ObpLookupObjectName
NTSTATUS __stdcall ObpLookupObjectName(
VOID *RootDirectoryHandle,
_UNICODE_STRING *ObjectName,
UINT64 Attributes,
_OBJECT_TYPE *ObjectType,
INT8 AccessMode,
VOID *ParseContext,
_SECURITY_QUALITY_OF_SERVICE *SecurityQos,
VOID *InsertObject,
_EJOB *Silo,
_ACCESS_STATE *AccessState,
_OBP_LOOKUP_CONTEXT *LookupContext,
UINT64 *MaxRelativeAccessMask,
VOID **FoundObject){
_OBP_LOOKUP_CONTEXT *v13;
__int16 v14;
_UNICODE_STRING *v15;
bool v17;
VOID **v18;
_EJOB *v19;
CHAR v20;
VOID *v21;
unsigned int v22;
bool v23;
_SECURITY_SUBJECT_CONTEXT *p_SubjectContext;
_KTRANSACTION *v25;
_ADAPTER_OBJECT *DosDevicesDirectory;
_OBJECT_DIRECTORY_ENTRY *v27;
wchar_t *v28;
int v29;
_HALP_EMERGENCY_LA_QUEUE_ENTRY *p_LowMemoryLogicalAddressQueueEntry;
__int64 v31;
_OBJECT_TYPE *v32;
NTSTATUS(__stdcall *ParseProcedure)(VOID *, VOID *, _SECURITY_SUBJECT_CONTEXT *, _KPROCESSOR_MODE, UINT64, _UNICODE_STRING *, _UNICODE_STRING *, VOID *, _SECURITY_QUALITY_OF_SERVICE *, _OB_EXTENDED_PARSE_PARAMETERS *, VOID **);
_ADAPTER_OBJECT *v34;
int v35;
int v36;
NTSTATUS v37;
NTSTATUS result;
_ADAPTER_OBJECT *v39;
int Length;
wchar_t *v41;
unsigned int v42;
unsigned __int64 v43;
__int64 v44;
unsigned int v45;
unsigned int v46;
int v47;
unsigned __int8 DirectoryLocked;
unsigned __int16 v49;
__int64 v50;
_OBJECT_DIRECTORY_ENTRY **p_ChainLink;
_EX_PUSH_LOCK *p_MapRegisterMdl;
_ETHREAD *v53;
_ADAPTER_OBJECT *v54;
_OBJECT_DIRECTORY *v55;
unsigned int Flags;
_OBJECT_DIRECTORY *ShadowDirectory;
_ESERVERSILO_GLOBALS *v58;
_ETHREAD *v59;
ULONG_PTR v60;
_DEVICE_MAP *v61;
_ETHREAD *v62;
unsigned __int8 v63;
_OBP_LOOKUP_CONTEXT *v64;
_OBJECT_DIRECTORY_ENTRY **v65;
_ETHREAD *v66;
_OBJECT_DIRECTORY_ENTRY *v67;
unsigned int HashValue;
unsigned int v69;
wchar_t *v70;
_QWORD *v71;
wchar_t *v72;
signed __int64 v73;
unsigned __int64 v74;
unsigned __int64 v75;
_ADAPTER_OBJECT *v76;
NTSTATUS(__stdcall *v77)(VOID *, VOID *, _SECURITY_SUBJECT_CONTEXT *, _KPROCESSOR_MODE, UINT64, _UNICODE_STRING *, _UNICODE_STRING *, VOID *, _SECURITY_QUALITY_OF_SERVICE *, _OB_EXTENDED_PARSE_PARAMETERS *, VOID **);
_ADAPTER_OBJECT *v78;
_UNICODE_STRING v79;
_ADAPTER_OBJECT *v80;
wchar_t *Buffer;
wchar_t v82;
_DEVICE_MAP *v83;
signed __int32 ReferenceCount;
signed __int32 v85;
_ADAPTER_OBJECT *v86;
_ETHREAD *CurrentThread;
_ADAPTER_OBJECT *v88;
char v89;
INT64 Process;
_EJOB *v91;
_KSPIN_LOCK *v92;
_DEVICE_MAP *v93;
_ESERVERSILO_GLOBALS *CurrentServerSiloGlobals;
_ETHREAD *v95;
_DEVICE_MAP **p_SystemDeviceMap;
ULONG_PTR v97;
_ETHREAD *v98;
_UNICODE_STRING v99;
unsigned int v100;
wchar_t *v101;
_QWORD *v102;
wchar_t *v103;
signed __int64 v104;
UINT16 v105;
UINT16 v106;
_OBP_LOOKUP_CONTEXT *v107;
_OBJECT_DIRECTORY *v108;
_ETHREAD *v109;
_ADAPTER_OBJECT *Directory;
_ADAPTER_OBJECT *v111;
_HALP_DMA_TRANSLATION_ENTRY *ScatterBufferListHead;
_DEVICE_MAP *v113;
_DEVICE_MAP *v114;
unsigned int v115;
_OBJECT_DIRECTORY *v116;
INT8 v117;
unsigned int SessionId;
size_t v119;
VOID **PoolWithTag;
char *v121;
void *v122;
unsigned __int16 v123;
UINT16 v124;
int v125;
int v126;
VOID *ClientToken;
NTSTATUS v128;
_ADAPTER_OBJECT *v129;
__int64 v130;
__int64 v131;
__int128 v132;
_ESERVERSILO_GLOBALS *ServerSiloGlobals;
_ETHREAD *v134;
ULONG_PTR v135;
_DEVICE_MAP *v136;
_EJOB *ServerSilo;
UINT64 DesiredAccess;
UINT64 PreviouslyGrantedAccess;
INT64 v140;
_UNICODE_STRING v141;
_ADAPTER_OBJECT *v142;
_DEVICE_MAP *DeviceMap;
PADAPTER_OBJECT DmaAdapter;
unsigned int v145;
unsigned int v146;
INT64 a6;
VOID *TokenInformation;
int v149;
_UNICODE_STRING ComponentName;
PADAPTER_OBJECT v151;
__int16 v152[2];
int v153;
_EJOB *v154;
INT64 GrantedAccess;
PVOID ReturnedSiloContext;
PVOID v157;
VOID *DirectoryObject;
_HANDLE_TABLE_ENTRY_INFO ObjectInfo;
_DEVICE_MAP *ppDevMap;
_SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
PVOID Object;
_LEARNING_MODE_OBJECT_INFORMATION ObjectInformation[2];
__int64 v164;
_UNICODE_STRING *p_Name;
_UNICODE_STRING *v166;
VOID *v167;
__int128 v168;
_SECURITY_SUBJECT_CONTEXT SubjectContext;
bool v170;
int v172;
v172 = Attributes;
v13 = LookupContext;
v14 = Attributes;
v149 = 64;
DmaAdapter = 0i64;
v15 = ObjectName;
LookupContext->Directory = 0i64;
LookupContext->Object = 0i64;
*(_WORD *)&LookupContext->DirectoryLocked = 0;
LookupContext->LockStateSignature = -60876;
v152[1] = 0;
ObjectInfo = 0i64;
*(_QWORD *)ObjectInformation = 0i64;
v164 = 0i64;
DeviceMap = 0i64;
v170 = 0;
BYTE5(v140) = 0;
v168 = 0i64;
v141 = 0i64;
if( MaxRelativeAccessMask )
*(_DWORD *)MaxRelativeAccessMask = 0;
v17 = ObpCaseInsensitive == 0;
v18 = FoundObject;
v152[0] = 16;
v19 = Silo;
v154 = Silo;
*FoundObject = 0i64;
LODWORD(v140) = 0;
LODWORD(a6) = 0;
BYTE6(v140) = 1;
v142 = 0i64;
v151 = 0i64;
v153 = -1;
if( !v17 && (ObjectType->TypeInfo._bf_0 & 1) != 0 && (*(_DWORD *)&KeGetCurrentThread()[1].gapD8[8] & 0x80000) == 0 )
{
v14 = Attributes | 0x40;
v172 = Attributes | 0x40;
}
v20 = AccessMode;
v21 = InsertObject;
v22 = 1;
if( (v14 & 0x400) == 0 )
v22 = (unsigned __int8)AccessMode;
v146 = v22;
if( !InsertObject )
{
v23 = 0;
BYTE5(v140) = 1;
LODWORD(TokenInformation) = 0;
p_SubjectContext = 0i64;
GrantedAccess = 0i64;
memset(&SubjectContext, 0, sizeof(SubjectContext));
if( (_BYTE)v22 )
{
if( AccessState == (_ACCESS_STATE *)-32i64 )
{
p_SubjectContext = &SubjectContext;
SeCaptureSubjectContext((INT64)&SubjectContext);
}
else
{
p_SubjectContext = (_SECURITY_SUBJECT_CONTEXT *)((char *)AccessState + 32);
}
LODWORD(PreviouslyGrantedAccess) = 0;
LODWORD(DesiredAccess) = 0x20000;
if( SeAccessCheckWithHint(
SeMediumDaclSd,
8ui64,
p_SubjectContext,
0i64,
DesiredAccess,
PreviouslyGrantedAccess,
0i64,
(_GENERIC_MAPPING *)&RtlpRestrictedMapping,
v22,
(UINT64 *)((char *)&GrantedAccess + 4),
&GrantedAccess) )
{
if( ext_ms_win_ntos_tm_l1_1_0_TmIsKTMCommitCoordinator(v25) )
{
ClientToken = p_SubjectContext->ClientToken;
if( !p_SubjectContext->ClientToken )
ClientToken = p_SubjectContext->PrimaryToken;
if( SeQueryInformationToken(ClientToken, TokenIsAppContainer, &TokenInformation) >= 0 )
v23 = (_DWORD)TokenInformation == 0;
}
else
{
v23 = 1;
}
}
v20 = AccessMode;
v19 = Silo;
}
else
{
v23 = 1;
}
if( p_SubjectContext == &SubjectContext )
{
SeReleaseSubjectContext(p_SubjectContext);
v19 = Silo;
v20 = AccessMode;
}
v170 = !v23;
v18 = FoundObject;
v21 = 0i64;
}
if( RootDirectoryHandle )
{
LODWORD(DesiredAccess) = 1953261124;
result = ObpReferenceObjectByHandleWithTag(
RootDirectoryHandle,
0i64,
0i64,
v20,
DesiredAccess,
(VOID **)&DmaAdapter,
0i64,
&ObjectInfo);
LODWORD(v140) = result;
if( result < 0 )
return result;
if( ObjectInfo.MaxRelativeAccessMask )
{
v153 &= ObjectInfo.MaxRelativeAccessMask;
if( (v153 & *((_DWORD *)AccessState + 6)) != *((_DWORD *)AccessState + 6) )
{
HalPutDmaAdapter(DmaAdapter);
return -1073741790;
}
}
v78 = DmaAdapter;
if( v15->Length )
{
if( *v15->Buffer == 92
&& (POBJECT_TYPE *)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ LOBYTE(DmaAdapter[-1].AllocationState) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)DmaAdapter - 48) >> 8)] != IoFileObjectType )
{
HalPutDmaAdapter(DmaAdapter);
return -1073741765;
}
}
else if( (POBJECT_TYPE)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ LOBYTE(DmaAdapter[-1].AllocationState) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)DmaAdapter - 48) >> 8)] == ::DmaAdapter )
{
