Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- NTSTATUS __stdcall IovUnloadDrivers()
- {
- NTSTATUS result; // er12@3
- PDRIVER_OBJECT driverObject; // rdi@4 MAPDST
- _DEVICE_OBJECT *DeviceObject; // rsi@7 MAPDST
- char have_next_driver; // bp@16
- PDRIVER_OBJECT *nextDriverObject; // rdi@16
- char have_next_device; // al@16
- PBOOLEAN unloadDriver; // [sp+30h] [bp-78h]@8
- _LARGE_INTEGER Interval; // [sp+38h] [bp-70h]@22
- struct _WORK_QUEUE_ITEM WorkItem; // [sp+40h] [bp-68h]@12
- KEVENT Event; // [sp+60h] [bp-48h]@12
- if ( !PopShutdownCleanly )
- return STATUS_UNSUCCESSFUL;
- IovDriverListHead = 0i64;
- driverObject = 0i64;
- result = ObEnumerateObjectsByType(IoDriverObjectType, IovpBuildDriverObjectList, 0i64);
- while ( 1 )
- {
- driverObject = IovDriverListHead;
- if ( IovDriverListHead )
- IovDriverListHead = *IovDriverListHead;
- if ( !driverObject )
- break;
- DeviceObject = driverObject->DeviceObject;
- if ( !DeviceObject->Queue.Wcb.DeviceRoutine )
- goto LABEL_14;
- ObfReferenceObject(driverObject->DeviceObject);
- if ( IopCheckUnloadDriver(DeviceObject, &unloadDriver) < 0 && (ObfDereferenceObject(DeviceObject), unloadDriver) )
- {
- if ( IovpUnloadDriver(driverObject) == PsInitialSystemProcess )
- {
- (DeviceObject->Queue.Wcb.DeviceRoutine)(DeviceObject);
- }
- else
- {
- KeInitializeEvent(&Event, NotificationEvent, FALSE);
- ExInitializeWorkItem(WorkItem, IopLoadUnloadDriver, WorkItem);
- ExQueueWorkItem(&WorkItem, DelayedWorkQueue);
- KeWaitForSingleObject(&Event, 0, 0, 0, 0i64);
- }
- ObMakeTemporaryObject(DeviceObject);
- ObfDereferenceObject(DeviceObject);
- LABEL_14:
- ObfDereferenceObject(driverObject->DeviceObject);
- ExFreePoolWithTag(driverObject, 0);
- }
- else
- {
- *&driverObject->Type = driverObject;
- }
- }
- do
- {
- have_next_driver = 0;
- nextDriverObject = 0i64;
- have_next_device = 0;
- while ( driverObject )
- {
- DeviceObject = driverObject->DeviceObject;
- driverObject = *&driverObject->Type;
- if ( DeviceObject->NextDevice & 1 )
- {
- ObfDereferenceObject(DeviceObject);
- ExFreePoolWithTag(driverObject, 0);
- have_next_device = 1;
- }
- else
- {
- *&driverObject->Type = nextDriverObject;
- nextDriverObject = driverObject;
- }
- }
- if ( have_next_device )
- {
- Interval.QuadPart = -100000000i64;
- ZwDelayExecution(0i64, &Interval);
- have_next_driver = 1;
- }
- driverObject = nextDriverObject;
- }
- while ( have_next_driver == 1 && nextDriverObject );
- while ( driverObject )
- {
- DeviceObject = driverObject->DeviceObject;
- driverObject = *&driverObject->Type;
- ObfDereferenceObject(DeviceObject);
- ExFreePoolWithTag(driverObject, 0);
- }
- return result;
- }
Advertisement
Add Comment
Please, Sign In to add comment