status = TCReadDevice (LowerDeviceObject, ioBuffer, offset, TC_SECTOR_SIZE_BIOS);

if (NT_SUCCESS (status))

{

NTSTATUS saveStatus = STATUS_INVALID_PARAMETER;

XSTATE_SAVE SaveState;

if (IsCpuIntel() && HasSAVX())

saveStatus = KeSaveExtendedProcessorStateVC(XSTATE_MASK_GSSE, &SaveState);

#endif

WHIRLPOOL_add (ioBuffer, TC_BOOT_SECTOR_PIM_VALUE_OFFSET, &whirlpool);

WHIRLPOOL_add (ioBuffer + TC_BOOT_SECTOR_USER_MESSAGE_OFFSET + TC_BOOT_SECTOR_USER_MESSAGE_MAX_LENGTH, (TC_BOOT_SECTOR_USER_CONFIG_OFFSET - (TC_BOOT_SECTOR_USER_MESSAGE_OFFSET + TC_BOOT_SECTOR_USER_MESSAGE_MAX_LENGTH)), &whirlpool);

sha512_end (&BootLoaderFingerprint [WHIRLPOOL_DIGESTSIZE], &sha2);

}

KeRestoreExtendedProcessorStateVC(&SaveState);

#endif

}

else

int64 hiddenHeaderOffset = BootArgs.HiddenSystemPartitionStart + TC_HIDDEN_VOLUME_HEADER_OFFSET;

NTSTATUS status;

LARGE_INTEGER offset;

int pkcs5_prf = 0, pim = 0;

PARTITION_INFORMATION_EX pi;

BOOL bIsGPT = FALSE;

if (!NT_SUCCESS (status))

TC_BUG_CHECK (status);

{

}

// Hidden system hibernation is not supported if an extra boot partition is present as the system is not allowed to update the boot partition

if (IsHiddenSystemRunning() && (BootArgs.Flags & TC_BOOT_ARGS_FLAG_EXTRA_BOOT_PARTITION))

static VOID MountDriveWorkItemRoutine (PDEVICE_OBJECT deviceObject, DriveFilterExtension *filterExtension)

{

CheckDeviceTypeAndMount (filterExtension);

KeSetEvent (&filterExtension->MountWorkItemCompletedEvent, IO_NO_INCREMENT, FALSE);

}

static NTSTATUS DispatchPower (PDEVICE_OBJECT DeviceObject, PIRP Irp, DriveFilterExtension *Extension, PIO_STACK_LOCATION irpSp)

{

NTSTATUS status;

Dump ("IRP_MJ_POWER minor=%d type=%d shutdown=%d\n", (int) irpSp->MinorFunction, (int) irpSp->Parameters.Power.Type, (int) irpSp->Parameters.Power.ShutdownType);

if (SetupInProgress

{

BOOL bBlockTrim = BlockSystemTrimCommand || IsHiddenSystemRunning();

NTSTATUS status = IoAcquireRemoveLock (&Extension->Queue.RemoveLock, Irp);

if (!NT_SUCCESS (status))

return TCCompleteIrp (Irp, status, 0);

Dump ("DriverFilter-DispatchControl: IOCTL_STORAGE_MANAGE_DATA_SET_ATTRIBUTES\n");

if (bBlockTrim)

{

DWORD inputLength = irpSp->Parameters.DeviceIoControl.InputBufferLength;

if (inputLength >= sizeof (DEVICE_MANAGE_DATA_SET_ATTRIBUTES))

{

return status;

}

{

irp->IoStatus.Information = 0;

if (BootDriveFound && BootDriveFilterExtension && BootDriveFilterExtension->DriveMounted)

InvalidateDriveFilterKeys (BootDriveFilterExtension);

ClearSecurityParameters();

irp->IoStatus.Status = STATUS_SUCCESS;

}

}

{

LARGE_INTEGER offset;

ReopenBootVolumeHeaderRequest *request = (ReopenBootVolumeHeaderRequest *) irp->AssociatedIrp.SystemBuffer;

irp->IoStatus.Information = 0;

goto ret;

}

if (IsRamEncryptionEnabled())

{

VcUnprotectKeys (BootDriveFilterExtension->HeaderCryptoInfo, VcGetEncryptionID (BootDriveFilterExtension->HeaderCryptoInfo));

}

if (ReadVolumeHeader (!BootDriveFilterExtension->HiddenSystem, header, &request->VolumePassword, request->pkcs5_prf, request->pim, NULL, BootDriveFilterExtension->HeaderCryptoInfo) == 0)

{

Dump ("Header reopened\n");

if (IsRamEncryptionEnabled())

{

VcProtectKeys (BootDriveFilterExtension->HeaderCryptoInfo, VcGetEncryptionID(BootDriveFilterExtension->HeaderCryptoInfo));

}

ComputeBootLoaderFingerprint (BootDriveFilterExtension->LowerDeviceObject, header);

BootDriveFilterExtension->Queue.CryptoInfo->pkcs5 = BootDriveFilterExtension->HeaderCryptoInfo->pkcs5;

ModuleTableItem *moduleItem;

LIST_ENTRY *listEntry;

KIRQL origIrql;

if (!imageInfo || !imageInfo->SystemModeImage || !imageInfo->ImageBase || !TCDriverObject->DriverSection)

return;

}

static VOID SetupThreadProc (PVOID threadArg)

{

DriveFilterExtension *Extension = BootDriveFilterExtension;

// wipeRandCharsUpdate instead of relying on uninitialized stack memory

ChaCha20RngCtx rngCtx;

uint8 pbSeed[CHACHA20RNG_KEYSZ + CHACHA20RNG_IVSZ];

GetDriverRandomSeed (pbSeed, sizeof (pbSeed));

ChaCha20RngInit (&rngCtx, pbSeed, GetDriverRandomSeed, 0);

}

{

if (ValidateIOBufferSize (irp, sizeof (VOLUME_PROPERTIES_STRUCT), ValidateOutput))

{

}

{

/* IMPORTANT: Do NOT add any potentially time-consuming operations to this function. */

}

{

if (ValidateIOBufferSize (irp, sizeof (uint16), ValidateOutput))

{

}

}

{

if (ValidateIOBufferSize (irp, sizeof (BootLoaderFingerprintRequest), ValidateOutput))

{

BootLoaderFingerprintRequest *bootLoaderFingerprint = (BootLoaderFingerprintRequest *) irp->AssociatedIrp.SystemBuffer;

/* compute the fingerprint again and check if it is the same as the one retrieved during boot */

if (!header)

{

irp->IoStatus.Status = STATUS_INSUFFICIENT_RESOURCES;

}

}

{

if (ValidateIOBufferSize (irp, sizeof (GetBootEncryptionAlgorithmNameRequest), ValidateOutput))

{

static VOID DecoySystemWipeThreadProc (PVOID threadArg)

{

DriveFilterExtension *Extension = BootDriveFilterExtension;

LARGE_INTEGER offset;

}

{

if (ValidateIOBufferSize (irp, sizeof (DecoySystemWipeStatus), ValidateOutput))

{

NTSTATUS AbortBootEncryptionSetup ();

NTSTATUS DriveFilterAddDevice (PDRIVER_OBJECT driverObject, PDEVICE_OBJECT pdo);

NTSTATUS DriveFilterDispatchIrp (PDEVICE_OBJECT DeviceObject, PIRP Irp);

NTSTATUS GetSetupResult ();

DriveFilterExtension *GetBootDriveFilterExtension ();

CRYPTO_INFO *GetSystemDriveCryptoInfo ();

NTSTATUS LoadBootArguments (BOOL bIsEfi);

static NTSTATUS SaveDriveVolumeHeader (DriveFilterExtension *Extension);

NTSTATUS StartBootEncryptionSetup (PDEVICE_OBJECT DeviceObject, PIRP irp, PIO_STACK_LOCATION irpSp);

NTSTATUS StartDecoySystemWipe (PDEVICE_OBJECT DeviceObject, PIRP irp, PIO_STACK_LOCATION irpSp);

NTSTATUS AbortDecoySystemWipe ();

BOOL IsDecoySystemWipeInProgress();

NTSTATUS GetDecoySystemWipeResult();

uint64 GetBootDriveLength ();

NTSTATUS WriteBootDriveSector (PIRP irp, PIO_STACK_LOCATION irpSp);

static NTSTATUS DumpFilterStart (PFILTER_EXTENSION filterExtension)

{

Dump ("DumpFilterStart type=%d\n", filterExtension->DumpType);

if (BootDriveFilterExtension->MagicNumber != TC_BOOT_DRIVE_FILTER_EXTENSION_MAGIC_NUMBER)

uint32 intersectLength;

PVOID writeBuffer;

CSHORT origMdlFlags;

if (BootDriveFilterExtension->MagicNumber != TC_BOOT_DRIVE_FILTER_EXTENSION_MAGIC_NUMBER)

TC_BUG_CHECK (STATUS_CRC_ERROR);

if ((offset & (ENCRYPTION_DATA_UNIT_SIZE - 1)) != 0)

TC_BUG_CHECK (STATUS_INVALID_PARAMETER);

if (!writeBuffer)

TC_BUG_CHECK (STATUS_INSUFFICIENT_RESOURCES);

static NTSTATUS DumpFilterFinish (PFILTER_EXTENSION filterExtension)

{

Dump ("DumpFilterFinish type=%d\n", filterExtension->DumpType);

return STATUS_SUCCESS;

static NTSTATUS DumpFilterUnload (PFILTER_EXTENSION filterExtension)

{

Dump ("DumpFilterUnload type=%d\n", filterExtension->DumpType);

if (WriteFilterBuffer)

{

UINT64_STRUCT dataUnit;

if (!dataBuffer)

{

TCfree (buffer);

continue;

}

if (dataBuffer == NULL)

{

int EncryptionItemCount = 0;

int EncryptionFragmentSize = 0;

PDEVICE_OBJECT VirtualVolumeDeviceObjects[MAX_MOUNTED_VOLUME_DRIVE_NUMBER + 1];

BOOL AlignValue (ULONG ulValue, ULONG ulAlignment, ULONG *pulResult)

WHIRLPOOL_add ((unsigned char *) &(iSeed2.QuadPart), sizeof(iSeed2.QuadPart), &tctx);

if (KeQueryInterruptTimePrecisePtr)

{

WHIRLPOOL_add ((unsigned char *) &(iSeed.QuadPart), sizeof(iSeed.QuadPart), &tctx);

WHIRLPOOL_add ((unsigned char *) &(iSeed2.QuadPart), sizeof(iSeed2.QuadPart), &tctx);

}

}

{

PKEY_VALUE_PARTIAL_INFORMATION startKeyValue;

LONG version;

int i;

// KeAreAllApcsDisabled is available starting from Windows Server 2003

if ((OsMajorVersion > 5) || (OsMajorVersion == 5 && OsMinorVersion >= 2))

UNICODE_STRING KeAreAllApcsDisabledFuncName;

RtlInitUnicodeString(&KeAreAllApcsDisabledFuncName, L"KeAreAllApcsDisabled");

}

// KeSaveExtendedProcessorState/KeRestoreExtendedProcessorState are available starting from Windows 7

RtlInitUnicodeString(&groupCountFuncName, L"KeQueryActiveGroupCount");

RtlInitUnicodeString(&procCountFuncName, L"KeQueryActiveProcessorCountEx");

RtlInitUnicodeString(&setAffinityFuncName, L"KeSetSystemGroupAffinityThread");

}

// ExGetFirmwareEnvironmentVariable is available starting from Windows 8

if ((OsMajorVersion > 6) || (OsMajorVersion == 6 && OsMinorVersion >= 2))

{

UNICODE_STRING funcName;

RtlInitUnicodeString(&funcName, L"ExGetFirmwareEnvironmentVariable");

}

// KeQueryInterruptTimePrecise is available starting from Windows 8.1

{

UNICODE_STRING funcName;

RtlInitUnicodeString(&funcName, L"KeQueryInterruptTimePrecise");

}

// Load dump filter if the main driver is already loaded

TCDriverObject = DriverObject;

SelfTestsPassed = AutoTestAlgorithms();

// Enable device class filters and load boot arguments if the driver is set to start at system boot

{

{

if (!SelfTestsPassed)

{

// in case of system encryption, if self-tests fail, disable all extended CPU

// features and try again in order to workaround faulty configurations

SelfTestsPassed = AutoTestAlgorithms();

// BUG CHECK if the self-tests still fail

if (!SelfTestsPassed)

}

VolumeClassFilterRegistered = IsVolumeClassFilterRegistered();

DriverObject->DriverExtension->AddDevice = DriverAddDevice;

}

}

{

}

for (i = 0; i <= IRP_MJ_MAXIMUM_FUNCTION; ++i)

{

}

DriverObject->DriverUnload = TCUnloadDriver;

}

NTSTATUS ProcessVolumeDeviceControlIrp (PDEVICE_OBJECT DeviceObject, PEXTENSION Extension, PIRP Irp)

{

PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation (Irp);

switch (irpSp->Parameters.DeviceIoControl.IoControlCode)

{

else

{

ULONG outLength;

PMOUNTDEV_UNIQUE_ID outputBuffer = (PMOUNTDEV_UNIQUE_ID) Irp->AssociatedIrp.SystemBuffer;

RtlStringCbCopyA (volId, sizeof(volId),TC_UNIQUE_ID_PREFIX);

if (ValidateIOBufferSize (Irp, minOutputSize, ValidateOutput))

{

BOOL bFullBuffer = (irpSp->Parameters.DeviceIoControl.OutputBufferLength >= fullOutputSize)? TRUE : FALSE;

PDISK_GEOMETRY_EX outputBuffer = (PDISK_GEOMETRY_EX) Irp->AssociatedIrp.SystemBuffer;

Dump ("ProcessVolumeDeviceControlIrp (IOCTL_DISK_GET_DRIVE_LAYOUT)\n");

if (ValidateIOBufferSize (Irp, sizeof (DRIVE_LAYOUT_INFORMATION), ValidateOutput))

{

BOOL bFullBuffer = (irpSp->Parameters.DeviceIoControl.OutputBufferLength >= (sizeof (DRIVE_LAYOUT_INFORMATION) + 3*sizeof(PARTITION_INFORMATION)))? TRUE : FALSE;

PDRIVE_LAYOUT_INFORMATION outputBuffer = (PDRIVE_LAYOUT_INFORMATION)

Irp->AssociatedIrp.SystemBuffer;

{

if (ValidateIOBufferSize (Irp, sizeof (DRIVE_LAYOUT_INFORMATION_EX), ValidateOutput))

{

BOOL bFullBuffer = (irpSp->Parameters.DeviceIoControl.OutputBufferLength >= (sizeof (DRIVE_LAYOUT_INFORMATION_EX) + 3*sizeof(PARTITION_INFORMATION_EX)))? TRUE : FALSE;

PDRIVE_LAYOUT_INFORMATION_EX outputBuffer = (PDRIVE_LAYOUT_INFORMATION_EX)

Irp->AssociatedIrp.SystemBuffer;

case IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS:

Dump ("ProcessVolumeDeviceControlIrp (IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS)\n");

// Vista's, Windows 8.1 and later filesystem defragmenter fails if IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS does not succeed.

{

Irp->IoStatus.Status = STATUS_SUCCESS;

}

break;

{

if (ValidateIOBufferSize (Irp, sizeof (DEVICE_MANAGE_DATA_SET_ATTRIBUTES), ValidateInput))

{

DWORD inputLength = irpSp->Parameters.DeviceIoControl.InputBufferLength;

PDEVICE_MANAGE_DATA_SET_ATTRIBUTES pInputAttrs = (PDEVICE_MANAGE_DATA_SET_ATTRIBUTES) Irp->AssociatedIrp.SystemBuffer;

DEVICE_DATA_MANAGEMENT_SET_ACTION action = pInputAttrs->Action;

{

PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation (Irp);

NTSTATUS ntStatus;

switch (irpSp->Parameters.DeviceIoControl.IoControlCode)

{

case TC_IOCTL_IS_DRIVER_UNLOAD_DISABLED:

if (ValidateIOBufferSize (Irp, sizeof (int), ValidateOutput))

{

*(int *) Irp->AssociatedIrp.SystemBuffer = DriverUnloadDisabled;

IO_STATUS_BLOCK IoStatus;

LARGE_INTEGER offset;

ACCESS_MASK access = FILE_READ_ATTRIBUTES;

if (!ValidateIOBufferSize (Irp, sizeof (OPEN_TEST_STRUCT), ValidateInputOutput))

break;

if (readBuffer[510] == 0x55 && readBuffer[511] == 0xaa)

{

for (i = 0; i < 4; ++i)

{

if (readBuffer[446 + i * 16 + 4] == PARTITION_LDM)

{

RESOLVE_SYMLINK_STRUCT *resolve = (RESOLVE_SYMLINK_STRUCT *) Irp->AssociatedIrp.SystemBuffer;

{

EnsureNullTerminatedString (resolve->symLinkName, sizeof (resolve->symLinkName));

resolve->targetName,

sizeof (resolve->targetName));

Irp->IoStatus.Information = sizeof (RESOLVE_SYMLINK_STRUCT);

}

}

break;

DISK_PARTITION_INFO_STRUCT *info = (DISK_PARTITION_INFO_STRUCT *) Irp->AssociatedIrp.SystemBuffer;

{

PARTITION_INFORMATION_EX pi;

EnsureNullTerminatedString (info->deviceName, sizeof (info->deviceName));

{

memset (&info->partInfo, 0, sizeof (info->partInfo));

else

{

// Windows 2000 does not support IOCTL_DISK_GET_PARTITION_INFO_EX

info->IsGPT = FALSE;

}

{

GET_LENGTH_INFORMATION lengthInfo;

{

memset (&info->partInfo, 0, sizeof (info->partInfo));

info->partInfo.PartitionLength = lengthInfo.Length;

info->IsDynamic = FALSE;

{

# define IOCTL_VOLUME_IS_DYNAMIC CTL_CODE(IOCTL_VOLUME_BASE, 18, METHOD_BUFFERED, FILE_ANY_ACCESS)

if (!NT_SUCCESS (TCDeviceIoControl (info->deviceName, IOCTL_VOLUME_IS_DYNAMIC, NULL, 0, &info->IsDynamic, sizeof (info->IsDynamic))))

}

Irp->IoStatus.Information = sizeof (DISK_PARTITION_INFO_STRUCT);

}

}

break;

{

DISK_GEOMETRY_STRUCT *g = (DISK_GEOMETRY_STRUCT *) Irp->AssociatedIrp.SystemBuffer;

{

EnsureNullTerminatedString (g->deviceName, sizeof (g->deviceName));

Dump ("Calling IOCTL_DISK_GET_DRIVE_GEOMETRY on %ls\n", g->deviceName);

IOCTL_DISK_GET_DRIVE_GEOMETRY,

NULL, 0, &g->diskGeometry, sizeof (g->diskGeometry));

Irp->IoStatus.Information = sizeof (DISK_GEOMETRY_STRUCT);

}

}

break;

{

DISK_GEOMETRY_EX_STRUCT *g = (DISK_GEOMETRY_EX_STRUCT *) Irp->AssociatedIrp.SystemBuffer;

{

PVOID buffer = TCalloc (256); // enough for DISK_GEOMETRY_EX and padded data

if (buffer)

{

EnsureNullTerminatedString (g->deviceName, sizeof (g->deviceName));

Dump ("Calling IOCTL_DISK_GET_DRIVE_GEOMETRY_EX on %ls\n", g->deviceName);

IOCTL_DISK_GET_DRIVE_GEOMETRY_EX,

NULL, 0, buffer, 256);

{

PDISK_GEOMETRY_EX pGeo = (PDISK_GEOMETRY_EX) buffer;

memcpy (&g->diskGeometry, &pGeo->Geometry, sizeof (DISK_GEOMETRY));

{

DISK_GEOMETRY dg = {0};

Dump ("Failed. Calling IOCTL_DISK_GET_DRIVE_GEOMETRY on %ls\n", g->deviceName);

IOCTL_DISK_GET_DRIVE_GEOMETRY,

NULL, 0, &dg, sizeof (dg));

{

g->DiskSize.QuadPart = dg.Cylinders.QuadPart * dg.SectorsPerTrack * dg.TracksPerCylinder * dg.BytesPerSector;

{

}

}

}

TCfree (buffer);

Irp->IoStatus.Information = sizeof (DISK_GEOMETRY_EX_STRUCT);

}

else

{

if (ValidateIOBufferSize (Irp, sizeof (MOUNT_STRUCT), ValidateInputOutput))

{

MOUNT_STRUCT *mount = (MOUNT_STRUCT *) Irp->AssociatedIrp.SystemBuffer;

if ((irpSp->Parameters.DeviceIoControl.InputBufferLength != sizeof (MOUNT_STRUCT))

|| mount->VolumePassword.Length > MAX_PASSWORD || mount->ProtectedHidVolPassword.Length > MAX_PASSWORD

{

UNMOUNT_STRUCT *unmount = (UNMOUNT_STRUCT *) Irp->AssociatedIrp.SystemBuffer;

PDEVICE_OBJECT ListDevice = GetVirtualVolumeDeviceObject (unmount->nDosDriveNo);

if (irpSp->Parameters.DeviceIoControl.InputBufferLength != sizeof (UNMOUNT_STRUCT))

{

if (ValidateIOBufferSize (Irp, sizeof (UNMOUNT_STRUCT), ValidateInputOutput))

{

UNMOUNT_STRUCT *unmount = (UNMOUNT_STRUCT *) Irp->AssociatedIrp.SystemBuffer;

if (irpSp->Parameters.DeviceIoControl.InputBufferLength != sizeof (UNMOUNT_STRUCT))

{

break;

case VC_IOCTL_EMERGENCY_CLEAR_ALL_KEYS:

WipeCache();

break;

break;

case TC_IOCTL_GET_BOOT_ENCRYPTION_STATUS:

break;

case TC_IOCTL_GET_BOOT_ENCRYPTION_SETUP_RESULT:

break;

case TC_IOCTL_GET_BOOT_DRIVE_VOLUME_PROPERTIES:

break;

case TC_IOCTL_GET_BOOT_LOADER_VERSION:

break;

case TC_IOCTL_REOPEN_BOOT_VOLUME_HEADER:

break;

case VC_IOCTL_GET_BOOT_LOADER_FINGERPRINT:

break;

case TC_IOCTL_GET_BOOT_ENCRYPTION_ALGORITHM_NAME:

break;

case TC_IOCTL_IS_HIDDEN_SYSTEM_RUNNING:

break;

case TC_IOCTL_GET_DECOY_SYSTEM_WIPE_STATUS:

break;

case TC_IOCTL_WRITE_BOOT_DRIVE_SECTOR:

if (Extension->SecurityClientContextValid)

{

UNICODE_STRING name;

RtlInitUnicodeString (&name, L"PsDereferenceImpersonationToken");

if (!PsDereferenceImpersonationTokenD)

TC_BUG_CHECK (STATUS_NOT_IMPLEMENTED);

VOID TCUnloadDriver (PDRIVER_OBJECT DriverObject)

{

Dump ("TCUnloadDriver BEGIN\n");

OnShutdownPending();

if (IsBootDriveMounted())

static VOID TCDeviceIoControlWorkItemRoutine (PDEVICE_OBJECT rootDeviceObject, TCDeviceIoControlWorkItemArgs *arg)

{

arg->Status = TCDeviceIoControl (arg->deviceName, arg->IoControlCode, arg->InputBuffer, arg->InputBufferSize, arg->OutputBuffer, arg->OutputBufferSize);

KeSetEvent (&arg->WorkItemCompletedEvent, IO_NO_INCREMENT, FALSE);

}

static VOID SendDeviceIoControlRequestWorkItemRoutine (PDEVICE_OBJECT rootDeviceObject, SendDeviceIoControlRequestWorkItemArgs *arg)

{

arg->Status = SendDeviceIoControlRequest (arg->deviceObject, arg->ioControlCode, arg->inputBuffer, arg->inputBufferSize, arg->outputBuffer, arg->outputBufferSize);

KeSetEvent (&arg->WorkItemCompletedEvent, IO_NO_INCREMENT, FALSE);

}

static VOID UpdateFsVolumeInformationWorkItemRoutine (PDEVICE_OBJECT rootDeviceObject, UpdateFsVolumeInformationWorkItemArgs *arg)

