VfClearVerifierSettings
VOID __stdcall VfClearVerifierSettings(){
INT64 v0;
unsigned int v1;
_UNICODE_STRING *v2;
_OBJECT_TYPE *v3;
NTSTATUS v4;
_OBJECT_TYPE *v5;
NTSTATUS v6;
_OBJECT_TYPE *v7;
NTSTATUS v8;
_OBJECT_TYPE *v9;
NTSTATUS v10;
_OBJECT_TYPE *v11;
NTSTATUS v12;
_OBJECT_TYPE *v13;
NTSTATUS v14;
_OBJECT_TYPE *v15;
NTSTATUS v16;
_OBJECT_TYPE *v17;
NTSTATUS v18;
_OBJECT_TYPE *v19;
NTSTATUS v20;
_OBJECT_TYPE *v21;
NTSTATUS v22;
_OBJECT_TYPE *v23;
NTSTATUS v24;
_OBJECT_TYPE *v25;
NTSTATUS v26;
VOID *Data;
INT64 DataSize;
UINT64 DataSizea;
_UNICODE_STRING DestinationString;
_OBJECT_ATTRIBUTES ObjectAttributes;
unsigned int v32;
VOID *KeyHandle;
KeyHandle = 0i64;
*(&ObjectAttributes.Length + 1) = 0;
*(&ObjectAttributes.Attributes + 1) = 0;
DestinationString = 0i64;
if( (VfOptionFlags & 0x20) != 0 )
{
v1 = VfOptionFlags & 0xFFFFFFCF;
}
else if( (VfOptionFlags & 0x400) != 0 )
{
v1 = VfOptionFlags & 0xFFFFFBC7;
}
else
{
v1 = VfOptionFlags & 0xFFFFFFE7;
}
v32 = v1;
v2 = (_UNICODE_STRING *)((char *)&stru_140C00F40 + 4408);
ObjectAttributes.Length = 48;
if( !*(&stru_140CF2E80 + 1656) )
v2 = &CmRegistryMachineSystemCurrentControlSetControlSessionManagerMemoryManagement;
ObjectAttributes.Attributes = 576;
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.ObjectName = v2;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
if( ZwOpenKey(
&KeyHandle,
0xF003Fui64,
&ObjectAttributes,
v0,
(INT64)Data,
DataSize,
*(INT64 *)&DestinationString.Length,
(INT64)DestinationString.Buffer) < 0 )
{
VfUtilDbgPrint((INT8 *)"Driver Verifier: Failed to open Memory Management key with status: 0x%x\n"
" Registry updates aborted!");
}
else
{
RtlInitUnicodeString(&DestinationString, L"VerifierOptions");
LODWORD(DataSizea) = 4;
if( ZwSetValueKey(KeyHandle, &DestinationString, 0i64, 4ui64, &v32, DataSizea) < 0 )
{
VfUtilDbgPrint((INT8 *)"Driver Verifier: Failed to set VerifierOptionFlags key value with status: 0x%x\n"
" Registry updates aborted!");
}
else
{
RtlInitUnicodeString(&DestinationString, L"VerifyDriverLevel");
v4 = ZwDeleteValueKey(KeyHandle, &DestinationString, v3);
if( (int)(v4 + 0x80000000) >= 0 && v4 != -1073741772 )
VfUtilDbgPrint((INT8 *)"Driver Verifier: Failed to delete VerifyDriverLevel key value with status: 0x%x\n");
RtlInitUnicodeString(&DestinationString, L"VerifierSettingState");
v6 = ZwDeleteValueKey(KeyHandle, &DestinationString, v5);
if( ((v6 + 0x80000000) & 0x80000000) == 0 && v6 != -1073741772 )
VfUtilDbgPrint((INT8 *)"Driver Verifier: Failed to delete RuleClasses key value with status: 0x%x\n");
RtlInitUnicodeString(&DestinationString, L"VerifyDrivers");
v8 = ZwDeleteValueKey(KeyHandle, &DestinationString, v7);
if( ((v8 + 0x80000000) & 0x80000000) == 0 && v8 != -1073741772 )
VfUtilDbgPrint((INT8 *)"Driver Verifier: Failed to delete VerifyDrivers key value with status: 0x%x\n");
RtlInitUnicodeString(&DestinationString, L"VerifierRandomTargets");
v10 = ZwDeleteValueKey(KeyHandle, &DestinationString, v9);
