IopLiveDumpWriteDumpFileWithExtraPages
NTSTATUS __stdcall IopLiveDumpWriteDumpFileWithExtraPages(INT64 a1){
__int64 v1;
INT64 v2;
VOID **v4;
int SecureDumpHeader;
UINT64 *v6;
_LARGE_INTEGER v7;
VOID *v8;
__int64 v9;
char ExtraMergePages;
int v11;
__int64 v12;
int v13;
__int64 *v14;
_QWORD *v15;
_QWORD *v16;
char v17;
__int64 v18;
unsigned int v19;
__int64 v20;
char v21;
int v22;
UINT64 *v23;
bool v24;
char *v25;
UINT64 *v26;
__int64 v27;
__int64 v28;
_MDL *v29;
char v30;
VOID **PoolWithTag;
__int64 v32;
unsigned int v33;
__int128 v34;
int v35;
size_t v36;
int v37;
__int128 v38;
int v39;
__int128 v40;
__int64 v41;
UINT64 v42;
VOID **v43;
VOID **v44;
_CONTEXT *v45;
char v47;
char v48;
char v49;
_LARGE_INTEGER ByteOffset;
UINT64 v51;
char *v52;
char *v53;
_QWORD *v54;
__int64 v55;
__int64 *v56;
__int64 v57;
__int64 v58;
VOID *Buffer;
__int64 v60;
UINT64 *v61;
__int64 v62;
INT64 CurrentThread;
VOID **v64;
_LIVEDUMP_BUFFER_DESCRIPTOR *BufferDescriptor;
__int128 Src[2];
__int128 v67;
v1 = *(_QWORD *)(a1 + 1024);
v2 = *(_QWORD *)(a1 + 560);
v53 = 0i64;
v57 = 0i64;
v52 = 0i64;
v4 = 0i64;
v55 = 0i64;
v51 = 0i64;
v64 = 0i64;
BufferDescriptor = (_LIVEDUMP_BUFFER_DESCRIPTOR *)(a1 + 680);
v62 = v1;
v67 = 0i64;
memset(Src, 0, sizeof(Src));
if( !v1 )
goto LABEL_2;
v6 = *(UINT64 **)(a1 + 1032);
v61 = v6;
if( !v6 )
goto LABEL_2;
if( *(_BYTE *)(a1 + 880) )
v7.QuadPart = *(_QWORD *)(v2 + 8224) + *(unsigned int *)(a1 + 888);
else
v7 = *(_LARGE_INTEGER *)(v2 + 8224);
v8 = *(VOID **)(a1 + 64);
ByteOffset = v7;
v60 = -1i64;
CurrentThread = (INT64)KeGetCurrentThread();
v9 = *(_QWORD *)(a1 + 624);
v58 = 0i64;
v47 = 0;
if( *(_QWORD *)(a1 + 552) != v9 )
{
RtlClearAllBitsEx((_RTL_BITMAP_EX *)(a1 + 616));
v9 = *(_QWORD *)(a1 + 624);
}
if( v9 != *(_QWORD *)(a1 + 640) )
RtlClearAllBitsEx((_RTL_BITMAP_EX *)(a1 + 632));
*(_QWORD *)(a1 + 728) = 0i64;
*(_QWORD *)(a1 + 736) = 0i64;
IopLiveDumpGetNtMergePages(a1, v6, &v52, &v51, &v55);
v56 = (__int64 *)v6;
ExtraMergePages = IopLiveDumpGetExtraMergePages((_QWORD *)a1, v1, &v53, (_DWORD *)&v51 + 1, &v57);
v11 = v51;
v12 = v1;
v54 = (_QWORD *)v1;
v13 = HIDWORD(v51);
v48 = ExtraMergePages;
while( v13 || v11 )
{
if( v11 )
{
v14 = &v60;
if( v13 )
v14 = (__int64 *)v12;
v54 = v14;
}
else
{
v56 = &v60;
}
SecureDumpHeader = IopLiveDumpCheckTermination(a1, CurrentThread);
if( SecureDumpHeader < 0 )
goto LABEL_89;
if( v13 && v15[v13 - 1] < *v16 )
{
Buffer = v53;
v19 = v13 << 12;
v20 = v62;
v47 = v17;
v58 = v57;
v21 = IopLiveDumpGetExtraMergePages((_QWORD *)a1, v62, &v53, (_DWORD *)&v51 + 1, &v57);
v54 = (_QWORD *)v20;
goto LABEL_37;
}
if( v11 && v16[v11 - 1] < *v15 )
{
v22 = v11;
Buffer = v52;
v23 = v61;
v19 = v22 << 12;
v58 = v55;
v47 = 1;
IopLiveDumpGetNtMergePages(a1, v61, &v52, &v51, &v55);
v56 = (__int64 *)v23;
v11 = v51;
goto LABEL_38;
}
v49 = 0;
v24 = *v16 == *v15;
if( *v16 < *v15 )
{
v25 = v52;
Buffer = v52;
goto LABEL_30;
}
Buffer = v53;
v49 = 1;
if( v24 )
{
v25 = v52;
LABEL_30:
v24 = v11-- == 1;
LODWORD(v51) = v11;
if( v24 )
{
v26 = v61;
v47 = 1;
v58 = v55;
IopLiveDumpGetNtMergePages(a1, v61, &v52, &v51, &v55);
v15 = v54;
v18 = 4096i64;
v17 = v48;
v11 = v51;
v56 = (__int64 *)v26;
}
else
{
v52 = &v25[v18];
v56 = v16 + 1;
}
}
v19 = v18;
if( !v49 )
goto LABEL_38;
v24 = v13-- == 1;
HIDWORD(v51) = v13;
if( !v24 )
{
v53 += v18;
v54 = v15 + 1;
goto LABEL_38;
}
v27 = v62;
v47 = v17;
v58 = v57;
v21 = IopLiveDumpGetExtraMergePages((_QWORD *)a1, v62, &v53, (_DWORD *)&v51 + 1, &v57);
v54 = (_QWORD *)v27;
v19 = 4096;
LABEL_37:
v13 = HIDWORD(v51);
v48 = v21;
LABEL_38:
SecureDumpHeader = IopLiveDumpWriteBuffer(v8, Buffer, (_CONTEXT *)v19, &ByteOffset);
if( SecureDumpHeader < 0 )
goto LABEL_89;
v12 = (__int64)v54;
if( v47 )
{
v28 = v58;
v29 = *(_MDL **)(*(_QWORD *)(a1 + 760) + 8 * v58);
if( v29 )
{
MmFreePagesFromMdl(v29);
ExFreePoolWithTag(*(PVOID *)(*(_QWORD *)(a1 + 760) + 8 * v28), 0);
*(_QWORD *)(*(_QWORD *)(a1 + 760) + 8 * v28) = 0i64;
}
else
{
MmFreeIndependentPages(*(VOID **)(*(_QWORD *)(a1 + 752) + 8 * v58), (unsigned int)BufferChunkSizeInBytes);
}
v12 = (__int64)v54;
*(_QWORD *)(*(_QWORD *)(a1 + 752) + 8 * v28) = 0i64;
v47 = 0;
}
}
v30 = *(_BYTE *)(a1 + 880);
if( !v30 )
goto LABEL_47;
PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x1000ui64, 1886217292i64);
v4 = PoolWithTag;
if( !PoolWithTag )
{
LABEL_2:
SecureDumpHeader = -1073741670;
goto LABEL_89;
}
memset(PoolWithTag, 0i64, 0x1000u);
v30 = *(_BYTE *)(a1 + 880);
LABEL_47:
LODWORD(v67) = 1886221636;
*(_QWORD *)((char *)&v67 + 4) = 0x10626F6C42i64;
HIDWORD(v67) = NtBuildNumber;
if( v30 )
{
v32 = 2i64;
*(_OWORD *)v4 = v67;
goto LABEL_51;
}
SecureDumpHeader = IopLiveDumpWriteBuffer(v8, &v67, (_CONTEXT *)0x10, &ByteOffset);
if( SecureDumpHeader >= 0 )
{
v32 = 0i64;
LABEL_51:
v33 = 32;
DWORD1(Src[1]) = *(_DWORD *)(a1 + 184);
v34 = *(_OWORD *)(a1 + 160);
LODWORD(Src[0]) = 32;
HIDWORD(Src[1]) = 0;
*(__int128 *)((char *)Src + 4) = v34;
if( *(_BYTE *)(a1 + 880) )
{
v35 = 4096;
DWORD2(Src[1]) = 4064 - v32 * 8;
memmove(&v4[v32], Src, 0x20u);
while( 1 )
{
SecureDumpHeader = IopLiveDumpWriteBuffer(v8, v4, (_CONTEXT *)0x1000, &ByteOffset);
if( SecureDumpHeader < 0 )
goto LABEL_87;
v35 -= 4096;
memset(v4, 0i64, 0x1000u);
if( v33 != LODWORD(Src[0]) )
{
v36 = LODWORD(Src[0]) - v33;
if( LODWORD(Src[0]) - v33 > 0x1000 )
v36 = 4096;
memmove(v4, (char *)Src + v33, v36);
v33 += v36;
}
if( !v35 )
goto LABEL_62;
}
}
DWORD2(Src[1]) = ((ByteOffset.anonymous_0.LowPart + 4127) & 0xFFFFF000) - ByteOffset.anonymous_0.LowPart;
