Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- __int64 __fastcall PopCreateHiberFile(LARGE_INTEGER *a1)
- {
- ...
- RtlInitUnicodeString(&Source, L"\hiberfil.sys");
- ...
- RtlAppendUnicodeStringToString(&Destination, &IoArcBootDeviceName);
- RtlAppendUnicodeStringToString(&Destination, &Source);
- ...
- ObjectAttributes.RootDirectory = 0i64;
- ObjectAttributes.Attributes = 576;
- ObjectAttributes.ObjectName = &Destination;
- ObjectAttributes.SecurityDescriptor = v5;
- ObjectAttributes.SecurityQualityOfService = 0i64;
- ret_2 = IoCreateFile(
- &FileHandle,
- 0x100003u,
- &ObjectAttributes,
- ...
- NTSTATUS INIT_FUNCTION NTAPI IopCreateArcNames ( IN PLOADER_PARAMETER_BLOCK LoaderBlock )
- ...
- /* Create the global system partition name */
- 63 sprintf(Buffer, "\ArcName\%s", LoaderBlock->ArcBootDeviceName);
- 64 RtlInitAnsiString(&ArcString, Buffer);
- 65 RtlAnsiStringToUnicodeString(&IoArcBootDeviceName, &ArcString, TRUE);
- 66
- 67 /* Allocate memory for the string */
- 68 Length = strlen(LoaderBlock->ArcBootDeviceName) + sizeof(ANSI_NULL);
- 69 IoLoaderArcBootDeviceName = ExAllocatePoolWithTag(PagedPool,
- 70 Length,
- 71 TAG_IO);
- 72 if (IoLoaderArcBootDeviceName)
- 73 {
- 74 /* Copy the name */
- 75 RtlCopyMemory(IoLoaderArcBootDeviceName,
- 76 LoaderBlock->ArcBootDeviceName,
- 77 Length);
- 78 }
- ...
- 1405A9C15 4C 8B 4B 78 mov r9, [rbx+78h]
- Patch #1 80
- 1405A9C19 4C 8D 05 30 06+ lea r8, aArcnameS ; "\ArcName\%s"
- 1405A9C20 48 8D 4C 24 40 lea rcx, [rsp+0D8h+pszDest] ; pszDest
- 1405A9C25 48 8B D7 mov rdx, rdi ; cchDest
- 1405A9C28 E8 E3 AE B6 FF call RtlStringCchPrintfA
- ...
- 1405A9C41 48 8D 0D C0 E7+ lea rcx, IoArcBootDeviceName ; DestinationString
- 1405A9C48 41 B0 01 mov r8b, 1 ; AllocateDestinationString
- 1405A9C4B E8 60 13 DB FF call RtlAnsiStringToUnicodeString
- 1405A9C50 48 8B 7B 78 mov rdi, [rbx+78h]
- Patch #2 80
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement