Reversed ObpCreateSymbolicLinkName

//Waliedassar
//https://twitter.com/waleedassar

//Called by ObCloseHandleTableEntry
void ObpDeleteSymbolicLinkName
(_OBJECT_SYMBOLIC_LINK *SymbolicLink)
{
    ulong var_DosDeviceDriveIndex =
    SymbolicLink->DosDeviceDriveIndex;

    // DosDeviceDriveIndex field is 1 if the symbolic link is named "A:"
    // and is zero if it is not within "A:" and "Z:"


    if(var_DosDeviceDriveIndex)
    {
        _OBJECT_HEADER* pObjHdr =
        SymbolicLink - 0x30;

        //Usually 0x20
        ulong Offset =
        ObpInfoMaskToOffset[pObjHdr->InfoMask & 3];


        _OBJECT_HEADER_NAME_INFO* pNameInfo =
        pObjHdr - Offset;

        //The directory, our symbolic link object lives in.
        _OBJECT_DIRECTORY* pParentDir =
        pNameInfo->Directory;

        //The device map associated with our process, in case this
        //directory object is our process's device map directory.
        _DEVICE_MAP* pDeviceMap =
        pParentDir->DeviceMap;

        if(pDeviceMap)
        {
            _ESERVERSILO_GLOBALS* pServerSiloGlob =
            PsGetCurrentServerSiloGlobals();

            ExGetCurrentThread()->??--;

            ExAcquirePushLockExclusiveEx
            (&pServerSiloGlob->ObSiloState.DeviceMapLock,0);


            pDeviceMap->DriveMap &=
            ~(1 << (var_DosDeviceDriveIndex-1));

            pDeviceMap->DriveType[var_DosDeviceDriveIndex-1] = 0;

            if(pDeviceMap != pServerSiloGlob->ObSiloState.SystemDeviceMap)
            {
                pServerSiloGlob->ObSiloState.SystemDosDeviceState.LocalDeviceCount[var_DosDeviceDriveIndex-1]--;
            }
            else
            {
                pServerSiloGlob->ObSiloState.SystemDosDeviceState.GlobalDeviceMap &=
                (~(1 << (var_DosDeviceDriveIndex-1)));
            }
            //Common_0
            ExReleasePushLockEx
            (&pServerSiloGlob->ObSiloState.DeviceMapLock,0);

            KiLeaveGuardedRegionUnsafe(ExGetCurrentThread());
        }
        //Notice this line
        SymbolicLink->DosDeviceDriveIndex = 0;
    }
    return;
}

void ObpCreateSymbolicLinkName
(_OBJECT_SYMBOLIC_LINK *SymbolicLink)
{
    //r10 0

    _OBP_LOOKUP_CONTEXT LookupContext;
    LookupContext.EntryLink = 0;
    LookupContext.HashValue = 0;
    LookupContext.HashIndex = 0;
    LookupContext.Pad = 0;



    _OBJECT_HEADER* ObjHdr =
    SymbolicLink - 0x30;//r15

    //rsi SymbolicLink

    uchar var_InfoMask =
    ObjHdr->InfoMask;

    ulong var_NumberOfSymLinksToProcess = 0x40;

    _OBJECT_HEADER_NAME_INFO* NameInfo = 0;

    if(var_InfoMask & 0x2)
    {
        NameInfo =
        ObjHdr - nt!ObpInfoMaskToOffset[var_InfoMask & 0x3];
    }
    //Common_0

    if(!NameInfo) return;

    _OBJECT_DIRECTORY* NameInfoDirectory =
    NameInfo->Directory;

    //Missing check for null pointer here, another bug found.
    if(NameInfoDirectory->DeviceMap == 0) return;

    if(NameInfo->Name.Length != 4) return;

    //BRANCH_X
    if(NameInfo->Name.Buffer[1] != L':') return;


    ushort DriveLetter =
    NLS_UPCASE(NameInfo->Name.Buffer[0]);

    ushort DriveLetterIndex =
    DriveLetter - 0x41;

    if(DriveLetterIndex > 0x19) return;

    LookupContext.DirectoryLocked = 0;

    SymbolicLink->DosDeviceDriveIndex =
    DriveLetter - 0x40;


    bool b12 = false;
    bool b13 = false;

