PfQuerySuperfetchInformation
NTSTATUS __stdcall PfQuerySuperfetchInformation(
VOID *SystemInformation,
UINT64 SystemInformationLength,
CHAR PreviousMode,
UINT64 *Length){
INT8 v4;
UINT64 *v5;
NTSTATUS v6;
_SUPERFETCH_INFORMATION v7;
int v8;
_LUID v9;
_EPROCESS *Process;
_ETHREAD *CurrentThread;
_ETHREAD *v12;
_TOKEN *ClientToken;
_EX_FAST_REF *p_Token;
_TOKEN *PrimaryToken;
_TOKEN *v16;
UINT8 AccessGranted;
_TOKEN *v18;
void *Sid;
__int64 v22;
PSE_EXPORTS v23;
_ETHREAD *v24;
__int64 v25;
_QWORD *v26;
__int64 v27;
_ETHREAD *v28;
_EX_PUSH_LOCK *p_ProcessLock;
_QWORD *v30;
_SUPERFETCH_INFORMATION Info[4];
VOID *ElEntry[2];
_SECURITY_SUBJECT_CONTEXT DmaAdapter;
__int128 v34;
UINT64 *v35;
VOID *v36;
__int128 v37;
__int64 v38;
int v39;
_PRIVILEGE_SET PrivilegeSet;
__int128 v41;
__int128 v42;
UINT64 *ReturnSize;
v4 = (char)Length;
v5 = ReturnSize;
v35 = ReturnSize;
v41 = 0i64;
v42 = 0i64;
v36 = 0i64;
if( PreviousMode != 32 )
return -1073741820;
v6 = 0;
*(_OWORD *)Info = *(_OWORD *)SystemInformationLength;
*(_OWORD *)ElEntry = *(_OWORD *)(SystemInformationLength + 16);
if( *(_QWORD *)Info != 0x6B7568430000002Di64 )
return -1073741811;
v7 = Info[2];
if( Info[2] <= 0x1Cu )
{
v8 = 268501248;
if( _bittest(&v8, Info[2]) )
goto LABEL_29;
}
v9 = SeProfileSingleProcessPrivilege;
*(_QWORD *)&DmaAdapter.ImpersonationLevel = 0i64;
Process = KeGetCurrentThread()->ApcState.Process;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
DmaAdapter.ProcessAuditId = Process->UniqueProcessId;
if( CurrentThread )
{
if( (CurrentThread->CrossThreadFlags & 8) != 0 )
{
v12 = (_ETHREAD *)KeGetCurrentThread();
--v12->Tcb.KernelApcDisable;
ExAcquirePushLockSharedEx(&CurrentThread->ThreadLock, 0i64);
if( (CurrentThread->CrossThreadFlags & 8) != 0 )
{
ClientToken = (_TOKEN *)(CurrentThread->ClientSecurity.ImpersonationData & 0xFFFFFFFFFFFFFFF8ui64);
ObfReferenceObject(ClientToken);
DmaAdapter.ImpersonationLevel = CurrentThread->ClientSecurity.ImpersonationData & 3;
}
else
{
ClientToken = 0i64;
}
if( _InterlockedCompareExchange64(&CurrentThread->ThreadLock._bf_0, 0i64, 17i64) != 17 )
ExfReleasePushLockShared(&CurrentThread->ThreadLock);
KeAbPostRelease(&CurrentThread->ThreadLock);
KeLeaveCriticalRegionThread(&v12->Tcb);
}
else
{
ClientToken = 0i64;
}
DmaAdapter.ClientToken = ClientToken;
}
else
{
ClientToken = 0i64;
DmaAdapter.ClientToken = 0i64;
}
p_Token = &Process->Token;
PrimaryToken = (_TOKEN *)ObFastReferenceObject(&Process->Token);
if( !PrimaryToken )
{
v28 = (_ETHREAD *)KeGetCurrentThread();
--v28->Tcb.KernelApcDisable;
p_ProcessLock = &Process->ProcessLock;
ExAcquirePushLockSharedEx(p_ProcessLock, 0i64);
PrimaryToken = (_TOKEN *)ObFastReferenceObjectLocked(p_Token);
if( _InterlockedCompareExchange64(&p_ProcessLock->_bf_0, 0i64, 17i64) != 17 )
ExfReleasePushLockShared(p_ProcessLock);
KeAbPostRelease(p_ProcessLock);
KeLeaveCriticalRegionThread(&v28->Tcb);
ClientToken = (_TOKEN *)DmaAdapter.ClientToken;
}
DmaAdapter.PrimaryToken = PrimaryToken;
if( SeTokenLeakTracking )
{
if( PrimaryToken )
{
_InterlockedIncrement(&PrimaryToken->DiagnosticInfo->CaptureCount);
if( PrimaryToken == (_TOKEN *)SepTokenLeakToken )
__debugbreak();
ClientToken = (_TOKEN *)DmaAdapter.ClientToken;
PrimaryToken = (_TOKEN *)DmaAdapter.PrimaryToken;
}
if( ClientToken )
{
_InterlockedIncrement(&ClientToken->DiagnosticInfo->CaptureCount);
ClientToken = (_TOKEN *)DmaAdapter.ClientToken;
if( DmaAdapter.ClientToken == (void *)SepTokenLeakToken )
__debugbreak();
PrimaryToken = (_TOKEN *)DmaAdapter.PrimaryToken;
}
}
PrivilegeSet.PrivilegeCount = 1;
PrivilegeSet.Control = 1;
PrivilegeSet.Privilege[0].Luid = v9;
PrivilegeSet.Privilege[0].Attributes = 0;
if( v4 )
{
if( !ClientToken )
{
v16 = PrimaryToken;
goto LABEL_19;
}
if( DmaAdapter.ImpersonationLevel >= SecurityImpersonation )
{
v16 = ClientToken;
LABEL_19:
AccessGranted = SepPrivilegeCheck(v16, PrivilegeSet.Privilege, 1ui64, 1ui64, v4);
goto LABEL_20;
}
AccessGranted = 0;
}
else
{
AccessGranted = 1;
}
LABEL_20:
if( v4 )
{
v18 = ClientToken ? ClientToken : PrimaryToken;
Sid = v18->UserAndGroups->Sid;
if( !RtlEqualSid(SeLocalSystemSid, Sid) )
{
if( (v23 = SeExports, !RtlEqualSid(SeExports->SeNetworkServiceSid, Sid))
&& !RtlEqualSid(v23->SeLocalServiceSid, Sid)
|| SepFilterPrivilegeAudits(1ui64, &PrivilegeSet) )
{
SepAdtPrivilegedServiceAuditAlarm(
&DmaAdapter,
(_UNICODE_STRING *)&SeSubsystemName,
0i64,
ClientToken,
PrimaryToken,
&PrivilegeSet,
AccessGranted);
PrimaryToken = (_TOKEN *)DmaAdapter.PrimaryToken;
ClientToken = (_TOKEN *)DmaAdapter.ClientToken;
}
}
}
if( SeTokenLeakTracking )
{
if( PrimaryToken )
{
_InterlockedDecrement(&PrimaryToken->DiagnosticInfo->CaptureCount);
if( DmaAdapter.PrimaryToken == (void *)SepTokenLeakToken )
__debugbreak();
ClientToken = (_TOKEN *)DmaAdapter.ClientToken;
}
if( ClientToken )
{
_InterlockedDecrement(&ClientToken->DiagnosticInfo->CaptureCount);
if( DmaAdapter.ClientToken == (void *)SepTokenLeakToken )
__debugbreak();
}
}
ObFastDereferenceObject(&KeGetCurrentThread()->ApcState.Process->Token, DmaAdapter.PrimaryToken);
DmaAdapter.PrimaryToken = 0i64;
if( DmaAdapter.ClientToken )
HalPutDmaAdapter((PADAPTER_OBJECT)DmaAdapter.ClientToken);
DmaAdapter.ClientToken = 0i64;
if( !AccessGranted )
return -1073741790;
v7 = Info[2];
v6 = 0;
v5 = v35;
LABEL_29:
if( v7 == 6 )
{
return PfpPfnPrioRequest(Info, v4, v5);
}
