ObpLookupObjectName
INT64 __fastcall ObpLookupObjectName(
VOID *RootDirectoryHandle,
_UNICODE_STRING *ObjectName,
UINT64 Attributes,
_OBJECT_TYPE *ObjectType,
INT64 AccessMode,
VOID *ParseContext,
_SECURITY_QUALITY_OF_SERVICE *SecurityQos,
VOID *InsertObject,
_EJOB *Silo,
_ACCESS_STATE *AccessState,
_OBP_LOOKUP_CONTEXT *LookupContext,
UINT64 *MaxRelativeAccessMask,
VOID **FoundObject){
_OBP_LOOKUP_CONTEXT *v13;
__int16 v14;
_UNICODE_STRING *v15;
bool v17;
VOID **v18;
_EJOB *v19;
char v20;
void *v21;
unsigned int v22;
bool v23;
struct _SECURITY_SUBJECT_CONTEXT *p_SubjectContext;
KTRANSACTION *v25;
struct _DMA_ADAPTER *v26;
_OBJECT_DIRECTORY_ENTRY *v27;
wchar_t *v28;
int v29;
struct _DMA_ADAPTER *v30;
__int64 v31;
_OBJECT_TYPE *v32;
NTSTATUS(__stdcall *ParseProcedure)(PVOID, PVOID, ACCESS_STATE *, INT8, UINT64, UNICODE_STRING *, UNICODE_STRING *, PVOID, SECURITY_QUALITY_OF_SERVICE *, _OB_EXTENDED_PARSE_PARAMETERS *, PVOID *);
struct _DMA_ADAPTER *v34;
NTSTATUS v35;
NTSTATUS v36;
unsigned int v37;
INT64 result;
struct _DMA_ADAPTER *v39;
int v40;
unsigned __int16 *v41;
unsigned int v42;
unsigned __int64 v43;
__int64 v44;
unsigned int v45;
unsigned int v46;
int v47;
unsigned __int8 DirectoryLocked;
unsigned __int16 v49;
_OBJECT_DIRECTORY_ENTRY **p_ChainLink;
UINT64 p_DmaOperations;
_ETHREAD *v52;
struct _DMA_ADAPTER *v53;
PVOID v54;
int v55;
_OBJECT_DIRECTORY *v56;
__int64 *v57;
_ETHREAD *v58;
UINT64 v59;
__int64 v60;
_ETHREAD *v61;
unsigned __int8 v62;
_OBP_LOOKUP_CONTEXT *v63;
_OBJECT_DIRECTORY_ENTRY **v64;
_ETHREAD *v65;
_OBJECT_DIRECTORY_ENTRY *v66;
unsigned int HashValue;
__int64 v68;
unsigned int v69;
char *v70;
_QWORD *v71;
char *v72;
signed __int64 v73;
unsigned __int64 v74;
unsigned __int64 v75;
struct _DMA_ADAPTER *v76;
struct _DMA_ADAPTER *v77;
NTSTATUS(__stdcall *v78)(PVOID, PVOID, ACCESS_STATE *, INT8, UINT64, UNICODE_STRING *, UNICODE_STRING *, PVOID, SECURITY_QUALITY_OF_SERVICE *, _OB_EXTENDED_PARSE_PARAMETERS *, PVOID *);
struct _DMA_ADAPTER *v79;
__int128 v80;
struct _DMA_ADAPTER *v81;
wchar_t *Buffer;
wchar_t v83;
PVOID v84;
signed __int32 v85;
signed __int32 v86;
struct _DMA_ADAPTER *v87;
_ETHREAD *CurrentThread;
struct _DMA_ADAPTER *v89;
char v90;
__int64 v91;
_EJOB *ProcessServerSilo;
ULONG *v93;
ULONG *v94;
WCHAR *v95;
volatile signed __int32 *v96;
__int64 *CurrentServerSiloGlobals;
_ETHREAD *v98;
volatile signed __int32 **v99;
UINT64 v100;
_ETHREAD *v101;
_UNICODE_STRING v102;
unsigned int v103;
__int64 v104;
char *v105;
_QWORD *v106;
char *v107;
signed __int64 v108;
UINT16 v109;
UINT16 v110;
_OBP_LOOKUP_CONTEXT *v111;
_OBJECT_DIRECTORY *v112;
struct _DMA_ADAPTER *v113;
_ETHREAD *v114;
struct _DMA_ADAPTER *Directory;
struct _DMA_ADAPTER *v116;
PVOID *v117;
_DEVICE_MAP *v118;
unsigned int v119;
CHAR *v120;
INT8 v121;
int v122;
unsigned int v123;
UINT8 *PoolWithTag;
char *v125;
void *v126;
__int16 v127;
UINT16 v128;
int v129;
int v130;
void *ClientToken;
NTSTATUS v132;
struct _DMA_ADAPTER *v133;
__int64 v134;
__int64 v135;
__int128 v136;
__int64 *ServerSiloGlobals;
_ETHREAD *v138;
UINT64 v139;
PADAPTER_OBJECT *v140;
PADAPTER_OBJECT v141;
UINT64 Tag;
UINT64 PreviousMode;
INT64 AccessStatus;
__int128 v145;
struct _DMA_ADAPTER *v146;
PVOID P;
PADAPTER_OBJECT DmaAdapter;
unsigned int v149;
unsigned int v150;
NTSTATUS v151;
BOOL v152;
PVOID TokenInformation;
int v154;
void *Src[2];
PADAPTER_OBJECT v156;
__int16 v157[2];
int v158;
_EJOB *v159;
INT64 GrantedAccess;
PVOID ReturnedSiloContext;
PVOID v162;
PVOID DirectoryObject;
__int64 v164;
volatile signed __int32 *v165;
INT64 v166;
PVOID Object;
INT64 v168[2];
_UNICODE_STRING *p_Name;
_UNICODE_STRING *v170;
VOID *v171;
__int128 v172;
struct _SECURITY_SUBJECT_CONTEXT SubjectContext;
bool v174;
int v176;
v176 = Attributes;
v13 = LookupContext;
v14 = Attributes;
v154 = 64;
DmaAdapter = 0i64;
v15 = ObjectName;
LookupContext->Directory = 0i64;
LookupContext->Object = 0i64;
*(_WORD *)&LookupContext->DirectoryLocked = 0;
LookupContext->LockStateSignature = -60876;
v157[1] = 0;
v164 = 0i64;
v168[0] = 0i64;
v168[1] = 0i64;
P = 0i64;
v174 = 0;
BYTE5(AccessStatus) = 0;
v172 = 0i64;
v145 = 0i64;
if( MaxRelativeAccessMask )
*(_DWORD *)MaxRelativeAccessMask = 0;
v17 = ObpCaseInsensitive == 0;
v18 = FoundObject;
v157[0] = 16;
v19 = Silo;
v159 = Silo;
*FoundObject = 0i64;
LODWORD(AccessStatus) = 0;
v151 = 0;
BYTE6(AccessStatus) = 1;
v146 = 0i64;
v156 = 0i64;
v158 = -1;
if( !v17
&& (ObjectType->TypeInfo.ObjectTypeFlags & 1) != 0
&& (*((_DWORD *)KeGetCurrentThread() + 324) & 0x80000) == 0 )
{
v14 = Attributes | 0x40;
v176 = Attributes | 0x40;
}
v20 = AccessMode;
v21 = InsertObject;
v22 = 1;
if( (v14 & 0x400) == 0 )
v22 = (unsigned __int8)AccessMode;
v150 = v22;
if( !InsertObject )
{
v23 = 0;
BYTE5(AccessStatus) = 1;
LODWORD(TokenInformation) = 0;
p_SubjectContext = 0i64;
GrantedAccess = 0i64;
memset(&SubjectContext, 0, sizeof(SubjectContext));
if( (_BYTE)v22 )
{
if( AccessState == (_ACCESS_STATE *)-32i64 )
{
p_SubjectContext = &SubjectContext;
SeCaptureSubjectContext(&SubjectContext);
}
else
{
p_SubjectContext = (struct _SECURITY_SUBJECT_CONTEXT *)((char *)AccessState + 32);
}
LODWORD(PreviousMode) = 0;
LODWORD(Tag) = 0x20000;
if( SeAccessCheckWithHint(
SeMediumDaclSd,
8ui64,
p_SubjectContext,
0i64,
Tag,
PreviousMode,
0i64,
(GENERIC_MAPPING *)&RtlpRestrictedMapping,
v22,
(UINT64 *)((char *)&GrantedAccess + 4),
&GrantedAccess) )
{
if( ext_ms_win_ntos_tm_l1_1_0_TmIsKTMCommitCoordinator(v25) )
{
ClientToken = p_SubjectContext->ClientToken;
if( !p_SubjectContext->ClientToken )
ClientToken = p_SubjectContext->PrimaryToken;
if( (int)SeQueryInformationToken(ClientToken, TokenIsAppContainer, &TokenInformation) >= 0 )
v23 = (_DWORD)TokenInformation == 0;
}
else
{
v23 = 1;
}
}
v20 = AccessMode;
v19 = Silo;
}
else
{
v23 = 1;
}
if( p_SubjectContext == &SubjectContext )
{
SeReleaseSubjectContext(p_SubjectContext);
v19 = Silo;
v20 = AccessMode;
}
v174 = !v23;
v18 = FoundObject;
v21 = 0i64;
}
if( RootDirectoryHandle )
{
result = ObpReferenceObjectByHandleWithTag(
(ULONG_PTR)RootDirectoryHandle,
0,
0i64,
v20,
0x746C6644u,
(__int64)&DmaAdapter,
0i64,
(__int64)&v164);
LODWORD(AccessStatus) = result;
if( (int)result < 0 )
return result;
if( HIDWORD(v164) )
{
v158 &= HIDWORD(v164);
if( (v158 & *((_DWORD *)AccessState + 6)) != *((_DWORD *)AccessState + 6) )
{
HalPutDmaAdapter(DmaAdapter);
return 3221225506i64;
}
}
v79 = DmaAdapter;
if( v15->Length )
{
if( *v15->Buffer == 92
&& (POBJECT_TYPE *)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ LOBYTE(DmaAdapter[-2].DmaOperations) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)DmaAdapter - 48) >> 8)] != IoFileObjectType )
{
HalPutDmaAdapter(DmaAdapter);
return 3221225531i64;
}
}
else if( (POBJECT_TYPE)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ LOBYTE(DmaAdapter[-2].DmaOperations) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)DmaAdapter - 48) >> 8)] == ObpDirectoryObjectType )
{
v132 = ObReferenceObjectByPointer(DmaAdapter, 0, ObjectType, AccessMode);
v133 = v146;
LODWORD(AccessStatus) = v132;
if( v132 >= 0 )
v133 = v79;
v146 = v133;
HalPutDmaAdapter(v79);
*v18 = v146;
return(unsigned int)AccessStatus;
}
v80 = (__int128)*v15;
v146 = DmaAdapter;
v145 = v80;
p_Name = &ObjectType->Name;
v170 = v15;
v171 = RootDirectoryHandle;
SeSetLearningModeObjectInformation((INT64)v168);
v26 = v146;
LABEL_35:
while( 2 )
{
v30 = v26 - 3;
v31 = (unsigned __int8)((unsigned __int16)((_WORD)v26 - 48) >> 8);
v32 = (_OBJECT_TYPE *)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ v31 ^ LOBYTE(v26[-2].DmaOperations)];
ParseProcedure = (NTSTATUS(__stdcall *)(PVOID, PVOID, ACCESS_STATE *, INT8, UINT64, UNICODE_STRING *, UNICODE_STRING *, PVOID, SECURITY_QUALITY_OF_SERVICE *, _OB_EXTENDED_PARSE_PARAMETERS *, PVOID *))v32->TypeInfo.ParseProcedure;
if( ParseProcedure )
{
if( ParseProcedure != ObpParseSymbolicLinkEx )
{
if( InsertObject )
{
LABEL_350:
LODWORD(AccessStatus) = -1073741788;
goto LABEL_157;
}
ObfReferenceObject(v26);
if( v13->DirectoryLocked )
{
ExReleasePushLockEx((UINT64)&v13->Directory->Lock, 0i64);
Directory = (struct _DMA_ADAPTER *)v13->Directory;
v13->LockStateSignature = -286387660;
HalPutDmaAdapter(Directory);
v13->Directory = 0i64;
*(_WORD *)&v13->DirectoryLocked = 0;
KeLeaveCriticalRegion();
}
v34 = (struct _DMA_ADAPTER *)v13->Object;
if( v34 )
{
HalPutDmaAdapter(v34);
v13->Object = 0i64;
}
v26 = v146;
}
v15 = ObjectName;
v14 = v176;
if( (*(_BYTE *)(ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ v31 ^ LOBYTE(v30[1].DmaOperations)] + 67) & 1) != 0 )
v35 = ((__int64(__fastcall *)(struct _DMA_ADAPTER *, _OBJECT_TYPE *, _ACCESS_STATE *, _QWORD, int, _UNICODE_STRING *, __int128 *, VOID *, _SECURITY_QUALITY_OF_SERVICE *, __int16 *, struct _DMA_ADAPTER **))ParseProcedure)(
v26,
ObjectType,
AccessState,
v150,
v176,
ObjectName,
&v145,
ParseContext,
SecurityQos,
v157,
&v146);
else
v35 = ((__int64(__fastcall *)(struct _DMA_ADAPTER *, _OBJECT_TYPE *, _ACCESS_STATE *, _QWORD, int, _UNICODE_STRING *, __int128 *, VOID *, _SECURITY_QUALITY_OF_SERVICE *, struct _DMA_ADAPTER **))ParseProcedure)(
v26,
ObjectType,
AccessState,
v150,
v176,
ObjectName,
&v145,
ParseContext,
SecurityQos,
&v146);
v36 = v35;
LODWORD(AccessStatus) = v35;
if( ParseProcedure != ObpParseSymbolicLinkEx )
{
HalPutDmaAdapter(v30 + 3);
v36 = AccessStatus;
}
if( v36 < 0 )
{
LABEL_157:
if( v13->DirectoryLocked )
ObpUnlockDirectory((INT64)v13->Directory, (INT64)v13);
v81 = (struct _DMA_ADAPTER *)v13->Object;
if( v81 )
{
HalPutDmaAdapter(v81);
v13->Object = 0i64;
}
goto LABEL_59;
}
if( v36 != 260 && v36 != 872 )
v156 = v146;
if( (v158 & *((_DWORD *)AccessState + 6)) != *((_DWORD *)AccessState + 6) )
{
LABEL_347:
LODWORD(AccessStatus) = -1073741790;
goto LABEL_157;
}
if( v36 != 260 && v36 != 280 && v36 != 872 )
{
if( !v146 )
{
v36 = -1073741772;
LODWORD(AccessStatus) = -1073741772;
}
v156 = 0i64;
LABEL_58:
if( v36 < 0 )
goto LABEL_157;
LABEL_59:
if( P )
ObfDereferenceDeviceMap((_DEVICE_MAP *)P);
if( DmaAdapter )
HalPutDmaAdapter(DmaAdapter);
if( v156 )
HalPutDmaAdapter(v156);
SeClearLearningModeObjectInformation();
v37 = AccessStatus;
if( (int)AccessStatus < 0 )
{
*FoundObject = 0i64;
}
else
{
if( MaxRelativeAccessMask )
{
if( v158 != -1 )
*(_DWORD *)MaxRelativeAccessMask = v158;
}
*FoundObject = v146;
}
return v37;
}
if( (v176 & 0x1000) != 0 && v36 != 872 )
{
LODWORD(AccessStatus) = -1073740533;
goto LABEL_157;
}
if( !--v154 )
{
LABEL_156:
LODWORD(AccessStatus) = -1073741772;
goto LABEL_157;
}
if( ObjectName->Length )
{
HalPutDmaAdapter(DmaAdapter);
Buffer = ObjectName->Buffer;
DmaAdapter = 0i64;
v83 = *Buffer;
if( (_DWORD)AccessStatus == 280 )
{
if( v83 != 92 )
{
v26 = v146;
DmaAdapter = v146;
v156 = 0i64;
goto LABEL_171;
}
}
else if( v83 == 92 )
{
if( (_DWORD)AccessStatus == 872 )
{
v26 = (struct _DMA_ADAPTER *)ObpRootDirectoryObject;
}
else
{
v162 = 0i64;
if( PsGetPermanentSiloContext(Silo, (unsigned int)PsObjectDirectorySiloContextSlot, &v162) >= 0 )
{
v26 = (struct _DMA_ADAPTER *)v162;
}
else
{
v26 = (struct _DMA_ADAPTER *)ObpRootDirectoryObject;
v162 = ObpRootDirectoryObject;
}
}
DmaAdapter = v26;
ObfReferenceObject(v26);
LABEL_171:
v84 = P;
if( !P )
{
LABEL_176:
if( v13->DirectoryLocked )
ObpUnlockDirectory((INT64)v13->Directory, (INT64)v13);
v87 = (struct _DMA_ADAPTER *)v13->Object;
if( v87 )
{
HalPutDmaAdapter(v87);
v13->Object = 0i64;
}
LABEL_29:
v28 = v15->Buffer;
if( ((unsigned __int8)v28 & 7) != 0 )
goto LABEL_33;
v29 = v14 & 0x800;
if( v15->Length < 8u || *(_QWORD *)v28 != ObpDosDevicesShortNamePrefix )
{
if( v15->Length == 6 && *(_DWORD *)v28 == ObpDosDevicesShortNameRoot && v28[2] == 63 )
{
v117 = (PVOID *)ObpReferenceDeviceMap((v14 & 0x800) != 0);
P = v117;
v118 = (_DEVICE_MAP *)v117;
if( v117 )
{
if( *v117 )
{
LODWORD(AccessStatus) = ObReferenceObjectByPointer(*v117, 0, ObjectType, AccessMode);
if( (int)AccessStatus >= 0 )
{
if( MaxRelativeAccessMask && v158 != -1 )
*(_DWORD *)MaxRelativeAccessMask = v158;
*FoundObject = v118->DosDevicesDirectory;
}
ObfDereferenceDeviceMap(v118);
HalPutDmaAdapter(v26);
SeClearLearningModeObjectInformation();
return(unsigned int)AccessStatus;
}
}
}
goto LABEL_33;
}
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
P = 0i64;
v89 = 0i64;
v90 = 0;
v91 = *((_QWORD *)CurrentThread + 68);
ProcessServerSilo = (_EJOB *)PsGetProcessServerSilo(v91);
if( ProcessServerSilo != PsGetCurrentServerSilo() )
v90 = 1;
if( (*((_DWORD *)CurrentThread + 324) & 8) == 0 || v29 )
{
if( v90 )
goto LABEL_193;
v96 = 0i64;
}
else
{
if( v90 )
goto LABEL_193;
v116 = (struct _DMA_ADAPTER *)PsReferenceImpersonationTokenEx(
(INT64)CurrentThread,
1,
(BYTE *)&v152 + 1,
&v152,
&v166,
0i64);
v89 = v116;
if( !v116 )
goto LABEL_314;
if( v116[1].DmaOperations == (_DMA_OPERATIONS *)999 )
{
v90 = 1;
goto LABEL_193;
}
v165 = 0i64;
if( SeGetTokenDeviceMap((__int64)v116, &v165) >= 0 )
{
v96 = v165;
P = (PVOID)v165;
if( v165 )
{
_InterlockedIncrement(v165 + 6);
LABEL_200:
if( v89 )
HalPutDmaAdapter(v89);
if( v96 && *(_QWORD *)v96 )
{
v102 = *ObjectName;
*(_QWORD *)&v145 = *(_QWORD *)&ObjectName->Length;
LOWORD(v145) = v145 - 8;
*((_QWORD *)&v145 + 1) = _mm_srli_si128((__m128i)v102, 8).m128i_u64[0] + 8;
WORD1(v145) -= 8;
v26 = *(struct _DMA_ADAPTER **)v96;
goto LABEL_34;
}
v26 = DmaAdapter;
v15 = ObjectName;
LABEL_33:
v145 = (__int128)*v15;
LABEL_34:
v146 = v26;
continue;
}
}
else
{
LABEL_314:
v96 = 0i64;
}
}
if( !*(_QWORD *)(v91 + 1416) && ObSetCurrentProcessDeviceMap(v94, v93, v95, (PULONG)v27) < 0 )
goto LABEL_200;
LABEL_193:
CurrentServerSiloGlobals = PsGetCurrentServerSiloGlobals();
v98 = (_ETHREAD *)KeGetCurrentThread();
v99 = (volatile signed __int32 **)CurrentServerSiloGlobals;
--*((_WORD *)v98 + 243);
v100 = (UINT64)(CurrentServerSiloGlobals + 15);
ExAcquirePushLockSharedEx((UINT64)(CurrentServerSiloGlobals + 15), 0i64);
if( v90 )
v96 = *v99;
else
v96 = *(volatile signed __int32 **)(v91 + 1416);
P = (PVOID)v96;
if( v96 )
_InterlockedIncrement(v96 + 6);
ExReleasePushLockEx(v100, 0i64);
v101 = (_ETHREAD *)KeGetCurrentThread();
v17 = (*((_WORD *)v101 + 243))++ == 0xFFFF;
if( v17 && *((_ETHREAD **)v101 + 19) != (_ETHREAD *)((char *)v101 + 152) )
KiCheckForKernelApcDelivery();
goto LABEL_200;
}
v85 = *((_DWORD *)P + 6);
if( v85 == 1 )
{
LABEL_337:
ServerSiloGlobals = PsGetServerSiloGlobals(*((_QWORD *)v84 + 8));
v138 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v138 + 243);
v139 = (UINT64)(ServerSiloGlobals + 15);
ExAcquirePushLockExclusiveEx((UINT64)(ServerSiloGlobals + 15), 0i64);
v140 = (PADAPTER_OBJECT *)P;
v85 = _InterlockedExchangeAdd((volatile signed __int32 *)P + 6, 0xFFFFFFFF);
if( v85 == 1 )
{
*(_QWORD *)&(*v140)[19].Version = 0i64;
ExReleasePushLockEx(v139, 0i64);
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
v141 = v140[8];
if( v141 )
ObfDereferenceObjectWithTag(v141, 0x6D44624Fui64);
ZwClose(v140[2]);
HalPutDmaAdapter(*v140);
ExFreePoolWithTag(v140, 0x6D44624Fu);
goto LABEL_175;
}
ExReleasePushLockEx(v139, 0i64);
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
}
else
{
while( 1 )
{
v86 = _InterlockedCompareExchange((volatile signed __int32 *)v84 + 6, v85 - 1, v85);
v17 = v85 == v86;
v85 = v86;
if( v17 )
break;
if( v86 == 1 )
goto LABEL_337;
}
}
if( v85 <= 0 )
__fastfail(0xEu);
LABEL_175:
v26 = DmaAdapter;
P = 0i64;
goto LABEL_176;
}
}
LABEL_291:
LODWORD(AccessStatus) = -1073741773;
goto LABEL_157;
}
break;
}
if( v32 != ObpDirectoryObjectType )
goto LABEL_350;
v39 = v26;
DirectoryObject = v26;
if( (_WORD)v145 && **((_WORD **)&v145 + 1) == 92 )
{
*((_QWORD *)&v145 + 1) += 2i64;
LOWORD(v145) = v145 - 2;
WORD1(v145) -= 2;
}
for( *(_OWORD *)Src = v145; (_WORD)v145; LOWORD(v145) = v145 - 2 )
{
if( **((_WORD **)&v145 + 1) == 92 )
break;
*((_QWORD *)&v145 + 1) += 2i64;
}
WORD1(v145) -= LOWORD(Src[0]) - v145;
LOWORD(Src[0]) -= v145;
if( !LOWORD(Src[0]) )
goto LABEL_291;
if( !(_BYTE)v150
|| (*((_DWORD *)AccessState + 3) & 1) != 0
|| (BYTE6(AccessStatus) = ObpCheckTraverseAccess(v26, AccessState, (INT8)AccessState, (INT64 *)v27)) != 0 )
{
if( (_WORD)v145 )
goto LABEL_83;
if( !InsertObject )
{
v13->LockStateSignature = -1145368012;
v114 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v114 + 242);
ExAcquirePushLockSharedEx((UINT64)&v26[18].DmaOperations, 0i64);
v13->LockStateSignature = -572714444;
ObfReferenceObject(v26);
v13->Directory = (_OBJECT_DIRECTORY *)v26;
*(_WORD *)&v13->DirectoryLocked = 1;
goto LABEL_83;
}
}
else
{
v36 = v151;
if( v151 >= 0 )
v36 = -1073741772;
v151 = v36;
if( (_WORD)v145 || !InsertObject )
{
LABEL_320:
LODWORD(AccessStatus) = v36;
goto LABEL_58;
}
}
ObpLockDirectoryExclusive(v13, (_OBJECT_DIRECTORY *)v26);
LABEL_83:
v40 = LOWORD(Src[0]);
v41 = (unsigned __int16 *)Src[1];
v42 = LOWORD(Src[0]) >> 1;
Object = v26;
HIDWORD(TokenInformation) = v176 & 0x40;
v149 = LOWORD(Src[0]);
if( v42 < 4 )
{
v45 = 0;
}
else
{
v43 = 0i64;
do
{
v44 = *(_QWORD *)v41;
if( (*(_QWORD *)v41 & 0xFF80FF80FF80FF80ui64) != 0 )
{
v134 = 4i64;
do
{
v135 = (unsigned __int16)v44;
if( (unsigned __int16)v44 >= 0x61u )
{
if( (unsigned __int16)v44 <= 0x7Au )
v135 = (unsigned int)(unsigned __int16)v44 - 32;
else
v135 = NLS_UPCASE(v44);
}
*(_QWORD *)&v136 = v44;
*((_QWORD *)&v136 + 1) = v135;
