IopParseDevice
NTSTATUS __stdcall IopParseDevice(
PVOID ParseObject,
PVOID ObjectType,
_ACCESS_STATE *AccessState,
INT8 AccessMode,
UINT64 Attributes,
_UNICODE_STRING *CompleteName,
_UNICODE_STRING *RemainingName,
PVOID Context,
_SECURITY_QUALITY_OF_SERVICE *SecurityQos,
_OB_EXTENDED_PARSE_PARAMETERS *ExtendedParameters,
PVOID *Object){
int v11;
_ACCESS_STATE *v12;
unsigned int *v13;
unsigned int *v14;
__int64 v15;
__int64 v16;
_DEVICE_OBJECT *v17;
unsigned __int64 v18;
NTSTATUS result;
bool v20;
bool v21;
__int64 v22;
_DEVICE_OBJECT *v23;
_DEVICE_OBJECT *v24;
_EJOB *CurrentServerSilo;
NTSTATUS ServerSiloServiceSessionId;
_DEVICE_OBJECT *DevicePDO;
_ADAPTER_OBJECT *v28;
unsigned int v29;
bool v30;
char v31;
__int64 v32;
int v33;
INT8 v34;
char v35;
int ActiveConsoleId;
_EJOB *v37;
NTSTATUS v38;
bool v39;
_SECURITY_SUBJECT_CONTEXT *v40;
char v41;
VOID *ClientToken;
unsigned int v43;
_UNICODE_STRING *v44;
char v45;
INT8 v46;
char v47;
char v48;
unsigned __int16 Length;
__int64 v50;
_VPB *v51;
_DEVICE_OBJECT *DeviceObject;
char v53;
int v54;
char v55;
_VPB *v56;
_DEVICE_OBJECT *v57;
unsigned int Characteristics;
_BOOL8 v59;
_UNICODE_STRING *v60;
unsigned int v61;
_ACCESS_STATE *v62;
char v63;
_IRP *Irp;
_IRP *v65;
INT8 v66;
_IO_STACK_LOCATION *v67;
unsigned int v68;
unsigned int v69;
unsigned __int8 v70;
_DEVICE_OBJECT *v71;
_FILE_OBJECT *v72;
_QWORD *v73;
unsigned __int64 v74;
__int64 v75;
INT64 v76;
_EJOB *v77;
INT32 *p_Type;
INT64 v79;
char v80;
_EJOB *v81;
_EJOB *Silo;
int v83;
_QWORD *v84;
unsigned __int16 v85;
VOID **PoolWithTag;
int v87;
const WCHAR *v88;
wchar_t *Buffer;
unsigned __int16 v90;
VOID **v91;
const WCHAR *v92;
_DEVICE_OBJECT *v93;
const WCHAR *v94;
_RELATIVE_SYMLINK_INFO *MostRecentlyUsedName;
NTSTATUS updated;
_KSEMAPHORE *v97;
char v98;
int v99;
unsigned __int8 v100;
int v101;
__int64 v102;
unsigned __int8 CurrentIrql;
int v104;
int v105;
UINT8 v106;
_ECP_LIST *v107;
_REPARSE_DATA_BUFFER *v108;
unsigned __int64 v109;
__int64 v110;
void *v111;
__int64 v112;
char v113;
int v114;
unsigned int v115;
int v116;
_DEVICE_OBJECT *v117;
unsigned __int64 v118;
unsigned __int64 v119;
__int64 v120;
_UNICODE_STRING *v121;
VOID **v122;
wchar_t *v123;
__int64 v124;
__int64 v125;
char *v126;
_FILE_OBJECT *v127;
_DEVICE_OBJECT *v128;
_FILE_OBJECT *v129;
_DEVICE_OBJECT *v130;
int v131;
char *AuxiliaryBuffer;
__int64 v133;
unsigned int v134;
unsigned __int64 v135;
__int64 v136;
unsigned int v137;
_ACCESS_STATE *v138;
_OB_EXTENDED_PARSE_PARAMETERS *v139;
_EJOB *v140;
_DEVICE_OBJECT *v141;
__int64 v142;
_DEVICE_OBJECT *v143;
_VPB *v144;
_VPB *v145;
_FILE_OBJECT *RelatedFileObject;
unsigned __int64 DeviceType;
__int64 v148;
NTSTATUS FileInformation;
char v150;
_FAST_IO_DISPATCH *FastIoDispatch;
__int64 v152;
unsigned __int8(__fastcall *FastIoQueryBasicInfo)(_FILE_OBJECT *, unsigned __int8, _FILE_BASIC_INFORMATION *, _IO_STATUS_BLOCK *, _DEVICE_OBJECT *);
VOID *v154;
VOID **Pool_1;
unsigned __int8(__fastcall *FastIoQueryNetworkOpenInfo)(_FILE_OBJECT *, unsigned __int8, _FILE_NETWORK_OPEN_INFORMATION *, _IO_STATUS_BLOCK *, _DEVICE_OBJECT *);
VOID *v157;
NTSTATUS v158;
_PRIVILEGE_SET *PreviouslyGrantedAccess;
__int64 *PreviouslyGrantedAccessa;
_KPROCESSOR_MODE AccessModea;
PACCESS_MASK GrantedAccess;
INT64 status;
int v164;
unsigned int Privileges[5];
_ACCESS_MASK DesiredAccess;
_DEVICE_OBJECT *TargetDeviceObject;
_ETHREAD *Thread;
_FILE_OBJECT *FileObject;
char v170;
unsigned int ReturnedLength;
INT64 v172;
VOID *SymlinkInfo;
int v174;
struct _ECP_LIST *EcpList;
_VPB *Vpb;
PVOID BugCheckParameter4[2];
VOID *TypeExt;
_IO_STACK_LOCATION *v179;
_UNICODE_STRING ObjectTypeName;
struct _ECP_LIST *ExtraCreateParameter;
__int128 v182;
__int64 v183;
VOID *v184;
VOID *retaddr;
unsigned __int8(__fastcall *v187)(_FILE_OBJECT *, unsigned __int8, _FILE_BASIC_INFORMATION *, _IO_STATUS_BLOCK *, _DEVICE_OBJECT *);
_ACCESS_STATE *AccessStatea;
INT8 v189;
v189 = AccessMode;
AccessStatea = AccessState;
v12 = AccessState;
v13 = (unsigned int *)ParseObject;
v14 = (unsigned int *)Context;
Privileges[0] = 0;
LODWORD(status) = 0;
*(_OWORD *)BugCheckParameter4 = 0i64;
v182 = 0i64;
v183 = 0i64;
v174 = 0;
LOBYTE(v164) = 0;
ReturnedLength = 0;
ObjectTypeName = 0i64;
*(_QWORD *)&Privileges[3] = 0i64;
v172 = 0i64;
EcpList = 0i64;
SymlinkInfo = 0i64;
if( ObjectType != IoFileObjectType )
return -1073741788;
Thread = (_ETHREAD *)KeGetCurrentThread();
LOBYTE(v11) = 4;
RtlInitUnicodeString(&ObjectTypeName, L"File");
*Object = 0i64;
FileObject = 0i64;
if( !v14 )
return -1073741788;
while( 1 )
{
v15 = 0x60010000110040i64;
v16 = 0x1080020084i64;
if( *(_WORD *)v14 != 8 || *((_WORD *)v14 + 1) != 216 )
return -1073741788;
v17 = (_DEVICE_OBJECT *)v13;
*(_QWORD *)&Privileges[1] = v13;
if( v14[8] == 1 )
{
v14[8] = -1096154543;
*((_QWORD *)v14 + 5) = v13;
v14[4] = 0;
ObfReferenceObject(v13);
return 0;
}
if( (v14[38] & 0x10) != 0 )
{
v18 = v13[18];
if( *((_QWORD *)v14 + 3) == 2684354563i64 )
{
if( (unsigned int)v18 > 0x24 || !_bittest64(&v16, v18) )
goto LABEL_10;
}
else
{
v20 = (unsigned int)v18 <= 0x24 && _bittest64(&v16, v18);
v21 = (unsigned int)v18 <= 0x36 && _bittest64(&v15, v18);
if( !v20 && !v21 )
{
LABEL_10:
v14[4] = -1073741192;
return -1073741192;
}
result = IopSymlinkEnforceEnabledTypes(v14[38] & 8, v20, *((_ECP_LIST **)v14 + 21));
LODWORD(status) = result;
if( result < 0 )
goto LABEL_413;
}
}
v22 = *((_QWORD *)v14 + 5);
if( v22 )
{
v17 = *(_DEVICE_OBJECT **)(v22 + 8);
*(_QWORD *)&Privileges[1] = v17;
}
if( v17->DeviceType == 7 )
{
v23 = v17;
v24 = v17;
do
{
if( v23->Vpb )
break;
v23 = v23->AttachedDevice;
v24 = v23;
}
while( v23 );
if( v24 && v24 != v17 )
{
v14[38] |= 2u;
v17 = v24;
*(_QWORD *)&Privileges[1] = v24;
}
}
result = IopCheckDeviceAndDriver((_OPEN_PACKET *)v14, v17);
LODWORD(status) = result;
if( result < 0 )
goto LABEL_413;
if( (v17->DeviceObjectExtension->ExtensionFlags & 0x400) != 0 && !*((_QWORD *)v14 + 5) )
{
CurrentServerSilo = PsGetCurrentServerSilo();
ServerSiloServiceSessionId = PsGetServerSiloServiceSessionId((INT64)CurrentServerSilo);
if( ServerSiloServiceSessionId != PsGetCurrentProcessSessionId()
|| *(&stru_140CF2E80 + 1658) && (v14[16] & 0x40000) == 0 )
{
DevicePDO = IopGetDevicePDO(v17);
v28 = (_ADAPTER_OBJECT *)DevicePDO;
if( DevicePDO )
{
if( !IopCheckSessionDeviceAccess(DevicePDO) )
{
HalPutDmaAdapter(v28);
IopDecrementDeviceObjectRef(v17, 0, 0);
v14[4] = -1073741790;
return -1073741790;
}
HalPutDmaAdapter(v28);
}
}
}
RtlMapGenericMask((UINT64 *)v12 + 2, (_GENERIC_MAPPING *)((char *)IoFileObjectType + 76));
RtlMapGenericMask((UINT64 *)v12 + 3, (_GENERIC_MAPPING *)((char *)IoFileObjectType + 76));
SeSetAccessStateGenericMapping((INT64)v12, (OWORD *)((char *)IoFileObjectType + 76));
v29 = *((_DWORD *)v12 + 4);
DesiredAccess = v29;
v30 = v189 || (v14[21] & 1) != 0;
IopCheckBackupRestorePrivilege(v12, (UINT64 *)v14 + 8, v30, v14[22]);
v31 = *((_BYTE *)v14 + 136);
if( v31 && !RemainingName->Length || (*((_DWORD *)v12 + 3) & 0x100) != 0 )
{
v29 |= *((_DWORD *)v12 + 5);
DesiredAccess = v29;
}
v32 = *((_QWORD *)v14 + 5);
LOBYTE(v33) = v164;
if( v32 && (*(_DWORD *)(v32 + 80) & 0x400000) != 0 )
{
v33 = (unsigned __int8)v164;
if( !RemainingName->Length )
v33 = 1;
v164 = v33;
}
if( ((v34 = v189) != 0 || (v14[21] & 1) != 0) && (!v32 || (_BYTE)v33) && !v31 )
{
v35 = v11 & 0xDF;
if( RemainingName->Length )
{
v40 = (_SECURITY_SUBJECT_CONTEXT *)((char *)v12 + 32);
if( IopDoFullTraverseCheck(v17, v189, (_SECURITY_SUBJECT_CONTEXT *)v12 + 1) )
{
v44 = CompleteName;
LODWORD(PreviouslyGrantedAccess) = 1;
IopCreateSecurityCheck(
v17,
0i64,
v12,
v29 | 0x20,
PreviouslyGrantedAccess,
*(UINT64 **)&Privileges[3],
(_UNICODE_STRING *)Privileges,
CompleteName,
(_ETHREAD *)&ObjectTypeName,
(UINT8)Thread);
LOBYTE(v11) = (v35 ^ v45) & 1 ^ v35;
}
else
{
if( (*((_DWORD *)v12 + 3) & 1) != 0 )
{
LOBYTE(v11) = v35 | 1;
}
else
{
KeEnterCriticalRegionThread(&Thread->Tcb);
ExAcquireResourceSharedLite((UINT64)&stru_140C452E0 + 1408, 1);
LOBYTE(v11) = (v35 ^ SeFastTraverseCheck(v17->SecurityDescriptor, v12, 0x20ui64, v46)) & 1 ^ v35;
if( (v11 & 1) == 0 )
{
*(_QWORD *)&Privileges[3] = 0i64;
SeLockSubjectContext((PSECURITY_SUBJECT_CONTEXT)v12 + 1);
LOBYTE(AccessModea) = 1;
LOBYTE(v11) = ((v11 | 0x20) ^ (unsigned __int8)SeAccessCheck(
v17->SecurityDescriptor,
(PSECURITY_SUBJECT_CONTEXT)v12 + 1,
1u,
32,
0,
(PPRIVILEGE_SET *)&Privileges[3],
(PGENERIC_MAPPING)((char *)IoFileObjectType + 76),
AccessModea,
Privileges,
(PNTSTATUS)&status)) & 1 ^ (v11 | 0x20);
if( *(_QWORD *)&Privileges[3] )
{
SeAppendPrivileges(v12, *(PRIVILEGE_SET **)&Privileges[3]);
CmSiFreeMemory(*(PPRIVILEGE_SET *)&Privileges[3]);
}
}
ExReleaseResourceLite((PERESOURCE)((char *)&stru_140C452E0 + 1408));
KeLeaveCriticalRegionThread(&Thread->Tcb);
}
v44 = CompleteName;
}
}
else
{
v39 = 0;
if( (v17->Characteristics & 0x40001) != 0 && (v29 & 0xFFEDFF7F) != 0 )
{
ActiveConsoleId = RtlGetActiveConsoleId();
if( ActiveConsoleId != PsGetCurrentProcessSessionId() )
{
v37 = PsGetCurrentServerSilo();
v38 = PsGetServerSiloServiceSessionId((INT64)v37);
if( v38 != PsGetCurrentProcessSessionId() && !IopAllowRemoteDASD() )
v39 = 1;
}
}
*(_QWORD *)&Privileges[3] = 0i64;
KeEnterCriticalRegionThread(&Thread->Tcb);
ExAcquireResourceSharedLite((UINT64)&stru_140C452E0 + 1408, 1);
v40 = (_SECURITY_SUBJECT_CONTEXT *)((char *)v12 + 32);
SeLockSubjectContext((PSECURITY_SUBJECT_CONTEXT)v12 + 1);
v41 = v35 | 0x20;
if( !v39 )
goto LABEL_71;
ClientToken = v40->ClientToken;
if( !v40->ClientToken )
ClientToken = (VOID *)*((_QWORD *)v12 + 6);
if( SeTokenIsAdmin(ClientToken) )
{
LABEL_71:
LOBYTE(AccessModea) = 1;
v29 = DesiredAccess;
LOBYTE(v11) = (v41 ^ (unsigned __int8)SeAccessCheck(
v17->SecurityDescriptor,
(PSECURITY_SUBJECT_CONTEXT)v12 + 1,
(v41 & 0x20) != 0,
DesiredAccess,
0,
(PPRIVILEGE_SET *)&Privileges[3],
(PGENERIC_MAPPING)((char *)IoFileObjectType + 76),
AccessModea,
Privileges,
(PNTSTATUS)&status)) & 1 ^ v41;
if( *(_QWORD *)&Privileges[3] )
{
SeAppendPrivileges(v12, *(PRIVILEGE_SET **)&Privileges[3]);
CmSiFreeMemory(*(PPRIVILEGE_SET *)&Privileges[3]);
}
if( (v11 & 1) != 0 )
{
v43 = Privileges[0];
*((_DWORD *)v12 + 5) |= Privileges[0];
*((_DWORD *)v12 + 4) &= ~(v43 | 0x2000000);
*((_BYTE *)v14 + 136) = 1;
}
}
else
{
LOBYTE(v11) = v41 & 0xFE;
LODWORD(status) = -1073741790;
v29 = DesiredAccess;
}
v44 = CompleteName;
SeOpenObjectAuditAlarm(
&ObjectTypeName,
v17,
CompleteName,
v17->SecurityDescriptor,
v12,
0,
v11 & 1,
1,
(UINT8 *)v12 + 10);
ExReleaseResourceLite((PERESOURCE)((char *)&stru_140C452E0 + 1408));
KeLeaveCriticalRegionThread(&Thread->Tcb);
}
if( (v11 & 0x20) != 0 )
SeUnlockSubjectContext(v40);
if( (v11 & 1) == 0 )
goto LABEL_299;
v34 = v189;
}
else
{
v44 = CompleteName;
}
if( *((_BYTE *)v14 + 137) || *((_BYTE *)v14 + 138) )
v47 = 64;
else
v47 = 0;
v48 = v47 | v11 & 0xBF;
Length = RemainingName->Length;
if( RemainingName->Length || (v50 = *((_QWORD *)v14 + 5)) != 0 || (v29 & 0xFEE1FF7F) != 0 || (v48 & 0x40) != 0 )
{
LOBYTE(v11) = v48 & 0xF7;
v50 = *((_QWORD *)v14 + 5);
}
else
{
LOBYTE(v11) = v48 | 8;
}
HIDWORD(status) = v11;
v51 = 0i64;
Vpb = 0i64;
if( !v50 || (*(_DWORD *)(v50 + 80) & 0x800) != 0 )
{
DeviceObject = v17;
TargetDeviceObject = v17;
v54 = HIDWORD(status);
if( v17->Vpb && (status & 0x800000000i64) == 0 )
{
if( (v17->Characteristics & 0x100) != 0
&& (v17->DeviceObjectExtension->ExtensionFlags & 0x800) == 0
&& (v34 || (v14[21] & 1) != 0)
&& (v50 || Length)
&& !(_BYTE)v164 )
{
*(_QWORD *)&Privileges[3] = 0i64;
LODWORD(PreviouslyGrantedAccess) = v14[22];
IopCreateSecurityCheck(
v17,
v17,
AccessStatea,
v29,
PreviouslyGrantedAccess,
0i64,
(_UNICODE_STRING *)Privileges,
CompleteName,
(_ETHREAD *)&ObjectTypeName,
(UINT8)Thread);
if( !v55 )
goto LABEL_299;
}
v56 = IopCheckVpbMounted((_OPEN_PACKET *)v14, v17, RemainingName, &status);
v51 = v56;
Vpb = v56;
if( !v56 )
return status;
DeviceObject = v56->DeviceObject;
TargetDeviceObject = DeviceObject;
}
if( (v14[38] & 1) != 0 )
{
LOBYTE(v54) = v54 | 2;
HIDWORD(status) = v54;
}
else if( DeviceObject->AttachedDevice )
{
LODWORD(v57) = IoGetAttachedDevice((INT64)DeviceObject);
DeviceObject = v57;
TargetDeviceObject = v57;
}
}
else
{
DeviceObject = (_DEVICE_OBJECT *)ParseObject;
TargetDeviceObject = (_DEVICE_OBJECT *)ParseObject;
if( *(_QWORD *)(v50 + 16) )
{
v51 = *(_VPB **)(v50 + 16);
Vpb = v51;
if( (v17->Characteristics & 0x100) != 0
&& (v17->DeviceObjectExtension->ExtensionFlags & 0x800) == 0
&& (v34 || (v14[21] & 1) != 0)
&& !(_BYTE)v164 )
{
*(_QWORD *)&Privileges[3] = 0i64;
LODWORD(PreviouslyGrantedAccess) = v14[22];
IopCreateSecurityCheck(
v17,
v17,
AccessStatea,
v29,
PreviouslyGrantedAccess,
0i64,
(_UNICODE_STRING *)Privileges,
v44,
(_ETHREAD *)&ObjectTypeName,
(UINT8)Thread);
if( !v53 )
goto LABEL_299;
}
IopIncrementVpbRefCount(v51, 1u);
}
if( (v14[38] & 1) != 0 )
{
if( v51 )
{
DeviceObject = v51->DeviceObject;
TargetDeviceObject = DeviceObject;
}
v54 = HIDWORD(status);
LOBYTE(v54) = BYTE4(status) | 2;
HIDWORD(status) = v54;
}
else
{
LOBYTE(v54) = BYTE4(status);
}
}
Characteristics = v17->Characteristics;
if( (Characteristics & 0x40001) != 0
&& (v17->Flags & 0x600100) == 0
&& (Characteristics & 0x100) == 0
&& IopIsSecurityContextAppContainer((_SECURITY_SUBJECT_CONTEXT *)AccessStatea + 1) )
{
if( !v51 )
goto LABEL_299;
if( (v51->DeviceObject->Flags & 0x20000) == 0 )
{
IopDereferenceVpbAndFree(v51);
LABEL_299:
IopDecrementDeviceObjectRef(v17, 0, 0);
return -1073741790;
}
}
if( (v54 & 2) != 0 )
{
v59 = (v54 & 8) != 0;
v60 = RemainingName;
LODWORD(status) = IopCheckTopDeviceHint(&TargetDeviceObject, (_OPEN_PACKET *)v14, v59, RemainingName);
if( (int)status < 0 )
{
if( v51 )
IopDereferenceVpbAndFree(v51);
IopDecrementDeviceObjectRef(v17, 0, 0);
return status;
}
DeviceObject = TargetDeviceObject;
}
else
{
v60 = RemainingName;
}
v61 = v14[38];
if( (v61 & 0x10) != 0 )
v14[38] = v61 & 0xFFFFFFEF;
if( ((DeviceObject->Characteristics & 0x100) != 0
|| IopRequireDeviceAccessCheck && (v17->Characteristics & 0x100000) != 0)
&& (v189 || (v14[21] & 1) != 0)
&& (*((_QWORD *)v14 + 5) || v60->Length) )
{
v62 = AccessStatea;
if( !(_BYTE)v164 )
{
*(_QWORD *)&Privileges[3] = 0i64;
LODWORD(PreviouslyGrantedAccess) = v14[22];
IopCreateSecurityCheck(
v17,
DeviceObject,
AccessStatea,
v29,
PreviouslyGrantedAccess,
0i64,
(_UNICODE_STRING *)Privileges,
CompleteName,
(_ETHREAD *)&ObjectTypeName,
(UINT8)Thread);
if( !v63 )
{
IopDecrementDeviceObjectRef(v17, 0, 0);
if( v51 )
IopDereferenceVpbAndFree(v51);
return -1073741790;
}
}
}
else
{
v62 = AccessStatea;
}
Irp = IopAllocateIrpExReturn(DeviceObject, DeviceObject->StackSize, 0, retaddr);
v65 = Irp;
if( !Irp )
{
IopDecrementDeviceObjectRef(*(_DEVICE_OBJECT **)&Privileges[1], 0, 0);
if( v51 )
IopDereferenceVpbAndFree(v51);
return -1073741670;
}
Irp->Tail.Thread = Thread;
v66 = v189;
Irp->RequestorMode = v189;
Irp->Flags = 2180;
*(_QWORD *)&v182 = SecurityQos;
*((_QWORD *)&v182 + 1) = v62;
LODWORD(v183) = v29;
HIDWORD(v183) = v14[16];
v67 = Irp->Tail.CurrentStackLocation - 1;
v179 = v67;
v67->Control = 0;
v68 = v14[30];
v69 = Attributes;
if( v68 )
{
v67->MajorFunction = v68 == 1 ? 1 : 19;
*(_QWORD *)&v67->Parameters.EaLength = *((_QWORD *)v14 + 16);
}
else
{
v67->MajorFunction = 0;
v67->Parameters.EaLength = v14[20];
v70 = *((_BYTE *)v14 + 84);
v67->Flags = v70;
if( (v69 & 0x40) == 0 )
v67->Flags = v70 | 0x80;
}
v65->Overlay.UserApcRoutine = (void(__fastcall *)(void *, _IO_STATUS_BLOCK *, unsigned int))*((_QWORD *)v14 + 7);
v65->AssociatedIrp.MasterIrp = (_IRP *)*((_QWORD *)v14 + 9);
v67->Parameters.Options = (v14[22] << 24) | v14[16] & 0xFFFFFF;
v67->Parameters.FileAttributes = *((_WORD *)v14 + 34);
v67->Parameters.ShareAccess = *((_WORD *)v14 + 35);
v67->Parameters.SecurityContext = (_IO_SECURITY_CONTEXT *)&v182;
v65->UserBuffer = (void *)*((_QWORD *)v14 + 21);
v65->UserIosb = (_IO_STATUS_BLOCK *)BugCheckParameter4;
v65->MdlAddress = 0i64;
v65->PendingReturned = 0;
v65->Cancel = 0;
v65->UserEvent = 0i64;
v65->CancelRoutine = 0i64;
v65->Tail.AuxiliaryBuffer = 0i64;
if( *((_BYTE *)v14 + 137) )
break;
LODWORD(GrantedAccess) = v29;
LOBYTE(PreviouslyGrantedAccess) = v66;
v71 = *(_DEVICE_OBJECT **)&Privileges[1];
LODWORD(status) = IopAllocRealFileObject(
