IovpCallDriver1
VOID __stdcall IovpCallDriver1(_IOFCALLDRIVER_STACKDATA *CallDriverData){
__int64 v1;
UINT8 CurrentIrql;
_IOV_DATABASE_HEADER *v4;
int v5;
unsigned int v6;
UINT64 v7;
_IO_STACK_LOCATION *v8;
NTSTATUS ShouldForce;
_IOV_SESSION_DATA *v10;
unsigned int v11;
_DEVICE_OBJECT *v12;
_IOV_DATABASE_HEADER v13;
int v14;
__int64 v15;
_DEVICE_OBJECT *v16;
_DEVICE_OBJECT *v17;
_IRP *v18;
INT8 v19;
int v20;
_IOV_STACK_LOCATION *v21;
bool v22;
VOID *LowerDeviceObjectWithTag;
__int64 v24;
_IOFCALLDRIVER_STACKDATA *v25;
_IOFCALLDRIVER_STACKDATA **v26;
__int64 v27;
__int64 v28;
VOID *v29;
VOID *v30;
_IOV_SESSION_DATA *v31;
char v32;
_IOV_REQUEST_PACKET *IovPacket;
VOID *CallerAddressa;
VOID *CallerAddress;
INT64 *StackLocationsAdvanced;
INT64 v37;
_IOV_STACK_LOCATION *StackLocationInfo;
_IOV_SESSION_DATA *IovSessionData;
_IOV_FORCED_PENDING_TRACE *Trace;
unsigned int IsNewSession;
INT64 LocationsAdvanced;
NTSTATUS v43;
VOID *CulpritAddress;
v1 = *((_QWORD *)CallDriverData + 21);
StackLocationInfo = 0i64;
v37 = 0i64;
LODWORD(LocationsAdvanced) = 0;
CurrentIrql = KeGetCurrentIrql();
if( (*(_DWORD *)(v1 + 16) & 0xC0000000) != 0 )
{
if( (*(_DWORD *)(v1 + 16) & 0xC0000000) != 0x40000000 )
return;
v4 = VfIrpDatabaseEntryFindAndLock((_IRP *)v1);
}
else
{
v4 = VfIrpDatabaseEntryFindAndLock((_IRP *)v1);
if( v4 )
{
*(_DWORD *)(v1 + 16) |= 0x40000000u;
}
else
{
v4 = VfPacketCreateAndLock((_IRP *)v1);
v5 = *(_DWORD *)(v1 + 16);
if( v4 )
v6 = v5 | 0x40000000;
else
v6 = v5 | 0x80000000;
*(_DWORD *)(v1 + 16) = v6;
}
}
if( v4 )
{
v7 = (unsigned int)v4[58];
*((_BYTE *)v4 + 61) = CurrentIrql;
*((_BYTE *)v4 + 60) = CurrentIrql;
CallerAddressa = (VOID *)*((_QWORD *)CallDriverData + 22);
v8 = (_IO_STACK_LOCATION *)(*(_QWORD *)(v1 + 184) - 72i64);
Trace = 0i64;
CulpritAddress = CallerAddressa;
ShouldForce = VfPendingShouldForce(v7, CurrentIrql, (_IRP *)v1, v8, v4, CallerAddressa);
v10 = (_IOV_SESSION_DATA *)*((_QWORD *)v4 + 30);
v11 = ShouldForce;
v12 = (_DEVICE_OBJECT *)*((_QWORD *)CallDriverData + 20);
v43 = ShouldForce;
IovSessionData = v10;
if( v10 || (v13 = v4[14], (v13 & 1) != 0) )
{
v14 = 0;
IsNewSession = 0;
}
else
{
IsNewSession = 1;
v4[14] = v13 | 1;
v10 = IovpSessionDataCreate(v12, v4, v11);
IovSessionData = v10;
v14 = 1;
}
*(_QWORD *)CallDriverData = v10;
*((_QWORD *)CallDriverData + 2) = v4;
if( v10 )
{
v15 = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart;
if( v14 )
{
LODWORD(v16) = IovUtilGetBottomDeviceObjectWithTag(v12);
v17 = v16;
VfIrpLogRecordEvent((unsigned int)v4[58], v16, (_IRP *)v1);
ObfDereferenceObjectWithTag(v17, 0x49667256ui64);
_InterlockedIncrement(v4 + 5);
v10 = IovSessionData;
++v4[6];
IovpSessionDataReference(v10);
}
if( *(_QWORD *)(v1 + 104) )
{
ViErrorReport1(515, CulpritAddress, (const VOID *)v1);
*(_QWORD *)(v1 + 104) = 0i64;
}
if( (v4[14] & 0x10) != 0 )
ViErrorReport1(517, CulpritAddress, (const VOID *)v1);
if( *(_BYTE *)(v1 + 67) <= *(_BYTE *)(v1 + 66)
&& (unsigned __int8)(v8->MajorFunction - 3) <= 1u
&& *(_QWORD *)(*((_QWORD *)CallDriverData + 21) + 8i64)
&& (MmVerifierData & 0x6000) != 0 )
{
MdlInvariantPreProcessing1(CallDriverData, v4, v8);
}
v10[14] = IovpExamineDevObjForwarding(v12, *((_DEVICE_OBJECT **)v10 + 6));
IovpExamineIrpStackForwarding(
v4,
IsNewSession,
v18,
(VOID *)v1,
(_IO_STACK_LOCATION *)CulpritAddress,
(_IO_STACK_LOCATION **)v8,
&v37,
(INT64)&LocationsAdvanced);
if( v43 )
{
_InterlockedIncrement(v4 + 5);
++v4[6];
*((_QWORD *)v4 + 27) = v8;
Trace = VfPendingStartLogging((_IRP *)v1);
}
LODWORD(StackLocationsAdvanced) = 1;
LODWORD(CallerAddress) = VfMajorIsNewRequest((_IO_STACK_LOCATION *)v37, v8);
LODWORD(IovPacket) = LocationsAdvanced;
v19 = *(_BYTE *)(v1 + 67);
v43 = (int)CallerAddress;
v20 = IovpAdvanceStackDownwards(
v10 + 20,
v19,
v8,
(_IO_STACK_LOCATION *)v37,
(INT64)IovPacket,
(UINT64)CallerAddress,
(UINT64)StackLocationsAdvanced,
&StackLocationInfo);
v21 = StackLocationInfo;
*((_QWORD *)StackLocationInfo + 6) = v15;
if( !v20 )
{
CallDriverData[6] |= 0x4000000u;
v22 = v43 == 0;
*((_QWORD *)CallDriverData + 5) = CallDriverData + 8;
*((_QWORD *)CallDriverData + 4) = CallDriverData + 8;
*((_QWORD *)v21 + 7) = v15;
v21 = StackLocationInfo;
*((_QWORD *)StackLocationInfo + 14) = KeGetCurrentThread();
if( !v22 )
{
*((_OWORD *)v21 + 5) = *(_OWORD *)(v1 + 48);
*((_OWORD *)v21 + 6) = *(_OWORD *)(v1 + 48);
if( IsNewSession )
v21[1] |= 0x8000000u;
}
}
LowerDeviceObjectWithTag = IovUtilGetLowerDeviceObjectWithTag((INT64)v12);
if( LowerDeviceObjectWithTag )
ObfDereferenceObjectWithTag(LowerDeviceObjectWithTag, 0x49667256ui64);
else
v21[1] |= 0x10000000u;
LODWORD(v24) = VfGetPristineDispatchRoutine(v12->DriverObject, v8->MajorFunction);
*((_QWORD *)v21 + 5) = v24;
v25 = CallDriverData + 8;
v21[1] &= ~0x40000000u;
v26 = (_IOFCALLDRIVER_STACKDATA **)(v21 + 4);
v27 = *((_QWORD *)v21 + 2);
if( *(_IOV_STACK_LOCATION **)(v27 + 8) != v21 + 4 )
__fastfail(3u);
*(_QWORD *)v25 = v27;
*((_QWORD *)CallDriverData + 5) = v26;
*(_QWORD *)(v27 + 8) = v25;
*v26 = v25;
*((_QWORD *)CallDriverData + 1) = v21;
*((_QWORD *)CallDriverData + 9) = v1;
v28 = *(_QWORD *)(v1 + 184);
*((_OWORD *)CallDriverData + 5) = *(_OWORD *)(v28 - 72);
*((_OWORD *)CallDriverData + 6) = *(_OWORD *)(v28 - 56);
*((_OWORD *)CallDriverData + 7) = *(_OWORD *)(v28 - 40);
*((_OWORD *)CallDriverData + 8) = *(_OWORD *)(v28 - 24);
*((_QWORD *)CallDriverData + 18) = *(_QWORD *)(v28 - 8);
if( (v8->Control & 1) != 0 )
CallDriverData[6] |= 0x1000000u;
if( v8->MajorFunction == 27 && v8->MinorFunction == 2 )
{
CallDriverData[6] |= 0x20000000u;
LODWORD(v29) = IovUtilGetBottomDeviceObjectWithTag(v12);
*((_QWORD *)CallDriverData + 8) = v29;
ObfDereferenceObjectWithTag(v29, 0x49667256ui64);
if( (unsigned int)IovUtilIsInFdoStack(v12) && !(unsigned int)IovUtilIsDeviceObjectMarked(v12, 3) )
CallDriverData[6] |= 0x10000000u;
VfDevObjMarkDeviceRemoved(v12);
}
v30 = CulpritAddress;
if( IsNewSession )
VfMajorVerifyNewIrp(v4, (_IRP *)v1, v8, v21, CulpritAddress);
if( v43 && (v4[14] & 0x80000) == 0 )
VfMajorVerifyNewRequest(v4, v12, (_IO_STACK_LOCATION *)v37, v8, v21, v30);
VfMajorVerifyIrpStackDownward(v4, v12, (_IO_STACK_LOCATION *)v37, v8, v21, v30);
v31 = IovSessionData;
*((_QWORD *)IovSessionData + 6) = v12;
*((_BYTE *)v4 + 186) = *(_BYTE *)(v1 + 67);
*(_OWORD *)(*((_QWORD *)v21 + 1) + 96i64) = *(_OWORD *)(v1 + 48);
v32 = *(_BYTE *)(v1 + 67);
if( v32 > 2 )
{
*(_QWORD *)(v1 + 184) -= 72i64;
*(_BYTE *)(v1 + 67) = v32 - 1;
*(_BYTE *)(*(_QWORD *)(v1 + 184) - 69i64) |= 0x10u;
++*(_BYTE *)(v1 + 67);
*(_QWORD *)(v1 + 184) += 72i64;
}
IovpSessionDataReference(v31);
_InterlockedIncrement(v4 + 5);
if( VfWdCancelTimeoutTicks )
ViWdBeforeCallDriver((_IRP *)v1, *((VOID **)CallDriverData + 6), (_VF_WATCHDOG_IRP **)v4 + 31);
}
VfIrpDatabaseEntryReleaseLock(v4);
if( Trace )
VfPendingFinishLogging(Trace);
}
}Referenced by:
VfBeforeCallDriver