v44 = v136 >> 16;
--v134;
}
while( v134 );
}
else
{
v44 &= 0xFFDFFFDFFFDFFFDFui64;
}
v41 += 4;
v42 -= 4;
v43 = v44 + (v43 >> 1) + 3 * v43;
}
while( v42 >= 4 );
v40 = v149;
v39 = v26;
v45 = v43 + HIDWORD(v43);
}
if( !v42 )
{
LABEL_95:
DirectoryLocked = v13->DirectoryLocked;
v13->HashValue = v45;
BYTE4(AccessStatus) = DirectoryLocked;
v49 = v45 % 0x25;
v13->HashIndex = v49;
p_ChainLink = (_OBJECT_DIRECTORY_ENTRY **)v39 + v49;
p_DmaOperations = (UINT64)&v39[18].DmaOperations;
if( !DirectoryLocked )
{
v13->LockStateSignature = -1145368012;
v52 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v52 + 242);
ExAcquirePushLockSharedEx(p_DmaOperations, 0i64);
v13->LockStateSignature = -572714444;
ObfReferenceObject(v26);
v13->Directory = (_OBJECT_DIRECTORY *)v26;
*(_WORD *)&v13->DirectoryLocked = 1;
}
v27 = *p_ChainLink;
if( !*p_ChainLink )
goto LABEL_101;
while( 1 )
{
if( v27->HashValue == v13->HashValue )
{
v68 = (__int64)v27->Object
- *((unsigned __int8 *)ObpInfoMaskToOffset + (*((_BYTE *)v27->Object - 22) & 3))
- 48;
v69 = v40;
if( v40 == *(unsigned __int16 *)(v68 + 8) )
{
v70 = (char *)Src[1];
v71 = *(_QWORD **)(v68 + 16);
v72 = (char *)Src[1] + v40;
if( v149 >= 8 )
{
do
{
if( *(_QWORD *)v70 != *v71 )
break;
v69 -= 8;
if( !v69 )
goto LABEL_137;
v70 += 8;
++v71;
}
while( v69 >= 8 );
}
if( v70 >= v72 )
{
LABEL_137:
v26 = (struct _DMA_ADAPTER *)v27->Object;
ObfReferenceObject(v26);
if( !BYTE4(AccessStatus) )
{
ExReleasePushLockEx(p_DmaOperations, 0i64);
v76 = (struct _DMA_ADAPTER *)v13->Directory;
v13->LockStateSignature = -286387660;
HalPutDmaAdapter(v76);
v13->Directory = 0i64;
*(_WORD *)&v13->DirectoryLocked = 0;
KeLeaveCriticalRegion();
p_ChainLink = 0i64;
}
v77 = (struct _DMA_ADAPTER *)v13->Object;
if( v77 )
HalPutDmaAdapter(v77);
v13->Object = v26;
v13->EntryLink = p_ChainLink;
if( !v26 )
goto LABEL_104;
LABEL_142:
v146 = v26;
if( BYTE6(AccessStatus) )
{
if( !v26 )
goto LABEL_154;
if( !(_WORD)v145 )
{
v78 = *(NTSTATUS(__stdcall **)(PVOID, PVOID, ACCESS_STATE *, INT8, UINT64, UNICODE_STRING *, UNICODE_STRING *, PVOID, SECURITY_QUALITY_OF_SERVICE *, _OB_EXTENDED_PARSE_PARAMETERS *, PVOID *))(ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ LOBYTE(v26[-2].DmaOperations) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)v26 - 48) >> 8)] + 144);
if( !v78 || InsertObject && v78 != ObpParseSymbolicLinkEx )
{
v36 = ObReferenceObjectByPointer(v26, 0, ObjectType, AccessMode);
LODWORD(AccessStatus) = v36;
goto LABEL_58;
}
}
goto LABEL_35;
}
if( v26 )
{
v36 = v151;
goto LABEL_320;
}
LABEL_154:
if( (_WORD)v145 )
{
LODWORD(AccessStatus) = -1073741766;
}
else
{
if( !InsertObject )
goto LABEL_156;
if( ObjectType == ObpDirectoryObjectType )
v119 = 8;
else
v119 = 4;
v120 = (CHAR *)DirectoryObject;
v121 = v150;
if( ObCheckCreateObjectAccess(
DirectoryObject,
v119,
AccessState,
(_UNICODE_STRING *)Src,
0,
v150,
&AccessStatus) )
{
v122 = *((_DWORD *)v120 + 85);
if( v122 != -1
&& (ObjectType == MmSectionObjectType || ObjectType == ObpSymbolicLinkObjectType)
&& v122 != (unsigned int)PsGetCurrentProcessSessionId()
&& !SeSinglePrivilegeCheck(*(_QWORD *)&SeCreateGlobalPrivilege, v121)
&& !ObpIsUnsecureName((UNICODE_STRING *)Src, (v176 & 0x40) != 0) )
{
goto LABEL_347;
}
v123 = LOWORD(Src[0]);
PoolWithTag = (UINT8 *)ExAllocatePoolWithTag(PagedPool, LOWORD(Src[0]), 0x6D4E624Fui64);
if( PoolWithTag )
{
if( ObpInsertDirectoryEntry(v120, (CHAR *)InsertObject, (INT64)v13) )
{
memmove(PoolWithTag, (UINT8 *)Src[1], v123);
v125 = (char *)InsertObject
- *((unsigned __int8 *)ObpInfoMaskToOffset + (*((char *)InsertObject - 22) & 3))
- 48;
v126 = (void *)*((_QWORD *)v125 + 2);
if( v126 )
ExFreePoolWithTag(v126, 0);
v127 = (__int16)Src[0];
*((_WORD *)v125 + 4) = Src[0];
*((_WORD *)v125 + 5) = v127;
*((_QWORD *)v125 + 2) = PoolWithTag;
v146 = (struct _DMA_ADAPTER *)InsertObject;
LODWORD(AccessStatus) = 0;
goto LABEL_59;
}
ExFreePoolWithTag(PoolWithTag, 0);
}
LODWORD(AccessStatus) = -1073741670;
}
else if( (int)AccessStatus >= 0 )
{
LODWORD(AccessStatus) = -1073741772;
}
}
goto LABEL_157;
}
if( HIDWORD(TokenInformation) )
{
v73 = (char *)v71 - v70;
while( 1 )
{
v74 = *(unsigned __int16 *)v70;
v75 = *(unsigned __int16 *)&v70[v73];
if( (_WORD)v74 != (_WORD)v75 )
{
if( (unsigned int)v74 >= 0x61 )
{
if( (unsigned int)v74 > 0x7A )
{
if( Nls844UnicodeUpcaseTable && (unsigned __int16)v74 >= 0xC0u )
LOWORD(v74) = *(_WORD *)(Nls844UnicodeUpcaseTable
+ 2
* ((v74 & 0xF)
+ *(unsigned __int16 *)(Nls844UnicodeUpcaseTable
+ 2i64
* (((unsigned __int8)v74 >> 4)
+ (unsigned int)*(unsigned __int16 *)(Nls844UnicodeUpcaseTable + 2 * (v74 >> 8))))))
+ v74;
}
else
{
LOWORD(v74) = v74 - 32;
}
}
if( (unsigned int)v75 >= 0x61 )
{
if( (unsigned int)v75 > 0x7A )
{
if( Nls844UnicodeUpcaseTable && (unsigned __int16)v75 >= 0xC0u )
LOWORD(v75) = *(_WORD *)(Nls844UnicodeUpcaseTable
+ 2
* ((v75 & 0xF)
+ *(unsigned __int16 *)(Nls844UnicodeUpcaseTable
+ 2i64
* (((unsigned __int8)v75 >> 4)
+ (unsigned int)*(unsigned __int16 *)(Nls844UnicodeUpcaseTable + 2 * (v75 >> 8))))))
+ v75;
}
else
{
LOWORD(v75) = v75 - 32;
}
}
if( (_WORD)v74 != (_WORD)v75 )
break;
}
v70 += 2;
if( v70 >= v72 )
goto LABEL_137;
}
}
else
{
while( *(_WORD *)v70 == *(_WORD *)v71 )
{
v70 += 2;
v71 = (_QWORD *)((char *)v71 + 2);
if( v70 >= v72 )
goto LABEL_137;
}
}
v40 = v149;
}
}
p_ChainLink = &v27->ChainLink;
v27 = v27->ChainLink;
if( !v27 )
{
DirectoryLocked = BYTE4(AccessStatus);
LABEL_101:
if( !DirectoryLocked )
{
ExReleasePushLockEx(p_DmaOperations, 0i64);
v53 = (struct _DMA_ADAPTER *)v13->Directory;
v13->LockStateSignature = -286387660;
HalPutDmaAdapter(v53);
v13->Directory = 0i64;
*(_WORD *)&v13->DirectoryLocked = 0;
KeLeaveCriticalRegion();
}
v26 = 0i64;
LABEL_104:
if( !BYTE5(AccessStatus) )
goto LABEL_142;
v54 = Object;
LABEL_106:
v55 = *((_DWORD *)v54 + 84);
v56 = 0i64;
if( (v55 & 4) != 0 )
{
if( (v55 & 0x10) != 0 && !v174 )
goto LABEL_217;
v56 = (_OBJECT_DIRECTORY *)*((_QWORD *)v54 + 39);
}
else
{
v57 = PsGetCurrentServerSiloGlobals();
v58 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v58 + 243);
v59 = (UINT64)(v57 + 15);
ExAcquirePushLockSharedEx((UINT64)(v57 + 15), 0i64);
v60 = *((_QWORD *)v54 + 38);
if( v60 )
v56 = *(_OBJECT_DIRECTORY **)(v60 + 8);
ExReleasePushLockEx(v59, 0i64);
v61 = (_ETHREAD *)KeGetCurrentThread();
v17 = (*((_WORD *)v61 + 243))++ == 0xFFFF;
if( v17 && *((_ETHREAD **)v61 + 19) != (_ETHREAD *)((char *)v61 + 152) )
KiCheckForKernelApcDelivery();
}
if( !v56 )
goto LABEL_217;
v62 = v13->DirectoryLocked;
if( v62 )
{
ObfReferenceObject(v54);
v63 = LookupContext;
ObpUnlockDirectory((INT64)v54, (INT64)LookupContext);
ObpLockDirectoryShared(LookupContext, v56);
HalPutDmaAdapter((PADAPTER_OBJECT)v54);
v62 = LookupContext->DirectoryLocked;
}
else
{
v63 = LookupContext;
}
v64 = &v56->HashBuckets[v63->HashIndex];
if( !v62 )
{
v63->LockStateSignature = -1145368012;
v65 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v65 + 242);
ExAcquirePushLockSharedEx((UINT64)&v56->Lock, 0i64);
v63->LockStateSignature = -572714444;
ObfReferenceObject(v56);
v63->Directory = v56;
*(_WORD *)&v63->DirectoryLocked = 1;
}
v66 = *v64;
if( !*v64 )
{
LABEL_122:
if( !v62 )
ObpUnlockDirectory((INT64)v56, (INT64)v63);
v26 = 0i64;
v54 = v56;
goto LABEL_125;
}
HashValue = v63->HashValue;
while( 1 )
{
if( v66->HashValue == HashValue )
{
v103 = v149;
v104 = (__int64)v66->Object
- *((unsigned __int8 *)ObpInfoMaskToOffset + (*((_BYTE *)v66->Object - 22) & 3))
- 48;
if( v149 == *(unsigned __int16 *)(v104 + 8) )
{
v105 = (char *)Src[1];
v106 = *(_QWORD **)(v104 + 16);
v107 = (char *)Src[1] + (int)v149;
if( v149 >= 8 )
{
do
{
if( *(_QWORD *)v105 != *v106 )
break;
v103 -= 8;
if( !v103 )
goto LABEL_212;
v105 += 8;
++v106;
}
while( v103 >= 8 );
}
if( v105 >= v107 )
{
LABEL_212:
v26 = (struct _DMA_ADAPTER *)v66->Object;
ObfReferenceObject(v26);
if( v62 )
{
v111 = LookupContext;
}
else
{
ExReleasePushLockEx((UINT64)&v56->Lock, 0i64);
v111 = LookupContext;
v112 = LookupContext->Directory;
LookupContext->LockStateSignature = -286387660;
HalPutDmaAdapter((PADAPTER_OBJECT)v112);
LookupContext->Directory = 0i64;
*(_WORD *)&LookupContext->DirectoryLocked = 0;
KeLeaveCriticalRegion();
v64 = 0i64;
}
v113 = (struct _DMA_ADAPTER *)v111->Object;
if( v113 )
HalPutDmaAdapter(v113);
v111->Object = v26;
v111->EntryLink = v64;
LABEL_217:
v54 = v56;
if( v26 )
{
LABEL_218:
v13 = LookupContext;
goto LABEL_142;
}
LABEL_125:
v13 = LookupContext;
if( !v56 )
goto LABEL_218;
goto LABEL_106;
}
if( HIDWORD(TokenInformation) )
{
v108 = (char *)v106 - v105;
while( 1 )
{
v109 = *(_WORD *)v105;
v110 = *(_WORD *)&v105[v108];
if( *(_WORD *)v105 != v110 )
{
NLS_UPCASE(v110);
v128 = NLS_UPCASE(v109);
if( v128 != (_WORD)v27 )
break;
}
v105 += 2;
if( v105 >= v107 )
goto LABEL_212;
}
}
else
{
while( *(_WORD *)v105 == *(_WORD *)v106 )
{
v105 += 2;
v106 = (_QWORD *)((char *)v106 + 2);
if( v105 >= v107 )
goto LABEL_212;
}
}
}
}
v64 = &v66->ChainLink;
v66 = v66->ChainLink;
if( !v66 )
{
v63 = LookupContext;
goto LABEL_122;
}
}
}
}
}
while( 1 )
{
v46 = *v41++;
--v42;
v47 = (v45 >> 1) + 3 * v45;
if( v46 >= 0x61 )
{
if( v46 > 0x7A )
{
v129 = NLS_UPCASE(v46);
v45 = v129 + v130;
goto LABEL_94;
}
v47 -= 32;
}
v45 = v46 + v47;
LABEL_94:
if( !v42 )
goto LABEL_95;
}
}
if( !v15->Length || *v15->Buffer != 92 )
return 3221225531i64;
ReturnedSiloContext = 0i64;
if( PsGetPermanentSiloContext(v19, (unsigned int)PsObjectDirectorySiloContextSlot, &ReturnedSiloContext) >= 0 )
{
v26 = (struct _DMA_ADAPTER *)ReturnedSiloContext;
}
else
{
v26 = (struct _DMA_ADAPTER *)ObpRootDirectoryObject;
ReturnedSiloContext = ObpRootDirectoryObject;
}
DmaAdapter = v26;
if( v26 )
ObfReferenceObject(v26);
if( v15->Length != 2 )
{
v170 = v15;
p_Name = &ObjectType->Name;
v171 = 0i64;
SeSetLearningModeObjectInformation((INT64)v168);
goto LABEL_29;
}
if( v26 )
{
LODWORD(AccessStatus) = ObReferenceObjectByPointer(v26, 0, ObjectType, AccessMode);
if( (int)AccessStatus >= 0 )
*v18 = v26;
HalPutDmaAdapter(v26);
return(unsigned int)AccessStatus;
}
else if( v21 )
{
LODWORD(result) = ObReferenceObjectByPointer(v21, 0, ObjectType, AccessMode);
if( (int)result >= 0 )
*v18 = v21;
}
else
{
return 3221225485i64;
}
return result;
}Referenced by:
ObOpenObjectByNameEx
ObReferenceObjectByName
ObReferenceObjectByNameEx
ObpInsertOrLocateNamedObject