IopFileUtilClearAttributes
NTSTATUS __stdcall IopFileUtilClearAttributes(
_UNICODE_STRING *FullPathName,
UINT64 FileAttributes,
INT64 a3,
INT64 a4,
INT64 a5,
INT64 a6,
INT64 a7,
INT64 a8){
NTSTATUS result;
int v9;
unsigned int v10;
UINT64 ShareAccess;
UINT64 ShareAccessa;
UINT64 OpenOptions;
VOID *FileHandle;
_IO_STATUS_BLOCK IoStatusBlock;
_OBJECT_ATTRIBUTES ObjectAttributes;
__int128 FileInformation;
__int128 v18;
__int64 v19;
FileHandle = 0i64;
*(&ObjectAttributes.Length + 1) = 0;
memset(&ObjectAttributes.Attributes + 1, 0, 20);
ObjectAttributes.ObjectName = FullPathName;
LODWORD(OpenOptions) = 2113570;
ObjectAttributes.RootDirectory = 0i64;
v19 = 0i64;
IoStatusBlock = 0i64;
ObjectAttributes.Length = 48;
FileInformation = 0i64;
ObjectAttributes.Attributes = 576;
v18 = 0i64;
LODWORD(ShareAccess) = 3;
result = ZwOpenFile(&FileHandle, 0x100180ui64, &ObjectAttributes, &IoStatusBlock, ShareAccess, OpenOptions);
if( result >= 0 )
{
v9 = ZwQueryInformationFile(FileHandle, &IoStatusBlock, &FileInformation, 0x28ui64, FileBasicInformation);
if( v9 >= 0 && (v19 & 7) != 0 )
{
LODWORD(ShareAccessa) = 4;
v10 = v19 & 0xFFFFFFF8;
if( (v19 & 0xFFFFFFF8) == 0 )
v10 = 128;
FileInformation = 0i64;
v19 = v10;
v18 = 0i64;
v9 = ZwSetInformationFile(
(UINT64)FileHandle,
(UINT64)&IoStatusBlock,
(INT8 *)&FileInformation,
0x28ui64,
ShareAccessa);
}
ZwClose((_HANDLE)FileHandle);
return v9;
}
return result;
}Referenced by:
IopFileUtilRename
PiLastGoodRevertLastKnownDirectory
PpLastGoodDeleteFilesCallback