IoReportTargetDeviceChange
NTSTATUS __stdcall IoReportTargetDeviceChange(PDEVICE_OBJECT PhysicalDeviceObject, PVOID NotificationStructure){
__int64 v4;
GUID *v5;
int v6;
int v7;
NTSTATUS result;
__int16 *v9;
_WORD *v10;
PVOID *v11;
PVOID *v12;
__int64 v13;
_WORD *v14;
__int64 v15;
_WORD *v16;
__int64 v17;
struct _KEVENT Event;
ULONG Result;
Result = 0;
memset(&Event, 0, sizeof(Event));
if( !PhysicalDeviceObject )
goto LABEL_29;
v4 = *(_QWORD *)(*((_QWORD *)PhysicalDeviceObject + 39) + 40i64);
if( !v4 || (*(_DWORD *)(v4 + 396) & 0x20000) != 0 )
{
IoAddTriageDumpDataBlock(PhysicalDeviceObject, *((unsigned __int16 *)PhysicalDeviceObject + 1));
v9 = (__int16 *)*((_QWORD *)PhysicalDeviceObject + 1);
if( v9 )
{
IoAddTriageDumpDataBlock(v9, (unsigned int)v9[1]);
v10 = (_WORD *)(*((_QWORD *)PhysicalDeviceObject + 1) + 56i64);
if( *v10 )
{
IoAddTriageDumpDataBlock(v10, 2ui64);
IoAddTriageDumpDataBlock(
*(PVOID *)(*((_QWORD *)PhysicalDeviceObject + 1) + 64i64),
*(unsigned __int16 *)(*((_QWORD *)PhysicalDeviceObject + 1) + 56i64));
}
}
v11 = *(PVOID **)(*((_QWORD *)PhysicalDeviceObject + 39) + 40i64);
if( v11 )
{
v12 = v11 + 5;
IoAddTriageDumpDataBlock(v11, 0x310ui64);
if( *(_WORD *)v12 )
{
IoAddTriageDumpDataBlock(v12, 2ui64);
IoAddTriageDumpDataBlock(v12[1], *(unsigned __int16 *)v12);
}
v13 = *((_QWORD *)PhysicalDeviceObject + 39);
v14 = (_WORD *)(*(_QWORD *)(v13 + 40) + 56i64);
if( *v14 )
{
IoAddTriageDumpDataBlock(v14, 2ui64);
IoAddTriageDumpDataBlock(
*(PVOID *)(*(_QWORD *)(*((_QWORD *)PhysicalDeviceObject + 39) + 40i64) + 64i64),
*(unsigned __int16 *)(*(_QWORD *)(*((_QWORD *)PhysicalDeviceObject + 39) + 40i64) + 56i64));
v13 = *((_QWORD *)PhysicalDeviceObject + 39);
}
v15 = *(_QWORD *)(*(_QWORD *)(v13 + 40) + 16i64);
if( v15 )
{
v16 = (_WORD *)(v15 + 56);
if( *v16 )
{
IoAddTriageDumpDataBlock(v16, 2ui64);
v17 = *(_QWORD *)(*(_QWORD *)(*((_QWORD *)PhysicalDeviceObject + 39) + 40i64) + 16i64);
IoAddTriageDumpDataBlock(*(PVOID *)(v17 + 64), *(unsigned __int16 *)(v17 + 56));
}
}
}
LABEL_29:
KeBugCheckEx(0xCAu, 2ui64, (ULONG_PTR)PhysicalDeviceObject, 0i64, 0i64);
}
v5 = (GUID *)((char *)NotificationStructure + 4);
if( (char *)NotificationStructure + 4 == (char *)&GUID_TARGET_DEVICE_QUERY_REMOVE )
return -1073741808;
if( RtlCompareMemory(v5, &GUID_TARGET_DEVICE_QUERY_REMOVE, 0x10ui64) == 16 )
return -1073741808;
if( v5 == (GUID *)GUID_TARGET_DEVICE_REMOVE_CANCELLED )
return -1073741808;
if( RtlCompareMemory(v5, GUID_TARGET_DEVICE_REMOVE_CANCELLED, 0x10ui64) == 16 )
return -1073741808;
if( v5 == &GUID_TARGET_DEVICE_REMOVE_COMPLETE )
return -1073741808;
if( RtlCompareMemory(v5, &GUID_TARGET_DEVICE_REMOVE_COMPLETE, 0x10ui64) == 16 )
return -1073741808;
v6 = *((unsigned __int16 *)NotificationStructure + 1);
if( (unsigned __int16)v6 < 0x24u )
return -1073741808;
v7 = *((_DWORD *)NotificationStructure + 8);
if( v7 != -1 && v7 > v6 - 36 )
return -1073741808;
KeInitializeEvent(&Event, NotificationEvent, 0);
result = PnpSetCustomTargetEvent(
PhysicalDeviceObject,
&Event,
&Result,
0i64,
0i64,
(PTARGET_DEVICE_CUSTOM_NOTIFICATION)NotificationStructure);
if( result >= 0 )
{
KeWaitForSingleObject(&Event, Executive, 0, 0, 0i64);
return Result;
}
return result;
}Referenced by:
FsRtlNotifyVolumeEventEx
NtSetVolumeInformationFile