SmKmStoreFileOpenVolume
INT64 __stdcall SmKmStoreFileOpenVolume(
FILE_OBJECT *FileObject,
FILE_OBJECT **VolumeFileObjectOut,
DEVICE_OBJECT **VolumeDeviceObjectOut){
UINT8 v6;
int v7;
NTSTATUS v8;
FILE_OBJECT *v9;
_DEVICE_OBJECT *RelatedDeviceObject;
UINT64 v12;
UINT64 ShareAccess;
UINT64 CreateDisposition;
UINT64 CreateOptions;
UINT64 v16;
UINT64 ReturnLength;
void *FileHandle;
PVOID Object;
struct _OBJECT_ATTRIBUTES ObjectAttributes;
struct _IO_STATUS_BLOCK IoStatusBlock;
OBJECT_NAME_INFORMATION result[33];
LODWORD(ReturnLength) = 0;
IoStatusBlock = 0i64;
memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
memset((INT64)result, 0i64);
FileHandle = 0i64;
v6 = IoSetThreadHardErrorMode(0);
v7 = ObQueryNameStringMode(FileObject->DeviceObject, result, 0x208ui64, &ReturnLength, 0);
if( v7 >= 0 )
{
LODWORD(v16) = 0;
ObjectAttributes.RootDirectory = 0i64;
LODWORD(CreateOptions) = 32;
LODWORD(CreateDisposition) = 1;
LODWORD(ShareAccess) = 7;
LODWORD(v12) = 0;
ObjectAttributes.Length = 48;
ObjectAttributes.Attributes = 576;
ObjectAttributes.ObjectName = (_UNICODE_STRING *)result;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
v7 = ZwCreateFile(
&FileHandle,
0x100080ui64,
&ObjectAttributes,
&IoStatusBlock,
0i64,
v12,
ShareAccess,
CreateDisposition,
CreateOptions,
0i64,
v16);
if( v7 >= 0 )
{
Object = 0i64;
v8 = ObReferenceObjectByHandle(FileHandle, 3u, 0i64, 0, &Object, 0i64);
v9 = (FILE_OBJECT *)Object;
v7 = v8;
if( v8 >= 0 )
{
RelatedDeviceObject = IoGetRelatedDeviceObject((_FILE_OBJECT *)Object);
*VolumeFileObjectOut = v9;
v9 = 0i64;
*VolumeDeviceObjectOut = RelatedDeviceObject;
}
if( v9 )
HalPutDmaAdapter((PADAPTER_OBJECT)v9);
}
}
if( FileHandle )
ZwClose(FileHandle);
IoSetThreadHardErrorMode(v6);
return(unsigned int)v7;
}Referenced by:
SmKmEtwAppendProductName
SmKmStoreFileCreate
SmcCacheStart