    LookupContext.Directory = 0;
    LookupContext.Object = 0;
    LookupContext.LockStateSignature = 0xFFFF1234;


    _ESILO* pSilo =
    PsGetCurrentSilo();

    _OBJECT_DIRECTORY* pSiloRootDir =
    OBP_GET_SILO_ROOT_DIRECTORY_FROM_SILO
    (pSilo);

    ObfReferenceObject(pSiloRootDir);

    _UNICODE_STRING uniLinkTarget;
    memcpy(&uniLinkTarget,
        &SymbolicLink->LinkTarget,
        0x10);


    _ESERVERSILO_GLOBALS* pServerSiloGlob =
    PsGetCurrentServerSiloGlobals();//rsi

    //LoopOuter
    do
    {
        ulong var_LengthTarget;     //edi
        wchar_t* w_TargetBuffer;    //rbx
        _OBJECT_DIRECTORY* pRootDirectory = pSiloRootDir;//r14

        if( (uniLinkTarget.Buffer & 7) ||
            ( pServerSiloGlob->ObSiloState.SystemDeviceMap->DosDevicesDirectory == 0)
        )
        {
            var_LengthTarget =  uniLinkTarget.Length;
            w_TargetBuffer = uniLinkTarget.Buffer;
        }
        else
        {
            var_LengthTarget =
            uniLinkTarget.Length =
            uniLinkTarget.Length;

            if(var_LengthTarget < 0x8)
            {
                w_TargetBuffer = uniLinkTarget.Buffer;
            }
            else
            {
                w_TargetBuffer =
                uniLinkTarget.Buffer =
                uniLinkTarget.Buffer;

                //ObpDosDevicesShortNamePrefix => L"\??\"
                if( memcmp(w_TargetBuffer,ObpDosDevicesShortNamePrefix,8) == 0)
                {
                    w_TargetBuffer += 4;

                    var_LengthTarget -= 8;

                    uniLinkTarget.Buffer =
                    w_TargetBuffer;

                    uniLinkTarget.Length =
                    var_LengthTarget;

                    pRootDirectory =    pServerSiloGlob->ObSiloState.SystemDeviceMap->DosDevicesDirectory;
                }
            }
        }


        //LoopLookup
        do
        {
            if( *w_TargetBuffer == L'\\')
            {
                w_TargetBuffer++;

                var_LengthTarget -= 2;

                uniLinkTarget.Buffer =
                w_TargetBuffer;

                uniLinkTarget.Length =
                var_LengthTarget;
            }
            //Common_Inside_LoopLookup_0

            _UNICODE_STRING uniLinkTargetX;

            //XMM Op
            memcpy
            (&uniLinkTargetX,&uniLinkTarget,0x10);

            if(var_LengthTarget)
            {
                //LoopLookupInner
                while( *w_TargetBuffer != L'\\')//bug here
                {
                    w_TargetBuffer++;
                    var_LengthTarget -= 2;
                    uniLinkTarget.Length = var_LengthTarget;
                }
                //After_LoopLookupInner
                uniLinkTarget.Buffer = w_TargetBuffer;
            }
            //Common_Inside_LoopLookup_1
            uniLinkTargetX.Length -=
            var_LengthTarget;

            if(!uniLinkTargetX.Length)
            {
                ObpReleaseLookupContext(&LookupContext);
                ObDereferenceObject(pSiloRootDir);
                return;
            }
            if(pRootDirectory == NameInfoDirectory)
            {
                LookupContext.DirectoryLocked = 0x101;
            }
            b12 = false;
            b13 = false;

            //Common_Inside_LoopLookup_2
            _OBJECT_DIRECTORY* pTempObject =
            ObpLookupDirectoryEntryEx
            (pRootDirectory,
            &uniLinkTargetX,
            0,0,0,
            &LookupContext);

            if(pRootDirectory == NameInfoDirectory)
            {
                LookupContext.DirectoryLocked = b12;
                LookupContext.LockedExclusive = b13;
            }
            else
            {
                b12 = LookupContext.DirectoryLocked;
                b13 = LookupContext.LockedExclusive;
            }
            //Common_Inside_LoopLookup_3
            if(pTempObject == 0)
            {
                goto Common_X;
            }

            _OBJECT_TYPE* pTempObjectType =
            MacroGetType(pTempObject);


            if(pTempObjectType == ObpDirectoryObjectType)
            {
                //Link Target is an Object Directory
                pRootDirectory = pTempObject;
                continue;
            }
            else
            {

                if(pTempObjectType == ObpSymbolicLinkObjectType)
                {
                    //Link target is a symbolic link
                    _OBJECT_SYMBOLIC_LINK* pTempObjectSym =
                    (_OBJECT_SYMBOLIC_LINK*)pTempObject;

                    if(pTempObjectSym->DosDeviceDriveIndex != 0)
                    {
                        goto Common_X;
                    }

                    if(var_NumberOfSymLinksToProcess == 0)
                    {
                        pTempObjectSym =
                        pTempObject =
                        0;

                        goto Common_X;
                    }
                    else
                    {
                        //memcpy
                        //(&uniLinkTarget,
                        //&pTempObjectSym->LinkTarget,
                        //0x10);

                        //var_NumberOfSymLinksToProcess--;
                        break;
                    }
                }
                else
                {
                    goto Common_X;
                }
            }
        }while(1);

        memcpy
        (&uniLinkTarget,
        &pTempObjectSym->LinkTarget,
        0x10);

        var_NumberOfSymLinksToProcess--;
    }while(1);

Common_X:
    NameInfoDirectory =
    NameInfo->Directory;

    //r15 1
    //rbx 1

    _DEVICE_MAP* pDeviceMap =
    NameInfoDirectory->DeviceMap;//rdi

    uchar DriveType = 1;
    if(pTempObject)
    {
        if( MacroGetType(pTempObject) == IoDeviceObjectType)
        {
            _DEVICE_OBJECT* pTempDeviceObject =
            (_DEVICE_OBJECT*)pTempObject);

            register ulong var_DeviceType =
            pTempDeviceObject->DeviceType;

            if(var_DeviceType > 0x13)
            {
                if(var_DeviceType == 0x14)
                {
                    DriveType = 4;
                }
                else if(var_DeviceType == 0x24)
                {
                    DriveType = 6;
                }
                else if(var_DeviceType == 0x28)
                {
                    DriveType = 4;
                }
                else
                {
                    DriveType = 0;
                }
            }
            else if(var_DeviceType >= 0x12)
            {
                DriveType = 4;
            }
            else if(var_DeviceType < 2)
            {
                DriveType = 0;
            }
            else if(var_DeviceType <= 3)
            {
                DriveType = 5;
            }
            else if(var_DeviceType <= 6)
            {
                DriveType = 0;
            }
            else if(var_DeviceType > 9)
            {
                if(var_DeviceType == 0x10)
                {
                    DriveType = 4;
                }
                else
                {
                    DriveType = 0;
                }
            }
            else
            {
                DriveType =
                ((~(pTempDeviceObject->Characteristics)) & 1) + 2;
            }
        }
    }
Common_Final:
    ExGetCurrentThread()->???--;

    //Good, must have been in the function prologue instead
    ExAcquirePushLockExclusiveEx
    (pServerSiloGlob->ObSiloState.DeviceMapLock,0);

    ulong var_DosDeviceDriveIndex =
    SymbolicLink->DosDeviceDriveIndex;

    //DosDeviceDriveIndex are 1-based.
    //1 for A letter
    //2 for B letter

    var_DosDeviceDriveIndex--;

    pDeviceMap->DriveType[var_DosDeviceDriveIndex] = DriveType;
    pDeviceMap->DriveMap |= (1<<var_DosDeviceDriveIndex);

    if(pDeviceMap != pServerSiloGlob->ObSiloState.SystemDeviceMap)
    {
        pServerSiloGlob->
        ObSiloState.
        SystemDosDeviceState.
        LocalDeviceCount[var_DosDeviceDriveIndex] |= 1;
    }
    else
    {
        pServerSiloGlob->
        ObSiloState.
        SystemDosDeviceState.
        GlobalDeviceMap |=
        (1<<var_DosDeviceDriveIndex);
    }
    ExReleasePushLockEx
    (pServerSiloGlob->ObSiloState.DeviceMapLock,0);

    KiLeaveGuardedRegionUnsafe
    (ExGetCurrentThread());

    ObpReleaseLookupContext
    (&LookupContext);

    ObDereferenceObject(pSiloRootDir);

    return;
}