activation_context_blog-5.c

  attributes = OBJ_CASE_INSENSITIVE;
  ObjectAttributes.Length = 48;
  if ( !LdrpUseImpersonatedDeviceMap )               // Note how Microsoft left legacy
                                                     // vulnerable behavior available
                                                     // via configuration
    attributes = OBJ_IGNORE_IMPERSONATED_DEVICEMAP|OBJ_CASE_INSENSITIVE;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = attributes;
  ObjectAttributes.ObjectName = a2;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
...
    ntStatus = NtOpenFile(
                 &FileHandle,
                 SYNCHRONIZE|FILE_TRAVERSE|FILE_LIST_DIRECTORY,
                 &ObjectAttributes,
                 &IoStatusBlock,
                 FILE_SHARE_DELETE|FILE_SHARE_READ,
                 FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT);