KeSetTracepoint
NTSTATUS __fastcall KeSetTracepoint(
INT64 a1,
INT8 a2,
UINT64 a3,
INT64 a4,
INT64 a5,
INT64 a6,
INT64 a7,
INT64 a8,
_BYTE *a9){
INT64 v9;
INT64 v10;
__int64 v12;
int v13;
__int64 v14;
int v16;
__int64 v17;
_BOOL8 v18;
INT64 v19;
__int64 v21;
__int64 *v22;
__int64 v23;
__int64 *v24;
int v25;
VOID **PoolWithTag;
_ETHREAD *CurrentThread;
__int64 v28;
VOID **v29;
INT64 v30;
UINT64 v31;
INT64 *v32;
INT64 v33;
int v34;
VOID *v35;
_BOOL4 v36;
_BOOL4 v37;
int v38;
signed __int32 v39[8];
UINT64 Size;
_BOOL4 v41;
_BOOL4 v42;
_BOOL4 v43;
ULONG_PTR rcx0a[2];
int v45;
_BOOL4 v46;
VOID *BaseOfImage;
_BYTE *v48;
char v49[48];
BaseOfImage = 0i64;
v9 = 0i64;
v10 = a1;
*(_QWORD *)rcx0a = a1;
v12 = (unsigned int)KiDynamicTraceEnabled;
v13 = a4;
v45 = a4;
v48 = a9;
v14 = 1i64;
if( (KiDynamicTraceEnabled & 2) == 0 && (!a2 || (KiDynamicTraceEnabled & 1) == 0) )
return -1073741790;
if( !a1 && a2 || a3 > 0x7FFFFFFEFFFFi64 && a2 == 1 || a3 < 0xFFFF800000000000ui64 && !a2 )
return -1073741811;
if( a1 )
{
v17 = *(_QWORD *)(a1 + 992);
if( ((v17 & 1) != 0 || v17) && (a2 || (KiDynamicTraceEnabled & 2) == 0) )
return -1073741790;
}
v46 = (unsigned int)(v13 - 1) <= 1;
v18 = (unsigned int)(v13 - 2) <= 1;
v41 = (unsigned int)(v13 - 2) <= 1;
v42 = (unsigned int)(v13 - 4) <= 1;
v43 = (unsigned int)(v13 - 5) <= 1;
if( (unsigned int)(v13 - 2) <= 1 )
{
if( !a5 )
{
v19 = a7;
if( !a7 )
return -1073741811;
LABEL_28:
if( v19 )
{
v23 = 5i64;
if( a2 )
v23 = 7i64;
v24 = &KiDynamicTraceCallouts[v23];
if( (KiDynamicTraceEnabled & 4) == 0 )
{
LABEL_34:
if( v19 == *v24 )
goto LABEL_35;
return -1073741790;
}
if( v19 != *v24 )
{
DbgPrint("DTrace/NT: Overriding post-callback in DTrace test mode.\n", v12, v18, v14);
*v24 = a5;
goto LABEL_34;
}
}
LABEL_35:
v10 = *(_QWORD *)rcx0a;
goto LABEL_36;
}
v21 = 4i64;
if( a2 )
v21 = 6i64;
v12 = KiDynamicTraceEnabled & 4;
v22 = &KiDynamicTraceCallouts[v21];
if( (KiDynamicTraceEnabled & 4) != 0 )
{
if( a5 == *v22 )
{
LABEL_27:
v19 = a7;
goto LABEL_28;
}
DbgPrint((PCSTR)&stru_1407D2340._R15, v12, v18, 1i64);
*v22 = a5;
}
if( a5 != *v22 )
return -1073741790;
goto LABEL_27;
}
if( a5 || a7 )
return -1073741811;
LABEL_36:
if( (unsigned int)(v13 - 1) <= 1 || !v13 )
{
if( a3 >= 0xFFFF800000000000ui64 )
{
if( !RtlPcToFileHeader((VOID *)a3, &BaseOfImage) )
return -1073741811;
LOBYTE(v25) = KiTpIsSupportedKernelTracepointLocation((UINT64)BaseOfImage, a3);
if( !v25 )
return -1073741637;
}
if( (unsigned int)(v13 - 1) <= 1 )
{
PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x5Cui64, 1886549062i64);
v9 = (INT64)PoolWithTag;
if( !PoolWithTag )
return -1073741670;
memset(PoolWithTag, 0i64, 0x5Cu);
*(_QWORD *)(v9 + 16) = v10;
*(_BYTE *)(v9 + 50) = a2;
*(_QWORD *)(v9 + 8) = a3;
}
}
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
ExAcquirePushLockExclusiveEx(&KiTpStateLock, 0i64);
v28 = KiTpHashTable;
if( KiTpHashTable )
{
LABEL_53:
v30 = 0i64;
v31 = (a3 >> 4) & 0x3FFF;
v32 = (INT64 *)(v28 + 8 * v31);
v33 = *v32;
if( *v32 )
{
while( *(_QWORD *)(v33 + 8) != a3 || *(_QWORD *)(v33 + 16) != *(_QWORD *)rcx0a )
{
v32 = (INT64 *)v33;
v33 = *(_QWORD *)v33;
if( !v33 )
goto LABEL_57;
}
v30 = v33;
if( *(_BYTE *)(v33 + 50) != a2 )
{
v16 = -1073741811;
goto LABEL_104;
}
}
LABEL_57:
if( v45 )
{
v34 = v46;
if( !v46 )
goto LABEL_71;
if( v30 && !*(_BYTE *)(v30 + 24) )
v34 = *(_BYTE *)(v30 + 25) != 0 && v46;
if( v34 )
{
if( v30 )
{
v16 = -1073740008;
goto LABEL_104;
}
v35 = *(VOID **)(v9 + 8);
LODWORD(Size) = 1;
v16 = KiTpSetupCompletion(rcx0a[0], a2, v35, (VOID *)(v9 + 51), Size, (CHAR *)(v9 + 52));
if( v16 < 0 )
goto LABEL_104;
++KiTpRegisteredCount;
v32 = (INT64 *)(KiTpHashTable + 8 * v31);
*(_QWORD *)v9 = *v32;
*v32 = v9;
_InterlockedOr(v39, 0);
v36 = v41;
v30 = v9;
v9 &= -(__int64)v41;
}
else
{
LABEL_71:
if( !v30 )
{
v16 = -1073741275;
goto LABEL_104;
}
v36 = v41;
}
if( v36 )
{
if( !*(_BYTE *)(v30 + 48) )
{
if( ++KiTpEnabledCount == 1 )
_InterlockedOr(&KiDynamicTraceMask, 2u);
v16 = KiTpWriteBreakpoint(v30, 1);
if( v16 < 0 )
{
if( v30 == v9 )
{
*v32 = *(_QWORD *)v30;
_InterlockedOr(v39, 0);
--KiTpRegisteredCount;
}
if( !--KiTpEnabledCount )
_InterlockedAnd(&KiDynamicTraceMask, 0xFFFFFFFD);
goto LABEL_104;
}
*(_BYTE *)(v30 + 48) = 1;
}
*(_QWORD *)(v30 + 32) = a6;
*(_QWORD *)(v30 + 40) = a8;
_InterlockedOr(v39, 0);
v9 = 0i64;
*(_BYTE *)(v30 + 24) = a5 != 0;
*(_BYTE *)(v30 + 25) = a7 != 0;
}
v37 = v43;
v38 = v42;
if( v43 && *(_BYTE *)(v30 + 48) )
v38 = 1;
if( v38 )
{
if( *(_BYTE *)(v30 + 48) )
{
if( KiTpWriteBreakpoint(v30, 0) >= 0 )
{
if( !--KiTpEnabledCount )
_InterlockedAnd(&KiDynamicTraceMask, 0xFFFFFFFD);
v37 = v43;
*(_BYTE *)(v30 + 48) = 0;
}
else
{
v37 = 0;
}
}
*(_WORD *)(v30 + 24) = 0;
_InterlockedOr(v39, 0);
while( KiTpActiveTrapsCount )
_mm_pause();
*(_QWORD *)(v30 + 32) = 0i64;
*(_QWORD *)(v30 + 40) = 0i64;
}
if( v37 )
{
*v32 = *(_QWORD *)v30;
_InterlockedOr(v39, 0);
--KiTpRegisteredCount;
v9 = v30;
}
}
else if( !v30 )
{
LODWORD(Size) = 0;
v16 = KiTpSetupCompletion(rcx0a[0], a2, (VOID *)a3, 0i64, Size, v49);
goto LABEL_104;
}
if( v48 )
*v48 = *(_BYTE *)(v30 + 51);
v16 = 0;
goto LABEL_104;
}
v29 = ExAllocatePoolWithTag(0x200ui64, 0x20000ui64, 1886549062i64);
v28 = (__int64)v29;
if( v29 )
{
memset(v29, 0i64, 0x20000u);
KiTpHashTable = v28;
goto LABEL_53;
}
v16 = -1073741670;
LABEL_104:
if( v9 )
{
while( KiTpActiveTrapsCount )
_mm_pause();
ExFreePoolWithTag((PVOID)v9, 0x70727446u);
}
if( (_InterlockedExchangeAdd64(&KiTpStateLock._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(&KiTpStateLock);
KeAbPostRelease(&KiTpStateLock);
KeLeaveCriticalRegionThread(KeGetCurrentThread());
return v16;
}Referenced by:
No references.