&FileObject,
DeviceObject,
*(_DEVICE_OBJECT **)&Privileges[1],
v69,
PreviouslyGrantedAccess,
(_OPEN_PACKET *)v14,
ExtendedParameters,
0,
(UINT64)GrantedAccess);
if( (int)status < 0 )
{
IoFreeIrp(v65);
IopDecrementDeviceObjectRef(v71, 0, 0);
if( v51 )
IopDereferenceVpbAndFree(v51);
v127 = FileObject;
if( FileObject )
{
FileObject->DeviceObject = 0i64;
HalPutDmaAdapter((PADAPTER_OBJECT)v127);
result = status;
v14[4] = status;
return result;
}
goto LABEL_412;
}
v72 = FileObject;
LABEL_189:
if( (status & 0x800000000i64) != 0 )
v72->Flags |= 0x800u;
v65->Tail.OriginalFileObject = v72;
v67->FileObject = v72;
v85 = RemainingName->Length;
if( RemainingName->Length )
{
if( v85 >= 0x38u )
{
if( v85 >= 0x78u )
{
if( v85 < 0xF8u )
v85 = 248;
}
else
{
v85 = 120;
}
}
else
{
v85 = 56;
}
v72->FileName.MaximumLength = v85;
PoolWithTag = ExAllocatePoolWithTag(1ui64, v85, 1833856841i64);
v72->FileName.Buffer = (wchar_t *)PoolWithTag;
if( !PoolWithTag )
{
IoFreeIrp(v65);
IopDecrementDeviceObjectRef(v71, 0, 0);
if( v51 )
IopDereferenceVpbAndFree(v51);
v72->DeviceObject = 0i64;
if( !*((_BYTE *)v14 + 137) )
{
HalPutDmaAdapter((PADAPTER_OBJECT)v72);
return -1073741670;
}
return -1073741670;
}
}
RtlCopyUnicodeString(&v72->FileName, RemainingName);
if( *((_BYTE *)v14 + 137) )
{
LOBYTE(v187) = 0;
PreviouslyGrantedAccessa = (__int64 *)&v187;
LOBYTE(v87) = IopQueryInformation((UINT64)v14);
LODWORD(status) = v87;
if( v87 < 0 || (_BYTE)v187 )
{
v131 = v65->IoStatus.Status;
v14[4] = v131;
*((_QWORD *)v14 + 3) = v65->IoStatus.Information;
if( v131 == 260 )
{
AuxiliaryBuffer = v65->Tail.AuxiliaryBuffer;
if( AuxiliaryBuffer )
{
ExFreePoolWithTag(AuxiliaryBuffer, 0);
v65->Tail.AuxiliaryBuffer = 0i64;
*((_QWORD *)v14 + 5) = 0i64;
}
}
if( v72->FileName.Length )
ExFreePoolWithTag(v72->FileName.Buffer, 0);
if( v72->FileObjectExtension )
IopDeleteFileObjectExtension((_UNICODE_STRING *)v72, v88);
v130 = *(_DEVICE_OBJECT **)&Privileges[1];
goto LABEL_334;
}
if( !(unsigned __int8)RtlEqualUnicodeString(&v72->FileName, RemainingName, 0) )
{
Buffer = v72->FileName.Buffer;
if( Buffer )
{
ExFreePoolWithTag(Buffer, 0);
RtlInitUnicodeString(&v72->FileName, 0i64);
}
v90 = RemainingName->Length;
if( RemainingName->Length )
{
if( v90 >= 0x38u )
{
if( v90 >= 0x78u )
{
if( v90 < 0xF8u )
v90 = 248;
}
else
{
v90 = 120;
}
}
else
{
v90 = 56;
}
v72->FileName.MaximumLength = v90;
v91 = ExAllocatePoolWithTag(1ui64, v90, 1833856841i64);
v72->FileName.Buffer = (wchar_t *)v91;
if( !v91 )
{
if( v72->FileObjectExtension )
IopDeleteFileObjectExtension((_UNICODE_STRING *)v72, v92);
IopDecrementDeviceObjectRef(*(_DEVICE_OBJECT **)&Privileges[1], 0, 0);
if( v51 )
IopDereferenceVpbAndFree(v51);
IoFreeIrp(v65);
return -1073741670;
}
RtlCopyUnicodeString(&v72->FileName, RemainingName);
}
}
LODWORD(GrantedAccess) = DesiredAccess;
LOBYTE(PreviouslyGrantedAccessa) = v189;
v93 = *(_DEVICE_OBJECT **)&Privileges[1];
LODWORD(status) = IopAllocRealFileObject(
&FileObject,
DeviceObject,
*(_DEVICE_OBJECT **)&Privileges[1],
(unsigned int)Attributes,
PreviouslyGrantedAccessa,
(_OPEN_PACKET *)v14,
ExtendedParameters,
1u,
(UINT64)GrantedAccess);
if( (int)status < 0 )
{
v129 = FileObject;
if( FileObject->FileName.Length )
ExFreePoolWithTag(FileObject->FileName.Buffer, 0);
if( v129->FileObjectExtension )
IopDeleteFileObjectExtension((_UNICODE_STRING *)v129, v94);
v130 = v93;
LABEL_334:
IopDecrementDeviceObjectRef(v130, 0, 0);
if( v51 )
IopDereferenceVpbAndFree(v51);
IoFreeIrp(v65);
return status;
}
v72 = FileObject;
v67->FileObject = FileObject;
v65->Tail.OriginalFileObject = v72;
}
if( !v14[30] )
{
ExtraCreateParameter = 0i64;
LODWORD(status) = IoGetIrpExtraCreateParameter(v65, &ExtraCreateParameter);
if( ExtraCreateParameter )
{
if( IopSymlinkGetECP(ExtraCreateParameter, &SymlinkInfo) != -1073741275 )
{
MostRecentlyUsedName = IopSymlinkGetMostRecentlyUsedName((_RELATIVE_SYMLINK_INFO *)SymlinkInfo);
if( !MostRecentlyUsedName->DeviceNameLength )
{
updated = IopSymlinkUpdateECP(
v65,
MostRecentlyUsedName,
MostRecentlyUsedName->ExposedNamespaceLength,
CompleteName,
CompleteName->Length - RemainingName->Length,
MostRecentlyUsedName->Flags);
LODWORD(status) = updated;
if( updated < 0 )
{
v65->IoStatus.Status = updated;
v65->IoStatus.Information = 0i64;
BYTE4(status) &= ~4u;
}
}
}
}
}
v97 = (_KSEMAPHORE *)&v72->gap80[24];
KeInitializeEvent((INT64)&v72->gap80[24], 0, 0);
*((_QWORD *)v14 + 1) = v72;
v98 = BYTE4(status);
if( (status & 0x400000000i64) != 0 )
{
IopQueueThreadIrp(v65);
IoCallDriverWithTracing(DeviceObject, v65);
LODWORD(status) = v99;
v98 = BYTE4(status);
}
else
{
v99 = status;
}
if( v99 == 259 )
{
v100 = v98 | 0x80;
v101 = v98 & 0x7F;
if( (KeGetCurrentThread()->$66B5187701DB455CD8F8862345C5A268::$BF47041B248301F87E570BEB78208C5A::_bf_0 & 0x400) == 0 )
v101 = v100;
HIDWORD(status) = v101;
v102 = (unsigned __int8)v101 >> 7;
LODWORD(status) = KeWaitForSingleObject((UINT64)v97, 0, 0, (unsigned __int8)v101 >> 7, 0i64);
if( (_DWORD)status == 257 )
{
while( 1 )
{
CurrentIrql = KeGetCurrentIrql();
__writecr8(1ui64);
if( PsIsThreadTerminating((INT64)KeGetCurrentThread()) )
break;
KeReadStateSemaphore(v97);
if( !v104 )
{
if( v65->Cancel )
break;
}
__writecr8(CurrentIrql);
LODWORD(status) = KeWaitForSingleObject((UINT64)v97, 0, 0, v102, 0i64);
if( (_DWORD)status != 257 )
goto LABEL_235;
}
__writecr8(CurrentIrql);
IopCancelAlertedRequest(v97, v65);
}
LABEL_235:
LODWORD(status) = BugCheckParameter4[0];
v72 = FileObject;
}
LODWORD(status) = IoGetIrpExtraCreateParameter(v65, &EcpList);
v105 = v14[21] & 8;
v106 = v105 != 0;
v107 = EcpList;
if( v65->IoStatus.Status == 260 )
{
v172 = (INT64)v65->Tail.AuxiliaryBuffer;
if( !EcpList || IopSymlinkGetECP(EcpList, &SymlinkInfo) == -1073741275 )
{
LODWORD(status) = IopSymlinkCreateECP(
v65,
v72,
CompleteName,
CompleteName->Length - RemainingName->Length,
(_RELATIVE_SYMLINK_INFO **)&SymlinkInfo);
if( (int)status >= 0 )
{
if( !v107 )
{
LODWORD(status) = IoGetIrpExtraCreateParameter(v65, &EcpList);
v107 = EcpList;
}
}
else
{
v65->IoStatus.Information = 0i64;
v65->IoStatus.Status = status;
}
}
if( v65->IoStatus.Status == 260 )
{
v108 = (_REPARSE_DATA_BUFFER *)v172;
if( v105 && v107 )
v106 = IopCheckAndUpdateStopOnSymlinkEcp(v107, LODWORD(v65->IoStatus.Information), v172);
IopSymlinkProcessReparse(v65, v72, v108, v106, (INT64)PreviouslyGrantedAccess);
v109 = v65->IoStatus.Information - 2684354563u;
if( v109 <= 0x16 )
{
v110 = 4194817i64;
if( _bittest64(&v110, v109) )
{
v111 = (void *)v172;
v112 = *(unsigned __int16 *)(v172 + 6);
v113 = 0;
if( !(_WORD)v112 )
v113 = 16;
v114 = HIDWORD(status);
LOBYTE(v114) = v113 | BYTE4(status) & 0xEF;
HIDWORD(status) = v114;
if( (v114 & 0x10) == 0 && *(wchar_t *)((char *)RemainingName->Buffer + RemainingName->Length - v112) != 58 )
goto LABEL_262;
v115 = v14[16];
if( (v115 & 0x41) != 0 || v179->MajorFunction )
goto LABEL_262;
if( *(_DWORD *)v172 == -1610612733 )
goto LABEL_260;
if( *(_DWORD *)v172 != -1610612724 )
goto LABEL_262;
if( *(int *)(v172 + 16) < 0 )
{
LABEL_260:
v116 = v115 | 1;
LABEL_261:
v14[16] = v116;
}
else if( (*(_DWORD *)(v172 + 16) & 0x40000000) != 0 )
{
v116 = v115 | 0x40;
goto LABEL_261;
}
LABEL_262:
if( !v106 )
{
ExFreePoolWithTag(v111, 0);
v172 = 0i64;
}
}
}
}
}
if( v65->IoStatus.Status || v14[30] )
{
v117 = TargetDeviceObject;
}
else
{
LODWORD(status) = IopSymlinkPropagateToExtensionIfNeeded(v72, v107, CompleteName);
v117 = TargetDeviceObject;
if( (int)status < 0 )
{
IoCancelFileOpen((UINT64)TargetDeviceObject, (INT64)v72);
v65->IoStatus.Information = 0i64;
v65->IoStatus.Status = status;
}
}
if( v107 )
*((_QWORD *)v14 + 21) = v107;
*(_IO_STATUS_BLOCK *)BugCheckParameter4 = v65->IoStatus;
LODWORD(status) = _mm_cvtsi128_si32(*(__m128i *)BugCheckParameter4);
*(_DWORD *)&v72->gap80[28] = 1;
v11 = HIDWORD(status);
if( (status & 0x400000000i64) != 0 )
{
v65->Tail.Thread = Thread;
IopDequeueIrpFromThread(v65);
}
if( (v65->Flags & 0x30) == 48 )
ExFreePoolWithTag(v65->AssociatedIrp.MasterIrp, 0);
IoFreeIrp(v65);
v118 = (unsigned __int64)BugCheckParameter4[1];
*((PVOID *)v14 + 3) = BugCheckParameter4[1];