SecureDumpHeader = IopLiveDumpWriteBuffer(v8, Src, (_CONTEXT *)0x20, &ByteOffset);
if( SecureDumpHeader >= 0 )
{
ByteOffset.QuadPart += DWORD2(Src[1]);
LABEL_62:
SecureDumpHeader = IopLiveDumpWriteBuffer(
v8,
*(VOID **)(a1 + 176),
(_CONTEXT *)*(unsigned int *)(a1 + 184),
&ByteOffset);
if( SecureDumpHeader >= 0 )
{
v37 = *(_DWORD *)(a1 + 984);
if( !v37
|| (v38 = *(_OWORD *)(a1 + 960),
*((_QWORD *)&Src[1] + 1) = 0i64,
LODWORD(Src[0]) = 32,
DWORD1(Src[1]) = v37,
*(__int128 *)((char *)Src + 4) = v38,
SecureDumpHeader = IopLiveDumpWriteBuffer(v8, Src, (_CONTEXT *)0x20, &ByteOffset),
SecureDumpHeader >= 0)
&& (SecureDumpHeader = IopLiveDumpWriteBuffer(
v8,
*(VOID **)(a1 + 976),
(_CONTEXT *)*(unsigned int *)(a1 + 984),
&ByteOffset),
SecureDumpHeader >= 0) )
{
v39 = *(_DWORD *)(a1 + 936);
if( !v39
|| (v40 = *(_OWORD *)(a1 + 912),
*((_QWORD *)&Src[1] + 1) = 0i64,
LODWORD(Src[0]) = 32,
DWORD1(Src[1]) = v39,
*(__int128 *)((char *)Src + 4) = v40,
SecureDumpHeader = IopLiveDumpWriteBuffer(v8, Src, (_CONTEXT *)0x20, &ByteOffset),
SecureDumpHeader >= 0)
&& (SecureDumpHeader = IopLiveDumpWriteBuffer(
v8,
*(VOID **)(a1 + 928),
(_CONTEXT *)*(unsigned int *)(a1 + 936),
&ByteOffset),
SecureDumpHeader >= 0) )
{
v41 = *(_QWORD *)(a1 + 624);
if( *(_QWORD *)(a1 + 552) != v41 )
{
RtlMergeBitMapsEx((UINT64 *)(a1 + 544), (INT64 *)(a1 + 616));
v41 = *(_QWORD *)(a1 + 624);
}
if( v41 != *(_QWORD *)(a1 + 640) )
RtlMergeBitMapsEx((UINT64 *)(a1 + 544), (INT64 *)(a1 + 632));
*(_DWORD *)(v2 + 0x2000) = 1347241043;
*(_DWORD *)(v2 + 8196) = 1347245380;
*(_QWORD *)(v2 + 8232) = RtlNumberOfSetBitsEx((_RTL_BITMAP_EX *)(a1 + 544));
if( *(_BYTE *)(a1 + 880) )
*(_QWORD *)(v2 + 4000) = ByteOffset.QuadPart - *(unsigned int *)(a1 + 888);
else
*(_LARGE_INTEGER *)(v2 + 4000) = ByteOffset;
*(_DWORD *)(v2 + 4176) |= 0x10u;
if( *(_BYTE *)(a1 + 880) )
{
v42 = *(unsigned int *)(a1 + 888);
ByteOffset.QuadPart = v42;
v43 = ExAllocatePoolWithTag(0x200ui64, v42, 1886217292i64);
v44 = v43;
if( !v43 )
{
SecureDumpHeader = -1073741670;
goto LABEL_87;
}
SecureDumpHeader = SecureDump_Get_SecureDumpHeader(v2, (INT64)v43, *(unsigned int *)(a1 + 888));
if( SecureDumpHeader >= 0 )
{
LABEL_82:
SecureDumpHeader = IopLiveDumpWriteBuffer(
v8,
(VOID *)v2,
(_CONTEXT *)*(unsigned int *)(v2 + 8224),
&ByteOffset);
if( SecureDumpHeader >= 0 && *(_BYTE *)(a1 + 880) )
{
v45 = (_CONTEXT *)*(unsigned int *)(a1 + 888);
ByteOffset.QuadPart = 0i64;
SecureDumpHeader = IopLiveDumpWriteBuffer(v8, v44, v45, &ByteOffset);
}
}
if( v44 )
ExFreePoolWithTag(v44, 0);
goto LABEL_87;
}
v44 = v64;
ByteOffset.QuadPart = 0i64;
goto LABEL_82;
}
}
}
}
}
LABEL_87:
if( v4 )
ExFreePoolWithTag(v4, 0);
LABEL_89:
IopLiveDumpFreeDumpBuffers(BufferDescriptor);
return SecureDumpHeader;
}Referenced by:
IoCaptureLiveDump