KeSetTracepoint

NTSTATUS __fastcall KeSetTracepoint(
        INT64 a1,
        INT8 a2,
        UINT64 a3,
        INT64 a4,
        INT64 a5,
        INT64 a6,
        INT64 a7,
        INT64 a8,
        _BYTE *a9){
  INT64 v9; 
  INT64 v10; 
  __int64 v12; 
  int v13; 
  __int64 v14; 
  int v16; 
  __int64 v17; 
  _BOOL8 v18; 
  INT64 v19; 
  __int64 v21; 
  __int64 *v22; 
  __int64 v23; 
  __int64 *v24; 
  int v25; 
  VOID **PoolWithTag; 
  _ETHREAD *CurrentThread; 
  __int64 v28; 
  VOID **v29; 
  INT64 v30; 
  UINT64 v31; 
  INT64 *v32; 
  INT64 v33; 
  int v34; 
  VOID *v35; 
  _BOOL4 v36; 
  _BOOL4 v37; 
  int v38; 
  signed __int32 v39[8]; 
  UINT64 Size; 
  _BOOL4 v41; 
  _BOOL4 v42; 
  _BOOL4 v43; 
  ULONG_PTR rcx0a[2]; 
  int v45; 
  _BOOL4 v46; 
  VOID *BaseOfImage; 
  _BYTE *v48; 
  char v49[48]; 

  BaseOfImage = 0i64;
  v9 = 0i64;
  v10 = a1;
  *(_QWORD *)rcx0a = a1;
  v12 = (unsigned int)KiDynamicTraceEnabled;
  v13 = a4;
  v45 = a4;
  v48 = a9;
  v14 = 1i64;
  if( (KiDynamicTraceEnabled & 2) == 0 && (!a2 || (KiDynamicTraceEnabled & 1) == 0) )
    return -1073741790;
  if( !a1 && a2 || a3 > 0x7FFFFFFEFFFFi64 && a2 == 1 || a3 < 0xFFFF800000000000ui64 && !a2 )
    return -1073741811;
  if( a1 )
  {
    v17 = *(_QWORD *)(a1 + 992);
    if( ((v17 & 1) != 0 || v17) && (a2 || (KiDynamicTraceEnabled & 2) == 0) )
      return -1073741790;
  }
  v46 = (unsigned int)(v13 - 1) <= 1;
  v18 = (unsigned int)(v13 - 2) <= 1;
  v41 = (unsigned int)(v13 - 2) <= 1;
  v42 = (unsigned int)(v13 - 4) <= 1;
  v43 = (unsigned int)(v13 - 5) <= 1;
  if( (unsigned int)(v13 - 2) <= 1 )
  {
    if( !a5 )
    {
      v19 = a7;
      if( !a7 )
        return -1073741811;
LABEL_28:
      if( v19 )
      {
        v23 = 5i64;
        if( a2 )
          v23 = 7i64;
        v24 = &KiDynamicTraceCallouts[v23];
        if( (KiDynamicTraceEnabled & 4) == 0 )
        {
LABEL_34:
          if( v19 == *v24 )
            goto LABEL_35;
          return -1073741790;
        }
        if( v19 != *v24 )
        {
          DbgPrint("DTrace/NT: Overriding post-callback in DTrace test mode.\n", v12, v18, v14);
          *v24 = a5;
          goto LABEL_34;
        }
      }
LABEL_35:
      v10 = *(_QWORD *)rcx0a;
      goto LABEL_36;
    }
    v21 = 4i64;
    if( a2 )
      v21 = 6i64;
    v12 = KiDynamicTraceEnabled & 4;
    v22 = &KiDynamicTraceCallouts[v21];
    if( (KiDynamicTraceEnabled & 4) != 0 )
    {
      if( a5 == *v22 )
      {
LABEL_27:
        v19 = a7;
        goto LABEL_28;
      }
      DbgPrint((PCSTR)&stru_1407D2340._R15, v12, v18, 1i64);
      *v22 = a5;
    }
    if( a5 != *v22 )
      return -1073741790;
    goto LABEL_27;
  }
  if( a5 || a7 )
    return -1073741811;
LABEL_36:
  if( (unsigned int)(v13 - 1) <= 1 || !v13 )
  {
    if( a3 >= 0xFFFF800000000000ui64 )
    {
      if( !RtlPcToFileHeader((VOID *)a3, &BaseOfImage) )
        return -1073741811;
      LOBYTE(v25) = KiTpIsSupportedKernelTracepointLocation((UINT64)BaseOfImage, a3);
      if( !v25 )
        return -1073741637;
    }
    if( (unsigned int)(v13 - 1) <= 1 )
    {
      PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x5Cui64, 1886549062i64);
      v9 = (INT64)PoolWithTag;
      if( !PoolWithTag )
        return -1073741670;
      memset(PoolWithTag, 0i64, 0x5Cu);
      *(_QWORD *)(v9 + 16) = v10;
      *(_BYTE *)(v9 + 50) = a2;
      *(_QWORD *)(v9 + 8) = a3;
    }
  }
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  ExAcquirePushLockExclusiveEx(&KiTpStateLock, 0i64);
  v28 = KiTpHashTable;
  if( KiTpHashTable )
  {
LABEL_53:
    v30 = 0i64;
    v31 = (a3 >> 4) & 0x3FFF;
    v32 = (INT64 *)(v28 + 8 * v31);
    v33 = *v32;
    if( *v32 )
    {
      while( *(_QWORD *)(v33 + 8) != a3 || *(_QWORD *)(v33 + 16) != *(_QWORD *)rcx0a )
      {
        v32 = (INT64 *)v33;
        v33 = *(_QWORD *)v33;
        if( !v33 )
          goto LABEL_57;
      }
      v30 = v33;
      if( *(_BYTE *)(v33 + 50) != a2 )
      {
        v16 = -1073741811;
        goto LABEL_104;
      }
    }
LABEL_57:
    if( v45 )
    {
      v34 = v46;
      if( !v46 )
        goto LABEL_71;
      if( v30 && !*(_BYTE *)(v30 + 24) )
        v34 = *(_BYTE *)(v30 + 25) != 0 && v46;
      if( v34 )
      {
        if( v30 )
        {
          v16 = -1073740008;
          goto LABEL_104;
        }
        v35 = *(VOID **)(v9 + 8);
        LODWORD(Size) = 1;
        v16 = KiTpSetupCompletion(rcx0a[0], a2, v35, (VOID *)(v9 + 51), Size, (CHAR *)(v9 + 52));
        if( v16 < 0 )
          goto LABEL_104;
        ++KiTpRegisteredCount;
        v32 = (INT64 *)(KiTpHashTable + 8 * v31);
        *(_QWORD *)v9 = *v32;
        *v32 = v9;
        _InterlockedOr(v39, 0);
        v36 = v41;
        v30 = v9;
        v9 &= -(__int64)v41;
      }
      else
      {
LABEL_71:
        if( !v30 )
        {
          v16 = -1073741275;
          goto LABEL_104;
        }
        v36 = v41;
      }
      if( v36 )
      {
        if( !*(_BYTE *)(v30 + 48) )
        {
          if( ++KiTpEnabledCount == 1 )
            _InterlockedOr(&KiDynamicTraceMask, 2u);
          v16 = KiTpWriteBreakpoint(v30, 1);
          if( v16 < 0 )
          {
            if( v30 == v9 )
            {
              *v32 = *(_QWORD *)v30;
              _InterlockedOr(v39, 0);
              --KiTpRegisteredCount;
            }
            if( !--KiTpEnabledCount )
              _InterlockedAnd(&KiDynamicTraceMask, 0xFFFFFFFD);
            goto LABEL_104;
          }
          *(_BYTE *)(v30 + 48) = 1;
        }
        *(_QWORD *)(v30 + 32) = a6;
        *(_QWORD *)(v30 + 40) = a8;
        _InterlockedOr(v39, 0);
        v9 = 0i64;
        *(_BYTE *)(v30 + 24) = a5 != 0;
        *(_BYTE *)(v30 + 25) = a7 != 0;
      }
      v37 = v43;
      v38 = v42;
      if( v43 && *(_BYTE *)(v30 + 48) )
        v38 = 1;
      if( v38 )
      {
        if( *(_BYTE *)(v30 + 48) )
        {
          if( KiTpWriteBreakpoint(v30, 0) >= 0 )
          {
            if( !--KiTpEnabledCount )
              _InterlockedAnd(&KiDynamicTraceMask, 0xFFFFFFFD);
            v37 = v43;
            *(_BYTE *)(v30 + 48) = 0;
          }
          else
          {
            v37 = 0;
          }
        }
        *(_WORD *)(v30 + 24) = 0;
        _InterlockedOr(v39, 0);
        while( KiTpActiveTrapsCount )
          _mm_pause();
        *(_QWORD *)(v30 + 32) = 0i64;
        *(_QWORD *)(v30 + 40) = 0i64;
      }
      if( v37 )
      {
        *v32 = *(_QWORD *)v30;
        _InterlockedOr(v39, 0);
        --KiTpRegisteredCount;
        v9 = v30;
      }
    }
    else if( !v30 )
    {
      LODWORD(Size) = 0;
      v16 = KiTpSetupCompletion(rcx0a[0], a2, (VOID *)a3, 0i64, Size, v49);
      goto LABEL_104;
    }
    if( v48 )
      *v48 = *(_BYTE *)(v30 + 51);
    v16 = 0;
    goto LABEL_104;
  }
  v29 = ExAllocatePoolWithTag(0x200ui64, 0x20000ui64, 1886549062i64);
  v28 = (__int64)v29;
  if( v29 )
  {
    memset(v29, 0i64, 0x20000u);
    KiTpHashTable = v28;
    goto LABEL_53;
  }
  v16 = -1073741670;
LABEL_104:
  if( v9 )
  {
    while( KiTpActiveTrapsCount )
      _mm_pause();
    ExFreePoolWithTag((PVOID)v9, 0x70727446u);
  }
  if( (_InterlockedExchangeAdd64(&KiTpStateLock._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock(&KiTpStateLock);
  KeAbPostRelease(&KiTpStateLock);
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  return v16;
}

Referenced by:

No references.