PsDispatchIumService
void __fastcall PsDispatchIumService(INT64 a1, int a2, __int64 a3, UINT64 a4){
void(__fastcall *v5)(const _GUID *, unsigned int, unsigned __int8, INT64, unsigned __int64, _EVENT_FILTER_DESCRIPTOR *, void *);
unsigned int v6;
unsigned int v7;
unsigned int v8;
unsigned int v9;
unsigned int v10;
int PartitionState;
__int64 v12;
unsigned int v13;
unsigned int v14;
unsigned int v15;
unsigned int v16;
_ETHREAD *CurrentThread;
_EPROCESS *v18;
_EPROCESS *v19;
unsigned __int64 v20;
NTSTATUS VirtualMemory;
NTSTATUS v22;
unsigned int v23;
unsigned int v24;
unsigned int v25;
unsigned int v26;
_EPROCESS *Process;
_EPROCESS *v28;
NTSTATUS v29;
_EPROCESS *v30;
void *v31;
unsigned int v32;
unsigned int v33;
unsigned int v34;
_LPCGUID v35;
unsigned int v36;
unsigned int v37;
unsigned int v38;
unsigned int v39;
_MDL *v40;
_MDL *v41;
VOID **PoolWithTag;
_MDL *v43;
__int16 MdlFlags;
_MDL *v45;
NTSTATUS SecurePool;
INT64 v47;
UINT64 v48;
unsigned int v49;
unsigned int v50;
unsigned int v51;
unsigned int v52;
unsigned __int64 v53;
unsigned int v54;
unsigned int v55;
unsigned int v56;
unsigned int v57;
unsigned int v58;
unsigned int v59;
unsigned int v60;
INT64 a5;
PFN_WDFDEVICEWDMDISPATCHPREPROCESSEDIRP *DeviceObject;
INT64 UserDataCount;
UINT64 AllocationType;
UINT64 Win32Protect;
char OldIrql[8];
unsigned __int64 RegHandle[2];
__int128 v68;
__int128 v69;
__int64 v70;
_KAPC_STATE ApcState;
_DBGKM_APIMSG DbgMsg[68];
__int128 v73[5];
__int64 v74;
int v75;
__int16 v76;
char v77;
RegHandle[1] = a1;
memset(&ApcState, 0, sizeof(ApcState));
v5 = 0i64;
OldIrql[0] = 0;
v68 = 0i64;
v69 = 0i64;
v70 = 0i64;
if( *(_BYTE *)(a1 + 1) == 5 )
{
if( *(_QWORD *)(a1 + 8) )
ZwTerminateProcess((VOID *)0xFFFFFFFFFFFFFFFFi64, *(_DWORD *)(a1 + 16));
else
PspTerminateThreadByPointer(KeGetCurrentThread(), 0i64, 1u);
}
v6 = *(unsigned __int16 *)(a1 + 2);
if( v6 > 0x17 )
{
if( v6 > 0x23 )
{
if( v6 <= 0x29 )
{
if( v6 == 41 )
{
MmUpdateSlabRangeProtection(*(PVOID *)(a1 + 8), *(PVOID *)(a1 + 16), (PVOID)*(unsigned int *)(a1 + 24));
return;
}
v54 = v6 - 36;
if( !v54 )
{
HalPutDmaAdapter(*(PADAPTER_OBJECT *)(a1 + 8));
return;
}
v55 = v54 - 1;
if( !v55 )
{
KeSetEvent(*(PRKEVENT *)(a1 + 8), 0, 0);
return;
}
v56 = v55 - 1;
if( v56 )
{
v57 = v56 - 1;
if( v57 )
{
if( v57 == 1 )
{
PsTerminateVsmEnclave(*(_QWORD *)(a1 + 8), 0x80000000);
return;
}
goto LABEL_139;
}
*(_QWORD *)(a1 + 24) = 0i64;
if( PspIumReplenishPartitionPages(*(_QWORD *)(a1 + 8), *(unsigned int *)(a1 + 16)) )
*(_QWORD *)(a1 + 24) = 1i64;
return;
}
if( !*(_QWORD *)(a1 + 8) )
{
PspIumFreePartitionState(*(PVOID *)(a1 + 16));
return;
}
PartitionState = PspIumAllocatePartitionState(a1);
goto LABEL_22;
}
v58 = v6 - 42;
if( !v58 )
{
ExQueueWorkItem((PWORK_QUEUE_ITEM)&PspStorageBitmap.DeleteCount, DelayedWorkQueue);
return;
}
v59 = v58 - 1;
if( !v59 )
{
PartitionState = PsAdjustBasicEnclaveThreadList(
*(_QWORD *)(a1 + 8),
*(_QWORD *)(a1 + 16),
*(unsigned int *)(a1 + 24));
goto LABEL_22;
}
v60 = v59 - 1;
if( v60 )
{
if( v60 == 1 )
{
MmFreeSecurePoolMemory(*(PVOID *)(a1 + 24), *(PVOID *)(a1 + 32));
return;
}
goto LABEL_139;
}
SecurePool = PspIumAllocateSecurePool(a1);
}
else
{
if( v6 == 35 )
{
PartitionState = PspMapView(a1);
goto LABEL_22;
}
if( v6 > 0x1D )
{
v49 = v6 - 30;
if( v49 )
{
v50 = v49 - 1;
if( v50 )
{
v51 = v50 - 1;
if( v51 )
{
v52 = v51 - 1;
if( !v52 )
{
LODWORD(a5) = *(_DWORD *)(a1 + 40);
DbgkPostModuleMessage(
*(_EPROCESS **)(a1 + 8),
*(_ETHREAD **)(a1 + 16),
*(PVOID *)(a1 + 24),
*(_DWORD *)(a1 + 32),
a5,
*(_QWORD *)(a1 + 48));
return;
}
if( v52 == 1 )
{
DbgkMapViewOfSection(*(_EPROCESS **)(a1 + 8), *(VOID **)(a1 + 16), *(VOID **)(a1 + 24), a4, a5);
return;
}
goto LABEL_139;
}
if( *(_QWORD *)(a1 + 8) )
{
MmLockLoadedModuleListExclusive((UINT8 *)OldIrql);
}
else
{
v53 = *(unsigned __int8 *)(a1 + 16);
ExReleaseSpinLockExclusiveFromDpcLevel(&PsLoadedModuleSpinLock);
__writecr8(v53);
}
return;
}
PartitionState = MmUnmapViewOfSection((_EPROCESS *)PsSecureSystemProcess, *(VOID **)(a1 + 8));
}
else
{
LODWORD(Win32Protect) = 2;
LODWORD(AllocationType) = 0x40000;
PartitionState = MmMapViewOfSection(
*(VOID **)(a1 + 8),
(_EPROCESS *)PsSecureSystemProcess,
(VOID **)(a1 + 16),
0i64,
0i64,
(_LARGE_INTEGER *)(a1 + 24),
(UINT64 *)(a1 + 32),
ViewUnmap,
AllocationType,
Win32Protect);
}
goto LABEL_22;
}
if( v6 == 29 )
{
v47 = *(_QWORD *)(a1 + 24);
v48 = *(_QWORD *)(a1 + 8);
if( v47 )
MmMapHotPatchTablePage(v48, *(_QWORD *)(a1 + 16), v47);
else
MmChangeKernelCfgBitmap(v48);
return;
}
v36 = v6 - 24;
if( !v36 )
{
PartitionState = HvlpDepositPages(0);
goto LABEL_22;
}
v37 = v36 - 1;
if( v37 )
{
v38 = v37 - 1;
if( v38 )
{
v39 = v38 - 1;
if( !v39 )
{
PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x38ui64, 1684827469i64);
v43 = (_MDL *)PoolWithTag;
if( PoolWithTag )
{
*PoolWithTag = 0i64;
*((_DWORD *)PoolWithTag + 2) = 56;
PoolWithTag[4] = 0i64;
PoolWithTag[5] = (VOID *)4096;
PoolWithTag[6] = *(VOID **)(a1 + 8);
*((_WORD *)PoolWithTag + 5) |= 2u;
MdlFlags = *((_WORD *)PoolWithTag + 5);
if( (MdlFlags & 5) == 0 )
{
LODWORD(DeviceObject) = 1073741840;
LODWORD(a5) = 0;
MmMapLockedPagesSpecifyCache(v43, 0, MmCached, 0i64, a5, (UINT64)DeviceObject);
MdlFlags = v43->MdlFlags;
}
if( (MdlFlags & 1) != 0 )
{
*(_QWORD *)(a1 + 8) = 0i64;
*(_QWORD *)(a1 + 16) = v43;
*(_QWORD *)(a1 + 24) = v43->MappedSystemVa;
return;
}
ExFreePoolWithTag(v43, 0);
}
v12 = 3221225626i64;
LABEL_25:
*(_QWORD *)(a1 + 8) = v12;
return;
}
if( v39 != 1 )
goto LABEL_139;
v40 = *(_MDL **)(a1 + 8);
MmUnmapLockedPages(v40->MappedSystemVa, v40);
v41 = v40;
}
else
{
LODWORD(v45) = VslFreePoolTransferObject(*(PVOID *)(a1 + 8));
v41 = v45;
}
ExFreePoolWithTag(v41, 0);
return;
}
SecurePool = VslAllocatePool(*(_QWORD *)(a1 + 8), *(_DWORD *)(a1 + 16), a1 + 16);
}
*(_DWORD *)(a1 + 8) = SecurePool;
return;
}
if( v6 == 23 )
{
VslHandleKsrCall(a1);
return;
}
if( v6 > 0xC )
{
if( v6 <= 0x12 )
{
if( v6 == 18 )
{
RegHandle[0] = 0i64;
v31 = *(void **)(a1 + 24);
if( v31 )
v5 = VslIumEtwEnableCallback;
*(_QWORD *)(a1 + 8) = (int)EtwRegister((int)a1 + 8, (PETWENABLECALLBACK)v5, v31, RegHandle);
*(_QWORD *)(a1 + 16) = RegHandle[0];
return;
}
v23 = v6 - 13;
if( v23 )
{
v24 = v23 - 1;
if( !v24 )
{
Process = KeGetCurrentThread()->ApcState.Process;
v28 = *(_EPROCESS **)(a1 + 8);
if( Process != v28 )
{
KiStackAttachProcess(v28, 0i64, &ApcState);
v28 = *(_EPROCESS **)(a1 + 8);
}
LODWORD(a5) = *(_DWORD *)(a1 + 40);
v29 = MmProtectVirtualMemory(
*(PFN_WDFDRIVERERRORREPORTAPIMISSING **)(a1 + 16),
(PFN_WDFDRIVERERRORREPORTAPIMISSING *)v28,
(PFN_WDFDEVICEWDMDISPATCHPREPROCESSEDIRP **)(a1 + 24),
(_XSTATE_FEATURE **)(a1 + 32),
a5,
(PFN_WDFDEVICEWDMDISPATCHPREPROCESSEDIRP *)(a1 + 40));
if( Process != *(_EPROCESS **)(a1 + 8) )
KiUnstackDetachProcess(&ApcState, 0i64);
*(_DWORD *)(a1 + 8) = v29;
return;
}
v25 = v24 - 1;
if( !v25 )
{
LOBYTE(v12) = DbgkpSuspendProcess(*(_EPROCESS **)(a1 + 8));
goto LABEL_24;
}
v26 = v25 - 1;
if( !v26 )
{
DbgkpResumeProcess(*(_QWORD *)(a1 + 8));
return;
}
if( v26 != 1 )
goto LABEL_139;
memset(DbgMsg, 0i64, sizeof(DbgMsg));
PartitionState = DbgkpSendErrorMessage(
*(_EXCEPTION_RECORD **)(a1 + 8),
(_DBGKM_APIMSG *)*(unsigned int *)(a1 + 16),
DbgMsg);
goto LABEL_22;
}
v18 = KeGetCurrentThread()->ApcState.Process;
v30 = *(_EPROCESS **)(a1 + 8);
if( v18 != v30 )
KiStackAttachProcess(v30, 0i64, &ApcState);
LODWORD(DeviceObject) = 0x10000000;
VirtualMemory = MmFreeVirtualMemory(
-1i64,
(UINT64 *)(a1 + 24),
(INT64 *)(a1 + 32),
*(unsigned int *)(a1 + 40),
0,
(INT64)DeviceObject);
LABEL_42:
v22 = VirtualMemory;
if( v18 != *(_EPROCESS **)(a1 + 8) )
KiUnstackDetachProcess(&ApcState, 0i64);
*(_DWORD *)(a1 + 8) = v22;
return;
}
v32 = v6 - 19;
if( !v32 )
{
PartitionState = EtwUnregister(*(_QWORD *)(a1 + 8));
goto LABEL_22;
}
v33 = v32 - 1;
if( !v33 )
{
PartitionState = EtwSetInformation(
*(_QWORD *)(a1 + 8),
*(_EVENT_INFO_CLASS *)(a1 + 16),
*(PVOID *)(a1 + 24),
*(_DWORD *)(a1 + 32));
goto LABEL_22;
}
v34 = v33 - 1;
if( !v34 )
{
v35 = a1 + 32;
if( !*(_QWORD *)(a1 + 32) && !*(_QWORD *)(a1 + 40) )
v35 = 0;
if( *(_QWORD *)(a1 + 48) || *(_QWORD *)(a1 + 56) )
LODWORD(v5) = a1 + 48;
PartitionState = EtwWriteEx(
*(_QWORD *)(a1 + 8),
(PCEVENT_DESCRIPTOR)(a1 + 16),
0i64,
0,
v35,
(_LPCGUID)v5,
*(_DWORD *)(a1 + 64),
*(PEVENT_DATA_DESCRIPTOR *)(a1 + 72));
goto LABEL_22;
}
if( v34 == 1 )
{
PartitionState = PspIumVerifyParentSd(*(unsigned int *)(a1 + 8), a2, *(PVOID **)(a1 + 24));
goto LABEL_22;
}
LABEL_139:
PspTerminateThreadByPointer(KeGetCurrentThread(), 0xC0000005ui64, 1u);
return;
}
if( v6 == 12 )
{
v18 = KeGetCurrentThread()->ApcState.Process;
v19 = *(_EPROCESS **)(a1 + 8);
if( v18 != v19 )
KiStackAttachProcess(v19, 0i64, &ApcState);
v20 = *(_QWORD *)(a1 + 48);
if( v20 || *(_QWORD *)(a1 + 56) )
{
*(_QWORD *)&v68 = 1i64;
*((_QWORD *)&v68 + 1) = &v69;
v69 = v20;
v70 = *(_QWORD *)(a1 + 56);
}
VirtualMemory = MmAllocateVirtualMemory(
(PVOID *)0xFFFFFFFFFFFFFFFFi64,
a1 + 24,
(UINT64 *)(a1 + 32),
*(unsigned int *)(a1 + 40));
goto LABEL_42;
}
if( v6 > 6 )
{
v13 = v6 - 7;
if( !v13 )
{
LOBYTE(v12) = KeAlertThreadByThreadId(*(_KTHREAD **)(a1 + 8));
goto LABEL_24;
}
v14 = v13 - 1;
if( v14 )
{
v15 = v14 - 1;
if( !v15 )
{
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
KeLeaveCriticalRegion();
return;
}
v16 = v15 - 1;
if( !v16 )
{
memmove(*(VOID **)(a1 + 8), *(const VOID **)(a1 + 16), *(_DWORD *)(a1 + 24));
*(_QWORD *)(a1 + 8) = 0i64;
return;
}
if( v16 != 1 )
goto LABEL_139;
PartitionState = MmGetSectionStrongImageReference(
*(_QWORD *)(a1 + 8),
*(_BYTE *)(a1 + 24),
0i64,
(unsigned __int64 *)(a1 + 16));
}
else
{
PartitionState = KeWaitForAlertByThreadId(
*(_BYTE *)(a1 + 8),
(_LARGE_INTEGER *)((a1 + 24) & ((unsigned __int128)-(__int128)*(unsigned __int64 *)(a1 + 16) >> 64)),
0i64);
}
LABEL_22:
*(_QWORD *)(a1 + 8) = PartitionState;
return;
}
if( v6 == 6 )
{
LOBYTE(v12) = DbgkForwardException(
*(_EXCEPTION_RECORD **)(a1 + 8),
*(_BYTE *)(a1 + 16),
*(_BYTE *)(a1 + 24),
a4,
a5,
(INT64)DeviceObject,
UserDataCount);
LABEL_24:
v12 = (unsigned __int8)v12;
goto LABEL_25;
}
v7 = v6 - 1;
if( !v7 )
{
PartitionState = PspIumAllocatePhysicalPages(
*(_DWORD *)(a1 + 8),
*(void **)(a1 + 16),
*(_DWORD *)(a1 + 24),
(__int64 *)(a1 + 16),
(_DWORD *)(a1 + 24));
goto LABEL_22;
}
v8 = v7 - 1;
if( !v8 )
{
PspIumFreePhysicalPages(*(_QWORD *)(a1 + 16), *(unsigned int *)(a1 + 24), *(_QWORD *)(a1 + 8));
return;
}
v9 = v8 - 1;
if( v9 )
{
v10 = v9 - 1;
if( !v10 )
{
PspIumGetPhysicalPage(a1);
return;
}
if( v10 == 1 )
{
PspIumGetSystemData();
return;
}
goto LABEL_139;
}
v73[0] = *(_OWORD *)(a1 + 10);
v73[1] = *(_OWORD *)(a1 + 26);
v73[2] = *(_OWORD *)(a1 + 42);
v73[3] = *(_OWORD *)(a1 + 58);
v73[4] = *(_OWORD *)(a1 + 74);
v74 = *(_QWORD *)(a1 + 90);
v75 = *(_DWORD *)(a1 + 98);
v76 = *(_WORD *)(a1 + 102);
v77 = 0;
DbgPrintEx(
0,
0,
*(unsigned __int16 *)(a1 + 8) >> 13,
*(_DWORD *)(a1 + 4),
(*(unsigned __int16 *)(a1 + 8) >> 1) & 0xFFF,
(const char *)v73);
if( (*(_BYTE *)(a1 + 8) & 1) != 0 )
__debugbreak();
}Referenced by:
VslpEnterIumSecureMode