PspInitPhase0
UINT8 __stdcall PspInitPhase0(_LOADER_PARAMETER_BLOCK *LoaderBlock){
char *v1;
__int64 v3;
unsigned __int64 v4;
__int64 v5;
char v6;
__int64 v7;
__int128 *v8;
__int64 v9;
int v10;
size_t v11;
_RTL_RUN_ONCE *v12;
_RTL_RUN_ONCE *v13;
__int64 v14;
_RTL_RUN_ONCE *v15;
_RTL_RUN_ONCE *v16;
__int64 v17;
_RTL_RUN_ONCE *v18;
_RTL_RUN_ONCE *v19;
__int64 v20;
_EPROCESS *Process;
unsigned int *v22;
int v23;
INT64 v24;
INT64 v25;
INT64 v26;
INT64 v27;
VOID *v28;
NTSTATUS v29;
_EPROCESS *v30;
_OBJECT_NAME_INFORMATION *ImageFileName;
UINT64 CreateFlags;
UINT64 CreateFlagsa;
UINT64 *SectionHandle;
VOID *SectionHandlea;
_UNICODE_STRING DestinationString;
_OBJECT_TYPE_INITIALIZER ObjectTypeInitializer;
PVOID Object;
void *ThreadHandle;
UINT64 MitigationOptions[2];
__int64 v42;
INT64 v43[2];
__int64 v44;
int v45;
char v46;
int v47;
char v48;
int v49;
char v50;
int v51;
char v52;
int v53;
char v54;
int v55;
char v56;
__int128 v57[2];
PspMinimumWorkingSet += 30i64;
v1 = &v46;
PspMaximumWorkingSet += 300i64;
ThreadHandle = 0i64;
DestinationString = 0i64;
v45 = 0;
v57[0] = (__int128)_mm_load_si128((const __m128i *)&_xmm);
v46 = 1;
v3 = 6i64;
v47 = 2;
PspHardenedMitigationOptionsMap = 0i64;
v48 = 3;
v49 = 3;
v50 = 1;
v51 = 1;
v52 = 1;
v53 = 4;
v54 = 1;
v55 = 5;
v56 = 1;
v57[1] = (__int128)_mm_load_si128((const __m128i *)&_xmm);
qword_140CFBC78 = 0i64;
do
{
v4 = (unsigned int)(4 * *((_DWORD *)v1 - 1));
v5 = (unsigned __int8)*v1;
v6 = (4 * *(v1 - 4)) & 0x3F;
v1 += 8;
v4 >>= 6;
v7 = (v5 << v6) | *((_QWORD *)&PspHardenedMitigationOptionsMap + v4) & ~(3i64 << v6);
*((_QWORD *)&PspHardenedMitigationOptionsMap + v4) = v7;
--v3;
}
while( v3 );
if( (unsigned int)PspSystemMitigationOptionsLength < 0x18 )
memset(
(VOID *)(0x140000000i64 + (unsigned int)PspSystemMitigationOptionsLength + 13613520i64),
0i64,
24 - PspSystemMitigationOptionsLength);
LOBYTE(v7) = 1;
*(_OWORD *)MitigationOptions = PspSystemMitigationOptions;
PspSystemMitigationOptionsLength = 24;
v42 = qword_140CFB9E0;
if( PspValidateMitigationOptions((UINT64)MitigationOptions, v7) < 0 )
{
PspSystemMitigationOptions = 0i64;
qword_140CFB9E0 = 0i64;
}
v8 = v57;
v9 = 8i64;
do
{
v10 = *(_DWORD *)v8;
v8 = (__int128 *)((char *)v8 + 4);
*((_QWORD *)&PspSystemMitigationOptions + ((unsigned __int64)(unsigned int)(4 * v10) >> 6)) &= ~(3i64 << ((4 * v10) & 0x3F));
--v9;
}
while( v9 );
v11 = PspSystemMitigationAuditOptionsLength;
if( PspSystemMitigationAuditOptionsLength < 0x18 )
memset(
(char *)&PspSystemMitigationAuditOptions + PspSystemMitigationAuditOptionsLength,
0i64,
24 - PspSystemMitigationAuditOptionsLength);
*(_OWORD *)v43 = PspSystemMitigationAuditOptions;
v44 = qword_140CFBB80;
if( PspValidateMitigationAuditOptions((INT64)v43) < 0 )
memset(&PspSystemMitigationAuditOptions, 0i64, v11);
v12 = (_RTL_RUN_ONCE *)&stru_140CEBF20;
do
{
CmSiRWLockInitialize(v12);
v12 = v13 + 1;
}
while( v14 != 1 );
v15 = &stru_140CEC120;
do
{
CmSiRWLockInitialize(v15);
v15 = v16 + 1;
}
while( v17 != 1 );
v18 = (_RTL_RUN_ONCE *)&CallBack;
do
{
CmSiRWLockInitialize(v18);
v18 = v19 + 1;
}
while( v20 != 1 );
PsChangeQuantumTable(0, (unsigned int)PsRawPrioritySeparation);
PspActiveProcessLock = 0i64;
qword_140C1E078 = (__int64)&PsActiveProcessHead;
PsActiveProcessHead = (__int64)&PsActiveProcessHead;
Process = KeGetCurrentThread()->ApcState.Process;
*(_QWORD *)&PsIdleProcess = Process;
Process->ProcessLock._bf_0 = 0i64;
ExInitializePushLock(&Process->RundownProtect.Count);
*(_DWORD *)(*(_QWORD *)&PsIdleProcess + 892i64) = 0;
memset(&ObjectTypeInitializer, 0i64, sizeof(ObjectTypeInitializer));
ObjectTypeInitializer.Length = 120;
*(_QWORD *)&ObjectTypeInitializer.PoolType = 512i64;
RtlInitUnicodeString(&DestinationString, L"Job");
*(_QWORD *)&ObjectTypeInitializer.ObjectTypeCode = 2048i64;
ObjectTypeInitializer.DeleteProcedure = (void(__fastcall *)(void *))PspJobDelete;
ObjectTypeInitializer.DefaultNonPagedPoolCharge = 1600;
ObjectTypeInitializer.CloseProcedure = (void(__fastcall *)(_EPROCESS *, void *, unsigned __int64, unsigned __int64))PspJobClose;
ObjectTypeInitializer.ValidAccessMask = 2031679;
ObjectTypeInitializer._bf_0 = ObjectTypeInitializer._bf_0 & 0x77 | 8;
ObjectTypeInitializer.GenericMapping = (_GENERIC_MAPPING)PspJobMapping;
if( ObCreateObjectType(&DestinationString, &ObjectTypeInitializer, 0i64, (_OBJECT_TYPE **)&PsJobType) >= 0
&& SeRegisterObjectTypeMandatoryPolicy((_OBJECT_TYPE *)PsJobType, 1ui64) >= 0 )
{
ObjectTypeInitializer.InvalidAttributes = 176;
RtlInitUnicodeString(&DestinationString, L"Process");
ObjectTypeInitializer._bf_0 |= 0xC2u;
ObjectTypeInitializer.DeleteProcedure = (void(__fastcall *)(void *))PspProcessDelete;
ObjectTypeInitializer.ObjectTypeCode = 32;
ObjectTypeInitializer.OpenProcedure = (int(__fastcall *)(_OB_OPEN_REASON, char, _EPROCESS *, void *, unsigned int *, unsigned int))PspProcessOpen;
ObjectTypeInitializer.DefaultPagedPoolCharge = 4096;
ObjectTypeInitializer.CloseProcedure = (void(__fastcall *)(_EPROCESS *, void *, unsigned __int64, unsigned __int64))PspProcessClose;
ObjectTypeInitializer.DefaultNonPagedPoolCharge = 2624;
ObjectTypeInitializer.ValidAccessMask = 0x1FFFFF;
ObjectTypeInitializer.RetainAccess = 1052672;
ObjectTypeInitializer.GenericMapping = (_GENERIC_MAPPING)PspProcessMapping;
if( ObCreateObjectType(&DestinationString, &ObjectTypeInitializer, 0i64, (_OBJECT_TYPE **)&PsProcessType) >= 0
&& SeRegisterObjectTypeMandatoryPolicy((_OBJECT_TYPE *)PsProcessType, 3ui64) >= 0 )
{
RtlInitUnicodeString(&DestinationString, L"Thread");
ObjectTypeInitializer._bf_0 |= 0x80u;
ObjectTypeInitializer.DeleteProcedure = PspThreadDelete;
ObjectTypeInitializer.ObjectTypeCode = 4;
ObjectTypeInitializer.OpenProcedure = (int(__fastcall *)(_OB_OPEN_REASON, char, _EPROCESS *, void *, unsigned int *, unsigned int))PspThreadOpen;
ObjectTypeInitializer.DefaultPagedPoolCharge = 0;
ObjectTypeInitializer.DefaultNonPagedPoolCharge = 2200;
ObjectTypeInitializer.CloseProcedure = 0i64;
ObjectTypeInitializer.ValidAccessMask = 0x1FFFFF;
ObjectTypeInitializer.RetainAccess = 1054720;
ObjectTypeInitializer.GenericMapping = (_GENERIC_MAPPING)PspThreadMapping;
if( ObCreateObjectType(&DestinationString, &ObjectTypeInitializer, 0i64, (_OBJECT_TYPE **)&PsThreadType) >= 0
&& SeRegisterObjectTypeMandatoryPolicy((_OBJECT_TYPE *)PsThreadType, 3ui64) >= 0 )
{
RtlInitUnicodeString(&DestinationString, L"Partition");
memset(&ObjectTypeInitializer, 0i64, sizeof(ObjectTypeInitializer));
ObjectTypeInitializer._bf_0 |= 0xCu;
ObjectTypeInitializer.OpenProcedure = (int(__fastcall *)(_OB_OPEN_REASON, char, _EPROCESS *, void *, unsigned int *, unsigned int))PspOpenPartitionHandle;
ObjectTypeInitializer.Length = 120;
ObjectTypeInitializer.CloseProcedure = (void(__fastcall *)(_EPROCESS *, void *, unsigned __int64, unsigned __int64))PspClosePartitionHandle;
ObjectTypeInitializer.InvalidAttributes = 16;
ObjectTypeInitializer.DeleteProcedure = (void(__fastcall *)(void *))PspDeletePartition;
ObjectTypeInitializer.ValidAccessMask = 2031619;
ObjectTypeInitializer.PoolType = NonPagedPoolNx;
ObjectTypeInitializer.GenericMapping = (_GENERIC_MAPPING)PspPartitionMapping;
ObjectTypeInitializer.DefaultNonPagedPoolCharge = 128;
if( ObCreateObjectType(&DestinationString, &ObjectTypeInitializer, 0i64, &PsPartitionType) >= 0 )
{
memset(&ObjectTypeInitializer, 0i64, sizeof(ObjectTypeInitializer));
ObjectTypeInitializer.Length = 120;
ObjectTypeInitializer.PoolType = NonPagedPoolNx;
ObjectTypeInitializer._bf_0 = ObjectTypeInitializer._bf_0 & 0x7D | 2;
v22 = (unsigned int *)PspMemoryReserveObjectSizes;
ObjectTypeInitializer.InvalidAttributes = 176;
v23 = 0;
ObjectTypeInitializer.GenericMapping = (_GENERIC_MAPPING)PspMemReserveMapping;
ObjectTypeInitializer.ValidAccessMask = 983043;
do
{
ObjectTypeInitializer.DefaultNonPagedPoolCharge = *v22;
if( ObCreateObjectType(
(_UNICODE_STRING *)&PspMemoryReserveObjectNames[2 * v23],
&ObjectTypeInitializer,
0i64,
&PspMemoryReserveObjectTypes + v23) < 0 )
return 0;
++v23;
v22 += 2;
}
while( v23 < 2 );
RtlInitUnicodeString(&DestinationString, L"ActivityReference");
memset(&ObjectTypeInitializer, 0i64, sizeof(ObjectTypeInitializer));
ObjectTypeInitializer._bf_0 |= 4u;
ObjectTypeInitializer.Length = 120;
ObjectTypeInitializer.PoolType = PagedPool;
ObjectTypeInitializer.DefaultPagedPoolCharge = 8;
ObjectTypeInitializer.InvalidAttributes = 402;
ObjectTypeInitializer.GenericMapping = (_GENERIC_MAPPING)PspActivityReferenceMapping;
ObjectTypeInitializer.ValidAccessMask = 2031616;
ObjectTypeInitializer.CloseProcedure = (void(__fastcall *)(_EPROCESS *, void *, unsigned __int64, unsigned __int64))PspCloseActivityReference;
if( ObCreateObjectType(&DestinationString, &ObjectTypeInitializer, 0i64, &PspActivityReferenceObjectType) >= 0 )
{
if( PspInitializeJobStructures() )
{
if( PspInitializeSiloStructures() )
{
stru_140C130B0._bf_0 = 0i64;
qword_140C130A8 = (__int64)&PspWorkingSetChangeHead;
PspWorkingSetChangeHead = (__int64)&PspWorkingSetChangeHead;
PspAffinityUpdateLock._bf_0 = 0i64;
PspCidTable = ExCreateHandleTable(0i64, 0i64);
if( PspCidTable )
{
CmSiRWLockInitialize((PRTL_RUN_ONCE)&PsWin32CallBack);
CmSiRWLockInitialize(&PsWin32NullCallBack);
LOBYTE(PspCidTable->Flags) |= 1u;
PsReaperWorkItem.WorkerRoutine = (void(__fastcall *)(void *))PspReaper;
qword_140C1E030 = (__int64)PspProcessRundownWorker;
PspProcessRundownCacheWorkItem.WorkerRoutine = (void(__fastcall *)(void *))PspProcessRundownWorkerSingle;
PsReaperListHead = 0i64;
PsReaperWorkItem.Parameter = 0i64;
PsReaperWorkItem.List.Flink = 0i64;
qword_140C1E038 = 0i64;
PspProcessRundownWorkItem = 0i64;
PspProcessRundownCacheWorkItem.Parameter = 0i64;
PspProcessRundownCacheWorkItem.List.Flink = 0i64;
PspBootAccessToken = (PVOID)(*(_QWORD *)(*(_QWORD *)&PsIdleProcess + 1208i64) & 0xFFFFFFFFFFFFFFF0ui64);
if( PspInitializeSystemPartitionPhase0(
(INT64)PspBootAccessToken,
v24,
v25,
v26,
CreateFlags,
SectionHandle) >= 0 )
{
v27 = PspSystemPartition;
LODWORD(SectionHandlea) = 0;
LOBYTE(CreateFlagsa) = 0;
if( PspCreateProcess(
(VOID **)(PspSystemPartition + 112),
0x1FFFFFui64,
0i64,
0i64,
CreateFlagsa,
SectionHandlea,
0i64,
0i64) >= 0 )
{
v28 = *(VOID **)(v27 + 112);
Object = 0i64;
v29 = ObReferenceObjectByHandle(v28, 0i64, (_OBJECT_TYPE *)PsProcessType, 0, &Object, 0i64);
v30 = (_EPROCESS *)Object;
*(_QWORD *)(v27 + 104) = Object;
if( v29 >= 0 )
{
PsInitialSystemProcess = v30;
_InterlockedOr((volatile signed __int32 *)&v30->2512, 0x40000000u);
_InterlockedOr((volatile signed __int32 *)&PsInitialSystemProcess->2516, 0x2000u);
_InterlockedOr((volatile signed __int32 *)&PsInitialSystemProcess->2172, 0x1000u);
strcpy_s((PSTR)(*(_QWORD *)&PsIdleProcess + 1448i64), 0xFui64, (PSTR)"Idle");
strcpy_s((PSTR)PsInitialSystemProcess->ImageFileName, 0xFui64, (PSTR)"System");
PsInitialSystemProcess->SeAuditProcessCreationInfo.ImageFileName = (_OBJECT_NAME_INFORMATION *)ExAllocatePoolWithTag(0x200ui64, 0x10ui64, 1632658771i64);
ImageFileName = PsInitialSystemProcess->SeAuditProcessCreationInfo.ImageFileName;
if( ImageFileName )
{
*(_OWORD *)ImageFileName = 0i64;
if( PsCreateSystemThread(
&ThreadHandle,
0x1FFFFFu,
0i64,
0,
0i64,
Phase1Initialization,
LoaderBlock) >= 0 )
{
ObCloseHandle(ThreadHandle, 0);
if( !VslVsmEnabled )
{
LABEL_39:
PsVmProcessorHostTransitionEvent._bf_0 = 0i64;
return 1;
}
PspStorageBitmap.FreeRoutine = 0i64;
PspStorageBitmap.AllocateRoutine = (void *(__fastcall *)(_RTL_AVL_TABLE *, unsigned int))PspIumWorker;
*(_QWORD *)&PspStorageBitmap.DeleteCount = 0i64;
PspIumFreeMapping = MmAllocateMappingAddress(0x1000ui64, 0x466D7356ui64);
if( PspIumFreeMapping )
{
PspIumLogBuffer = MmAllocateIndependentPagesEx(
0x2000ui64,
-1,
(_QWORD *)0xFFFFFFFFFFFFFFFFi64,
1u);
PsIumResumeAfterHibernate();
if( (VslGetNestedPageProtectionFlags() & 0x40) != 0 )
*(_QWORD *)&PspSystemMitigationOptions = PspSystemMitigationOptions & 0xFFFFFF0FFFFFFFFFui64 | 0x5000000000i64;
if( PspIumLogBuffer )
{
*(&PspVsmLogCallbackRecord.State + 4) = 0;
KeRegisterBugCheckReasonCallback(
&PspVsmLogCallbackRecord,
PspVsmLogBugCheckCallback,
KbCallbackSecondaryDumpData,
(PUCHAR)"SecureKernelFailureLog");
}
goto LABEL_39;
}
}
}
}
}
}
}
}
}
}
}
}
}
}
return 0;
}Referenced by:
PsInitSystem