{

arg->Status = UpdateFsVolumeInformation (arg->mount, arg->NewExtension);

KeSetEvent (&arg->WorkItemCompletedEvent, IO_NO_INCREMENT, FALSE);

}

static VOID UnmountDeviceWorkItemRoutine (PDEVICE_OBJECT rootDeviceObject, UnmountDeviceWorkItemArgs *arg)

{

arg->Status = UnmountDevice (arg->unmountRequest, arg->deviceObject, arg->ignoreOpenFiles);

KeSetEvent (&arg->WorkItemCompletedEvent, IO_NO_INCREMENT, FALSE);

}

LARGE_INTEGER lDiskLength = { 0 };

__int64 partitionStartingOffset = 0;

int volumeType;

NTSTATUS ntStatus = 0;

BOOL forceAccessCheck = !bRawDevice;

BOOL disableBuffering = TRUE;

PARTITION_INFORMATION_EX pix;

LARGE_INTEGER diskLengthInfo;

DISK_GEOMETRY_EX dg;

uint8* dgBuffer;

STORAGE_DEVICE_NUMBER storageDeviceNumber;

FILE_READ_DATA | FILE_READ_ATTRIBUTES,

&Extension->pfoDeviceFile,

&Extension->pFsdDevice);

goto error;

if (!dgBuffer)

{

ntStatus = STATUS_INSUFFICIENT_RESOURCES;

goto error;

}

{

DISK_GEOMETRY geo;

{

goto error;

}

dg.DiskSize.QuadPart = geo.Cylinders.QuadPart * geo.SectorsPerTrack * geo.TracksPerCylinder * geo.BytesPerSector;

{

}

}

else

{

Extension->DeviceNumber = storageDeviceNumber.DeviceNumber;

}

Extension->HostBytesPerSector = dg.Geometry.BytesPerSector;

Extension->HostBytesPerPhysicalSector = dg.Geometry.BytesPerSector;

}

// Drive geometry is used only when IOCTL_DISK_GET_PARTITION_INFO fails

{

lDiskLength.QuadPart = pix.PartitionLength.QuadPart;

partitionStartingOffset = pix.StartingOffset.QuadPart;

}

// If IOCTL_DISK_GET_PARTITION_INFO_EX fails, switch to IOCTL_DISK_GET_PARTITION_INFO

{

lDiskLength.QuadPart = pi.PartitionLength.QuadPart;

partitionStartingOffset = pi.StartingOffset.QuadPart;

}

{

lDiskLength = diskLengthInfo;

}

ProbingHostDeviceForWrite = TRUE;

if (!mount->bMountReadOnly

IsHiddenSystemRunning() ? TC_IOCTL_DISK_IS_WRITABLE : IOCTL_DISK_IS_WRITABLE, NULL, 0) == STATUS_MEDIA_WRITE_PROTECTED)

{

mount->bMountReadOnly = TRUE;

static VOID TCSendHostDeviceIoControlRequestExWorkItemRoutine (PDEVICE_OBJECT rootDeviceObject, TCSendHostDeviceIoControlRequestExWorkItemArgs *arg)

{

arg->Status = TCSendHostDeviceIoControlRequestEx (arg->deviceObject, arg->Extension, arg->ioControlCode, arg->inputBuffer, arg->inputBufferSize, arg->outputBuffer, arg->outputBufferSize);

KeSetEvent (&arg->WorkItemCompletedEvent, IO_NO_INCREMENT, FALSE);

}

static NTSTATUS DispatchControl (PDEVICE_OBJECT DeviceObject, PIRP Irp, VolumeFilterExtension *Extension, PIO_STACK_LOCATION irpSp)

{

NTSTATUS status = IoAcquireRemoveLock (&Extension->Queue.RemoveLock, Irp);

if (!NT_SUCCESS (status))

return TCCompleteIrp (Irp, status, 0);

}

{

NTSTATUS status;

PoStartNextPowerIrp (Irp);

status = IoAcquireRemoveLock (&Extension->Queue.RemoveLock, Irp);

return DispatchPnp (DeviceObject, Irp, Extension, irpSp);

case IRP_MJ_POWER:

default:

status = IoAcquireRemoveLock (&Extension->Queue.RemoveLock, Irp);