Last active
June 13, 2020 02:49
-
-
Save fisboger/50b27368bc17ddce0baddb9d7672cd1b to your computer and use it in GitHub Desktop.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
__int64 __fastcall UtilVerifyAndLockDirectory(LPCWSTR path, HANDLE dirHandle) | |
{ | |
if ( dirHandle ) | |
{ | |
pathHandle = CreateFileW(path, 0xC0000000, 0, 0i64, 3u, 0x2000000u, 0i64); | |
result = UtilVerifyFilePath(v3, pathHandle); | |
if ( result >= 0 ) | |
{ | |
result = UtilGetGUIDString((struct CString *)&randomGuid); | |
if ( result >= 0 ) | |
{ | |
RtlInitUnicodeString(&fileName, randomGuid); | |
ObjectAttributes.Length = 48; | |
ObjectAttributes.RootDirectory = pathHandle; | |
ObjectAttributes.Attributes = 64; | |
ObjectAttributes.ObjectName = &fileName; | |
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64; | |
ntStatus = NtCreateFile( | |
&FileHandle, | |
0xC0010000, | |
&ObjectAttributes, | |
&IoStatusBlock, | |
0i64, | |
0x80u, | |
0, | |
2u, | |
0x1000u, | |
0i64, | |
0); | |
if ( FileHandle != (void *)-1i64 ) | |
{ | |
if ( ntStatus >= 0 ) | |
{ | |
result = 0; | |
} | |
else | |
{ | |
result = ntStatus | 0x10000000; | |
CloseHandle(FileHandle); | |
FileHandle = (void *)-1i64; | |
} | |
goto RETURN_LABEL; | |
} | |
goto RETURN_LABEL; | |
} | |
else | |
{ | |
goto RETURN_LABEL; | |
} | |
} | |
else | |
{ | |
goto RETURN_LABEL; | |
} | |
goto RETURN_LABEL; | |
} | |
RETURN_LABEL: | |
CloseHandle(pathHandle); | |
goto LABEL_36; | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment