KseShimDriverIoCallbacks

NTSTATUS __stdcall KseShimDriverIoCallbacks(_DRIVER_OBJECT *DriverObject, _UNICODE_STRING *BaseName){
  _UNICODE_STRING *v2; 
  _DRIVER_EXTENSION *DriverExtension; 
  _UNICODE_STRING *v4; 
  int ShimCallbacksForDriver; 
  int v7; 
  char *NonPaged; 
  int(__fastcall *DriverInit)(_DRIVER_OBJECT *, _UNICODE_STRING *); 
  int(__fastcall *v11)(_DRIVER_OBJECT *, _UNICODE_STRING *); 
  void(__fastcall *DriverStartIo)(_DEVICE_OBJECT *, _IRP *); 
  void(__fastcall *v13)(_DEVICE_OBJECT *, _IRP *); 
  void(__fastcall *DriverUnload)(_DRIVER_OBJECT *); 
  void(__fastcall *v15)(_DRIVER_OBJECT *); 
  int(__fastcall *AddDevice)(_DRIVER_OBJECT *, _DEVICE_OBJECT *); 
  int(__fastcall *v17)(_DRIVER_OBJECT *, _DEVICE_OBJECT *); 
  signed __int64 v18; 
  int(__fastcall **MajorFunction)(_DEVICE_OBJECT *, _IRP *); 
  signed __int64 v20; 
  __int64 v21; 
  VOID(__fastcall *v22)(_DEVICE_OBJECT *, _IRP *); 
  int(__fastcall *v23)(_DEVICE_OBJECT *, _IRP *); 
  _UNICODE_STRING TargetString; 
  _UNICODE_STRING DriverFileName; 
  _KSE_IO_CALLBACKS IoCallbacks[64]; 

  DriverExtension = DriverObject->DriverExtension;
  v4 = v2;
  memset(IoCallbacks, 0i64, sizeof(IoCallbacks));
  *(_QWORD *)&TargetString.Length = 0i64;
  ShimCallbacksForDriver = 0;
  TargetString.Buffer = 0i64;
  DriverFileName = 0i64;
  if( v4 )
  {
    if( dword_140C50324 == 2 && (Engine & 1) == 0 )
    {
      KsepStringDuplicateUnicode(&TargetString, v4);
      ShimCallbacksForDriver = v7;
      if( v7 >= 0 )
      {
        ShimCallbacksForDriver = KsepDriverPathTail(&TargetString, &DriverFileName);
        if( ShimCallbacksForDriver >= 0 )
        {
          ShimCallbacksForDriver = KsepGetShimCallbacksForDriver(DriverObject->DriverStart, IoCallbacks);
          if( ShimCallbacksForDriver >= 0 )
          {
            NonPaged = (char *)KsepPoolAllocateNonPaged(0x100ui64);
            if( NonPaged )
            {
              DriverInit = DriverObject->DriverInit;
              if( DriverInit )
              {
                v11 = *(int(__fastcall **)(_DRIVER_OBJECT *, _UNICODE_STRING *))IoCallbacks;
                if( *(_QWORD *)IoCallbacks )
                {
                  *(_QWORD *)NonPaged = DriverInit;
                  DriverObject->DriverInit = v11;
                }
              }
              DriverStartIo = DriverObject->DriverStartIo;
              if( DriverStartIo )
              {
                v13 = *(void(__fastcall **)(_DEVICE_OBJECT *, _IRP *))&IoCallbacks[2];
                if( *(_QWORD *)&IoCallbacks[2] )
                {
                  *((_QWORD *)NonPaged + 1) = DriverStartIo;
                  DriverObject->DriverStartIo = v13;
                }
              }
              DriverUnload = DriverObject->DriverUnload;
              if( DriverUnload )
              {
                v15 = *(void(__fastcall **)(_DRIVER_OBJECT *))&IoCallbacks[4];
                if( *(_QWORD *)&IoCallbacks[4] )
                {
                  *((_QWORD *)NonPaged + 2) = DriverUnload;
                  DriverObject->DriverUnload = v15;
                }
              }
              AddDevice = DriverExtension->AddDevice;
              if( AddDevice )
              {
                v17 = *(int(__fastcall **)(_DRIVER_OBJECT *, _DEVICE_OBJECT *))&IoCallbacks[6];
                if( *(_QWORD *)&IoCallbacks[6] )
                {
                  *((_QWORD *)NonPaged + 3) = AddDevice;
                  DriverExtension->AddDevice = v17;
                }
              }
              v18 = NonPaged - (char *)DriverObject;
              MajorFunction = DriverObject->MajorFunction;
              v20 = (char *)&IoCallbacks[8] - (char *)DriverObject;
              v21 = 28i64;
              do
              {
                v22 = (VOID(__fastcall *)(_DEVICE_OBJECT *, _IRP *))*MajorFunction;
                if( *MajorFunction )
                {
                  if( v22 != IopInvalidDeviceRequest )
                  {
                    v23 = *(int(__fastcall **)(_DEVICE_OBJECT *, _IRP *))((char *)MajorFunction + v20 - 112);
                    if( v23 )
                    {
                      *(int(__fastcall **)(_DEVICE_OBJECT *, _IRP *))((char *)MajorFunction + v18 - 80) = (int(__fastcall *)(_DEVICE_OBJECT *, _IRP *))v22;
                      *MajorFunction = v23;
                    }
                  }
                }
                ++MajorFunction;
                --v21;
              }
              while( v21 );
              DriverExtension->KseCallbacks = NonPaged;
              ShimCallbacksForDriver = 0;
              KsepHistoryMessages[((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryMessagesIndex, 1u) + 1) & 0x3F] = 524550i64;
              if( (KsepDebugFlag & 1) != 0 )
                KsepDebugPrint(
                  9i64,
                  "KSE: Hooked callbacks for driver [%ws].\n",
                  TargetString.Buffer,
                  v20,
                  *(_QWORD *)&TargetString.Length);
              KsepLogInfo(
                9,
                "KSE: Hooked callbacks for driver [%ws].\n",
                TargetString.Buffer,
                v20,
                *(_QWORD *)&TargetString.Length);
              goto LABEL_8;
            }
            ShimCallbacksForDriver = -1073741801;
          }
        }
      }
      KsepPoolFreeNonPaged(0i64);
    }
LABEL_8:
    KsepStringFree(&TargetString);
    return ShimCallbacksForDriver;
  }
  KsepHistoryMessages[((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryMessagesIndex, 1u) + 1) & 0x3F] = 524436i64;
  if( (KsepDebugFlag & 1) != 0 )
    KsepDebugPrint(0i64, "KSE: Callback shimming - missing driver object or driver name.\n");
  KsepLogInfo(0, "KSE: Callback shimming - missing driver object or driver name.\n");
  return -1073741811;
}

Referenced by: