KseShimDriverIoCallbacks

NTSTATUS __stdcall KseShimDriverIoCallbacks(DRIVER_OBJECT *DriverObject, UNICODE_STRING *BaseName){
  _UNICODE_STRING *v2; 
  _DRIVER_EXTENSION *DriverExtension; 
  _UNICODE_STRING *v4; 
  NTSTATUS ShimCallbacksForDriver; 
  char *v8; 
  int(__fastcall *DriverInit)(_DRIVER_OBJECT *, _UNICODE_STRING *); 
  int(__fastcall *v10)(_DRIVER_OBJECT *, _UNICODE_STRING *); 
  void(__fastcall *DriverStartIo)(_DEVICE_OBJECT *, _IRP *); 
  void(__fastcall *v12)(_DEVICE_OBJECT *, _IRP *); 
  void(__fastcall *DriverUnload)(_DRIVER_OBJECT *); 
  void(__fastcall *v14)(_DRIVER_OBJECT *); 
  int(__fastcall *AddDevice)(_DRIVER_OBJECT *, _DEVICE_OBJECT *); 
  __int64 v16; 
  signed __int64 v17; 
  int(__fastcall **MajorFunction)(_DEVICE_OBJECT *, _IRP *); 
  signed __int64 v19; 
  __int64 v20; 
  NTSTATUS(__stdcall *v21)(_DEVICE_OBJECT *, _IRP *); 
  int(__fastcall *v22)(_DEVICE_OBJECT *, _IRP *); 
  _UNICODE_STRING TargetString; 
  UNICODE_STRING DriverFileName; 
  INT64 result; 
  void(__fastcall *v26)(_DEVICE_OBJECT *, _IRP *); 
  void(__fastcall *v27)(_DRIVER_OBJECT *); 
  __int64 v28; 
  char v29; 
  DriverExtension = DriverObject->DriverExtension;
  v4 = v2;
  memset((INT64)&result, 0i64);
  *(_QWORD *)&TargetString.Length = 0i64;
  ShimCallbacksForDriver = 0;
  TargetString.Buffer = 0i64;
  DriverFileName = 0i64;
  if( v4 )
  {
    if( dword_140C50324 == 2 && (*(_BYTE *)KseEngine & 1) == 0 )
    {
      ShimCallbacksForDriver = KsepStringDuplicateUnicode(&TargetString, v4);
      if( ShimCallbacksForDriver >= 0 )
      {
        ShimCallbacksForDriver = KsepDriverPathTail(&TargetString, &DriverFileName);
        if( ShimCallbacksForDriver >= 0 )
        {
          ShimCallbacksForDriver = KsepGetShimCallbacksForDriver((INT64)DriverObject->DriverStart, &result);
          if( ShimCallbacksForDriver >= 0 )
          {
            LODWORD(v8) = KsepPoolAllocateNonPaged(0x100ui64);
            if( v8 )
            {
              DriverInit = DriverObject->DriverInit;
              if( DriverInit )
              {
                v10 = (int(__fastcall *)(_DRIVER_OBJECT *, _UNICODE_STRING *))result;
                if( result )
                {
                  *(_QWORD *)v8 = DriverInit;
                  DriverObject->DriverInit = v10;
                }
              }
              DriverStartIo = DriverObject->DriverStartIo;
              if( DriverStartIo )
              {
                v12 = v26;
                if( v26 )
                {
                  *((_QWORD *)v8 + 1) = DriverStartIo;
                  DriverObject->DriverStartIo = v12;
                }
              }
              DriverUnload = DriverObject->DriverUnload;
              if( DriverUnload )
              {
                v14 = v27;
                if( v27 )
                {
                  *((_QWORD *)v8 + 2) = DriverUnload;
                  DriverObject->DriverUnload = v14;
                }
              }
              AddDevice = DriverExtension->AddDevice;
              if( AddDevice )
              {
                v16 = v28;
                if( v28 )
                {
                  *((_QWORD *)v8 + 3) = AddDevice;
                  DriverExtension->AddDevice = (int(__fastcall *)(_DRIVER_OBJECT *, _DEVICE_OBJECT *))v16;
                }
              }
              v17 = v8 - (char *)DriverObject;
              MajorFunction = DriverObject->MajorFunction;
              v19 = &v29 - (char *)DriverObject;
              v20 = 28i64;
              do
              {
                v21 = (NTSTATUS(__stdcall *)(_DEVICE_OBJECT *, _IRP *))*MajorFunction;
                if( *MajorFunction )
                {
                  if( v21 != IopInvalidDeviceRequest )
                  {
                    v22 = *(int(__fastcall **)(_DEVICE_OBJECT *, _IRP *))((char *)MajorFunction + v19 - 112);
                    if( v22 )
                    {
                      *(int(__fastcall **)(_DEVICE_OBJECT *, _IRP *))((char *)MajorFunction + v17 - 80) = (int(__fastcall *)(_DEVICE_OBJECT *, _IRP *))v21;
                      *MajorFunction = v22;
                    }
                  }
                }
                ++MajorFunction;
                --v20;
              }
              while( v20 );
              DriverExtension->KseCallbacks = v8;
              ShimCallbacksForDriver = 0;
              KsepHistoryMessages[((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryMessagesIndex, 1u) + 1) & 0x3F] = 524550i64;
              if( (KsepDebugFlag & 1) != 0 )
                KsepDebugPrint(
                  9i64,
                  "KSE: Hooked callbacks for driver [%ws].\n",
                  TargetString.Buffer,
                  v19,
                  *(_QWORD *)&TargetString.Length);
              KsepLogInfo(
                9,
                "KSE: Hooked callbacks for driver [%ws].\n",
                TargetString.Buffer,
                v19,
                *(_QWORD *)&TargetString.Length);
              goto LABEL_8;
            }
            ShimCallbacksForDriver = -1073741801;
          }
        }
      }
      KsepPoolFreeNonPaged(0i64);
    }
LABEL_8:
    KsepStringFree(&TargetString);
    return ShimCallbacksForDriver;
  }
  KsepHistoryMessages[((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryMessagesIndex, 1u) + 1) & 0x3F] = 524436i64;
  if( (KsepDebugFlag & 1) != 0 )
    KsepDebugPrint(0i64, "KSE: Callback shimming - missing driver object or driver name.\n");
  KsepLogInfo(0, "KSE: Callback shimming - missing driver object or driver name.\n");
  return -1073741811;
}

Referenced by: