winobj.c

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */

#include "winobj.h"
#include "guests.h"
#include "swapmem.h"
#include "windrvobj.h"
#include "winpe.h"

#define WIN_POOL_TAG_DIRECTORY 0x65726944 // Dire

#define WIN_POOL_TAG_DIRECTORY_7 0xe5726944

#define WIN_POOL_TAG_OBJECT 0x546a624f

#define WIN_POOL_TAG_OBJECT_7 0xd46a624f

typedef enum
{
    IM_FLG_CREATOR_INFO = 0x01, 
    IM_FLG_NAME_INFO    = 0x02, 
    IM_FLG_HANDLE_INFO  = 0x04, 
    IM_FLG_QUOTA_INFO   = 0x08, 
    IM_FLG_PROCESS_INFO = 0x10, 
} IM_FLG;


// Optional Header sizes
#define HEADER_SIZE_CREATOR_INFO64     0x20     
#define HEADER_SIZE_CREATOR_INFO32     0x10     
#define HEADER_SIZE_CREATOR_INFO(is64) (is64) ? HEADER_SIZE_CREATOR_INFO64 : HEADER_SIZE_CREATOR_INFO32

#define HEADER_SIZE_NAME_INFO64     0x20    
#define HEADER_SIZE_NAME_INFO32     0x10    
#define HEADER_SIZE_NAME_INFO(is64) (is64) ? HEADER_SIZE_NAME_INFO64 : HEADER_SIZE_NAME_INFO32

#define HEADER_SIZE_HANDLE_INFO64     0x10  
#define HEADER_SIZE_HANDLE_INFO32     0x08  
#define HEADER_SIZE_HANDLE_INFO(is64) (is64) ? HEADER_SIZE_HANDLE_INFO64 : HEADER_SIZE_HANDLE_INFO32

#define HEADER_SIZE_QUOTA_INFO64     0x20   
#define HEADER_SIZE_QUOTA_INFO32     0x10   
#define HEADER_SIZE_QUOTA_INFO(is64) (is64) ? HEADER_SIZE_QUOTA_INFO64 : HEADER_SIZE_QUOTA_INFO32

#define HEADER_SIZE_PROC_INFO64     0x10    
#define HEADER_SIZE_PROC_INFO32     0x08    
#define HEADER_SIZE_PROC_INFO(is64) (is64) ? HEADER_SIZE_PROC_INFO64 : HEADER_SIZE_PROC_INFO32


#define ROOT_DIR_POOL_HEADER_OFF64 0x60
#define ROOT_DIR_POOL_HEADER_OFF32 0x30


// Known type index values
#define TYPE_IDX_TYPE 2 


#define OBJECT_DIR_ENTRY_COUNT 37   


typedef struct _ROOT_SEARCH_CTX
{
    QWORD   RootGva;        
    void   *SwapHandle;     
    BOOLEAN Waiting;
} ROOT_SEARCH_CTX, *PROOT_SEARCH_CTX;

typedef struct _WINOBJ_SWAPCTX
{
    LIST_ENTRY Link;        

    void *SwapHandle;       
    QWORD ObjectGva;        
    DWORD Id;               
} WINOBJ_SWAPCTX, *PWINOBJ_SWAPCTX;

#define ROOT_HINT_PTR_COUNT 3   

typedef struct _ROOT_HINT
{
    QWORD FoundAt;                       
    QWORD Pointers[ROOT_HINT_PTR_COUNT]; 
} ROOT_HINT, *PROOT_HINT;

static ROOT_SEARCH_CTX gPossibleRootGvas[32] = {0};

static DWORD gRootCount = 0;

static DWORD gDirEntriesToCheck = OBJECT_DIR_ENTRY_COUNT;

static DWORD gPendingDrivers = 0;

static DWORD gFoundDrivers = 0;

static BOOLEAN gStop = FALSE;

static LIST_ENTRY gSwapHandles;


static void
IntWinObjCheckDrvDirSearchState(
    void
    )
{
    if (!gStop)
    {
        if ((0 == gDirEntriesToCheck) && IsListEmpty(&gSwapHandles) &&
            (0 == gWinGuest->DriverDirectory || 0 == gWinGuest->FileSystemDirectory))
        {
            ERROR("[ERROR] Finished parsing the root directory, but not all drivers were found. "
                  "`Driver` @ 0x%016llx `FileSystem` @ 0x%016llx\n",
                  gWinGuest->DriverDirectory, gWinGuest->FileSystemDirectory);

            IntGuestSetIntroErrorState(intErrGuestStructureNotFound, NULL);

            gGuest.DisableOnReturn = TRUE;
            gStop = TRUE;
        }

        if (0 != gWinGuest->DriverDirectory && 0 != gWinGuest->FileSystemDirectory)
        {
            if (0 == gPendingDrivers)
            {
                LOG("[WINOBJ] Search over. `Driver` @ 0x%016llx `FileSystem` @ 0x%016llx. Pending drivers = 0\n",
                    gWinGuest->DriverDirectory, gWinGuest->FileSystemDirectory);
                gStop = TRUE;
                IntWinObjCleanup();
            }
            else
            {
                LOG("[WINOBJ] Search not over. `Driver` @ 0x%016llx `FileSystem` @ 0x%016llx. Pending drivers = %u\n",
                    gWinGuest->DriverDirectory, gWinGuest->FileSystemDirectory, gPendingDrivers);
            }
        }
    }
}


static BOOLEAN
IntWinObjIsRootSearchOver(
    void)
{
    for (DWORD i = 0; i < gRootCount; i++)
    {
        if (gPossibleRootGvas[i].Waiting)
        {
            return FALSE;
        }
    }

    return TRUE;
}


static void
IntWinObjCancelRootTransactions(
    void
    )
{
    for (DWORD i = 0; i < gRootCount; i++)
    {
        if (NULL != gPossibleRootGvas[i].SwapHandle)
        {
            INTSTATUS status = IntSwapMemRemoveTransaction(gPossibleRootGvas[i].SwapHandle);
            if (!INT_SUCCESS(status))
            {
                WARNING("[WARNING] IntSwapMemRemoveTransaction failed for 0x%016llx (Handle %p): 0x%08x\n",
                        gPossibleRootGvas[i].RootGva, gPossibleRootGvas[i].SwapHandle, status);
            }

            gPossibleRootGvas[i].SwapHandle = NULL;
        }

        gPossibleRootGvas[i].Waiting = FALSE;
    }

    gRootCount = 0;
}


static INTSTATUS
IntWinObjGetObjectNameInfo(
    _In_ QWORD ObjectGva,
    _Out_ QWORD *BufferGva,
    _Out_opt_ WORD *Length,
    _Out_opt_ QWORD *ParentDirGva
    )
{
    INTSTATUS status;
    QWORD infoMaskGva;
    DWORD sizeToSubtract = 0;
    BYTE infoMask = 0;
    DWORD creatorInfoSize;

    // If the Name Info Header is present we have the following layout: Name Info, Creator Info (optional), Object
    // Header, Object;
    // We need to go back at least sizeof(OBJECT_HEADER_NAME_INFO) + sizeof(OBJECT_HEADER),
    // but the Body field overlaps the object
    if (gGuest.Guest64)
    {
        sizeToSubtract += OFFSET_OF(OBJECT_HEADER64, Body) + HEADER_SIZE_NAME_INFO64;
        infoMaskGva = ObjectGva - OFFSET_OF(OBJECT_HEADER64, Body) + OFFSET_OF(OBJECT_HEADER64, InfoMask);
        creatorInfoSize = HEADER_SIZE_CREATOR_INFO64;
    }
    else
    {
        sizeToSubtract += OFFSET_OF(OBJECT_HEADER32, Body) + HEADER_SIZE_NAME_INFO32;
        infoMaskGva = ObjectGva - OFFSET_OF(OBJECT_HEADER32, Body) + OFFSET_OF(OBJECT_HEADER32, InfoMask);
        creatorInfoSize = HEADER_SIZE_CREATOR_INFO32;
    }

    status = IntKernVirtMemRead(infoMaskGva, sizeof(infoMask), &infoMask, NULL);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntKernVirtMemRead failed for 0x%016llx: 0x%08x\n", infoMaskGva, status);
        return status;
    }

    if (0 == (IM_FLG_NAME_INFO & infoMask))
    {
        return INT_STATUS_NOT_FOUND;
    }

    // Add the creator info, if it exists
    if (0 != (IM_FLG_CREATOR_INFO & infoMask))
    {
        sizeToSubtract += creatorInfoSize;
    }

    if (gGuest.Guest64)
    {
        OBJECT_NAME64 objNameInfo = {0};

        status = IntKernVirtMemRead(ObjectGva - sizeToSubtract, sizeof(objNameInfo), &objNameInfo, NULL);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntKernVirtMemRead failed: 0x%08x\n", status);
            return status;
        }

        *BufferGva = objNameInfo.Name.Buffer;
        if (NULL != Length)
        {
            *Length = objNameInfo.Name.Length;
        }

        if (NULL != ParentDirGva)
        {
            *ParentDirGva = objNameInfo.Directory;
        }
    }
    else
    {
        OBJECT_NAME32 objNameInfo = {0};

        status = IntKernVirtMemRead(ObjectGva - sizeToSubtract, sizeof(objNameInfo), &objNameInfo, NULL);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntKernVirtMemRead failed: 0x%08x\n", status);
            return status;
        }

        *BufferGva = objNameInfo.Name.Buffer;
        if (NULL != Length)
        {
            *Length = objNameInfo.Name.Length;
        }

        if (NULL != ParentDirGva)
        {
            *ParentDirGva = objNameInfo.Directory;
        }
    }

    return INT_STATUS_SUCCESS;
}


static INTSTATUS
IntWinObjHandleDriverDirectoryEntryInMemory(
    _In_ WINOBJ_SWAPCTX *Context,
    _In_ QWORD Cr3,
    _In_ QWORD Gva,
    _In_ QWORD Gpa,
    _In_ void *Data,
    _In_ DWORD DataSize,
    _In_ DWORD Flags
    )
{
    QWORD next = 0;
    QWORD drvObjGva = 0;
    DWORD sizeToRead;
    INTSTATUS status;
    PWINOBJ_SWAPCTX pSwapCtx = Context;

    UNREFERENCED_PARAMETER(Cr3);
    UNREFERENCED_PARAMETER(Gva);
    UNREFERENCED_PARAMETER(Gpa);
    UNREFERENCED_PARAMETER(DataSize);

    // Remove this swap handle from the list
    RemoveEntryList(&pSwapCtx->Link);
    HpFreeAndNullWithTag(&pSwapCtx, IC_TAG_WINOBJ_SWAP);

    if (gGuest.Guest64)
    {
        next = ((OBJECT_DIRECTORY_ENTRY64 *)Data)->Chain;
        drvObjGva = ((OBJECT_DIRECTORY_ENTRY64 *)Data)->Object;
        sizeToRead = sizeof(OBJECT_DIRECTORY_ENTRY64);
    }
    else
    {
        next = ((OBJECT_DIRECTORY_ENTRY32 *)Data)->Chain;
        drvObjGva = ((OBJECT_DIRECTORY_ENTRY32 *)Data)->Object;
        sizeToRead = sizeof(OBJECT_DIRECTORY_ENTRY32);
    }

    if (IntWinDrvObjIsValidDriverObject(drvObjGva))
    {
        PWIN_DRIVER_OBJECT pDrvObj = NULL;

        status = IntWinDrvObjCreateFromAddress(drvObjGva, TRUE, &pDrvObj);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntWinDrvObjCreateDriverObject failed for 0x%016llx: 0x%08x\n", drvObjGva, status);
        }
        else
        {
            gFoundDrivers++;
        }
    }

    // It should be 0 for the last entry in the linked list, but let's try to not inject a #PF on some random numbers
    if (IS_KERNEL_POINTER_WIN(gGuest.Guest64, next))
    {
        WINOBJ_SWAPCTX *pNextCtx;
        void *swapHandle = NULL;

        pNextCtx = HpAllocWithTag(sizeof(*pNextCtx), IC_TAG_WINOBJ_SWAP);
        if (NULL == pNextCtx)
        {
            return INT_STATUS_INSUFFICIENT_RESOURCES;
        }

        pNextCtx->Id = __LINE__;
        pNextCtx->ObjectGva = next;
        InsertTailList(&gSwapHandles, &pNextCtx->Link);

        status = IntSwapMemReadData(0,
                                    next,
                                    sizeToRead,
                                    SWAPMEM_OPT_BP_FAULT,
                                    pNextCtx,
                                    0,
                                    IntWinObjHandleDriverDirectoryEntryInMemory,
                                    NULL,
                                    &swapHandle);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntSwapMemReadData failoed: 0x%08x\n", status);
            RemoveEntryList(&pNextCtx->Link);
            HpFreeAndNullWithTag(&pNextCtx, IC_TAG_WINOBJ_SWAP);
        }
        else if (NULL != swapHandle)
        {
            gPendingDrivers++;
            pNextCtx->SwapHandle = swapHandle;
        }
    }

    // If this was an async call, check if it was the last and if we managed to find what we were searching for; if
    // the call is synchronous the caller will do this check
    if (0 != (SWAPMEM_FLAG_ASYNC_CALL & Flags))
    {
        gPendingDrivers--;
        IntWinObjCheckDrvDirSearchState();
    }

    return INT_STATUS_SUCCESS;
}


static INTSTATUS
IntWinObjParseDriverDirectory(
    _In_ WINOBJ_SWAPCTX *Context,
    _In_ QWORD Cr3,
    _In_ QWORD Gva,
    _In_ QWORD Gpa,
    _In_ void *Data,
    _In_ DWORD DataSize,
    _In_ DWORD Flags
    )
{
    PWINOBJ_SWAPCTX pCtx = Context;
    QWORD objectGva = pCtx->ObjectGva;
    INTSTATUS status = INT_STATUS_SUCCESS;

    UNREFERENCED_PARAMETER(Cr3);
    UNREFERENCED_PARAMETER(Gva);
    UNREFERENCED_PARAMETER(Gpa);

    RemoveEntryList(&pCtx->Link);
    HpFreeAndNullWithTag(&pCtx, IC_TAG_WINOBJ_SWAP);

    // Note: this is a guest read string, so we're not sure that it's NULL terminated. Use wstrncasecmp_len instead
    // of wstrcasecmp.
    if (0 == wstrncasecmp_len(Data, u"Driver", DataSize / 2, CWSTRLEN(u"Driver")))
    {
        LOG("[NAMESPACE] Found `Driver` directory @ 0x%016llx\n", objectGva);
        gWinGuest->DriverDirectory = objectGva;
    }
    else if (0 == wstrncasecmp_len(Data, u"FileSystem", DataSize / 2, CWSTRLEN((u"FileSystem"))))
    {
        LOG("[NAMESPACE] Found `FileSystem` directory @ 0x%016llx\n", objectGva);
        gWinGuest->FileSystemDirectory = objectGva;
    }
    else
    {
        return INT_STATUS_NOT_NEEDED_HINT;
    }

    if (gGuest.Guest64)
    {
        QWORD entries[OBJECT_DIR_ENTRY_COUNT] = {0};

        status = IntKernVirtMemRead(objectGva, sizeof(entries), entries, NULL);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntKernVirtMemRead failed: 0x%08x\n", status);
            return status;
        }

        for (DWORD i = 0; i < OBJECT_DIR_ENTRY_COUNT; i++)
        {
            if (IS_KERNEL_POINTER_WIN(gGuest.Guest64, entries[i]))
            {
                WINOBJ_SWAPCTX *pNextCtx;
                void *swapHandle = NULL;

                pNextCtx = HpAllocWithTag(sizeof(*pNextCtx), IC_TAG_WINOBJ_SWAP);
                if (NULL == pNextCtx)
                {
                    continue;
                }

                pNextCtx->Id = __LINE__;
                pNextCtx->ObjectGva = entries[i];
                InsertTailList(&gSwapHandles, &pNextCtx->Link);

                status = IntSwapMemReadData(0,
                                            entries[i],
                                            sizeof(OBJECT_DIRECTORY_ENTRY64),
                                            SWAPMEM_OPT_BP_FAULT,
                                            pNextCtx,
                                            0,
                                            IntWinObjHandleDriverDirectoryEntryInMemory,
                                            NULL,
                                            &swapHandle);
                if (!INT_SUCCESS(status))
                {
                    ERROR("[ERROR] IntSwapMemReadData failed: 0x%08x\n", status);
                    RemoveEntryList(&pNextCtx->Link);
                    HpFreeAndNullWithTag(&pNextCtx, IC_TAG_WINOBJ_SWAP);
                }
                else if (NULL != swapHandle)
                {
                    gPendingDrivers++;
                    pNextCtx->SwapHandle = swapHandle;
                }
            }
        }
    }
    else
    {
        DWORD entries[OBJECT_DIR_ENTRY_COUNT] = {0};

        status = IntKernVirtMemRead(objectGva, sizeof(entries), entries, NULL);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntKernVirtMemRead failed: 0x%08x\n", status);
            return status;
        }

        for (DWORD i = 0; i < OBJECT_DIR_ENTRY_COUNT; i++)
        {
            if (IS_KERNEL_POINTER_WIN(gGuest.Guest64, entries[i]))
            {
                WINOBJ_SWAPCTX *pNextCtx;
                void *swapHandle = NULL;

                pNextCtx = HpAllocWithTag(sizeof(*pNextCtx), IC_TAG_WINOBJ_SWAP);
                if (NULL == pNextCtx)
                {
                    continue;
                }

                pNextCtx->Id = __LINE__;
                pNextCtx->ObjectGva = entries[i];
                InsertTailList(&gSwapHandles, &pNextCtx->Link);

                status = IntSwapMemReadData(0,
                                            entries[i],
                                            sizeof(OBJECT_DIRECTORY_ENTRY32),
                                            SWAPMEM_OPT_BP_FAULT,
                                            pNextCtx,
                                            0,
                                            IntWinObjHandleDriverDirectoryEntryInMemory,
                                            NULL,
                                            &swapHandle);
                if (!INT_SUCCESS(status))
                {
                    ERROR("[ERROR] IntSwapMemReadData failed: 0x%08x\n", status);
                    RemoveEntryList(&pNextCtx->Link);
                    HpFreeAndNullWithTag(&pNextCtx, IC_TAG_WINOBJ_SWAP);
                }
                else if (NULL != swapHandle)
                {
                    gPendingDrivers++;
                    pNextCtx->SwapHandle = swapHandle;
                }
            }
        }
    }

    // If this was an async call, check if it was the last and if we managed to find what we were searching for; if
    // the call is synchronous the caller will do this check
    if (0 != (SWAPMEM_FLAG_ASYNC_CALL & Flags))
    {
        IntWinObjCheckDrvDirSearchState();
    }

    return INT_STATUS_SUCCESS;
}


static INTSTATUS
IntWinObjHandleObjectInMemory(
    _In_ WINOBJ_SWAPCTX *Context,
    _In_ QWORD Cr3,
    _In_ QWORD Gva,
    _In_ QWORD Gpa,
    _In_ void *Data,
    _In_ DWORD DataSize,
    _In_ DWORD Flags
    )
{
    QWORD objectGva;
    INTSTATUS status = INT_STATUS_SUCCESS;
    QWORD parentDirGva = 0;
    QWORD nameBufferGva = 0;
    WORD nameLength = 0;
    PWINOBJ_SWAPCTX pDrvDirCtx;
    PWINOBJ_SWAPCTX pCurrentCtx = Context;
    void *swapHandle;

    UNREFERENCED_PARAMETER(Cr3);
    UNREFERENCED_PARAMETER(Gva);
    UNREFERENCED_PARAMETER(Gpa);
    UNREFERENCED_PARAMETER(Data);
    UNREFERENCED_PARAMETER(DataSize);

    objectGva = pCurrentCtx->ObjectGva;

    RemoveEntryList(&pCurrentCtx->Link);
    HpFreeAndNullWithTag(&pCurrentCtx, IC_TAG_WINOBJ_SWAP);

    status = IntWinObjGetObjectNameInfo(objectGva, &nameBufferGva, &nameLength, &parentDirGva);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntWinObjGetObjectNameInfo failed for 0x%016llx: 0x%08x\n", objectGva, status);
        status = INT_STATUS_SUCCESS;
        goto cleanup_and_exit;
    }

    // Sanity check
    if ((!IS_KERNEL_POINTER_WIN(gGuest.Guest64, nameBufferGva)) || nameLength >= 32)
    {
        status = INT_STATUS_SUCCESS;
        goto cleanup_and_exit;
    }

    pDrvDirCtx = HpAllocWithTag(sizeof(*pDrvDirCtx), IC_TAG_WINOBJ_SWAP);
    if (NULL == pDrvDirCtx)
    {
        status = INT_STATUS_INSUFFICIENT_RESOURCES;
        goto cleanup_and_exit;
    }

    pDrvDirCtx->Id = __LINE__;
    pDrvDirCtx->ObjectGva = objectGva;
    InsertTailList(&gSwapHandles, &pDrvDirCtx->Link);

    status = IntSwapMemReadData(0,
                                nameBufferGva,
                                nameLength,
                                SWAPMEM_OPT_BP_FAULT,
                                pDrvDirCtx,
                                0,
                                IntWinObjParseDriverDirectory,
                                NULL,
                                &swapHandle);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntSwapMemReadData failed: 0x%08x\n", status);
        RemoveEntryList(&pDrvDirCtx->Link);
        HpFreeAndNullWithTag(&pDrvDirCtx, IC_TAG_WINOBJ_SWAP);
    }
    else if (NULL != swapHandle)
    {
        pDrvDirCtx->SwapHandle = swapHandle;
    }

cleanup_and_exit:
    // If this was an async call, check if it was the last and if we managed to find what we were searching for; if
    // the call is synchronous the caller will do this check
    if (0 != (SWAPMEM_FLAG_ASYNC_CALL & Flags))
    {
        IntWinObjCheckDrvDirSearchState();
    }

    return status;
}


static INTSTATUS
IntWinObjHandleDirectoryEntryInMemory(
    _In_ WINOBJ_SWAPCTX *Context,
    _In_ QWORD Cr3,
    _In_ QWORD Gva,
    _In_ QWORD Gpa,
    _In_ void *Data,
    _In_ DWORD DataSize,
    _In_ DWORD Flags
    )

{
    QWORD next;
    QWORD objectGva;
    DWORD sizeToRead;
    INTSTATUS status = INT_STATUS_SUCCESS;
    PWINOBJ_SWAPCTX pDrvDirCtx = NULL;
    PWINOBJ_SWAPCTX pCurrentCtx = Context;
    void *swapHandle;

    UNREFERENCED_PARAMETER(Cr3);
    UNREFERENCED_PARAMETER(Gva);
    UNREFERENCED_PARAMETER(Gpa);
    UNREFERENCED_PARAMETER(DataSize);
    UNREFERENCED_PARAMETER(Flags);

    RemoveEntryList(&pCurrentCtx->Link);
    HpFreeAndNullWithTag(&pCurrentCtx, IC_TAG_WINOBJ_SWAP);

    if (gGuest.Guest64)
    {
        POBJECT_DIRECTORY_ENTRY64 pEntry = (OBJECT_DIRECTORY_ENTRY64 *)Data;

        next = pEntry->Chain;
        objectGva = pEntry->Object;
        sizeToRead = sizeof(OBJECT_DIRECTORY_ENTRY64);
    }
    else
    {
        POBJECT_DIRECTORY_ENTRY32 pEntry = (OBJECT_DIRECTORY_ENTRY32 *)Data;

        next = pEntry->Chain;
        objectGva = pEntry->Object;
        sizeToRead = sizeof(OBJECT_DIRECTORY_ENTRY32);
    }

    // Don't bother if this is not a kernel pointer
    if (!IS_KERNEL_POINTER_WIN(gGuest.Guest64, objectGva))
    {
        goto next_entry;
    }

    pDrvDirCtx = HpAllocWithTag(sizeof(*pDrvDirCtx), IC_TAG_WINOBJ_SWAP);
    if (NULL == pDrvDirCtx)
    {
        status = INT_STATUS_INSUFFICIENT_RESOURCES;
        goto next_entry;
    }

    pDrvDirCtx->Id = __LINE__;
    pDrvDirCtx->ObjectGva = objectGva;
    InsertTailList(&gSwapHandles, &pDrvDirCtx->Link);

    status = IntSwapMemReadData(0,
                                objectGva,
                                1, // The size doesn't really matter, we just want to make the page present
                                SWAPMEM_OPT_BP_FAULT,
                                pDrvDirCtx,
                                0,
                                IntWinObjHandleObjectInMemory,
                                NULL,
                                &swapHandle);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntSwapMemReadData failed: 0x%08x\n", status);
        RemoveEntryList(&pDrvDirCtx->Link);
        HpFreeAndNullWithTag(&pDrvDirCtx, IC_TAG_WINOBJ_SWAP);
    }
    else if (NULL != swapHandle)
    {
        pDrvDirCtx->SwapHandle = swapHandle;
    }

next_entry:

    if (IS_KERNEL_POINTER_WIN(gGuest.Guest64, next))
    {
        WINOBJ_SWAPCTX *pDirEntryCtx;
        swapHandle = NULL;

        pDirEntryCtx = HpAllocWithTag(sizeof(*pDirEntryCtx), IC_TAG_WINOBJ_SWAP);
        if (NULL == pDirEntryCtx)
        {
            return INT_STATUS_INSUFFICIENT_RESOURCES;
        }

        pDirEntryCtx->Id = __LINE__;
        pDirEntryCtx->ObjectGva = next;
        InsertTailList(&gSwapHandles, &pDirEntryCtx->Link);

        status = IntSwapMemReadData(0,
                                    next,
                                    sizeToRead,
                                    SWAPMEM_OPT_BP_FAULT,
                                    pDirEntryCtx,
                                    0,
                                    IntWinObjHandleDirectoryEntryInMemory,
                                    NULL,
                                    &swapHandle);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntSwapMemReadData failed: 0x%08x\n", status);
            RemoveEntryList(&pDirEntryCtx->Link);
            HpFreeAndNullWithTag(&pDirEntryCtx, IC_TAG_WINOBJ_SWAP);

            // We failed to inject the #PF, there is nothing else we can do other than consider this bucket "done"
            gDirEntriesToCheck--;
            IntWinObjCheckDrvDirSearchState();
        }
        else if (NULL != swapHandle)
        {
            pDirEntryCtx->SwapHandle = swapHandle;
        }
    }
    else
    {
        // This is the last entry in this bucket, mark it as done
        gDirEntriesToCheck--;
        IntWinObjCheckDrvDirSearchState();
    }

    return status;
}


static INTSTATUS
IntWinObjHandleRootDirTagInMemory(
    _In_ ROOT_SEARCH_CTX *Context,
    _In_ QWORD Cr3,
    _In_ QWORD Gva,
    _In_ QWORD Gpa,
    _In_ void *Data,
    _In_ DWORD DataSize,
    _In_ DWORD Flags
    )
{
    DWORD tag = *(DWORD *)Data;
    PROOT_SEARCH_CTX pCtx = Context;
    QWORD objGva = pCtx->RootGva;
    INTSTATUS status;
    QWORD parentDirGva = 0;
    QWORD nameBufferGva = 0;
    WORD nameLength = 0;

    UNREFERENCED_PARAMETER(Cr3);
    UNREFERENCED_PARAMETER(Gpa);
    UNREFERENCED_PARAMETER(DataSize);
    UNREFERENCED_PARAMETER(Flags);

    pCtx->SwapHandle = NULL;
    pCtx->Waiting = FALSE;

    if ((gGuest.OSVersion < 9200 && WIN_POOL_TAG_DIRECTORY_7 != tag) ||
        (gGuest.OSVersion >= 9200 && WIN_POOL_TAG_DIRECTORY != tag))
    {
        TRACE("[NAMESPACE] Skipping tag 0x%08x @ 0x%016llx for object 0x%016llx!\n",
              tag, Gva, objGva);
        status = INT_STATUS_NOT_NEEDED_HINT;
        goto _check_state_and_exit;
    }

    LOG("[NAMESPACE] Found tag 0x%08x @ 0x%016llx for object 0x%016llx!\n", tag, Gva, objGva);

    // We know this page is in memory because we get here only if it already was in memory, or we injected a #PF
    // to bring it in memory
    status = IntWinObjGetObjectNameInfo(objGva, &nameBufferGva, &nameLength, &parentDirGva);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntWinObjGetObjectNameInfo failed for 0x%016llx: 0x%08x\n", objGva, status);
        goto _check_state_and_exit;
    }

    if (0 != parentDirGva)
    {
        TRACE("[NAMESPACE] Skipping object 0x%016llx because it's parent directory is not NULL\n", objGva);
        status = INT_STATUS_NOT_NEEDED_HINT;
        goto _check_state_and_exit;
    }

    if (2 != nameLength || !IS_KERNEL_POINTER_WIN(gGuest.Guest64, nameBufferGva))
    {
        status = INT_STATUS_NOT_NEEDED_HINT;
        goto _check_state_and_exit;
    }

    LOG("[NAMESPACE] Found Root Directory (`\\`) @ 0x%016llx!\n", objGva);
    gWinGuest->ObpRootDirectoryObject = objGva;

    // Root found, cancel all other transactions
    IntWinObjCancelRootTransactions();

    if (gGuest.Guest64)
    {
        QWORD entries[OBJECT_DIR_ENTRY_COUNT] = {0};

        status = IntKernVirtMemRead(objGva, sizeof(entries), entries, NULL);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntKernVirtMemRead failed: 0x%08x\n", status);
            goto _check_state_and_exit;
        }

        for (DWORD i = 0; i < OBJECT_DIR_ENTRY_COUNT; i++)
        {
            if (IS_KERNEL_POINTER_WIN(gGuest.Guest64, entries[i]))
            {
                WINOBJ_SWAPCTX *pDirEntryCtx;
                void *swapHandle = NULL;

                pDirEntryCtx = HpAllocWithTag(sizeof(*pDirEntryCtx), IC_TAG_WINOBJ_SWAP);
                if (NULL == pDirEntryCtx)
                {
                    continue;
                }

                pDirEntryCtx->Id = __LINE__;
                pDirEntryCtx->ObjectGva = entries[i];
                InsertTailList(&gSwapHandles, &pDirEntryCtx->Link);

                status = IntSwapMemReadData(0,
                                            entries[i],
                                            sizeof(OBJECT_DIRECTORY_ENTRY64),
                                            SWAPMEM_OPT_BP_FAULT,
                                            pDirEntryCtx,
                                            0,
                                            IntWinObjHandleDirectoryEntryInMemory,
                                            NULL,
                                            &swapHandle);
                if (!INT_SUCCESS(status))
                {
                    ERROR("[ERROR] IntSwapMemReadData failed: 0x%08x\n", status);
                    RemoveEntryList(&pDirEntryCtx->Link);
                    HpFreeAndNullWithTag(&pDirEntryCtx, IC_TAG_WINOBJ_SWAP);

                    gDirEntriesToCheck--;
                    IntWinObjCheckDrvDirSearchState();
                }
                else if (NULL != swapHandle)
                {
                    pDirEntryCtx->SwapHandle = swapHandle;
                }
            }
            else
            {
                // This entry is empty, so there's nothing to check here
                gDirEntriesToCheck--;
                IntWinObjCheckDrvDirSearchState();
            }
        }
    }
    else
    {
        DWORD entries[OBJECT_DIR_ENTRY_COUNT] = {0};

        status = IntKernVirtMemRead(objGva, sizeof(entries), entries, NULL);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntKernVirtMemRead failed: 0x%08x\n", status);
            goto _check_state_and_exit;
        }

        for (DWORD i = 0; i < OBJECT_DIR_ENTRY_COUNT; i++)
        {
            if (IS_KERNEL_POINTER_WIN(gGuest.Guest64, entries[i]))
            {
                WINOBJ_SWAPCTX *pDirEntryCtx;
                void *swapHandle = NULL;

                pDirEntryCtx = HpAllocWithTag(sizeof(*pDirEntryCtx), IC_TAG_WINOBJ_SWAP);
                if (NULL == pDirEntryCtx)
                {
                    status = INT_STATUS_INSUFFICIENT_RESOURCES;
                    continue;
                }

                pDirEntryCtx->Id = __LINE__;
                pDirEntryCtx->ObjectGva = entries[i];
                InsertTailList(&gSwapHandles, &pDirEntryCtx->Link);

                status = IntSwapMemReadData(0,
                                            entries[i],
                                            sizeof(OBJECT_DIRECTORY_ENTRY32),
                                            SWAPMEM_OPT_BP_FAULT,
                                            pDirEntryCtx,
                                            0,
                                            IntWinObjHandleDirectoryEntryInMemory,
                                            NULL,
                                            &swapHandle);
                if (!INT_SUCCESS(status))
                {
                    ERROR("[ERROR] IntSwapMemReadData failed: 0x%08x\n", status);
                    RemoveEntryList(&pDirEntryCtx->Link);
                    HpFreeAndNullWithTag(&pDirEntryCtx, IC_TAG_WINOBJ_SWAP);

                    gDirEntriesToCheck--;
                    IntWinObjCheckDrvDirSearchState();
                }
                else if (NULL != swapHandle)
                {
                    pDirEntryCtx->SwapHandle = swapHandle;
                }
            }
            else
            {
                // This entry is empty, so there's nothing to check here
                gDirEntriesToCheck--;
                IntWinObjCheckDrvDirSearchState();
            }
        }
    }

_check_state_and_exit:
    if (IntWinObjIsRootSearchOver() && 0 == gWinGuest->ObpRootDirectoryObject)
    {
        ERROR("[ERROR] Could not find ObpRootDirectoryObject!\n");

        IntGuestSetIntroErrorState(intErrGuestStructureNotFound, NULL);
        gGuest.DisableOnReturn = TRUE;
    }
    else
    {
        IntWinObjCheckDrvDirSearchState();
    }

    return status;
}


INTSTATUS
IntWinObjFindRootDirectory(
    _In_ PROOT_HINT Hint,
    _Out_ QWORD *PossibleRoot
    )
{
    INTSTATUS status = INT_STATUS_SUCCESS;
    WORD foundTypes = 0;
    const WORD expectedTypes = 1;
    QWORD root = 0;
    DWORD delta;

    if (NULL == Hint)
    {
        return INT_STATUS_INVALID_PARAMETER_1;
    }

    if (NULL == PossibleRoot)
    {
        return INT_STATUS_INVALID_PARAMETER_2;
    }

    if (0 != gWinGuest->ObpRootDirectoryObject)
    {
        *PossibleRoot = gWinGuest->ObpRootDirectoryObject;
        return INT_STATUS_NOT_NEEDED_HINT;
    }

    delta = gGuest.Guest64 ? ROOT_DIR_POOL_HEADER_OFF64 : ROOT_DIR_POOL_HEADER_OFF32;

    // ObpRootDirectoryObject is before, after or between two type objects from non-paged pool.
    // The actual layout is not the same on every OS version.

    for (DWORD i = 0; i < ROOT_HINT_PTR_COUNT; i++)
    {
        // We allow NULL pointers around the root
        if (0 == Hint->Pointers[i])
        {
            continue;
        }

        status = IntWinObjIsTypeObject(Hint->Pointers[i]);
        if (!INT_SUCCESS(status))
        {
            if ((0 == root) &&
                // the root and it's headers must be in the same page
                ((Hint->Pointers[i] & PAGE_MASK) == ((Hint->Pointers[i] - delta) & PAGE_MASK)))
            {
                root = Hint->Pointers[i];
            }
            else
            {
                *PossibleRoot = 0;
                return INT_STATUS_NOT_NEEDED_HINT;
            }
        }
        else
        {
            foundTypes++;
        }
    }

    if ((foundTypes < expectedTypes) || !IS_KERNEL_POINTER_WIN(gGuest.Guest64, root))
    {
        return INT_STATUS_NOT_NEEDED_HINT;
    }

    status = INT_STATUS_SUCCESS;

    for (size_t i = 0; i < ROOT_HINT_PTR_COUNT; i++)
    {
        if (root == Hint->Pointers[i])
        {
            LOG("[NAMESPACE] Found possible root @ 0x%016llx = 0x%016llx\n",
                Hint->FoundAt + i * gGuest.WordSize, Hint->Pointers[i]);
        }
        else
        {
            LOG("[NAMESPACE] Found type @ 0x%016llx = 0x%016llx\n",
                Hint->FoundAt + i * gGuest.WordSize, Hint->Pointers[i]);
        }
    }

    *PossibleRoot = root;

    return status;
}


INTSTATUS
IntWinObjIsTypeObject(
    _In_ QWORD Gva
    )
{
    POOL_HEADER poolHeader = {0};
    INTSTATUS status;
    DWORD poolTag;
    DWORD poolType;

    if (!IS_KERNEL_POINTER_WIN(gGuest.Guest64, Gva))
    {
        return INT_STATUS_NOT_FOUND;
    }

    // It must be readable as it is in non-paged pool
    if (gGuest.Guest64)
    {
        OBJECT_TYPE64 typeObj = {0};

        status = IntKernVirtMemRead(Gva, sizeof(typeObj), &typeObj, NULL);
        if (!INT_SUCCESS(status))
        {
            return INT_STATUS_NOT_FOUND;
        }

        if (!IS_KERNEL_POINTER_WIN(gGuest.Guest64, typeObj.DefaultObject) ||
            !IS_KERNEL_POINTER_WIN(gGuest.Guest64, typeObj.Name.Buffer))
        {
            return INT_STATUS_NOT_FOUND;
        }

        if (typeObj.Name.Length > typeObj.Name.MaximumLength)
        {
            return INT_STATUS_NOT_FOUND;
        }

        if ((!IS_KERNEL_POINTER_WIN(gGuest.Guest64, typeObj.TypeList.Blink)) ||
            (!IS_KERNEL_POINTER_WIN(gGuest.Guest64, typeObj.TypeList.Flink)))
        {
            return INT_STATUS_NOT_FOUND;
        }
    }
    else
    {
        OBJECT_TYPE32 typeObj = {0};

        status = IntKernVirtMemRead(Gva, sizeof(typeObj), &typeObj, NULL);
        if (!INT_SUCCESS(status))
        {
            return INT_STATUS_NOT_FOUND;
        }

        if (!IS_KERNEL_POINTER_WIN(gGuest.Guest64, typeObj.DefaultObject) ||
            !IS_KERNEL_POINTER_WIN(gGuest.Guest64, typeObj.Name.Buffer))
        {
            return INT_STATUS_NOT_FOUND;
        }

        if (typeObj.Name.Length > typeObj.Name.MaximumLength)
        {
            return INT_STATUS_NOT_FOUND;
        }

        if ((!IS_KERNEL_POINTER_WIN(gGuest.Guest64, typeObj.TypeList.Blink)) ||
            (!IS_KERNEL_POINTER_WIN(gGuest.Guest64, typeObj.TypeList.Flink)))
        {
            return INT_STATUS_NOT_FOUND;
        }
    }

    status = IntWinObjGetPoolHeaderForObject(Gva, &poolHeader);
    if (!INT_SUCCESS(status))
    {
        TRACE("[INFO] IntWinObjGetPoolHeaderForObject failed for 0x%016llx: 0x%08x\n", Gva, status);
        return INT_STATUS_NOT_FOUND;
    }

    poolTag = gGuest.Guest64 ? poolHeader.Header64.PoolTag : poolHeader.Header32.PoolTag;

    if ((gGuest.OSVersion < 9200 && WIN_POOL_TAG_OBJECT_7 != poolTag) ||
        (gGuest.OSVersion >= 9200 && WIN_POOL_TAG_OBJECT != poolTag))
    {
        return INT_STATUS_NOT_FOUND;
    }

    poolType = gGuest.Guest64 ? poolHeader.Header64.PoolType : poolHeader.Header32.PoolType;

    // An _OBJECT_TYPE is always in the paged pool and it never uses a "DontUseThisType" pool allocation
    if (0 != (BIT(NonPagedPool) & poolType) &&
        DontUseThisType != poolType &&
        DontUseThisTypeSession != poolType)
    {
        return INT_STATUS_NOT_FOUND;
    }

    return INT_STATUS_SUCCESS;
}


INTSTATUS
IntWinObjGetPoolHeaderForObject(
    _In_ QWORD ObjectGva,
    _Out_ POOL_HEADER *PoolHeader
    )
{
    INTSTATUS status;
    DWORD delta;

    if (!IS_KERNEL_POINTER_WIN(gGuest.Guest64, ObjectGva))
    {
        return INT_STATUS_INVALID_PARAMETER_1;
    }

    if (NULL == PoolHeader)
    {
        return INT_STATUS_INVALID_PARAMETER_2;
    }

    if (gGuest.Guest64)
    {
        delta = HEADER_SIZE_CREATOR_INFO64 + HEADER_SIZE_NAME_INFO64 +
                WIN_POOL_HEADER_SIZE64 + OFFSET_OF(OBJECT_HEADER64, Body);
    }
    else
    {
        delta = HEADER_SIZE_CREATOR_INFO32 + HEADER_SIZE_NAME_INFO32 +
                WIN_POOL_HEADER_SIZE32 + OFFSET_OF(OBJECT_HEADER32, Body);
    }

    if (!IS_KERNEL_POINTER_WIN(gGuest.Guest64, ObjectGva - delta))
    {
        return INT_STATUS_NOT_FOUND;
    }

    status = IntKernVirtMemRead(ObjectGva - delta,
                                gGuest.Guest64 ? sizeof(POOL_HEADER64) : sizeof(POOL_HEADER32),
                                PoolHeader, NULL);
    if (!INT_SUCCESS(status))
    {
        TRACE("[INFO] IntKernVirtMemRead failed for 0x%016llx: 0x%08x\n", ObjectGva - delta, status);
    }

    return status;
}


static void
IntWinObjReinitGlobalState(
    void
    )
{
    memset(gPossibleRootGvas, 0, sizeof(gPossibleRootGvas));
    gRootCount = 0;
    gDirEntriesToCheck = OBJECT_DIR_ENTRY_COUNT;
    gStop = FALSE;
    InitializeListHead(&gSwapHandles);
}


static INTSTATUS
IntWinGuestFindDriversNamespaceNoBuffer(
    void
    )
{
    //
    // This could be merged into IntWinGuestFindDriversNamespace and handle everything in one place, but that will make
    // everything harder to read and more error-prone
    //

    IMAGE_SECTION_HEADER sec = {0};
    INTSTATUS status;
    DWORD pageCount;

    IntWinObjReinitGlobalState();

    status = IntPeGetSectionHeadersByName(gGuest.KernelVa, NULL, ".data", 1, gGuest.Mm.SystemCr3, &sec, NULL);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntPeGetSectionHeadersByName failed for `.data`: 0x%08x\n", status);
        return status;
    }

    pageCount = ROUND_UP(sec.Misc.VirtualSize, PAGE_SIZE) / PAGE_SIZE;
    for (size_t i = 0; i < pageCount; i++)
    {
        QWORD targetGva = gGuest.KernelVa + sec.VirtualAddress + i * PAGE_SIZE;
        PBYTE page = NULL;
        DWORD ptrCount;

        status = IntVirtMemMap(targetGva, PAGE_SIZE, 0, 0, &page);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntVirtMemMap failed for 0x%016llx: 0x%08x\n", targetGva, status);
            continue;
        }

        if (i == pageCount - 1)
        {
            ptrCount = (sec.Misc.VirtualSize & PAGE_OFFSET) / gGuest.WordSize;
        }
        else
        {
            ptrCount = PAGE_SIZE / gGuest.WordSize;
        }

        for (DWORD j = 0; j < ptrCount; j++)
        {
            ROOT_HINT hint = {0};
            QWORD root = 0;

            hint.FoundAt = targetGva;

            // Make sure we don't try to read pointers from two pages when we mapped only one
            if (j + ROOT_HINT_PTR_COUNT < ptrCount)
            {
                for (DWORD k = 0; k < ROOT_HINT_PTR_COUNT; k++)
                {
                    hint.Pointers[k] = gGuest.Guest64 ? ((QWORD *)page)[j + k] : ((DWORD *)page)[j + k];
                }
            }
            // There's no point in doing this for the last page
            else if (i < ptrCount - 1)
            {
                if (gGuest.Guest64)
                {
                    status = IntKernVirtMemRead(hint.FoundAt, sizeof(hint.Pointers), hint.Pointers, NULL);
                }
                else
                {
                    DWORD temp[ROOT_HINT_PTR_COUNT] = {0};

                    status = IntKernVirtMemRead(hint.FoundAt, sizeof(temp), temp, NULL);
                    for (DWORD k = 0; k < ROOT_HINT_PTR_COUNT; k++)
                    {
                        hint.Pointers[k] = temp[k];
                    }
                }
                if (!INT_SUCCESS(status))
                {
                    ERROR("[ERROR] IntKernVirtMemRead failed for 0x%016llx: 0x%08x\n", hint.FoundAt, status);
                    goto _continue;
                }
            }

            status = IntWinObjFindRootDirectory(&hint, &root);
            if (!INT_SUCCESS(status) && INT_STATUS_NOT_FOUND != status)
            {
                ERROR("[ERROR] IntWinObjFindRootDirectory for 0x%016llx: 0x%08x\n", hint.FoundAt, status);
            }
            else if (INT_STATUS_SUCCESS == status)
            {
                if (gRootCount < ARRAYSIZE(gPossibleRootGvas))
                {
                    gPossibleRootGvas[gRootCount].RootGva = root;
                    gPossibleRootGvas[gRootCount].Waiting = TRUE;
                    gPossibleRootGvas[gRootCount].SwapHandle = NULL;
                    gRootCount++;
                }
                else
                {
                    break;
                }
            }

_continue:
            targetGva += gGuest.WordSize;
        }

        IntVirtMemUnmap(&page);
    }

    return INT_STATUS_SUCCESS;
}


INTSTATUS
IntWinGuestFindDriversNamespace(
    void
    )
{
    IMAGE_SECTION_HEADER sec = {0};
    INTSTATUS status;
    DWORD ptrCount;
    BOOLEAN useBuffer = TRUE;

    if (gRootCount || gPendingDrivers || gFoundDrivers)
    {
        WARNING("[WARNING] A find for drivers namespace is already in progress... "
                "root = %u, pending = %u, found = %u\n",
                gRootCount,
                gPendingDrivers,
                gFoundDrivers);

        return INT_STATUS_NOT_NEEDED_HINT;
    }

    IntWinObjReinitGlobalState();

_retry:
    if (!useBuffer)
    {
        TRACE("[NAMESPACE] Kernel buffer not present, will fetch objects directly from memory!\n");

        status = IntWinGuestFindDriversNamespaceNoBuffer();
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntWinGuestFindDriversNamespaceNoBuffer failed: 0x%08x\n", status);
        }

        // failure or not, we need to go through this check
        goto _check_roots;
    }

    status = IntPeGetSectionHeadersByName(gGuest.KernelVa, gWinGuest->KernelBuffer, ".data", 1,
                                          gGuest.Mm.SystemCr3, &sec, NULL);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntPeGetSectionHeadersByName failed for `.data`: 0x%08x\n", status);
        goto _check_roots;
    }

    ptrCount = sec.Misc.VirtualSize / gGuest.WordSize - ROOT_HINT_PTR_COUNT;

    for (DWORD i = 0; i < ptrCount; i++)
    {
        DWORD bufferOffset = sec.VirtualAddress + i * gGuest.WordSize;
        void *target;
        ROOT_HINT hint;
        QWORD root = 0;

        if (bufferOffset > gWinGuest->KernelBufferSize)
        {
            ERROR("[CRITICAL ERROR] RVA 0x%08x is outside the kernel buffer (size = 0x%08x)\n",
                  bufferOffset, gWinGuest->KernelBufferSize);
            break;
        }

        target = gWinGuest->KernelBuffer + bufferOffset;
        hint.FoundAt = gGuest.KernelVa + bufferOffset;

        for (DWORD k = 0; k < ROOT_HINT_PTR_COUNT; k++)
        {
            hint.Pointers[k] = gGuest.Guest64 ? ((QWORD *)target)[k] : ((DWORD *)target)[k];
        }

        status = IntWinObjFindRootDirectory(&hint, &root);
        if (!INT_SUCCESS(status) && INT_STATUS_NOT_FOUND != status)
        {
            ERROR("[ERROR] IntWinObjFindRootDirectory for 0x%016llx: 0x%08x\n", hint.FoundAt, status);
        }
        else if (INT_STATUS_SUCCESS == status)
        {
            if (gRootCount < ARRAYSIZE(gPossibleRootGvas))
            {
                gPossibleRootGvas[gRootCount].RootGva = root;
                gPossibleRootGvas[gRootCount].Waiting = TRUE;
                gPossibleRootGvas[gRootCount].SwapHandle = NULL;
                gRootCount++;
            }
            else
            {
                break;
            }
        }
    }

    if (0 == gRootCount && useBuffer)
    {
        WARNING("[WINOBJ] Found 0 possible root pointers inside the kernel buffer, will retry without it!\n");
        useBuffer = FALSE;
        goto _retry;
    }

_check_roots:
    LOG("[NAMESPACE] Will check %d possible root pointers...\n", gRootCount);

    for (DWORD i = 0; i < gRootCount; i++)
    {
        DWORD poolHeaderOffset = gGuest.Guest64 ? ROOT_DIR_POOL_HEADER_OFF64 : ROOT_DIR_POOL_HEADER_OFF32;
        QWORD root = gPossibleRootGvas[i].RootGva;

        TRACE("[NAMESPACE] Trying 0x%016llx (%d) with 0x%016llx...\n",
              root, i, root - poolHeaderOffset + OFFSET_OF(POOL_HEADER32, PoolTag));

        // It is ok to use the field offset of PoolTag inside POOL_HEADER32 because it is the same offset as
        // POOL_HEADER64.
        status = IntSwapMemReadData(0,
                                    root - poolHeaderOffset + OFFSET_OF(POOL_HEADER32, PoolTag),
                                    sizeof(DWORD),
                                    SWAPMEM_OPT_BP_FAULT,
                                    &gPossibleRootGvas[i],
                                    0,
                                    IntWinObjHandleRootDirTagInMemory,
                                    NULL,
                                    &gPossibleRootGvas[i].SwapHandle);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntSwapMemReadData failed for 0x%016llx: 0x%08x\n", root - poolHeaderOffset, status);
            gPossibleRootGvas[i].Waiting = FALSE;
        }

        // If the root was already found in a sync manner, bail out now (all transactions were canceled
        // in IntWinObjHandleRootDirTagInMemory)
        if (0 != gWinGuest->ObpRootDirectoryObject)
        {
            return INT_STATUS_SUCCESS;
        }
    }

    status = INT_STATUS_SUCCESS;

    if (0 == gRootCount || (IntWinObjIsRootSearchOver() && 0 == gWinGuest->ObpRootDirectoryObject))
    {
        ERROR("[ERROR] Could not find ObpRootDirectoryObject!\n");

        IntGuestSetIntroErrorState(intErrGuestStructureNotFound, NULL);
        gGuest.DisableOnReturn = TRUE;

        status = INT_STATUS_NOT_FOUND;
    }
    else
    {
        IntWinObjCheckDrvDirSearchState();
    }

    return status;
}


void
IntWinObjCleanup(
    void
    )
{
    PLIST_ENTRY entry = gSwapHandles.Flink;
    DWORD remCount = 0;

    // First, the root transactions (if any)
    IntWinObjCancelRootTransactions();
    TRACE("[WINOBJ] Root transactions removed: %d\n", gRootCount);

    if (NULL == entry)
    {
        TRACE("[WINOBJ] No swap handles are present, nothing to clean\n");
        return;
    }

    // Now, everything else
    while (entry != &gSwapHandles)
    {
        PWINOBJ_SWAPCTX pCtx = CONTAINING_RECORD(entry, WINOBJ_SWAPCTX, Link);
        INTSTATUS status;

        entry = entry->Flink;

        TRACE("[WINOBJ] Removing swap handle %p for %llx ID = %u\n",
              pCtx->SwapHandle, pCtx->ObjectGva, pCtx->Id);

        RemoveEntryList(&pCtx->Link);

        status = IntSwapMemRemoveTransaction(pCtx->SwapHandle);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntSwapMemRemoveTransaction failed: 0x%08x\n", status);
        }

        HpFreeAndNullWithTag(&pCtx, IC_TAG_WINOBJ_SWAP);
        remCount++;
    }

    TRACE("[WINOBJ] Queued transactions removed: %d\n", remCount);
    CRITICAL("[WINOBJ] Cleanup done with %u pending drivers. Found = %u\n", gPendingDrivers, gFoundDrivers);
}