RawQueryVolumeInformation
NTSTATUS __stdcall RawQueryVolumeInformation(_VCB *Vcb, _IRP *Irp, _IO_STACK_LOCATION *IrpSp){
unsigned int SecurityContext;
union {_IRP *MasterIrp;int IrpCount;void *SystemBuffer;} v5;
_IRP *v6;
NTSTATUS FsVolumeInfo;
int SectorSizeInformation;
unsigned int v9;
UINT64 Length;
SecurityContext = (unsigned int)IrpSp->Parameters.SecurityContext;
v5.MasterIrp = (_IRP *)Irp->AssociatedIrp;
v6 = Irp;
LODWORD(Length) = SecurityContext;
switch( IrpSp->Parameters.Options )
{
case 1u:
FsVolumeInfo = RawQueryFsVolumeInfo(Vcb, IrpSp->FileObject);
LABEL_3:
SecurityContext = Length;
SectorSizeInformation = FsVolumeInfo;
break;
case 3u:
FsVolumeInfo = RawQueryFsSizeInfo(Vcb, IrpSp->FileObject, (_FILE_FS_SIZE_INFORMATION *)v5.MasterIrp, &Length);
goto LABEL_3;
case 4u:
FsVolumeInfo = RawQueryFsDeviceInfo(Vcb, IrpSp->FileObject, (_FILE_FS_DEVICE_INFORMATION *)v5.MasterIrp, &Length);
goto LABEL_3;
case 5u:
if( SecurityContext < 0x12 )
{
SectorSizeInformation = -2147483643;
}
else
{
*(_DWORD *)&v5.MasterIrp->Type = 0;
SecurityContext -= 18;
*(_DWORD *)&v5.MasterIrp->AllocationProcessorNumber = 0;
LODWORD(v5.MasterIrp->MdlAddress) = 6;
SectorSizeInformation = 0;
HIDWORD(v5.MasterIrp->MdlAddress) = *(_DWORD *)L"RAW";
LOWORD(v5.MasterIrp->Flags) = aRaw[2];
}
break;
case 0xBu:
SectorSizeInformation = FsRtlGetSectorSizeInformation(
*(_DEVICE_OBJECT **)(*((_QWORD *)Vcb + 23) + 16i64),
(_FILE_FS_SECTOR_SIZE_INFORMATION *)v5.MasterIrp);
if( SectorSizeInformation >= 0 )
SecurityContext -= 28;
break;
default:
SectorSizeInformation = -1073741811;
break;
}
LOBYTE(Irp) = 1;
v9 = LODWORD(IrpSp->Parameters.SecurityContext) - SecurityContext;
v6->IoStatus.Status = SectorSizeInformation;
v6->IoStatus.Information = v9;
IofCompleteRequest(v6, (_CCHAR)Irp);
return SectorSizeInformation;
}Referenced by:
RawDispatch