NtWriteFileGather
VOID __stdcall NtWriteFileGather(){
void *v0;
void *v1;
INT64 v2;
__int64 v3;
PULONG v4;
PLARGE_INTEGER v5;
int v6;
INT8 v7;
unsigned __int8 GrantedAccess;
PFILE_OBJECT v9;
_DEVICE_OBJECT *RelatedDeviceObject;
unsigned int *p_Flags;
unsigned int Flags;
unsigned __int64 v13;
__int64 v14;
ULONG v15;
__int64 v16;
__int64 v17;
__int64 v18;
bool v19;
__int64 v20;
ULONG v21;
FILE_SEGMENT_ELEMENT *PoolWithQuota_0;
ULONG v23;
unsigned int v24;
unsigned int v25;
__int16 v26;
UINT64 v27;
UINT8 v28;
UINT8 v29;
NTSTATUS v30;
CHAR v31;
INT8 v32;
DEVICE_OBJECT *v33;
IRP *Irp;
IRP *v35;
PIO_STATUS_BLOCK v36;
__int64 v37;
MDL *Mdl;
MDL *v39;
__int64 v40;
__int64 v41;
_DWORD *FileObjectExtension;
_ETHREAD *v43;
PFILE_OBJECT v44;
__int64 v45;
INT64 v46;
IRP *Object;
UINT64 v48;
INT8 AccessMode;
__int64 QuadPart;
PFILE_OBJECT FileObject;
PVOID P;
ULONG v53;
PADAPTER_OBJECT DmaAdapter;
int v55;
unsigned int *v56;
PDEVICE_OBJECT DeviceObject;
PVOID VirtualAddress;
ULONG v59;
OBJECT_HANDLE_INFORMATION v60;
_ETHREAD *CurrentThread;
_ETHREAD *v62;
VOID *retaddr;
HANDLE Handle;
INT64 v65;
__int64 v66;
PIO_STATUS_BLOCK IoStatusBlock;
FILE_SEGMENT_ELEMENT *__attribute__((__org_arrdim(0,0))) BufferDescription;
ULONG BufferLength;
PLARGE_INTEGER ByteOffset;
PULONG Key;
v66 = v3;
v65 = v2;
Handle = v0;
v4 = Key;
v5 = ByteOffset;
v6 = 0;
FileObject = 0i64;
P = 0i64;
v60 = 0i64;
DmaAdapter = 0i64;
v53 = 0;
QuadPart = 0i64;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v7 = *((_BYTE *)CurrentThread + 562);
AccessMode = v7;
if( IopReferenceFileObject(v1, 0i64, v7, &FileObject, &v60) < 0 )
return;
GrantedAccess = v60.GrantedAccess;
v9 = FileObject;
RelatedDeviceObject = IoGetRelatedDeviceObject(FileObject);
DeviceObject = RelatedDeviceObject;
p_Flags = &v9->Flags;
v56 = &v9->Flags;
Flags = v9->Flags;
if( (Flags & 8) == 0
|| (Flags & 2) != 0
|| (*((_DWORD *)RelatedDeviceObject + 12) & 4) != 0
|| ((v13 = *((unsigned int *)RelatedDeviceObject + 18), (unsigned int)v13 > 0x36)
|| (v14 = 0x40000100100348i64, !_bittest64(&v14, v13)))
&& (_DWORD)v13 != 83 )
{
HalPutDmaAdapter((PADAPTER_OBJECT)v9);
return;
}
LOBYTE(v6) = (BufferLength & 0xFFF) != 0;
v15 = (BufferLength >> 12) + v6;
if( v7 )
{
if( ((~(unsigned __int8)(Flags >> 5) & 4 | 2) & GrantedAccess) == 0 )
{
HalPutDmaAdapter((PADAPTER_OBJECT)v9);
return;
}
v55 = 0;
v16 = (__int64)IoStatusBlock;
v17 = 0x7FFFFFFF0000i64;
if( (unsigned __int64)IoStatusBlock >= 0x7FFFFFFF0000i64 )
v16 = 0x7FFFFFFF0000i64;
*(_DWORD *)v16 = *(_DWORD *)v16;
IopMarkApcRoutineIfAsynchronousIo32((UINT64 **)&IoStatusBlock, &v65, *(_BYTE *)p_Flags & 2);
v62 = (_ETHREAD *)KeGetCurrentThread();
v18 = *(_QWORD *)(*((_QWORD *)v62 + 23) + 1408i64);
v19 = 0;
if( v18 )
{
v26 = *(_WORD *)(v18 + 8);
if( v26 == 332 || v26 == 452 )
v19 = 1;
}
v20 = v15;
if( v20 * 8 )
{
if( v19 )
{
if( ((unsigned __int8)BufferDescription & 3) != 0 )
ExRaiseDatatypeMisalignment();
}
else if( ((unsigned __int8)BufferDescription & 7) != 0 )
{
ExRaiseDatatypeMisalignment();
}
if( (unsigned __int64)&BufferDescription[v20] > 0x7FFFFFFF0000i64 || &BufferDescription[v20] < BufferDescription )
MEMORY[0x7FFFFFFF0000] = 0;
}
v21 = BufferLength;
if( BufferLength )
{
PoolWithQuota_0 = (FILE_SEGMENT_ELEMENT *)IopVerifierExAllocatePoolWithQuota_0(PagedPool, 8i64 * v15);
P = PoolWithQuota_0;
memmove((UINT8 *)PoolWithQuota_0, (UINT8 *)BufferDescription, 8i64 * v15);
BufferDescription = PoolWithQuota_0;
v23 = 0;
v59 = 0;
while( v23 < v15 )
{
if( ((__int64)BufferDescription[v23].Buffer & 0xFFFi64) != 0 )
RtlRaiseStatus(-1073741811);
v59 = ++v23;
}
v21 = BufferLength;
}
v9 = FileObject;
if( FileObject->CompletionContext && (v65 & 0xFFFFFFFFFFFFFFFEui64) != 0 )
RtlRaiseStatus(-1073741811);
if( v5 )
{
if( ((unsigned __int8)v5 & 3) != 0 )
ExRaiseDatatypeMisalignment();
QuadPart = v5->QuadPart;
v9 = FileObject;
}
p_Flags = &v9->Flags;
v56 = &v9->Flags;
v24 = v9->Flags;
if( (v24 & 8) != 0 )
{
v25 = *((unsigned __int16 *)DeviceObject + 152);
if( (_WORD)v25 && ((v25 - 1) & v21) != 0 && v21 % v25 )
RtlRaiseStatus(-1073741811);
if( v5
&& QuadPart != -1
&& (QuadPart != -2 || (v24 & 2) == 0)
&& (_WORD)v25
&& ((v25 - 1) & (unsigned int)QuadPart) != 0 )
{
RtlRaiseStatus(-1073741811);
}
}
if( v4 )
{
if( (unsigned __int64)v4 < 0x7FFFFFFF0000i64 )
v17 = (__int64)v4;
v53 = *(_DWORD *)v17;
v9 = FileObject;
}
v7 = AccessMode;
}
else
{
if( v5 )
QuadPart = v5->QuadPart;
if( v4 )
v53 = *v4;
}
if( (GrantedAccess & 6) == 4 )
QuadPart = -1i64;
if( Handle )
{
VirtualAddress = 0i64;
v30 = ObReferenceObjectByHandle(Handle, 2u, (POBJECT_TYPE)ExEventObjectType, v7, &VirtualAddress, 0i64);
DmaAdapter = (PADAPTER_OBJECT)VirtualAddress;
if( v30 < 0 )
{
HalPutDmaAdapter((PADAPTER_OBJECT)v9);
if( P )
ExFreePoolWithTag(P, 0);
return;
}
KeResetEvent(VirtualAddress, v27, v28, v29, Object);
}
if( (*p_Flags & 2) != 0 )
{
v43 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v43 + 242);
v44 = FileObject;
LODWORD(v45) = KeAbPreAcquire(&FileObject->Lock, 0i64, 0i64);
if( _InterlockedExchange((volatile __int32 *)&v44->Busy, 1) )
{
v32 = AccessMode;
LOBYTE(v46) = AccessMode;
v9 = FileObject;
IopWaitAndAcquireFileObjectLock(FileObject, v46);
}
else
{
if( v45 )
*(_BYTE *)(v45 + 26) |= 1u;
v9 = FileObject;
ObfReferenceObject(FileObject);
v32 = AccessMode;
}
v31 = 1;
if( !v5 && !(_DWORD)QuadPart || QuadPart == -2 )
QuadPart = v9->CurrentByteOffset.QuadPart;
p_Flags = v56;
}
else
{
if( !v5 && (*p_Flags & 0x280) == 0 )
{
if( DmaAdapter )
HalPutDmaAdapter(DmaAdapter);
goto LABEL_115;
}
v31 = 0;
v32 = AccessMode;
}
if( QuadPart < 0 && QuadPart != -1 )
{
if( DmaAdapter )
HalPutDmaAdapter(DmaAdapter);
if( v31 )
IopReleaseFileObjectLock((PADAPTER_OBJECT)v9);
LABEL_115:
HalPutDmaAdapter((PADAPTER_OBJECT)v9);
if( P )
{
LABEL_118:
ExFreePoolWithTag(P, 0);
return;
}
return;
}
IopResetEvent(v9);
v33 = DeviceObject;
Irp = IopAllocateIrpExReturn(DeviceObject, *((_BYTE *)DeviceObject + 76), v31 ^ 1u, retaddr);
v35 = Irp;
VirtualAddress = Irp;
if( !Irp )
{
IopAllocateIrpCleanup((PUNICODE_STRING)v9);
if( !P )
return;
goto LABEL_118;
}
*((_QWORD *)Irp + 24) = v9;
*((_QWORD *)Irp + 19) = CurrentThread;
*((_QWORD *)Irp + 20) = 0i64;
*((_BYTE *)Irp + 64) = v32;
*((_BYTE *)Irp + 65) = 0;
*((_BYTE *)Irp + 68) = 0;
*((_QWORD *)Irp + 13) = 0i64;
*((_QWORD *)Irp + 10) = DmaAdapter;
v36 = IoStatusBlock;
*((_QWORD *)Irp + 9) = IoStatusBlock;
*((_QWORD *)Irp + 11) = v65;
*((_QWORD *)Irp + 12) = v66;
v37 = *((_QWORD *)Irp + 23);
*(_DWORD *)(v37 - 72) = 4;
*(_QWORD *)(v37 - 24) = v9;
if( (*p_Flags & 0x10) != 0 )
*(_BYTE *)(v37 - 70) = 4;
*((_QWORD *)Irp + 3) = 0i64;
*((_QWORD *)Irp + 1) = 0i64;
*((_DWORD *)Irp + 4) = 0;
if( BufferLength )
{
Mdl = IoAllocateMdl(BufferDescription->Buffer, BufferLength, 0, 1u, Irp);
v39 = Mdl;
if( !Mdl )
RtlRaiseStatus(-1073741670);
v40 = *(unsigned __int8 *)(v37 - 72);
MmProbeAndLockSelectedPages(Mdl, BufferDescription, AccessMode, IoReadAccess);
if( (MmTrackLockedPages & 1) != 0 )
{
v41 = v40;
v33 = DeviceObject;
MmUpdateMdlTracker(v39, *(PVOID *)(*((_QWORD *)DeviceObject + 1) + 8 * v41 + 112), DeviceObject);
}
else
{
v33 = DeviceObject;
}
*((FILE_SEGMENT_ELEMENT *)v35 + 14) = (FILE_SEGMENT_ELEMENT)BufferDescription->Buffer;
}
if( P )
ExFreePoolWithTag(P, 0);
*((_DWORD *)v35 + 4) |= (*v56 & 8 | 0x5000) >> 3;
*(_DWORD *)(v37 - 64) = BufferLength;
*(_DWORD *)(v37 - 56) = v53;
*(_QWORD *)(v37 - 48) = QuadPart;
FileObjectExtension = v9->FileObjectExtension;
if( FileObjectExtension && (*FileObjectExtension & 0x10) != 0 )
*(_DWORD *)(v37 - 52) = v36->Information;
LODWORD(v48) = 1;
IopSynchronousServiceTail(v33, v35, v9, 1, AccessMode, v31, v48);
}Referenced by:
No references.