v128 = ObReferenceObjectByPointer(DmaAdapter, 0i64, ObjectType, AccessMode);
v129 = v142;
LODWORD(v140) = v128;
if( v128 >= 0 )
v129 = v78;
v142 = v129;
HalPutDmaAdapter(v78);
*v18 = v142;
return v140;
}
v79 = *v15;
v142 = DmaAdapter;
v141 = v79;
p_Name = &ObjectType->Name;
v166 = v15;
v167 = RootDirectoryHandle;
SeSetLearningModeObjectInformation(ObjectInformation);
DosDevicesDirectory = v142;
LABEL_35:
while( 2 )
{
p_LowMemoryLogicalAddressQueueEntry = &DosDevicesDirectory[-1].LowMemoryLogicalAddressQueueEntry;
v31 = (unsigned __int8)((unsigned __int16)((_WORD)DosDevicesDirectory - 48) >> 8);
v32 = (_OBJECT_TYPE *)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ v31 ^ LOBYTE(DosDevicesDirectory[-1].AllocationState)];
ParseProcedure = (NTSTATUS(__stdcall *)(VOID *, VOID *, _SECURITY_SUBJECT_CONTEXT *, _KPROCESSOR_MODE, UINT64, _UNICODE_STRING *, _UNICODE_STRING *, VOID *, _SECURITY_QUALITY_OF_SERVICE *, _OB_EXTENDED_PARSE_PARAMETERS *, VOID **))v32->TypeInfo.ParseProcedure;
if( ParseProcedure )
{
if( ParseProcedure != ObpParseSymbolicLinkEx )
{
if( InsertObject )
{
LABEL_351:
LODWORD(v140) = -1073741788;
goto LABEL_157;
}
ObfReferenceObject(DosDevicesDirectory);
if( v13->DirectoryLocked )
{
ExReleasePushLockEx(LODWORD(v13->Directory) + 296, 0);
Directory = (_ADAPTER_OBJECT *)v13->Directory;
v13->LockStateSignature = -286387660;
HalPutDmaAdapter(Directory);
v13->Directory = 0i64;
*(_WORD *)&v13->DirectoryLocked = 0;
KeLeaveCriticalRegion();
}
v34 = (_ADAPTER_OBJECT *)v13->Object;
if( v34 )
{
HalPutDmaAdapter(v34);
v13->Object = 0i64;
}
DosDevicesDirectory = v142;
}
v15 = ObjectName;
v14 = v172;
if( (*(_BYTE *)(ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ v31 ^ LOBYTE(p_LowMemoryLogicalAddressQueueEntry[1].ListEntry.Flink)]
+ 67) & 1) != 0 )
v35 = ((__int64(__fastcall *)(_ADAPTER_OBJECT *, _OBJECT_TYPE *, _ACCESS_STATE *, _QWORD, int, _UNICODE_STRING *, _UNICODE_STRING *, VOID *, _SECURITY_QUALITY_OF_SERVICE *, __int16 *, _ADAPTER_OBJECT **))ParseProcedure)(
DosDevicesDirectory,
ObjectType,
AccessState,
v146,
v172,
ObjectName,
&v141,
ParseContext,
SecurityQos,
v152,
&v142);
else
v35 = ((__int64(__fastcall *)(_ADAPTER_OBJECT *, _OBJECT_TYPE *, _ACCESS_STATE *, _QWORD, int, _UNICODE_STRING *, _UNICODE_STRING *, VOID *, _SECURITY_QUALITY_OF_SERVICE *, _ADAPTER_OBJECT **))ParseProcedure)(
DosDevicesDirectory,
ObjectType,
AccessState,
v146,
v172,
ObjectName,
&v141,
ParseContext,
SecurityQos,
&v142);
v36 = v35;
LODWORD(v140) = v35;
if( ParseProcedure != ObpParseSymbolicLinkEx )
{
HalPutDmaAdapter((PADAPTER_OBJECT)&p_LowMemoryLogicalAddressQueueEntry[2]);
v36 = v140;
}
if( v36 < 0 )
{
LABEL_157:
if( v13->DirectoryLocked )
ObpUnlockDirectory(v13->Directory, v13);
v80 = (_ADAPTER_OBJECT *)v13->Object;
if( v80 )
{
HalPutDmaAdapter(v80);
v13->Object = 0i64;
}
goto LABEL_59;
}
if( v36 != 260 && v36 != 872 )
v151 = v142;
if( (v153 & *((_DWORD *)AccessState + 6)) != *((_DWORD *)AccessState + 6) )
{
LABEL_348:
LODWORD(v140) = -1073741790;
goto LABEL_157;
}
if( v36 != 260 && v36 != 280 && v36 != 872 )
{
if( !v142 )
{
v36 = -1073741772;
LODWORD(v140) = -1073741772;
}
v151 = 0i64;
LABEL_58:
if( v36 < 0 )
goto LABEL_157;
LABEL_59:
if( DeviceMap )
ObfDereferenceDeviceMap(DeviceMap);
if( DmaAdapter )
HalPutDmaAdapter(DmaAdapter);
if( v151 )
HalPutDmaAdapter(v151);
SeClearLearningModeObjectInformation();
v37 = v140;
if( (int)v140 < 0 )
{
*FoundObject = 0i64;
}
else
{
if( MaxRelativeAccessMask )
{
if( v153 != -1 )
*(_DWORD *)MaxRelativeAccessMask = v153;
}
*FoundObject = v142;
}
return v37;
}
if( (v172 & 0x1000) != 0 && v36 != 872 )
{
LODWORD(v140) = -1073740533;
goto LABEL_157;
}
if( !--v149 )
{
LABEL_156:
LODWORD(v140) = -1073741772;
goto LABEL_157;
}
if( ObjectName->Length )
{
HalPutDmaAdapter(DmaAdapter);
Buffer = ObjectName->Buffer;
DmaAdapter = 0i64;
v82 = *Buffer;
if( (_DWORD)v140 == 280 )
{
if( v82 != 92 )
{
DosDevicesDirectory = v142;
DmaAdapter = v142;
v151 = 0i64;
goto LABEL_171;
}
}
else if( v82 == 92 )
{
if( (_DWORD)v140 == 872 )
{
DosDevicesDirectory = (_ADAPTER_OBJECT *)*(&stru_140C23628 + 836);
}
else
{
v157 = 0i64;
if( PsGetPermanentSiloContext(Silo, (unsigned int)PsObjectDirectorySiloContextSlot, &v157) >= 0 )
{
DosDevicesDirectory = (_ADAPTER_OBJECT *)v157;
}
else
{
DosDevicesDirectory = (_ADAPTER_OBJECT *)*(&stru_140C23628 + 836);
v157 = (PVOID)*(&stru_140C23628 + 836);
}
}
DmaAdapter = DosDevicesDirectory;
ObfReferenceObject(DosDevicesDirectory);
LABEL_171:
v83 = DeviceMap;
if( !DeviceMap )
{
LABEL_176:
if( v13->DirectoryLocked )
ObpUnlockDirectory(v13->Directory, v13);
v86 = (_ADAPTER_OBJECT *)v13->Object;
if( v86 )
{
HalPutDmaAdapter(v86);
v13->Object = 0i64;
}
LABEL_29:
v28 = v15->Buffer;
if( ((unsigned __int8)v28 & 7) != 0 )
goto LABEL_33;
v29 = v14 & 0x800;
if( v15->Length < 8u || *(_QWORD *)v28 != ObpDosDevicesShortNamePrefix )
{
if( v15->Length == 6 && *(_DWORD *)v28 == ObpDosDevicesShortNameRoot && v28[2] == 63 )
{
v113 = ObpReferenceDeviceMap((v14 & 0x800) != 0);
DeviceMap = v113;
v114 = v113;
if( v113 )
{
if( v113->DosDevicesDirectory )
{
LODWORD(v140) = ObReferenceObjectByPointer(
v113->DosDevicesDirectory,
0i64,
ObjectType,
AccessMode);
if( (int)v140 >= 0 )
{
if( MaxRelativeAccessMask && v153 != -1 )
*(_DWORD *)MaxRelativeAccessMask = v153;
*FoundObject = v114->DosDevicesDirectory;
}
ObfDereferenceDeviceMap(v114);
HalPutDmaAdapter(DosDevicesDirectory);
SeClearLearningModeObjectInformation();
return v140;
}
}
}
goto LABEL_33;
}
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
DeviceMap = 0i64;
v88 = 0i64;
v89 = 0;
Process = (INT64)CurrentThread->Tcb.Process;
LODWORD(v91) = PsGetProcessServerSilo(Process);
if( v91 != PsGetCurrentServerSilo() )
v89 = 1;
if( (CurrentThread->CrossThreadFlags & 8) == 0 || v29 )
{
if( v89 )
goto LABEL_193;
v93 = 0i64;
}
else
{
if( v89 )
goto LABEL_193;
v111 = (_ADAPTER_OBJECT *)PsReferenceImpersonationTokenEx(
CurrentThread,
1ui64,
(UINT8 *)&a6 + 5,
(UINT8 *)&a6 + 4,
&ImpersonationLevel,
0i64);
v88 = v111;
if( !v111 )
goto LABEL_315;
ScatterBufferListHead = v111->AdapterObject.ScatterBufferListHead;
if( (_DWORD)ScatterBufferListHead == 999 )
{
v92 = (_KSPIN_LOCK *)((unsigned __int64)ScatterBufferListHead >> 32);
if( !(_DWORD)v92 )
{
v89 = 1;
goto LABEL_193;
}
}
ppDevMap = 0i64;
if( SeGetTokenDeviceMap(v111, &ppDevMap) >= 0 )
{
v93 = ppDevMap;
DeviceMap = ppDevMap;
if( ppDevMap )
{
_InterlockedIncrement(&ppDevMap->ReferenceCount);
LABEL_200:
if( v88 )
HalPutDmaAdapter(v88);
if( v93 && v93->DosDevicesDirectory )
{
v99 = *ObjectName;
*(_QWORD *)&v141.Length = *(_QWORD *)&ObjectName->Length;
v141.Length -= 8;
v141.Buffer = (wchar_t *)(_mm_srli_si128((__m128i)v99, 8).m128i_u64[0] + 8);
v141.MaximumLength -= 8;
DosDevicesDirectory = (_ADAPTER_OBJECT *)v93->DosDevicesDirectory;
goto LABEL_34;
}
DosDevicesDirectory = DmaAdapter;
v15 = ObjectName;
LABEL_33:
v141 = *v15;
LABEL_34:
v142 = DosDevicesDirectory;
continue;
}
}
else
{
LABEL_315:
v93 = 0i64;
}
}
if( !*(_QWORD *)(Process + 1416) && ObSetCurrentProcessDeviceMap() < 0 )
goto LABEL_200;
LABEL_193:
CurrentServerSiloGlobals = PsGetCurrentServerSiloGlobals(v92);
v95 = (_ETHREAD *)KeGetCurrentThread();
p_SystemDeviceMap = &CurrentServerSiloGlobals->ObSiloState.SystemDeviceMap;
--v95->Tcb.SpecialApcDisable;
v97 = (_DWORD)CurrentServerSiloGlobals + 120;
ExAcquirePushLockSharedEx(&CurrentServerSiloGlobals->ObSiloState.DeviceMapLock, 0i64);
if( v89 )
v93 = *p_SystemDeviceMap;
else
v93 = *(_DEVICE_MAP **)(Process + 1416);
DeviceMap = v93;
if( v93 )
_InterlockedIncrement(&v93->ReferenceCount);
ExReleasePushLockEx(v97, 0);
v98 = (_ETHREAD *)KeGetCurrentThread();
v17 = v98->Tcb.SpecialApcDisable++ == -1;
if( v17 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v98->Tcb.ApcState.ApcListHead[0].Flink != &v98->Tcb.152 )
KiCheckForKernelApcDelivery();
goto LABEL_200;
}
ReferenceCount = DeviceMap->ReferenceCount;
if( ReferenceCount == 1 )
{
LABEL_338:
ServerSiloGlobals = PsGetServerSiloGlobals(v83->ServerSilo);
v134 = (_ETHREAD *)KeGetCurrentThread();
--v134->Tcb.SpecialApcDisable;
v135 = (_DWORD)ServerSiloGlobals + 120;
ExAcquirePushLockExclusiveEx(&ServerSiloGlobals->ObSiloState.DeviceMapLock, 0i64);
v136 = DeviceMap;
ReferenceCount = _InterlockedExchangeAdd(&DeviceMap->ReferenceCount, 0xFFFFFFFF);
if( ReferenceCount == 1 )
{
v136->DosDevicesDirectory->DeviceMap = 0i64;
ExReleasePushLockEx(v135, 0);
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
ServerSilo = v136->ServerSilo;
if( ServerSilo )
ObfDereferenceObjectWithTag(ServerSilo, 0x6D44624Fui64);
ZwClose((_HANDLE)v136->DosDevicesDirectoryHandle);
HalPutDmaAdapter((PADAPTER_OBJECT)v136->DosDevicesDirectory);
ExFreePoolWithTag(v136, 0x6D44624Fu);
goto LABEL_175;
}
ExReleasePushLockEx(v135, 0);
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
}
else
{
while( 1 )
{
v85 = _InterlockedCompareExchange(&v83->ReferenceCount, ReferenceCount - 1, ReferenceCount);
v17 = ReferenceCount == v85;
ReferenceCount = v85;
if( v17 )
break;
if( v85 == 1 )
goto LABEL_338;
}
}
if( ReferenceCount <= 0 )
__fastfail(0xEu);
LABEL_175:
DosDevicesDirectory = DmaAdapter;
DeviceMap = 0i64;
goto LABEL_176;
}
}
LABEL_292:
LODWORD(v140) = -1073741773;
goto LABEL_157;
}
break;
}
if( v32 != ::DmaAdapter )
goto LABEL_351;
v39 = DosDevicesDirectory;
DirectoryObject = DosDevicesDirectory;
if( v141.Length && *v141.Buffer == 92 )
{
++v141.Buffer;
v141.Length -= 2;
v141.MaximumLength -= 2;
}
for( ComponentName = v141; v141.Length; v141.Length -= 2 )
{
if( *v141.Buffer == 92 )
break;
++v141.Buffer;
}
v141.MaximumLength -= ComponentName.Length - v141.Length;
ComponentName.Length -= v141.Length;
if( !ComponentName.Length )
goto LABEL_292;
if( !(_BYTE)v146
|| (*((_DWORD *)AccessState + 3) & 1) != 0
|| (BYTE6(v140) = ObpCheckTraverseAccess(
DosDevicesDirectory,
(UINT64)AccessState,
AccessState,
(UINT8)v27,
v146,
&a6)) != 0 )
{
if( v141.Length )
goto LABEL_83;
if( !InsertObject )
{
v13->LockStateSignature = -1145368012;
v109 = (_ETHREAD *)KeGetCurrentThread();
--v109->Tcb.KernelApcDisable;
ExAcquirePushLockSharedEx((_EX_PUSH_LOCK *)&DosDevicesDirectory->MapRegisterMdl, 0i64);
v13->LockStateSignature = -572714444;
ObfReferenceObject(DosDevicesDirectory);
v13->Directory = (_OBJECT_DIRECTORY *)DosDevicesDirectory;
*(_WORD *)&v13->DirectoryLocked = 1;
goto LABEL_83;
}
}
else
{
v36 = a6;
if( (int)a6 >= 0 )
v36 = -1073741772;
LODWORD(a6) = v36;
if( v141.Length || !InsertObject )
{
LABEL_321:
LODWORD(v140) = v36;
goto LABEL_58;
}
}
ObpLockDirectoryExclusive(v13, (_OBJECT_DIRECTORY *)DosDevicesDirectory);
LABEL_83:
Length = ComponentName.Length;
v41 = ComponentName.Buffer;
v42 = ComponentName.Length >> 1;
Object = DosDevicesDirectory;
HIDWORD(TokenInformation) = v172 & 0x40;
v145 = ComponentName.Length;
if( v42 < 4 )
{
v45 = 0;
}
else
{
v43 = 0i64;
do
{
v44 = *(_QWORD *)v41;
if( (*(_QWORD *)v41 & 0xFF80FF80FF80FF80ui64) != 0 )
{
v130 = 4i64;
do
{
v131 = (unsigned __int16)v44;
if( (unsigned __int16)v44 >= 0x61u )
{
if( (unsigned __int16)v44 <= 0x7Au )
v131 = (unsigned int)(unsigned __int16)v44 - 32;
else
v131 = NLS_UPCASE(v44);
}
*(_QWORD *)&v132 = v44;
*((_QWORD *)&v132 + 1) = v131;
v44 = v132 >> 16;
--v130;
}
while( v130 );
}
else
{
v44 &= 0xFFDFFFDFFFDFFFDFui64;
}
v41 += 4;
v42 -= 4;
v43 = v44 + (v43 >> 1) + 3 * v43;
}
while( v42 >= 4 );
Length = v145;
v39 = DosDevicesDirectory;
v45 = v43 + HIDWORD(v43);
}
if( !v42 )
{
LABEL_95:
DirectoryLocked = v13->DirectoryLocked;
v13->HashValue = v45;
BYTE4(v140) = DirectoryLocked;
v49 = v45 % 0x25;
v50 = v49;
v13->HashIndex = v49;
p_ChainLink = (_OBJECT_DIRECTORY_ENTRY **)((char *)v39 + 8 * v49);
p_MapRegisterMdl = (_EX_PUSH_LOCK *)&v39->MapRegisterMdl;
if( !DirectoryLocked )
{
v13->LockStateSignature = -1145368012;
v53 = (_ETHREAD *)KeGetCurrentThread();
--v53->Tcb.KernelApcDisable;
ExAcquirePushLockSharedEx(p_MapRegisterMdl, 0i64);
v13->LockStateSignature = -572714444;
ObfReferenceObject(DosDevicesDirectory);
v13->Directory = (_OBJECT_DIRECTORY *)DosDevicesDirectory;
*(_WORD *)&v13->DirectoryLocked = 1;
}
v27 = *p_ChainLink;
if( !*p_ChainLink )
goto LABEL_101;
while( 1 )
{
if( v27->HashValue == v13->HashValue )
{
v50 = (__int64)v27->Object - *((unsigned __int8 *)&dword_140C25D60 + (*((_BYTE *)v27->Object - 22) & 3)) - 48;
v69 = Length;
if( Length == *(unsigned __int16 *)(v50 + 8) )
{
v70 = ComponentName.Buffer;
v71 = *(_QWORD **)(v50 + 16);
v72 = (wchar_t *)((char *)ComponentName.Buffer + Length);
if( v145 >= 8 )
{
do
{
if( *(_QWORD *)v70 != *v71 )
break;
v69 -= 8;
if( !v69 )
goto LABEL_137;
v70 += 4;
++v71;
}
while( v69 >= 8 );
}
if( v70 >= v72 )
{
LABEL_137:
DosDevicesDirectory = (_ADAPTER_OBJECT *)v27->Object;
ObfReferenceObject(DosDevicesDirectory);
if( !BYTE4(v140) )
{
ExReleasePushLockEx((ULONG_PTR)p_MapRegisterMdl, 0);
v76 = (_ADAPTER_OBJECT *)v13->Directory;
v13->LockStateSignature = -286387660;
HalPutDmaAdapter(v76);
v13->Directory = 0i64;
*(_WORD *)&v13->DirectoryLocked = 0;
KeLeaveCriticalRegion();
p_ChainLink = 0i64;
}
v50 = (__int64)v13->Object;
if( v50 )
HalPutDmaAdapter((PADAPTER_OBJECT)v50);
v13->Object = DosDevicesDirectory;
v13->EntryLink = p_ChainLink;
if( !DosDevicesDirectory )
goto LABEL_104;
LABEL_142:
v142 = DosDevicesDirectory;
if( BYTE6(v140) )
{
if( !DosDevicesDirectory )
goto LABEL_154;
if( !v141.Length )
{
v77 = *(NTSTATUS(__stdcall **)(VOID *, VOID *, _SECURITY_SUBJECT_CONTEXT *, _KPROCESSOR_MODE, UINT64, _UNICODE_STRING *, _UNICODE_STRING *, VOID *, _SECURITY_QUALITY_OF_SERVICE *, _OB_EXTENDED_PARSE_PARAMETERS *, VOID **))(ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ LOBYTE(DosDevicesDirectory[-1].AllocationState) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)DosDevicesDirectory - 48) >> 8)] + 144);
if( !v77 || InsertObject && v77 != ObpParseSymbolicLinkEx )
{
v36 = ObReferenceObjectByPointer(DosDevicesDirectory, 0i64, ObjectType, AccessMode);
LODWORD(v140) = v36;
goto LABEL_58;
}
}
goto LABEL_35;
}
if( DosDevicesDirectory )
{
v36 = a6;
goto LABEL_321;
}
LABEL_154:
if( v141.Length )
{
LODWORD(v140) = -1073741766;
}
else
{
if( !InsertObject )
goto LABEL_156;
if( ObjectType == ::DmaAdapter )
v115 = 8;
else
v115 = 4;
v116 = (_OBJECT_DIRECTORY *)DirectoryObject;
v117 = v146;
LOBYTE(DesiredAccess) = 0;
if( ObCheckCreateObjectAccess(
(INT64)DirectoryObject,
v115,
(INT64)AccessState,
(INT64)&ComponentName,
DesiredAccess,
v146,
&v140) )
{
SessionId = v116->SessionId;
if( SessionId != -1
&& (ObjectType == MmSectionObjectType || ObjectType == ::ObjectType)
&& SessionId != PsGetCurrentProcessSessionId()
&& !SeSinglePrivilegeCheck(*(_QWORD *)&SeCreateGlobalPrivilege, v117)
&& !ObpIsUnsecureName(&ComponentName, (v172 & 0x40) != 0) )
{
goto LABEL_348;
}
v119 = ComponentName.Length;
PoolWithTag = ExAllocatePoolWithTag(1ui64, ComponentName.Length, 1833853519i64);
if( PoolWithTag )
{
if( ObpInsertDirectoryEntry(v116, InsertObject, v13) )
{
memmove(PoolWithTag, ComponentName.Buffer, v119);
v121 = (char *)InsertObject
- *((unsigned __int8 *)&dword_140C25D60 + (*((char *)InsertObject - 22) & 3))
- 48;
v122 = (void *)*((_QWORD *)v121 + 2);
if( v122 )
ExFreePoolWithTag(v122, 0);
v123 = ComponentName.Length;
*((_WORD *)v121 + 4) = ComponentName.Length;
*((_WORD *)v121 + 5) = v123;
*((_QWORD *)v121 + 2) = PoolWithTag;
v142 = (_ADAPTER_OBJECT *)InsertObject;
LODWORD(v140) = 0;
goto LABEL_59;
}
ExFreePoolWithTag(PoolWithTag, 0);
}
LODWORD(v140) = -1073741670;
}
else if( (int)v140 >= 0 )
{
LODWORD(v140) = -1073741772;
}
}
goto LABEL_157;
}
if( HIDWORD(TokenInformation) )
{
v73 = (char *)v71 - (char *)v70;
while( 1 )
{
v74 = *v70;
v75 = *(wchar_t *)((char *)v70 + v73);
if( (_WORD)v74 != (_WORD)v75 )
{
if( (unsigned int)v74 >= 0x61 )
{
if( (unsigned int)v74 > 0x7A )
{
if( Nls844UnicodeUpcaseTable && (unsigned __int16)v74 >= 0xC0u )
{
v50 = (v74 & 0xF)
+ (unsigned int)*(unsigned __int16 *)(Nls844UnicodeUpcaseTable
+ 2i64
* (((unsigned __int8)v74 >> 4)
+ (unsigned int)*(unsigned __int16 *)(Nls844UnicodeUpcaseTable + 2 * (v74 >> 8))));
LOWORD(v74) = *(_WORD *)(Nls844UnicodeUpcaseTable + 2 * v50) + v74;
}
}
else
{
LOWORD(v74) = v74 - 32;
}
}
if( (unsigned int)v75 >= 0x61 )
{
if( (unsigned int)v75 > 0x7A )
{
if( Nls844UnicodeUpcaseTable && (unsigned __int16)v75 >= 0xC0u )
{
v50 = (v75 & 0xF)
+ (unsigned int)*(unsigned __int16 *)(Nls844UnicodeUpcaseTable
+ 2i64
* (((unsigned __int8)v75 >> 4)
+ (unsigned int)*(unsigned __int16 *)(Nls844UnicodeUpcaseTable + 2 * (v75 >> 8))));
LOWORD(v75) = *(_WORD *)(Nls844UnicodeUpcaseTable + 2 * v50) + v75;
}
}
else
{
LOWORD(v75) = v75 - 32;
}
}
if( (_WORD)v74 != (_WORD)v75 )
break;
}
if( ++v70 >= v72 )
goto LABEL_137;
}
}
else
{
while( *v70 == *(_WORD *)v71 )
{
++v70;
v71 = (_QWORD *)((char *)v71 + 2);
if( v70 >= v72 )
goto LABEL_137;
}
}
Length = v145;
}
}
p_ChainLink = &v27->ChainLink;
v27 = v27->ChainLink;
if( !v27 )
{
DirectoryLocked = BYTE4(v140);
LABEL_101:
if( !DirectoryLocked )
{
ExReleasePushLockEx((ULONG_PTR)p_MapRegisterMdl, 0);
v54 = (_ADAPTER_OBJECT *)v13->Directory;
v13->LockStateSignature = -286387660;
HalPutDmaAdapter(v54);
v13->Directory = 0i64;
*(_WORD *)&v13->DirectoryLocked = 0;
KeLeaveCriticalRegion();
}
DosDevicesDirectory = 0i64;
LABEL_104:
if( !BYTE5(v140) )
goto LABEL_142;
v55 = (_OBJECT_DIRECTORY *)Object;
LABEL_106:
Flags = v55->Flags;
ShadowDirectory = 0i64;
if( (Flags & 4) != 0 )
{
if( (Flags & 0x10) != 0 && !v170 )
goto LABEL_217;
ShadowDirectory = v55->ShadowDirectory;
}
else
{
v58 = PsGetCurrentServerSiloGlobals((_KSPIN_LOCK *)v50);
v59 = (_ETHREAD *)KeGetCurrentThread();
--v59->Tcb.SpecialApcDisable;
v60 = (_DWORD)v58 + 120;
ExAcquirePushLockSharedEx(&v58->ObSiloState.DeviceMapLock, 0i64);
v61 = v55->DeviceMap;
if( v61 )
ShadowDirectory = v61->GlobalDosDevicesDirectory;
ExReleasePushLockEx(v60, 0);
v62 = (_ETHREAD *)KeGetCurrentThread();
v17 = v62->Tcb.SpecialApcDisable++ == -1;
if( v17 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v62->Tcb.ApcState.ApcListHead[0].Flink != &v62->Tcb.152 )
KiCheckForKernelApcDelivery();
}
if( !ShadowDirectory )
goto LABEL_217;
v63 = v13->DirectoryLocked;
if( v63 )
{
ObfReferenceObject(v55);
v64 = LookupContext;
ObpUnlockDirectory(v55, LookupContext);
ObpLockDirectoryShared(LookupContext, ShadowDirectory);
HalPutDmaAdapter((PADAPTER_OBJECT)v55);
v63 = LookupContext->DirectoryLocked;
}
else
{
v64 = LookupContext;
}
v65 = &ShadowDirectory->HashBuckets[v64->HashIndex];
if( !v63 )
{
v64->LockStateSignature = -1145368012;
v66 = (_ETHREAD *)KeGetCurrentThread();
--v66->Tcb.KernelApcDisable;
ExAcquirePushLockSharedEx(&ShadowDirectory->Lock, 0i64);
v64->LockStateSignature = -572714444;
ObfReferenceObject(ShadowDirectory);
v64->Directory = ShadowDirectory;
*(_WORD *)&v64->DirectoryLocked = 1;
}
v67 = *v65;
if( !*v65 )
{
LABEL_122:
if( !v63 )
ObpUnlockDirectory(ShadowDirectory, v64);
DosDevicesDirectory = 0i64;
v55 = ShadowDirectory;
goto LABEL_125;
}
HashValue = v64->HashValue;
while( 1 )
{
if( v67->HashValue == HashValue )
{
v100 = v145;
v50 = (__int64)v67->Object
- *((unsigned __int8 *)&dword_140C25D60 + (*((_BYTE *)v67->Object - 22) & 3))
- 48;
if( v145 == *(unsigned __int16 *)(v50 + 8) )
{
v101 = ComponentName.Buffer;
v102 = *(_QWORD **)(v50 + 16);
v103 = (wchar_t *)((char *)ComponentName.Buffer + (int)v145);
if( v145 >= 8 )
{
do
{
if( *(_QWORD *)v101 != *v102 )
break;
v100 -= 8;
if( !v100 )
goto LABEL_212;
v101 += 4;
++v102;
}
while( v100 >= 8 );
}
if( v101 >= v103 )
{
LABEL_212:
DosDevicesDirectory = (_ADAPTER_OBJECT *)v67->Object;
ObfReferenceObject(DosDevicesDirectory);
if( v63 )
{
v107 = LookupContext;
}
else
{
ExReleasePushLockEx((_DWORD)ShadowDirectory + 296, 0);
v107 = LookupContext;
v108 = LookupContext->Directory;
LookupContext->LockStateSignature = -286387660;
HalPutDmaAdapter((PADAPTER_OBJECT)v108);
LookupContext->Directory = 0i64;
*(_WORD *)&LookupContext->DirectoryLocked = 0;
KeLeaveCriticalRegion();
v65 = 0i64;
}
v50 = (__int64)v107->Object;
if( v50 )
HalPutDmaAdapter((PADAPTER_OBJECT)v50);
v107->Object = DosDevicesDirectory;
v107->EntryLink = v65;
LABEL_217:
v55 = ShadowDirectory;
if( DosDevicesDirectory )
{
LABEL_218:
v13 = LookupContext;
goto LABEL_142;
}
LABEL_125:
v13 = LookupContext;
if( !ShadowDirectory )
goto LABEL_218;
goto LABEL_106;
}
if( HIDWORD(TokenInformation) )
{
v104 = (char *)v102 - (char *)v101;
while( 1 )
{
v105 = *v101;
v106 = *(wchar_t *)((char *)v101 + v104);
if( *v101 != v106 )
{
NLS_UPCASE(v106);
v124 = NLS_UPCASE(v105);
if( v124 != (_WORD)v27 )
break;
}
if( ++v101 >= v103 )
goto LABEL_212;
}
}
else
{
while( *v101 == *(_WORD *)v102 )
{
++v101;
v102 = (_QWORD *)((char *)v102 + 2);
if( v101 >= v103 )
goto LABEL_212;
}
}
}
}
v65 = &v67->ChainLink;
v67 = v67->ChainLink;
if( !v67 )
{
v64 = LookupContext;
goto LABEL_122;
}
}
}
}
}
while( 1 )
{
v46 = *v41++;
--v42;
v47 = (v45 >> 1) + 3 * v45;
if( v46 >= 0x61 )
{
if( v46 > 0x7A )
{
v125 = NLS_UPCASE(v46);
v45 = v125 + v126;
goto LABEL_94;
}
v47 -= 32;
}
v45 = v46 + v47;
LABEL_94:
if( !v42 )
goto LABEL_95;
}
}
if( !v15->Length || *v15->Buffer != 92 )
return -1073741765;
ReturnedSiloContext = 0i64;
if( PsGetPermanentSiloContext(v19, (unsigned int)PsObjectDirectorySiloContextSlot, &ReturnedSiloContext) >= 0 )
{
DosDevicesDirectory = (_ADAPTER_OBJECT *)ReturnedSiloContext;
}
else
{
DosDevicesDirectory = (_ADAPTER_OBJECT *)*(&stru_140C23628 + 836);
ReturnedSiloContext = (PVOID)*(&stru_140C23628 + 836);
}
DmaAdapter = DosDevicesDirectory;
if( DosDevicesDirectory )
ObfReferenceObject(DosDevicesDirectory);
if( v15->Length != 2 )
{
v166 = v15;
p_Name = &ObjectType->Name;
v167 = 0i64;
SeSetLearningModeObjectInformation(ObjectInformation);
goto LABEL_29;
}
if( DosDevicesDirectory )
{
LODWORD(v140) = ObReferenceObjectByPointer(DosDevicesDirectory, 0i64, ObjectType, AccessMode);
if( (int)v140 >= 0 )
*v18 = DosDevicesDirectory;
HalPutDmaAdapter(DosDevicesDirectory);
return v140;
}
else if( v21 )
{
result = ObReferenceObjectByPointer(v21, 0i64, ObjectType, AccessMode);
if( result >= 0 )
*v18 = v21;
}
else
{
return -1073741811;
}
return result;
}Referenced by:
ObOpenObjectByNameEx
ObReferenceObjectByName
ObReferenceObjectByNameEx
ObpInsertOrLocateNamedObject