PiCMCreateDevice
NTSTATUS __stdcall PiCMCreateDevice(
VOID *IoctlInputBuffer,
UINT64 IoctlInputBufferSize,
VOID *IoctlOutputBuffer,
UINT64 IoctlOutputBufferSize,
UINT64 *BytesUsed){
unsigned int v6;
VOID **PoolWithTag;
char v8;
size_t v9;
UINT8 *v10;
int DeviceInputData;
NTSTATUS inited;
WCHAR *v13;
char v14;
int v15;
WCHAR *v16;
int v17;
INT64 v18;
_ETHREAD *CurrentThread;
HPNPCTX *v20;
INT64 v21;
INT64 v22;
NTSTATUS v23;
HPNPCTX *v24;
INT64 v25;
INT64 v26;
_ETHREAD *v27;
INT8 PreviousMode;
HPNPCTX *v30;
INT64 v31;
INT64 v32;
_ADAPTER_OBJECT *v33;
INT64 v34;
__int64 v35;
WCHAR *v36;
NTSTATUS DeviceRegProp;
__int64 v38;
int v39;
int DeviceInstanceCsConfigFlags;
char v41;
HPNPCTX *v42;
HPNPCTX *v43;
int v44;
_ETHREAD *v45;
size_t *pcchRemaining;
size_t *pcchRemaininga;
size_t *pcchRemainingb;
UINT8 *dwFlags;
INT64 dwFlagsa;
INT64 dwFlagsb;
VOID **DeviceKey;
VOID **DeviceKeya;
VOID **DeviceKeyb;
UINT64 *Disposition;
UINT64 *Dispositiona;
INT64 v57;
VOID *Created;
UINT8 *v59;
UINT64 PropertySize;
UINT8 PropertyBuffer[4];
INT64 a7;
size_t pcchLength[2];
INT64 a5;
int Data;
INT64 v66;
PADAPTER_OBJECT DmaAdapter;
HPNPOPCTX *hPnpOpCtx;
_UNICODE_STRING DeviceInstance;
WCHAR *PartialDeviceId[2];
WCHAR *SourceString[2];
UINT64 ExpectedOutputSize;
_UNICODE_STRING DestinationString[4];
unsigned int IoctlOutputBufferSizea;
UINT64 *v76;
IoctlOutputBufferSizea = IoctlOutputBufferSize;
ExpectedOutputSize = 0i64;
PropertySize = 0i64;
v6 = IoctlOutputBufferSize;
v66 = 0i64;
*(_DWORD *)v76 = 0;
PoolWithTag = 0i64;
Data = 0;
v8 = 0;
a5 = 0i64;
v9 = 0;
*(_DWORD *)PropertyBuffer = 0;
v10 = 0i64;
DmaAdapter = 0i64;
a7 = 0i64;
hPnpOpCtx = 0i64;
*(_QWORD *)pcchLength = 0i64;
v59 = 0i64;
DeviceInstance = 0i64;
*(_OWORD *)PartialDeviceId = 0i64;
*(_OWORD *)SourceString = 0i64;
DestinationString[0] = 0i64;
DeviceInputData = PiCMCaptureCreateDeviceInputData(
IoctlInputBuffer,
IoctlInputBufferSize,
(_CMAPI_INPUT_CREATE_DEVICE_DATA *)(unsigned int)BytesUsed);
if( DeviceInputData < 0 )
goto LABEL_47;
if( !PiAuDoesClientHaveAccess(2ui64) )
{
inited = -1073741790;
goto LABEL_36;
}
v13 = PartialDeviceId[1];
if( !PartialDeviceId[1] || LODWORD(SourceString[0]) < 2 || !SourceString[1] || (unsigned int)ExpectedOutputSize < 2 )
{
inited = -1073741811;
v10 = 0i64;
goto LABEL_58;
}
if( !IoctlOutputBuffer
|| v6 < 0x14
|| (v14 = BYTE4(PartialDeviceId[0]), (HIDWORD(PartialDeviceId[0]) & 0xFFFFFFF0) != 0) )
{
inited = -1073741811;
LABEL_12:
v10 = 0i64;
goto LABEL_36;
}
v15 = BYTE4(PartialDeviceId[0]) & 2;
if( !CmIsRootDevice(SourceString[1]) )
{
inited = -1073741811;
LABEL_15:
v10 = 0i64;
goto LABEL_36;
}
inited = PiPnpRtlBeginOperation(&hPnpOpCtx);
if( inited < 0 )
goto LABEL_15;
PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x190ui64, 879783504i64);
if( !PoolWithTag )
{
inited = -1073741670;
goto LABEL_12;
}
v17 = v14 & 4;
if( !v17 )
{
inited = CmValidateDeviceName(v16);
goto LABEL_23;
}
inited = PiCMGenerateDeviceInstance(v13, v15 != 0, (WCHAR *)PoolWithTag);
if( !v15 )
{
LABEL_23:
if( inited < 0 )
goto LABEL_15;
if( !v17 )
{
LODWORD(dwFlags) = 2048;
inited = RtlStringCchCopyExW((WCHAR *)PoolWithTag, 0xC8ui64, v13, 0i64, 0i64, (UINT64)dwFlags);
if( inited < 0 )
goto LABEL_15;
}
LODWORD(pcchRemaining) = 131103;
inited = CmOpenDeviceRegKey(
*(&stru_140CF2E80 + 607),
(WCHAR *)PoolWithTag,
CM_KEY_TYPE_DEVICE_INSTANCE,
0i64,
(UINT64)pcchRemaining,
0,
(VOID **)&a7,
0i64);
if( (int)(inited + 0x80000000) >= 0 && inited != -1073741810 )
goto LABEL_21;
if( v15 )
{
if( a7 )
{
LABEL_30:
inited = -1073741771;
goto LABEL_15;
}
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
ExAcquireResourceExclusiveLite((UINT64)&PnpReplaceEvent + 6688, 1, v18);
LODWORD(dwFlags) = 0;
LOBYTE(Created) = 0;
v8 = 1;
inited = CmCreateDevice(
*(&stru_140CF2E80 + 607),
(WCHAR *)PoolWithTag,
(WCHAR *)0x20006,
(INT64)&v66,
&Created,
dwFlags,
(INT64)DeviceKey,
(INT64)Disposition,
v57);
if( inited < 0 )
goto LABEL_34;
if( !(_BYTE)Created )
{
inited = -1073741771;
PnpCtxRegCloseKey(
v20,
(VOID *)v66,
v21,
v22,
(INT64)pcchRemaining,
(INT64)dwFlags,
(INT64)DeviceKeya,
(INT64)Disposition);
LABEL_34:
v9 = pcchLength[0];
goto LABEL_35;
}
LODWORD(a5) = 1;
LODWORD(dwFlags) = 4;
inited = PnpCtxRegSetValue(v20, (VOID *)v66, (WCHAR *)L"Phantom", 4ui64, &a5, (UINT64)dwFlags);
PnpCtxRegCloseKey(
v30,
(VOID *)v66,
v31,
v32,
(INT64)pcchRemainingb,
dwFlagsb,
(INT64)DeviceKeya,
(INT64)Disposition);
if( inited < 0 )
goto LABEL_34;
ExReleaseResourceLite((PERESOURCE)((char *)&PnpReplaceEvent + 6688));
KeLeaveCriticalRegion();
v9 = pcchLength[0];
}
else
{
if( a7 )
{
if( RtlInitUnicodeStringEx(DestinationString, (WCHAR *)PoolWithTag) >= 0 )
{
PpDevNodeLockTree(PPL_SIMPLE_READ);
v33 = (_ADAPTER_OBJECT *)PnpDeviceObjectFromDeviceInstanceWithTag((__int64)DestinationString, 0x746C6644u);
DmaAdapter = v33;
v34 = (INT64)v33;
if( v33 )
v35 = *(_QWORD *)(v33->ExpiredLock._bf_0 + 40);
else
v35 = 0i64;
PpDevNodeUnlockTree(PPL_SIMPLE_READ);
if( v35 )
{
if( IopIsRootEnumeratedDeviceObjectActive(v34) )
goto LABEL_30;
}
else
{
PiPnpRtlEnsureObjectCached(v36);
}
}
}
else
{
v45 = (_ETHREAD *)KeGetCurrentThread();
--v45->Tcb.KernelApcDisable;
ExAcquireResourceExclusiveLite((UINT64)&PnpReplaceEvent + 6688, 1, v18);
LODWORD(dwFlags) = 0;
LOBYTE(Created) = 0;
v8 = 1;
inited = CmCreateDevice(
*(&stru_140CF2E80 + 607),
(WCHAR *)PoolWithTag,
(WCHAR *)0x2001F,
(INT64)&a7,
&Created,
dwFlags,
(INT64)DeviceKey,
(INT64)Disposition,
v57);
if( inited < 0 )
goto LABEL_34;
ExReleaseResourceLite((PERESOURCE)((char *)&PnpReplaceEvent + 6688));
KeLeaveCriticalRegion();
v8 = 0;
v9 = pcchLength[0];
if( !(_BYTE)Created )
{
inited = -1073741771;
goto LABEL_35;
}
}
inited = RtlInitUnicodeStringEx(&DeviceInstance, (WCHAR *)PoolWithTag);
v8 = 0;
if( inited < 0 )
goto LABEL_35;
LODWORD(Disposition) = 0;
LODWORD(PropertySize) = 4;
DeviceRegProp = CmGetDeviceRegProp(
*(&stru_140CF2E80 + 607),
(const WCHAR *)PoolWithTag,
(VOID *)a7,
11i64,
(UINT64 *)((char *)&PropertySize + 4),
PropertyBuffer,
&PropertySize,
(UINT64)Disposition);
v39 = *(_DWORD *)PropertyBuffer;
if( DeviceRegProp < 0 )
v39 = 0;
*(_DWORD *)PropertyBuffer = v39;
DeviceInstanceCsConfigFlags = PnpGetDeviceInstanceCsConfigFlags(&DeviceInstance.Length, v38, (_DWORD *)&a5 + 1);
v41 = BYTE4(a5);
if( DeviceInstanceCsConfigFlags < 0 )
v41 = 0;
if( (PropertyBuffer[0] & 0x12) != 0 || (v41 & 2) != 0 )
{
inited = -1073741808;
goto LABEL_35;
}
inited = PiInitializeDevice(&DeviceInstance);
if( inited < 0 )
{
LABEL_35:
v10 = v59;
goto LABEL_36;
}
LODWORD(PropertySize) = 4;
if( PnpCtxRegQueryValue(
v42,
(VOID *)a7,
(WCHAR *)L"Phantom",
(UINT64 *)((char *)&PropertySize + 4),
&Data,
&PropertySize) < 0
|| HIDWORD(PropertySize) != 4
|| (v44 = Data, (_DWORD)PropertySize != 4) )
{
v44 = 0;
}
if( v44 )
PnpCtxRegDeleteValue(v43, (VOID *)a7, (WCHAR *)L"Phantom");
if( (BYTE4(PartialDeviceId[0]) & 8) != 0 )
{
LODWORD(PropertySize) = 512;
v10 = (UINT8 *)ExAllocatePoolWithTag(1ui64, 0x200ui64, 879783504i64);
if( !v10 )
{
inited = -1073741670;
v8 = 0;
goto LABEL_36;
}
LODWORD(Disposition) = 0;
if( CmGetDeviceRegProp(
*(&stru_140CF2E80 + 607),
(const WCHAR *)PoolWithTag,
(VOID *)a7,
5i64,
(UINT64 *)((char *)&PropertySize + 4),
v10,
&PropertySize,
(UINT64)Disposition) >= 0
&& HIDWORD(PropertySize) == 1
&& (unsigned int)PropertySize <= 0x200 )
{
if( *(_WORD *)v10 )
{
inited = RtlInitUnicodeStringEx(&DeviceInstance, (WCHAR *)PoolWithTag);
if( inited >= 0 )
inited = PpDeviceRegistration(&DeviceInstance, 1u, 0i64, 0);
}
}
goto LABEL_57;
}
}
v10 = v59;
goto LABEL_57;
}
LABEL_21:
v10 = 0i64;
LABEL_57:
v6 = IoctlOutputBufferSizea;
LABEL_58:
v8 = 0;
if( inited >= 0 )
{
inited = RtlStringCchLengthW((WCHAR *)PoolWithTag, 0xC8ui64, (UINT64 *)pcchLength);
if( inited < 0 )
{
v9 = 0;
}
else
{
v9 = pcchLength[0] + 1;
if( (unsigned __int64)v6 - 20 < 2 * (*(_QWORD *)pcchLength + 1i64) )
inited = -1073741789;
}
if( inited >= 0 )
{
LODWORD(Disposition) = v6;
LODWORD(dwFlags) = HIDWORD(ExpectedOutputSize);
LODWORD(pcchRemaining) = 2 * v9;
v23 = PiCMReturnBufferResultData(
(unsigned int)inited,
2 * v9,
0i64,
PoolWithTag,
(UINT64)pcchRemaining,
(UINT64)dwFlags,
IoctlOutputBuffer,
(UINT64)Disposition,
v76);
goto LABEL_37;
}
}
LABEL_36:
LODWORD(Disposition) = IoctlOutputBufferSizea;
LODWORD(dwFlags) = HIDWORD(ExpectedOutputSize);
LODWORD(pcchRemaining) = 0;
v23 = PiCMReturnBufferResultData(
(unsigned int)inited,
2 * v9,
0i64,
0i64,
(UINT64)pcchRemaining,
(UINT64)dwFlags,
IoctlOutputBuffer,
(UINT64)Disposition,
v76);
LABEL_37:
DeviceInputData = v23;
if( a7 )
PnpCtxRegCloseKey(
v24,
(VOID *)a7,
v25,
v26,
(INT64)pcchRemaininga,
dwFlagsa,
(INT64)DeviceKeyb,
(INT64)Dispositiona);
if( PoolWithTag )
ExFreePoolWithTag(PoolWithTag, 0x34706E50u);
if( v10 )
ExFreePoolWithTag(v10, 0x34706E50u);
if( DmaAdapter )
HalPutDmaAdapter(DmaAdapter);
if( v8 )
{
ExReleaseResourceLite((PERESOURCE)((char *)&PnpReplaceEvent + 6688));
KeLeaveCriticalRegion();
}
LABEL_47:
v27 = (_ETHREAD *)KeGetCurrentThread();
PreviousMode = v27->Tcb.PreviousMode;
if( PartialDeviceId[1] )
PiControlFreeUserModeCallersBuffer(v27->Tcb.PreviousMode, PartialDeviceId[1]);
if( SourceString[1] )
PiControlFreeUserModeCallersBuffer(PreviousMode, SourceString[1]);
if( hPnpOpCtx )
PiPnpRtlEndOperation(hPnpOpCtx);
return DeviceInputData;
}Referenced by:
PiCMHandleIoctl