VII. Antivirus/mac/quarantine_getinfo.c

@@ -0,0 +1,77 @@
+__int64 __fastcall quarantine_getinfo(
+        struct vnode *node,        // a1: vnode object representing the file
+        char *buffer,              // a2: buffer to store quarantine info
+        size_t *buffer_size,       // a3: size of the buffer
+        int flag,                  // a4: flag to determine the operation mode
+        __int64 reserved1,         // a5: reserved, not used in this function
+        __int64 reserved2,         // a6: reserved, not used in this function
+        __int64 reserved3,         // a7: reserved, not used in this function
+        __int64 reserved4,         // a8: reserved, not used in this function
+        __int64 reserved5,         // a9: reserved, not used in this function
+        size_t max_size)           // a10: maximum allowed size for the buffer
+{
+  // Local variables
+  size_t initial_buffer_size = *buffer_size;  // Initial size of the buffer
+  __int64 attr_length = 0LL;                  // Attribute length placeholder
+  struct mount *mount_info;                   // Mount information
+  int result;                                 // Result of operations
+
+  mount_info = vnode_mount(node);
+  if (flag) {
+    if (vnode_isvroot(node)) {
+      if ((vfs_flags(mount_info) & 0x400) == 0) {
+        return 93LL;  // Return 93 if the file system does not have the required flag
+      }
+      if (vnode_isvroot(node)) {
+        if ((vfs_flags(mount_info) & 0x400) != 0) {
+          goto LABEL_11;
+        }
+        return 93LL;  // Return 93 if the file system does not have the required flag
+      }
+    }
+    return 22LL;  // Return 22 if the vnode is not the root
+  }
+
+  if ((vfs_flags(mount_info) & 0x400) == 0) {
+    result = mac_vnop_getxattr(node, "com.apple.quarantine", buffer, initial_buffer_size, &attr_length);
+    if ((unsigned int)result <= 0x2D) {
+      if (((1LL << result) & 0x200000402002LL) != 0) {
+        return 93LL;  // Return 93 if the result is in the specific error range
+      }
+      if (!(_DWORD)result) {
+        if (attr_length <= initial_buffer_size) {
+          result = 0LL;
+          *buffer_size = attr_length;
+          return result;  // Return 0 on success
+        }
+        return 34LL;  // Return 34 if the buffer is too small
+      }
+    }
+    if ((_DWORD)result != 102) {
+      return result;  // Return the result if it is not 102
+    }
+    return 93LL;  // Return 93 for specific error
+  }
+
+LABEL_11:
+  if (!vfs_mntlabel(mount_info) || (const char *mount_label = (const char *)mount_label_copy_quarantine_info()) == 0LL) {
+    size_t default_info_len = strlen(quarantine_getinfo_default_qtninfo);
+    if (default_info_len <= initial_buffer_size) {
+      *buffer_size = default_info_len;
+      memmove(buffer, quarantine_getinfo_default_qtninfo, default_info_len);
+      return 0LL;  // Return 0 on success with default info
+    }
+    return 34LL;  // Return 34 if the buffer is too small for default info
+  }
+
+  size_t mount_label_len = strlen(mount_label);
+  if (mount_label_len <= initial_buffer_size) {
+    *buffer_size = mount_label_len;
+    memmove(buffer, mount_label, mount_label_len);
+    result = 0LL;  // Return 0 on success
+  } else {
+    result = 34LL;  // Return 34 if the buffer is too small for mount label
+  }
+  kfree_data_addr_external(mount_label);
+  return result;
+}