if( (int)status < 0 )
{
if( (v72->Flags & 0x200000) != 0 )
{
HalPutDmaAdapter((PADAPTER_OBJECT)v72);
*((_QWORD *)v14 + 1) = 0i64;
result = status;
v14[4] = status;
return result;
}
if( v72->FileName.Length )
{
ExFreePoolWithTag(v72->FileName.Buffer, 0);
v72->FileName.Length = 0;
}
v72->DeviceObject = 0i64;
HalPutDmaAdapter((PADAPTER_OBJECT)v72);
IopDecrementDeviceObjectRef(*(_DEVICE_OBJECT **)&Privileges[1], 0, 0);
if( Vpb )
IopDereferenceVpbAndFree(Vpb);
*((_QWORD *)v14 + 1) = 0i64;
goto LABEL_412;
}
if( (_DWORD)status != 260 )
{
LODWORD(v141) = IoGetRelatedDeviceObject((INT64)v72);
v143 = v141;
if( v117 != v141 )
{
v144 = v72->Vpb;
v145 = Vpb;
if( v144 != Vpb )
{
if( v144 )
IopIncrementVpbRefCount(v144, 1u);
if( v145 )
IopDereferenceVpbAndFree(v145);
}
}
if( (status & 0x4000000000i64) == 0 )
{
*Object = v72;
v14[8] = -1096154543;
ObfReferenceObject(v72);
RelatedFileObject = v72->RelatedFileObject;
if( (!RelatedFileObject || (RelatedFileObject->Flags & 0x400000) != 0) && !v72->FileName.Length )
{
DeviceType = v143->DeviceType;
if( (unsigned int)DeviceType <= 0x20 )
{
v148 = 0x100000308i64;
if( _bittest64(&v148, DeviceType) )
v72->Flags |= 0x400000u;
}
}
result = (NTSTATUS)BugCheckParameter4[0];
v14[4] = (unsigned int)BugCheckParameter4[0];
return result;
}
if( *((_BYTE *)v14 + 137) )
{
if( *((_BYTE *)v14 + 208) )
{
FileInformation = IoQueryFileInformation(
v72,
(_FILE_INFORMATION_CLASS)v14[50],
v14[51],
*((VOID **)v14 + 14),
(UINT64 *)(v14 + 51));
goto LABEL_403;
}
v150 = 0;
FastIoDispatch = v143->DriverObject->FastIoDispatch;
if( *((_BYTE *)v14 + 139) )
{
if( FastIoDispatch )
{
if( FastIoDispatch->SizeOfFastIoDispatch > 0x70 )
{
FastIoQueryNetworkOpenInfo = FastIoDispatch->FastIoQueryNetworkOpenInfo;
if( FastIoQueryNetworkOpenInfo )
{
v157 = (MmVerifierData & 0x10) != 0 ? VfFastIoSnapState() : 0i64;
LOBYTE(v142) = 1;
v150 = FastIoQueryNetworkOpenInfo(
v72,
v142,
*((_FILE_NETWORK_OPEN_INFORMATION **)v14 + 13),
(_IO_STATUS_BLOCK *)BugCheckParameter4,
v143);
if( v157 )
VfFastIoCheckState(v157, FastIoQueryNetworkOpenInfo);
}
}
}
if( !v150 )
{
v158 = IoQueryFileInformation(
v72,
FileNetworkOpenInformation,
0x38ui64,
*((VOID **)v14 + 13),
(UINT64 *)&ReturnedLength);
LODWORD(status) = v158;
if( v158 == -1073741811 || v158 == -1073741822 )
{
FileInformation = IopGetNetworkOpenInformation(v72, (_OPEN_PACKET *)v14);
LABEL_403:
LODWORD(status) = FileInformation;
}
}
}
else
{
v152 = 0i64;
SymlinkInfo = 0i64;
if( FastIoDispatch )
FastIoQueryBasicInfo = FastIoDispatch->FastIoQueryBasicInfo;
else
FastIoQueryBasicInfo = 0i64;
v187 = FastIoQueryBasicInfo;
if( FastIoQueryBasicInfo )
{
v154 = (MmVerifierData & 0x10) != 0 ? VfFastIoSnapState() : 0i64;
v184 = v154;
LOBYTE(v152) = 1;
v150 = FastIoQueryBasicInfo(
v72,
v152,
*((_FILE_BASIC_INFORMATION **)v14 + 12),
(_IO_STATUS_BLOCK *)BugCheckParameter4,
v143);
v170 = v150;
if( v154 )
VfFastIoCheckState(v154, FastIoQueryBasicInfo);
}
if( v150 )
{
LODWORD(status) = BugCheckParameter4[0];
}
else
{
Pool_1 = IopVerifierExAllocatePool_1(0x200ui64, 0x28ui64);
SymlinkInfo = Pool_1;
if( Pool_1 )
{
LODWORD(status) = IoQueryFileInformation(
v72,
FileBasicInformation,
0x28ui64,
Pool_1,
(UINT64 *)&ReturnedLength);
if( (int)status >= 0 )
memmove(*((VOID **)v14 + 12), Pool_1, ReturnedLength);
ExFreePoolWithTag(Pool_1, 0);
}
else
{
LODWORD(status) = -1073741670;
}
}
}
}
v14[8] = -1096154543;
IopCloseFile(0i64, v72, 1ui64, (UINT8 *)1);
HalPutDmaAdapter((PADAPTER_OBJECT)v72);
*((_QWORD *)v14 + 1) = 0i64;
result = status;
v14[4] = status;
return result;
}
if( (v118 & 0xFFFFFFFFFFFFFFFDui64) != 0
&& ((v119 = v118 - 2684354563u, v118 - 2684354563u > 0x16) || (v120 = 4194817i64, !_bittest64(&v120, v119))
|| v106) )
{
v121 = CompleteName;
}
else
{
v121 = CompleteName;
if( CompleteName->MaximumLength < v72->FileName.Length )
{
v122 = ExAllocatePoolWithTag(1ui64, v72->FileName.Length, 1665560393i64);
if( !v122 )
{
v14[4] = -1073741670;
return -1073741670;
}
v123 = v121->Buffer;
if( v123 )
ExFreePoolWithTag(v123, 0);
v121->Buffer = (wchar_t *)v122;
v121->MaximumLength = v72->FileName.Length;
}
RtlCopyUnicodeString(v121, &v72->FileName);
if( (unsigned __int64)BugCheckParameter4[1] - 2684354563u <= 0x16 )
{
v124 = 4194817i64;
if( _bittest64(&v124, (unsigned __int64)BugCheckParameter4[1] - 2684354563u) )
*((_QWORD *)v14 + 5) = 0i64;
}
}
if( v72->FileName.Length )
{
ExFreePoolWithTag(v72->FileName.Buffer, 0);
v72->FileName.Length = 0;
}
v72->DeviceObject = 0i64;
HalPutDmaAdapter((PADAPTER_OBJECT)v72);
*((_QWORD *)v14 + 1) = 0i64;
v125 = *(_QWORD *)&Privileges[1];
IopDecrementDeviceObjectRef(*(_DEVICE_OBJECT **)&Privileges[1], 0, 0);
if( Vpb )
IopDereferenceVpbAndFree(Vpb);
v126 = (char *)BugCheckParameter4[1];
if( BugCheckParameter4[1] != (PVOID)1 )
{
*((_QWORD *)v14 + 5) = 0i64;
v133 = 4194817i64;
if( (unsigned __int64)(v126 - 2684354563i64) <= 0x16
&& _bittest64(&v133, (unsigned __int64)(v126 - 2684354563i64)) )
{
v14[38] |= 0x10u;
v134 = v14[38];
v135 = *(unsigned int *)(v125 + 72);
if( (unsigned int)v135 <= 0x24 && (v136 = 0x1080020084i64, _bittest64(&v136, v135)) )
v137 = v134 | 8;
else
v137 = v134 & 0xFFFFFFF7;
v14[38] = v137;
}
if( *((_BYTE *)v14 + 136) )
KeBugCheckEx(0xF9u, (PVOID)v125, TargetDeviceObject, v121, v126);
if( (*(_DWORD *)(*(_QWORD *)(v125 + 312) + 32i64) & 0x800) == 0 )
{
v138 = AccessStatea;
*((_QWORD *)AccessStatea + 2) = *((unsigned int *)AccessStatea + 6);
*((_DWORD *)v138 + 3) &= ~0x100u;
}
if( (unsigned __int64)(v126 - 2684354563i64) <= 0x16
&& _bittest64(&v133, (unsigned __int64)(v126 - 2684354563i64))
&& v106 )
{
*((_QWORD *)v14 + 3) = v172;
v14[4] = -2147483603;
return -2147483603;
}
else if( v126 == (char *)2684354585i64 || v126 == (char *)2 )
{
v139 = ExtendedParameters;
LODWORD(v140) = PsGetParentSilo((INT64)ExtendedParameters->Silo);
v139->Silo = v140;
return 872;
}
else
{
return 260;
}
}
if( (unsigned int)++v174 > 0x20 )
return -1073741823;
*Object = 0i64;
FileObject = 0i64;
v12 = AccessStatea;
v13 = (unsigned int *)ParseObject;
}
v73 = (_QWORD *)*((_QWORD *)v14 + 18);
memset(v73, 0i64, 0x110u);
v72 = (_FILE_OBJECT *)(v73 + 6);
FileObject = (_FILE_OBJECT *)(v73 + 6);
*((_BYTE *)v73 + 24) = ObHeaderCookie ^ *((_BYTE *)IoFileObjectType + 40) ^ BYTE1(v73);
*v73 = 1i64;
if( (Attributes & 0x40) == 0 )
*((_DWORD *)v73 + 32) |= 0x20000u;
*(_DWORD *)&v72->Type = 14155781;
v73[14] = *((_QWORD *)v14 + 5);
v71 = *(_DEVICE_OBJECT **)&Privileges[1];
v72->DeviceObject = *(_DEVICE_OBJECT **)&Privileges[1];
if( (v14[38] & 0x20) == 0
|| !v189
|| (DeviceObject->Flags & 0x40000) == 0
&& ((v74 = DeviceObject->DeviceType, (unsigned int)v74 > 0x35) || (v75 = 0x20000100100108i64, !_bittest64(&v75, v74)))
|| (LODWORD(status) = IopRetrieveTransactionParameters(
DeviceObject,
(_OPEN_PACKET *)v14,
(unsigned int)DesiredAccess,
v72),
(int)status >= 0) )
{
if( !PsIsHostSilo(ExtendedParameters->Silo)
|| (v76 = (INT64)v72->RelatedFileObject) != 0 && (LODWORD(v77) = IoGetSilo(v76), !PsIsHostSilo(v77)) )
{
TypeExt = 0i64;
p_Type = (INT32 *)&v72->RelatedFileObject->Type;
if( p_Type && (PsIsServerSilo((INT64)ExtendedParameters->Silo, p_Type), v80) )
{
LODWORD(v81) = IoGetSilo(v79);
Silo = v81;
}
else
{
Silo = ExtendedParameters->Silo;
}
if( !PsIsHostSilo(Silo) )
{
LODWORD(status) = PsAcquireSiloHardReference(Silo);
if( (int)status < 0 )
goto LABEL_311;
IopGetSetSpecificExtension(v72, FoExtTypeSilo, 0x10ui64, 1u, &TypeExt, 0i64);
LODWORD(status) = v83;
if( v83 < 0 )
{
PsReleaseSiloHardReference(Silo);
v83 = status;
}
v84 = TypeExt;
if( v83 < 0 )
{
LABEL_311:
IoFreeIrp(v65);
v128 = *(_DEVICE_OBJECT **)&Privileges[1];
goto LABEL_309;
}
*(_DWORD *)TypeExt = 16;
v84[1] = Silo;
*((_DWORD *)v84 + 1) |= 1u;
ObfReferenceObjectWithTag(Silo, 0x70536F49ui64);
}
v71 = *(_DEVICE_OBJECT **)&Privileges[1];
v67 = v179;
}
goto LABEL_189;
}
IoFreeIrp(v65);
v128 = v71;
LABEL_309:
IopDecrementDeviceObjectRef(v128, 0, 0);
if( v51 )
{
IopDereferenceVpbAndFree(v51);
result = status;
v14[4] = status;
return result;
}
LABEL_412:
result = status;
LABEL_413:
v14[4] = result;
return result;
}Referenced by:
IopParseFile