
{
LOBYTE(v16) = 0;
}
v17 = ExpInitializeStateSeparationPhase0(v16);
if( (int)(v17 + 0x80000000) < 0 || v17 == -1073741637 )
{
EtwInitialize(0i64);
if( EtwRegister(&IoTraceProvider, (PETWENABLECALLBACK)IopEtwEnableCallback, 0i64, &IoTraceHandle) < 0 )
{
IopInitFailCode = 16;
}
else if( EtwRegister(&IoMgrProvider, 0i64, 0i64, &IoMgrTraceHandle) < 0 )
{
IopInitFailCode = 11;
}
else
{
SeAuditBootConfiguration(*(_QWORD *)(*((_QWORD *)LoaderBlock + 30) + 2848i64));
BootApplicationPersistentDataProcess(1i64);
BapdRecordFirmwareBootStats(v19, v18, v20, v21);
KdInitialize(2i64, 0i64, &KdpContext);
TraceLoggingRegisterEx_EtwRegister_EtwSetInformation(&dword_140C01A70);
if( !IopErrorLogDisabledThisBoot )
{
KeAcquireSpinLockRaiseToDpc(&IopErrorLogLock, v22);
v24 = v23;
if( *(INT64(__stdcall **)(FILE_OBJECT *, FILE_OBJECT *))IopErrorLogListHead == IopErrorLogListHead )
{
IopErrorLogSessionPending = 0;
}
else
{
IopErrorLogWorkItem.Parameter = 0i64;
IopErrorLogWorkItem.WorkerRoutine = (void(__fastcall *)(void *))IopErrorLogThread;
IopErrorLogWorkItem.List.Flink = 0i64;
ExQueueWorkItem(&IopErrorLogWorkItem, DelayedWorkQueue);
}
KeReleaseSpinLock(&IopErrorLogLock, v24);
}
WheaInitialize(LoaderBlock, 0i64);
if( IopStoreArcInformation(LoaderBlock) >= 0 )
{
if( IopInitializePlugPlayServices(LoaderBlock, 1ui64) < 0 )
{
HeadlessKernelAddLogEntry(8ui64, 0i64);
IopInitFailCode = 5;
}
else
{
RtlInitializeGenericTableAvl(
(PRTL_AVL_TABLE)IoStatusBlockRangeTable,
(PRTL_AVL_COMPARE_ROUTINE)IopCompareIosbRanges,
(PRTL_AVL_ALLOCATE_ROUTINE)IopAllocateGenericTableEntry,
(PRTL_AVL_FREE_ROUTINE)IopFreeGenericTableEntry,
0i64);
IoStatusBlockRangeTableLock.Count = 1;
IoStatusBlockRangeTableLock.Event.Header.WaitListHead.Blink = &IoStatusBlockRangeTableLock.Event.Header.WaitListHead;
IoStatusBlockRangeTableLock.Event.Header.WaitListHead.Flink = &IoStatusBlockRangeTableLock.Event.Header.WaitListHead;
IoStatusBlockRangeTableLock.Owner = 0i64;
IoStatusBlockRangeTableLock.Contention = 0;
LOWORD(IoStatusBlockRangeTableLock.Event.Header.Lock) = 1;
IoStatusBlockRangeTableLock.Event.Header.Size = 6;
IoStatusBlockRangeTableLock.Event.Header.SignalState = 0;
KitpInitAitSampleRate(LoaderBlock);
if( EtwRegister(&MS_Windows_AIT_Provider, 0i64, 0i64, &KitEtwHandle) < 0 )
KitEtwHandle = 0i64;
KseInitialize(LoaderBlock, 1ui64);
if( HvlPhase2Initialize(LoaderBlock) >= 0 )
{
Context_4 = KeQueryActiveProcessorCountEx(0xFFFFu);
Context = Context_4;
KeIpiGenericCall((PKIPI_BROADCAST_WORKER)KeOptimizeSpecCtrlSettings, &Context);
VslpIumPhase4Initialize();
if( PnpEtwHandle )
EtwWriteStartScenario(
PnpEtwHandle,
&KMPnPEvt_DriverInitPhase_Start,
&PnpDriverInitPhaseActivityId,
0i64,
0i64);
LOWORD(ActiveConnectListLock.Header.Lock) = 1;
qword_140C452C8 = (__int64)&ActiveConnectList;
ActiveConnectList = (__int64)&ActiveConnectList;
ActiveConnectListLock.Header.WaitListHead.Blink = &ActiveConnectListLock.Header.WaitListHead;
ActiveConnectListLock.Header.WaitListHead.Flink = &ActiveConnectListLock.Header.WaitListHead;
ActiveConnectListLock.Header.Size = 6;
ActiveConnectListLock.Header.SignalState = 1;
if( (int)IopInitializePassiveInterruptServices() >= 0 )
{
SecureDump_PrepareForInit(v25, (BYTE *)&OutputBuffer);
if( ForceDumpDisabled || (_BYTE)OutputBuffer )
CapsuleDumpAllowed = 0;
else
IopInitDumpCapsuleSupport();
if( (_DWORD)ExLeapSecondDataLastParseResult )
EtwTraceLeapSecondDataParseFailure((unsigned int)ExLeapSecondDataLastParseResult);
EtwTraceLeapSecondDataUpdate(
0i64,
*(unsigned __int8 *)ExLeapSecondData,
*((unsigned int *)ExLeapSecondData + 1),
0i64);
IopInitializeIoRate(v27, v26);
PsAltSystemCallRegistrationLock = 0i64;
PsAltSystemCallHandlers[0] = (__int64)PsPicoAltSystemCallDispatch;
if( (unsigned int)IopInitializeBootDrivers(LoaderBlock, &PreviousDriver) )
{
if( (int)IopLoadBootHotPatches() < 0 )
{
IopInitFailCode = 21;
}
else
{
if( !PoInitSystem(2ui64, LoaderBlock) )
KeBugCheck(0xA0ui64);
SmInitSystem(1ui64);
EtwInitialize(1ui64);
LOBYTE(OutputBuffer) = 0;
if( VslVsmEnabled )
{
LODWORD(Sizea) = 1;
if( NtPowerInformation((POWER_INFORMATION_LEVEL)66, 0i64, 0i64, &OutputBuffer, Sizea) >= 0 )
{
if( (_BYTE)OutputBuffer )
{
ExSubscribeWnfStateChange(
&VslpIumCsWnfSubscription,
(INT64 *)&WNF_PO_SCENARIO_CHANGE,
1i64,
0i64,
(INT64)VslpConnectedStandbyWnfCallback,
0i64);
PoRegisterPowerSettingCallback(
0i64,
&GUID_LOW_POWER_EPOCH,
VslpConnectedStandbyPoCallback,
0i64,
0i64);
PoRegisterPowerSettingCallback(
0i64,
&GUID_PDC_IDLE_RESILIENCY_ENGAGED,
VslpConnectedStandbyPoCallback,
0i64,
0i64);
}
}
}
IopInitializeSystemVariableService(v29, v28);
if( !ForceDumpDisabled )
{
EtwRegister(
&LiveDumpProvGuid,
(PETWENABLECALLBACK)IopLiveDumpTracingControlCallback,
0i64,
&IopLiveDumpEtwRegHandle);
TraceLoggingRegisterEx_EtwRegister_EtwSetInformation(&dword_140C04498);
}
IopInitializeTriageDumpData();
if( IopInitCrashDumpDuringSysInit(LoaderBlock) >= 0 )
IopRemoveDumpCapsuleSupport();
if( !RtlIsStateSeparationEnabled() )
PpLastGoodDoBootProcessing();
v30 = NtGlobalFlag;
NtGlobalFlag |= 0x40000u;
SystemDlls = PsLocateSystemDlls();
NtGlobalFlag = v30;
if( SystemDlls < 0 )
{
HeadlessKernelAddLogEntry(0xAui64, 0i64);
IopInitFailCode = 7;
}
else
{
PfSnBeginBootPhase(0i64);
if( IopReassignSystemRoot(LoaderBlock, &NtDeviceName) )
{
if( IopProtectSystemPartition(LoaderBlock) )
{
if( NtVhdBootFile )
{
ObjectAttributes.ObjectName = (_UNICODE_STRING *)((char *)PsLoadedModuleList + 72);
ObjectAttributes.Length = 48;
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.Attributes = 576;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
if( ZwOpenFile(&KeyHandle, (PWCHAR)0x80000000i64) >= 0 )
{
Object = 0i64;
if( ObReferenceObjectByHandle(
*(HANDLE *)&KeyHandle.Length,
0x80u,
0i64,
0,
&Object,
0i64) >= 0 )
{
PpPagePathAssign((PFILE_OBJECT)Object);
HalPutDmaAdapter((PADAPTER_OBJECT)Object);
}
ZwClose(*(HANDLE *)&KeyHandle.Length);
}
}
if( WMIInitialize(1ui64, 0i64) )
{
WheaInitialize(LoaderBlock, 1ui64);
return 1;
}
}
else
{
HeadlessKernelAddLogEntry(0xDui64, 0i64);
IopInitFailCode = 10;
}
}
else
{
HeadlessKernelAddLogEntry(0xCui64, 0i64);
IopInitFailCode = 9;
}
}
}
}
else
{
HeadlessKernelAddLogEntry(9ui64, 0i64);
IopInitFailCode = 6;
}
}
}
}
}
}
}
}
}
}
else
{
HeadlessKernelAddLogEntry(6ui64, 0i64);
IopInitFailCode = 3;
}
}
}
else
{
IopInitFailCode = 1;
}
return 0;
}Referenced by:
IoInitSystem