Guest User

IovUnloadDrivers source code v2

a guest
Feb 1st, 2017
169
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 2.83 KB | None | 0 0
  1. NTSTATUS __stdcall IovUnloadDrivers()
  2. {
  3. NTSTATUS result; // er12@3
  4. PDRIVER_OBJECT driverObject; // rdi@4 MAPDST
  5. _DEVICE_OBJECT *DeviceObject; // rsi@7 MAPDST
  6. char have_next_driver; // bp@16
  7. PDRIVER_OBJECT *nextDriverObject; // rdi@16
  8. char have_next_device; // al@16
  9. PBOOLEAN unloadDriver; // [sp+30h] [bp-78h]@8
  10. _LARGE_INTEGER Interval; // [sp+38h] [bp-70h]@22
  11. struct _WORK_QUEUE_ITEM WorkItem; // [sp+40h] [bp-68h]@12
  12. KEVENT Event; // [sp+60h] [bp-48h]@12
  13.  
  14. if ( !PopShutdownCleanly )
  15. return STATUS_UNSUCCESSFUL;
  16. IovDriverListHead = 0i64;
  17. driverObject = 0i64;
  18. result = ObEnumerateObjectsByType(IoDriverObjectType, IovpBuildDriverObjectList, 0i64);
  19. while ( 1 )
  20. {
  21. driverObject = IovDriverListHead;
  22. if ( IovDriverListHead )
  23. IovDriverListHead = *IovDriverListHead;
  24. if ( !driverObject )
  25. break;
  26. DeviceObject = driverObject->DeviceObject;
  27. if ( !DeviceObject->Queue.Wcb.DeviceRoutine )
  28. goto LABEL_14;
  29. ObfReferenceObject(driverObject->DeviceObject);
  30. if ( IopCheckUnloadDriver(DeviceObject, &unloadDriver) < 0 && (ObfDereferenceObject(DeviceObject), unloadDriver) )
  31. {
  32. if ( IovpUnloadDriver(driverObject) == PsInitialSystemProcess )
  33. {
  34. (DeviceObject->Queue.Wcb.DeviceRoutine)(DeviceObject);
  35. }
  36. else
  37. {
  38. KeInitializeEvent(&Event, NotificationEvent, FALSE);
  39. ExInitializeWorkItem(WorkItem, IopLoadUnloadDriver, WorkItem);
  40. ExQueueWorkItem(&WorkItem, DelayedWorkQueue);
  41. KeWaitForSingleObject(&Event, 0, 0, 0, 0i64);
  42. }
  43. ObMakeTemporaryObject(DeviceObject);
  44. ObfDereferenceObject(DeviceObject);
  45. LABEL_14:
  46. ObfDereferenceObject(driverObject->DeviceObject);
  47. ExFreePoolWithTag(driverObject, 0);
  48. }
  49. else
  50. {
  51. *&driverObject->Type = driverObject;
  52. }
  53. }
  54. do
  55. {
  56. have_next_driver = 0;
  57. nextDriverObject = 0i64;
  58. have_next_device = 0;
  59. while ( driverObject )
  60. {
  61. DeviceObject = driverObject->DeviceObject;
  62. driverObject = *&driverObject->Type;
  63. if ( DeviceObject->NextDevice & 1 )
  64. {
  65. ObfDereferenceObject(DeviceObject);
  66. ExFreePoolWithTag(driverObject, 0);
  67. have_next_device = 1;
  68. }
  69. else
  70. {
  71. *&driverObject->Type = nextDriverObject;
  72. nextDriverObject = driverObject;
  73. }
  74. }
  75. if ( have_next_device )
  76. {
  77. Interval.QuadPart = -100000000i64;
  78. ZwDelayExecution(0i64, &Interval);
  79. have_next_driver = 1;
  80. }
  81. driverObject = nextDriverObject;
  82. }
  83. while ( have_next_driver == 1 && nextDriverObject );
  84. while ( driverObject )
  85. {
  86. DeviceObject = driverObject->DeviceObject;
  87. driverObject = *&driverObject->Type;
  88. ObfDereferenceObject(DeviceObject);
  89. ExFreePoolWithTag(driverObject, 0);
  90. }
  91. return result;
  92. }
Advertisement
Add Comment
Please, Sign In to add comment