if( ((v10 + 0x80000000) & 0x80000000) == 0 && v10 != -1073741772 )
VfUtilDbgPrint((INT8 *)"Driver Verifier: Failed to delete VerifierRandomTargets key value with status: 0x%x\n");
if( VfFlightOptions )
{
RtlInitUnicodeString(&DestinationString, L"XdvVerifierOptions");
v12 = ZwDeleteValueKey(KeyHandle, &DestinationString, v11);
if( ((v12 + 0x80000000) & 0x80000000) == 0 && v12 != -1073741772 )
VfUtilDbgPrint((INT8 *)"Driver Verifier: Failed to delete XdvVerifierOptions key value with status: 0x%x\n");
}
RtlInitUnicodeString(&DestinationString, L"VrfPersistThroughUpgrade");
v14 = ZwDeleteValueKey(KeyHandle, &DestinationString, v13);
if( ((v14 + 0x80000000) & 0x80000000) == 0 && v14 != -1073741772 )
VfUtilDbgPrint((INT8 *)"Driver Verifier: Failed to delete VrfPersistThroughUpgrade key value with status: 0x%x\n");
RtlInitUnicodeString(&DestinationString, L"VerifierTriageContext");
v16 = ZwDeleteValueKey(KeyHandle, &DestinationString, v15);
if( ((v16 + 0x80000000) & 0x80000000) == 0 && v16 != -1073741772 )
VfUtilDbgPrint((INT8 *)"Driver Verifier: Failed to delete VerifierTriageContext key value with status: 0x%x\n");
if( VfXdvSuppressDriversBufferLength != -1 )
{
RtlInitUnicodeString(&DestinationString, L"VerifyDriversSuppress");
v18 = ZwDeleteValueKey(KeyHandle, &DestinationString, v17);
if( ((v18 + 0x80000000) & 0x80000000) == 0 && v18 != -1073741772 )
VfUtilDbgPrint((INT8 *)"Driver Verifier: Failed to delete VerifyDriversSuppress key value with status: 0x%x\n");
}
RtlInitUnicodeString(&DestinationString, L"VerifierTipLimitNumerator");
v20 = ZwDeleteValueKey(KeyHandle, &DestinationString, v19);
if( ((v20 + 0x80000000) & 0x80000000) == 0 && v20 != -1073741772 )
VfUtilDbgPrint((INT8 *)"Driver Verifier: Failed to delete VerifierTipLimitNumerator key value with status: 0x%x\n");
RtlInitUnicodeString(&DestinationString, L"VerifierTipLimitDenominator");
v22 = ZwDeleteValueKey(KeyHandle, &DestinationString, v21);
if( ((v22 + 0x80000000) & 0x80000000) == 0 && v22 != -1073741772 )
VfUtilDbgPrint((INT8 *)"Driver Verifier: Failed to delete VerifierTipLimitDenominator key value with status: 0x%x\n");
RtlInitUnicodeString(&DestinationString, L"VerifierTipSparseness");
v24 = ZwDeleteValueKey(KeyHandle, &DestinationString, v23);
if( ((v24 + 0x80000000) & 0x80000000) == 0 && v24 != -1073741772 )
VfUtilDbgPrint((INT8 *)"Driver Verifier: Failed to delete VerifierTipSparseness key value with status: 0x%x\n");
RtlInitUnicodeString(&DestinationString, L"VerifierLwspPoolTags");
v26 = ZwDeleteValueKey(KeyHandle, &DestinationString, v25);
if( ((v26 + 0x80000000) & 0x80000000) == 0 && v26 != -1073741772 )
VfUtilDbgPrint((INT8 *)"Driver Verifier: Failed to delete VerifierLwspPoolTags key value with status: 0x%x\n");
ZwFlushKey(KeyHandle);
if( VfClearanceFlag )
VfUtilDbgPrint((INT8 *)"Driver Verifier: Clearing Verifier options from Registry for preventing recursive crash.\n");
}
ZwClose((_HANDLE)KeyHandle);
}
}Referenced by:
Phase1InitializationIoReady
VfNotifyVerifierOfEvent