else
{
switch( v7 )
{
case 1:
return PfGetCompletedTrace(ElEntry[0], LODWORD(ElEntry[1]), v4, v5);
case 2:
if( LODWORD(ElEntry[1]) != 28 )
goto LABEL_107;
v24 = (_ETHREAD *)KeGetCurrentThread();
--v24->Tcb.KernelApcDisable;
ExAcquirePushLockSharedEx(&stru_140C4FFF8, 0i64);
v37 = xmmword_140C4FE44;
v38 = qword_140C4FE54;
v39 = WaitTimeMax;
if( _InterlockedCompareExchange64(&stru_140C4FFF8._bf_0, 0i64, 17i64) != 17 )
ExfReleasePushLockShared(&stru_140C4FFF8);
KeAbPostRelease(&stru_140C4FFF8);
KeLeaveCriticalRegion();
if( v4 )
{
v25 = (__int64)ElEntry[0];
if( ((__int64)ElEntry[0] & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( ElEntry[0] >= (VOID *)0x7FFFFFFF0000i64 )
v25 = 0x7FFFFFFF0000i64;
*(_BYTE *)v25 = *(_BYTE *)v25;
*(_BYTE *)(v25 + 27) = *(_BYTE *)(v25 + 27);
}
v26 = ElEntry[0];
*(_OWORD *)ElEntry[0] = v37;
v26[2] = v38;
*((_DWORD *)v26 + 6) = v39;
*(_DWORD *)v5 = 28;
v6 = 0;
break;
case 8:
return PfpPrivSourceEnum(Info, v4, v5);
case 9:
if( LODWORD(ElEntry[1]) != 4 )
goto LABEL_107;
if( v4 )
{
v27 = (__int64)ElEntry[0];
if( ((__int64)ElEntry[0] & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( ElEntry[0] >= (VOID *)0x7FFFFFFF0000i64 )
v27 = 0x7FFFFFFF0000i64;
*(_BYTE *)v27 = *(_BYTE *)v27;
*(_BYTE *)(v27 + 3) = *(_BYTE *)(v27 + 3);
v6 = 0;
}
*(_DWORD *)ElEntry[0] = PfKernelGlobals.StreamSequenceNumber;
*(_DWORD *)v5 = 4;
break;
case 12:
return PfpQueryScenarioInformation(Info, v4, v5);
case 16:
return PfpMemoryListQuery(Info, v4, v5);
case 17:
return PfpMemoryRangesQuery(Info, v4, v5);
case 20:
if( LODWORD(ElEntry[1]) != 16 )
goto LABEL_107;
*(_QWORD *)&v34 = 0i64;
if( v4 )
{
v22 = (__int64)ElEntry[0];
if( ((__int64)ElEntry[0] & 7) != 0 )
ExRaiseDatatypeMisalignment();
if( ElEntry[0] >= (VOID *)0x7FFFFFFF0000i64 )
v22 = 0x7FFFFFFF0000i64;
*(_BYTE *)v22 = *(_BYTE *)v22;
*(_BYTE *)(v22 + 15) = *(_BYTE *)(v22 + 15);
v6 = 0;
}
v34 = *(_OWORD *)ElEntry[0];
if( (_DWORD)v34 == 1 )
{
*((_QWORD *)&v34 + 1) = qword_140C50170[0];
*(_OWORD *)ElEntry[0] = v34;
*(_DWORD *)v5 = 16;
}
else
{
v6 = -1073741735;
}
break;
case 23:
return PfpVirtualQuery(Info, v4, v5);
case 24:
if( LODWORD(ElEntry[1]) == 16 )
{
MmLogQueryCombineStats(0i64, 0i64);
v30 = ElEntry[0];
if( v4 )
ProbeForWrite((UINT64)ElEntry[0], 16i64, 4i64);
v36 = ElEntry[0];
if( *(_DWORD *)ElEntry[0] == 1 )
{
*((_DWORD *)ElEntry[0] + 1) = DWORD1(v41);
v30[1] = *((_QWORD *)&v42 + 1);
}
else
{
v6 = -1073741811;
}
}
else
{
LABEL_107:
v6 = -1073741306;
}
break;
case 27:
return PfpQueryFileExtentsRequest(Info, v4, v5);
case 28:
return PfpQueryGpuUtilization(Info, v4, v5);
default:
v6 = -1073741821;
break;
}
}
return v6;
}Referenced by:
ExpQuerySystemInformation