PiDevCfgQueryDriverNode
__int64 __fastcall PiDevCfgQueryDriverNode(PCWSTR SourceString, PCWSTR a2, int a3, int a4, int a5, __int64 a6){
wchar_t *i;
int DriverPackageId;
INT64 v10;
VOID *PoolWithTag;
INT64 v12;
PVOID *v13;
int v14;
int v15;
NTSTATUS v16;
NTSTATUS v17;
int v18;
WCHAR *v19;
NTSTATUS v20;
int v21;
__int64 v23;
INT64 v24;
char v25;
UINT64 v26;
UINT64 v27;
UINT64 v28;
char v29;
char v30;
int v31;
HANDLE Handle;
HANDLE ConfigurationKeyHandle;
HANDLE v34;
struct _UNICODE_STRING UnicodeString;
UNICODE_STRING ValueName;
int v37;
int v38;
void *KeyHandle;
struct _UNICODE_STRING v40;
struct _OBJECT_ATTRIBUTES ObjectAttributes;
_QWORD *v42;
INT64 result;
int v44;
char *v45;
INT64 v46;
int v47;
__int64 *v48;
int v49;
struct _UNICODE_STRING *v50;
int v51;
int v52;
const wchar_t *v53;
const int *v54;
int v55;
int *v56;
int v57;
int v58;
__int64 *v59;
const wchar_t *v60;
INT64 v61;
int v62;
int v63;
__int64 *v64;
int v65;
INT64 v66;
unsigned int v67;
int v68;
int v69;
v42 = (_QWORD *)a6;
v37 = a4;
v31 = -16777216;
v38 = a3;
*(_QWORD *)&UnicodeString.Length = 0i64;
UnicodeString.Buffer = 0i64;
i = 0i64;
Handle = 0i64;
v30 = 0;
*(_QWORD *)&v40.Length = 0i64;
v40.Buffer = 0i64;
v29 = 0;
ValueName = 0i64;
KeyHandle = 0i64;
v34 = 0i64;
ConfigurationKeyHandle = 0i64;
DriverPackageId = PiDevCfgGetDriverPackageId((PWCHAR)SourceString, &UnicodeString);
if( DriverPackageId < 0 )
goto LABEL_43;
DriverPackageId = PnpOpenObjectRegKey(PiPnpRtlCtx, (__int64)UnicodeString.Buffer, 8u, 131097, 0, (__int64)&Handle);
if( DriverPackageId < 0 )
goto LABEL_43;
memset((INT64)&result, 0i64);
result = (INT64)DEVPKEY_DriverPackage_Invalidated;
LODWORD(v26) = 2;
v45 = &v30;
v48 = DEVPKEY_DriverPackage_TargetComputerIds;
v50 = &v40;
v44 = 17;
LODWORD(v46) = 1;
v49 = 8210;
v52 = 6;
DriverPackageId = PiDevCfgQueryObjectProperties(
v10,
(INT64)UnicodeString.Buffer,
8ui64,
(INT64)Handle,
(INT64)&result,
v26);
if( DriverPackageId < 0 )
goto LABEL_43;
if( v47 >= 0 && v30 == -1 )
{
DriverPackageId = -1073741738;
goto LABEL_43;
}
if( (int)v53 >= 0 && v40.Buffer && v40.Length > 2u )
{
for( i = v40.Buffer; *i; i += v23 + 1 )
{
if( (unsigned __int8)PipCheckComputerSupported(i) )
break;
v23 = -1i64;
do
++v23;
while( i[v23] );
}
if( !*i )
goto LABEL_63;
}
if( (a5 & 8) != 0 && !i )
{
LABEL_63:
DriverPackageId = -1073740764;
goto LABEL_43;
}
PoolWithTag = ExAllocatePoolWithTag(PagedPool, 0x1A0ui64, 0x63647050ui64);
v12 = (INT64)PoolWithTag;
if( !PoolWithTag )
{
DriverPackageId = -1073741670;
goto LABEL_43;
}
memset((INT64)PoolWithTag, 0i64);
*(_QWORD *)(v12 + 232) = v12 + 224;
*(_QWORD *)(v12 + 224) = v12 + 224;
*(_QWORD *)(v12 + 216) = v12 + 208;
*(_QWORD *)(v12 + 208) = v12 + 208;
*(_QWORD *)(v12 + 376) = v12 + 368;
*(_QWORD *)(v12 + 368) = v12 + 368;
if( !RtlCreateUnicodeString((UNICODE_STRING *)(v12 + 40), (PWCHAR)SourceString)
|| !PnpDuplicateUnicodeString((UNICODE_STRING *)(v12 + 56), &UnicodeString)
|| !RtlCreateUnicodeString((UNICODE_STRING *)(v12 + 72), (PWCHAR)a2)
|| i && !RtlCreateUnicodeString((UNICODE_STRING *)(v12 + 128), i) )
{
DriverPackageId = -1073741670;
goto LABEL_41;
}
memset((INT64)&result, 0i64);
result = (INT64)DEVPKEY_DriverPackage_DriverDate;
LODWORD(v27) = 5;
v44 = 16;
v48 = DEVPKEY_DriverPackage_DriverVersion;
v45 = (char *)(v12 + 112);
v50 = (struct _UNICODE_STRING *)(v12 + 120);
LODWORD(v46) = 8;
v54 = &DEVPKEY_DriverPackage_SignerScore;
v13 = (PVOID *)(v12 + 144);
v51 = 8;
v56 = &v31;
v59 = DEVPKEY_DriverPackage_ExtensionId;
v64 = DEVPKEY_DriverPackage_ExtensionContractIds;
v68 = 2;
v49 = 9;
v55 = 7;
v57 = 4;
LODWORD(v60) = 13;
v61 = v12 + 188;
v62 = 16;
v65 = 4109;
v66 = v12 + 144;
DriverPackageId = PiDevCfgQueryObjectProperties(
16i64,
(INT64)UnicodeString.Buffer,
8ui64,
(INT64)Handle,
(INT64)&result,
v27);
if( DriverPackageId < 0 )
goto LABEL_41;
if( v47 < 0 )
*(_QWORD *)(v12 + 112) = 0i64;
if( (int)v53 < 0 )
*(_QWORD *)(v12 + 120) = 0i64;
v14 = v31;
if( v58 < 0 )
v14 = -16777216;
v31 = v14;
if( v63 < 0 )
*(_OWORD *)(v12 + 188) = 0i64;
if( v69 >= 0 )
{
if( (v67 & 0xF) != 0 )
{
ExFreePoolWithTag(*v13, 0);
*v13 = 0i64;
}
else
{
*(_DWORD *)(v12 + 152) = v67 >> 4;
}
}
else
{
*v13 = 0i64;
}
if( (a5 & 4) != 0 )
v15 = -1;
else
v15 = (unsigned __int16)v38 | v37 & 0xFF0000 | v31 & ((a5 & 1) != 0 ? -268435456 : -16777216);
*(_DWORD *)(v12 + 108) = v15;
if( (a5 & 2) != 0 )
{
memset((INT64)&result, 0i64);
result = (INT64)DEVPKEY_DriverPackage_F6;
v45 = &v29;
LODWORD(v28) = 1;
v44 = 17;
LODWORD(v46) = 1;
DriverPackageId = PiDevCfgQueryObjectProperties(
v24,
(INT64)UnicodeString.Buffer,
8ui64,
(INT64)Handle,
(INT64)&result,
v28);
if( DriverPackageId < 0 )
goto LABEL_41;
v25 = v29;
if( v47 < 0 )
v25 = 0;
v29 = v25;
if( v25 == -1 )
*(_DWORD *)(v12 + 184) |= 2u;
}
*(_DWORD *)&ValueName.Length = 1572886;
ValueName.Buffer = L"Descriptors";
ObjectAttributes.RootDirectory = Handle;
*(_QWORD *)&ObjectAttributes.Length = 48i64;
ObjectAttributes.ObjectName = &ValueName;
*(_QWORD *)&ObjectAttributes.Attributes = 576i64;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
v16 = ZwOpenKey(&KeyHandle, 0x20019u, &ObjectAttributes);
DriverPackageId = v16;
if( v16 == -1073741772 )
goto LABEL_52;
if( v16 < 0 )
goto LABEL_41;
ObjectAttributes.RootDirectory = KeyHandle;
*(_QWORD *)&ObjectAttributes.Length = 48i64;
*(_QWORD *)&ObjectAttributes.Attributes = 576i64;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
ObjectAttributes.ObjectName = (_UNICODE_STRING *)(v12 + 72);
v17 = ZwOpenKey(&v34, 0x20019u, &ObjectAttributes);
DriverPackageId = v17;
if( v17 == -1073741772 )
{
LABEL_52:
DriverPackageId = 0;
}
else
{
if( v17 < 0 )
goto LABEL_41;
memset((INT64)&result, 0i64);
v45 = (char *)L"Configuration";
v47 = 0x1000000;
v46 = v12 + 88;
v44 = 288;
LOBYTE(v18) = RtlpQueryRegistryValues((_KTRAP_FRAME *)0xC0000000i64, (_KEXCEPTION_FRAME *)v34);
DriverPackageId = v18;
if( v18 < 0 )
goto LABEL_41;
if( !*(_WORD *)(v12 + 88) && *(_QWORD *)(v12 + 96) )
RtlFreeAnsiString((_UNICODE_STRING *)(v12 + 88));
}
v19 = *(WCHAR **)(v12 + 96);
if( !v19 )
{
LABEL_39:
if( PnpBootMode )
{
*(_DWORD *)&ValueName.Length = 1572886;
ValueName.Buffer = (wchar_t *)L"ConfigFlags";
if( !ConfigurationKeyHandle || !PnpRegistryValueExists(ConfigurationKeyHandle, &ValueName) )
*(_DWORD *)(v12 + 184) |= 4u;
}
*(_QWORD *)(v12 + 16) = Handle;
*(_QWORD *)(v12 + 24) = v34;
*(_QWORD *)(v12 + 32) = ConfigurationKeyHandle;
Handle = 0i64;
v34 = 0i64;
ConfigurationKeyHandle = 0i64;
*v42 = v12;
v12 = 0i64;
goto LABEL_41;
}
v20 = PiDevCfgOpenDriverConfiguration(Handle, v19, &ConfigurationKeyHandle);
DriverPackageId = v20;
if( v20 == -1073741772 )
{
DriverPackageId = 0;
goto LABEL_39;
}
if( v20 >= 0 )
{
memset((INT64)&result, 0i64);
result = (INT64)PiDevCfgQueryDriverVersionValueCallback;
v45 = (char *)L"DriverDate";
v50 = (struct _UNICODE_STRING *)PiDevCfgQueryDriverVersionValueCallback;
v53 = L"DriverVersion";
v46 = v12 + 112;
v54 = (const int *)(v12 + 120);
v62 = 117440512;
v60 = L"ExcludeIds";
v61 = v12 + 160;
LODWORD(v59) = 304;
LOBYTE(v21) = RtlpQueryRegistryValues((_KTRAP_FRAME *)0xC0000000i64, (_KEXCEPTION_FRAME *)ConfigurationKeyHandle);
DriverPackageId = v21;
if( v21 >= 0 )
{
if( *(_WORD *)(v12 + 160) <= 2u && *(_QWORD *)(v12 + 168) )
RtlFreeAnsiString((_UNICODE_STRING *)(v12 + 160));
goto LABEL_39;
}
}
LABEL_41:
if( v12 )
PiDevCfgFreeDriverNode(v12);
LABEL_43:
if( Handle )
ZwClose(Handle);
if( v34 )
ZwClose(v34);
if( KeyHandle )
ZwClose(KeyHandle);
if( ConfigurationKeyHandle )
ZwClose(ConfigurationKeyHandle);
RtlFreeAnsiString(&UnicodeString);
RtlFreeAnsiString(&v40);
return(unsigned int)DriverPackageId;
}Referenced by:
PiDevCfgFindDeviceDriver