KdpAddBreakpoint
UINT64 __stdcall KdpAddBreakpoint(
VOID *Address,
UINT64 BreakInstruction,
UINT8 BreakInstructionSize,
UINT8 BreakInstructionAlignment){
__int64 v8;
int v9;
VOID **i;
int v11;
NTSTATUS v12;
char v14;
int inserted;
UINT64 Buffer[5];
Buffer[0] = 0i64;
if( ((unsigned __int8)(BreakInstructionSize - 1) & BreakInstructionSize) != 0
|| (unsigned __int64)Address >= 0xFFFF800000000000ui64
&& (BreakInstruction != 204 || BreakInstructionSize != 1 || BreakInstructionAlignment) )
{
return 0i64;
}
v8 = 0i64;
++*(&KiSwapEvent + 1155);
v9 = 0;
for( i = (VOID **)&KdpBreakpointTable; ; i += 5 )
{
v11 = *((_DWORD *)i + 8);
if( (v11 & 1) != 0 && *i == Address )
break;
if( !v8 && !v11 )
v8 = (__int64)i;
if( (unsigned int)++v9 >= 0x20 )
{
if( !v8 )
return 0i64;
v12 = KdpCopyCodeStream(
(unsigned __int64)Address & ~(unsigned __int64)BreakInstructionAlignment,
Buffer,
(VOID *)BreakInstructionSize,
4ui64);
*(_QWORD *)v8 = Address;
*(_BYTE *)(v8 + 36) = BreakInstructionSize;
*(_BYTE *)(v8 + 37) = BreakInstructionAlignment;
*(_QWORD *)(v8 + 16) = BreakInstruction;
if( v12 < 0 )
{
*(_QWORD *)(v8 + 8) = KeGetCurrentThread()->ApcState.Process;
*(_DWORD *)(v8 + 32) = 3;
return(unsigned int)((v8 - (__int64)&KdpBreakpointTable) / 40) + 1;
}
*(_QWORD *)(v8 + 24) = Buffer[0];
v14 = KdpOweBreakpoint;
*(_QWORD *)(v8 + 8) = KeGetCurrentThread()->ApcState.Process;
inserted = KdpInsertBreakpoint(v8, Buffer);
if( inserted )
{
*(_DWORD *)(v8 + 32) = inserted;
return(unsigned int)((v8 - (__int64)&KdpBreakpointTable) / 40) + 1;
}
KdpOweBreakpoint = v14;
return 0i64;
}
}
if( (v11 & 8) == 0 )
return 0i64;
*((_DWORD *)i + 8) = v11 & 0xFFFFFFF7;
return(unsigned int)(v9 + 1);
}Referenced by:
KdpSendWaitContinue
KdpWriteBreakPointEx
KdpWriteCustomBreakpoint