PspInitPhase0
UINT8 __fastcall PspInitPhase0(_LOADER_PARAMETER_BLOCK *LoaderBlock){
char *v1;
__int64 v3;
unsigned __int64 v4;
__int64 v5;
char v6;
__int64 v7;
__int128 *v8;
__int64 v9;
int v10;
union _RTL_RUN_ONCE *v11;
union _RTL_RUN_ONCE *v12;
__int64 v13;
union _RTL_RUN_ONCE *v14;
union _RTL_RUN_ONCE *v15;
__int64 v16;
union _RTL_RUN_ONCE *v17;
union _RTL_RUN_ONCE *v18;
__int64 v19;
EX_RUNDOWN_REF *v20;
WCHAR v21;
WCHAR v22;
WCHAR v23;
WCHAR v24;
int *v25;
int v26;
WCHAR v27;
_QWORD *v28;
void *v29;
NTSTATUS v30;
PVOID v31;
_OWORD *v32;
PVOID *Object;
POBJECT_HANDLE_INFORMATION HandleInformation;
struct _UNICODE_STRING DestinationString;
_DWORD result[3];
__int128 v38;
int v39;
int v40;
__int64 v41;
int v42;
void *v43;
void *v44;
__int64(__fastcall *v45)(ULONG_PTR);
PVOID v46;
void *ThreadHandle;
UINT64 MitigationOptions[2];
__int64 v49;
INT64 v50[2];
__int64 v51;
int v52;
char v53;
int v54;
char v55;
int v56;
char v57;
int v58;
char v59;
int v60;
char v61;
int v62;
char v63;
__int128 v64[2];
PspMinimumWorkingSet += 30i64;
v1 = &v53;
PspMaximumWorkingSet += 300i64;
ThreadHandle = 0i64;
DestinationString = 0i64;
v52 = 0;
v64[0] = (__int128)_mm_load_si128((const __m128i *)&_xmm);
v53 = 1;
v3 = 6i64;
v54 = 2;
PspHardenedMitigationOptionsMap = 0i64;
v55 = 3;
v56 = 3;
v57 = 1;
v58 = 1;
v59 = 1;
v60 = 4;
v61 = 1;
v62 = 5;
v63 = 1;
v64[1] = (__int128)_mm_load_si128((const __m128i *)&_xmm);
qword_140CFBC78 = 0i64;
do
{
v4 = (unsigned int)(4 * *((_DWORD *)v1 - 1));
v5 = (unsigned __int8)*v1;
v6 = (4 * *(v1 - 4)) & 0x3F;
v1 += 8;
v4 >>= 6;
v7 = (v5 << v6) | *((_QWORD *)&PspHardenedMitigationOptionsMap + v4) & ~(3i64 << v6);
*((_QWORD *)&PspHardenedMitigationOptionsMap + v4) = v7;
--v3;
}
while( v3 );
if( (unsigned int)PspSystemMitigationOptionsLength < 0x18 )
memset(0x140000000i64 + (unsigned int)PspSystemMitigationOptionsLength + 13613520i64, 0i64);
LOBYTE(v7) = 1;
*(_OWORD *)MitigationOptions = PspSystemMitigationOptions;
PspSystemMitigationOptionsLength = 24;
v49 = qword_140CFB9E0;
if( PspValidateMitigationOptions((UINT64)MitigationOptions, v7) < 0 )
{
PspSystemMitigationOptions = 0i64;
qword_140CFB9E0 = 0i64;
}
v8 = v64;
v9 = 8i64;
do
{
v10 = *(_DWORD *)v8;
v8 = (__int128 *)((char *)v8 + 4);
*((_QWORD *)&PspSystemMitigationOptions + ((unsigned __int64)(unsigned int)(4 * v10) >> 6)) &= ~(3i64 << ((4 * v10) & 0x3F));
--v9;
}
while( v9 );
if( (unsigned int)PspSystemMitigationAuditOptionsLength < 0x18 )
memset((INT64)&PspSystemMitigationAuditOptions + (unsigned int)PspSystemMitigationAuditOptionsLength, 0i64);
*(_OWORD *)v50 = *(_OWORD *)&PspSystemMitigationAuditOptions;
v51 = qword_140CFBB80;
if( (int)PspValidateMitigationAuditOptions((INT64)v50) < 0 )
memset((INT64)&PspSystemMitigationAuditOptions, 0i64);
v11 = (union _RTL_RUN_ONCE *)&PspCreateThreadNotifyRoutine;
do
{
CmSiRWLockInitialize(v11);
v11 = v12 + 1;
}
while( v13 != 1 );
v14 = &PspCreateProcessNotifyRoutine;
do
{
CmSiRWLockInitialize(v14);
v14 = v15 + 1;
}
while( v16 != 1 );
v17 = (union _RTL_RUN_ONCE *)&PspLoadImageNotifyRoutine;
do
{
CmSiRWLockInitialize(v17);
v17 = v18 + 1;
}
while( v19 != 1 );
PsChangeQuantumTable(0, (unsigned int)PsRawPrioritySeparation);
PspActiveProcessLock = 0i64;
qword_140C1E078 = (__int64)&PsActiveProcessHead;
PsActiveProcessHead = (__int64)&PsActiveProcessHead;
v20 = (EX_RUNDOWN_REF *)*((_QWORD *)KeGetCurrentThread() + 23);
PsIdleProcess = v20;
v20[135].Count = 0i64;
ExInitializePushLock(v20 + 139);
*((_DWORD *)PsIdleProcess + 223) = 0;
memset((INT64)result, 0i64);
LOWORD(result[0]) = 120;
v41 = 512i64;
RtlInitUnicodeString(&DestinationString, L"Job", v21);
*(_QWORD *)&result[1] = 2048i64;
v45 = (__int64(__fastcall *)(ULONG_PTR))PspJobDelete;
v42 = 1600;
v44 = PspJobClose;
v39 = 2031679;
BYTE2(result[0]) = BYTE2(result[0]) & 0x77 | 8;
v38 = PspJobMapping;
if( (int)ObCreateObjectType(&DestinationString, (__int64)result, 0i64, (__int64)&PsJobType) >= 0
&& (int)SeRegisterObjectTypeMandatoryPolicy((__int64)PsJobType, 1) >= 0 )
{
result[2] = 176;
RtlInitUnicodeString(&DestinationString, L"Process", v22);
BYTE2(result[0]) |= 0xC2u;
v45 = PspProcessDelete;
result[1] = 32;
v43 = PspProcessOpen;
HIDWORD(v41) = 4096;
v44 = PspProcessClose;
v42 = 2624;
v39 = 0x1FFFFF;
v40 = 1052672;
v38 = PspProcessMapping;
if( (int)ObCreateObjectType(&DestinationString, (__int64)result, 0i64, (__int64)&PsProcessType) >= 0
&& (int)SeRegisterObjectTypeMandatoryPolicy((__int64)PsProcessType, 3) >= 0 )
{
RtlInitUnicodeString(&DestinationString, L"Thread", v23);
BYTE2(result[0]) |= 0x80u;
v45 = (__int64(__fastcall *)(ULONG_PTR))PspThreadDelete;
result[1] = 4;
v43 = PspThreadOpen;
HIDWORD(v41) = 0;
v42 = 2200;
v44 = 0i64;
v39 = 0x1FFFFF;
v40 = 1054720;
v38 = PspThreadMapping;
if( (int)ObCreateObjectType(&DestinationString, (__int64)result, 0i64, (__int64)&PsThreadType) >= 0
&& (int)SeRegisterObjectTypeMandatoryPolicy((__int64)PsThreadType, 3) >= 0 )
{
RtlInitUnicodeString(&DestinationString, L"Partition", v24);
memset((INT64)result, 0i64);
BYTE2(result[0]) |= 0xCu;
v43 = PspOpenPartitionHandle;
LOWORD(result[0]) = 120;
v44 = PspClosePartitionHandle;
result[2] = 16;
v45 = (__int64(__fastcall *)(ULONG_PTR))PspDeletePartition;
v39 = 2031619;
LODWORD(v41) = 512;
v38 = PspPartitionMapping;
v42 = 128;
if( (int)ObCreateObjectType(&DestinationString, (__int64)result, 0i64, (__int64)&PsPartitionType) >= 0 )
{
memset((INT64)result, 0i64);
LOWORD(result[0]) = 120;
LODWORD(v41) = 512;
BYTE2(result[0]) = BYTE2(result[0]) & 0x7D | 2;
v25 = (int *)PspMemoryReserveObjectSizes;
result[2] = 176;
v26 = 0;
v38 = PspMemReserveMapping;
v39 = 983043;
do
{
v42 = *v25;
if( (int)ObCreateObjectType(
(const UNICODE_STRING *)&PspMemoryReserveObjectNames[2 * v26],
(__int64)result,
0i64,
(__int64)(&PspMemoryReserveObjectTypes + v26)) < 0 )
return 0;
++v26;
v25 += 2;
}
while( v26 < 2 );
RtlInitUnicodeString(&DestinationString, L"ActivityReference", v27);
memset((INT64)result, 0i64);
BYTE2(result[0]) |= 4u;
LOWORD(result[0]) = 120;
v41 = 0x800000001i64;
result[2] = 402;
v38 = PspActivityReferenceMapping;
v39 = 2031616;
v44 = PspCloseActivityReference;
if( (int)ObCreateObjectType(
&DestinationString,
(__int64)result,
0i64,
(__int64)&PspActivityReferenceObjectType) >= 0 )
{
if( PspInitializeJobStructures() )
{
if( PspInitializeSiloStructures() )
{
qword_140C130B0 = 0i64;
qword_140C130A8 = (__int64)&PspWorkingSetChangeHead;
PspWorkingSetChangeHead = (__int64)&PspWorkingSetChangeHead;
PspAffinityUpdateLock = 0i64;
PspCidTable = (_HANDLE_TABLE *)ExCreateHandleTable(0i64, 0i64);
if( PspCidTable )
{
CmSiRWLockInitialize((PRTL_RUN_ONCE)&PsWin32CallBack);
CmSiRWLockInitialize(&PsWin32NullCallBack);
LOBYTE(PspCidTable->Flags) |= 1u;
PsReaperWorkItem.WorkerRoutine = PspReaper;
qword_140C1E030 = (__int64)PspProcessRundownWorker;
PspProcessRundownCacheWorkItem.WorkerRoutine = (void(__fastcall *)(void *))PspProcessRundownWorkerSingle;
PsReaperListHead = 0i64;
PsReaperWorkItem.Parameter = 0i64;
PsReaperWorkItem.List.Flink = 0i64;
qword_140C1E038 = 0i64;
PspProcessRundownWorkItem = 0i64;
PspProcessRundownCacheWorkItem.Parameter = 0i64;
PspProcessRundownCacheWorkItem.List.Flink = 0i64;
PspBootAccessToken = (PVOID)(*((_QWORD *)PsIdleProcess + 151) & 0xFFFFFFFFFFFFFFF0ui64);
if( (int)PspInitializeSystemPartitionPhase0() >= 0 )
{
v28 = PspSystemPartition;
LODWORD(HandleInformation) = 0;
LOBYTE(Object) = 0;
if( (int)PspCreateProcess(
(PVOID *)PspSystemPartition + 14,
0x1FFFFFui64,
0i64,
0i64,
(UINT64)Object,
HandleInformation,
0i64,
0i64) >= 0 )
{
v29 = (void *)v28[14];
v46 = 0i64;
v30 = ObReferenceObjectByHandle(v29, 0, (POBJECT_TYPE)PsProcessType, 0, &v46, 0i64);
v31 = v46;
v28[13] = v46;
if( v30 >= 0 )
{
PsInitialSystemProcess = (PEPROCESS)v31;
_InterlockedOr((volatile signed __int32 *)v31 + 628, 0x40000000u);
_InterlockedOr((volatile signed __int32 *)PsInitialSystemProcess + 629, 0x2000u);
_InterlockedOr((volatile signed __int32 *)PsInitialSystemProcess + 543, 0x1000u);
strcpy_s((PSTR)PsIdleProcess + 1448, 0xFui64, (PSTR)"Idle");
strcpy_s((PSTR)PsInitialSystemProcess + 1448, 0xFui64, (PSTR)"System");
*((_QWORD *)PsInitialSystemProcess + 184) = ExAllocatePoolWithTag(
NonPagedPoolNx,
0x10ui64,
0x61506553ui64);
v32 = (_OWORD *)*((_QWORD *)PsInitialSystemProcess + 184);
if( v32 )
{
*v32 = 0i64;
if( PsCreateSystemThread(
&ThreadHandle,
0x1FFFFFu,
0i64,
0i64,
0i64,
Phase1Initialization,
LoaderBlock) >= 0 )
{
ObCloseHandle(ThreadHandle, 0);
if( !VslVsmEnabled )
{
LABEL_39:
PsVmProcessorHostTransitionEvent.0 = 0i64;
return 1;
}
PspIumWorkItem.Parameter = 0i64;
PspIumWorkItem.WorkerRoutine = (void(__fastcall *)(void *))PspIumWorker;
PspIumWorkItem.List.Flink = 0i64;
PspIumFreeMapping = MmAllocateMappingAddress(0x1000ui64, 0x466D7356ui64);
if( PspIumFreeMapping )
{
PspIumLogBuffer = MmAllocateIndependentPagesEx(
0x2000ui64,
0xFFFFFFFFi64,
(_QWORD *)0xFFFFFFFFFFFFFFFFi64,
1ui64);
PsIumResumeAfterHibernate();
if( (VslGetNestedPageProtectionFlags() & 0x40) != 0 )
*(_QWORD *)&PspSystemMitigationOptions = PspSystemMitigationOptions & 0xFFFFFF0FFFFFFFFFui64 | 0x5000000000i64;
if( PspIumLogBuffer )
{
PspVsmLogCallbackRecord.State = 0;
KeRegisterBugCheckReasonCallback(
&PspVsmLogCallbackRecord,
PspVsmLogBugCheckCallback,
KbCallbackSecondaryDumpData,
(PUCHAR)"SecureKernelFailureLog");
}
goto LABEL_39;
}
}
}
}
}
}
}
}
}
}
}
}
}
}
return 0;
}Referenced by:
PsInitSystem