IopLiveDumpCaptureMemoryPages
NTSTATUS __stdcall IopLiveDumpCaptureMemoryPages(_LIVEDUMP_CONTEXT *Context){
_LIVEDUMP_CONTEXT *v2;
__int64 v3;
char v4;
bool v5;
_LIVEDUMP_CONTEXT v6;
int v7;
__int64 v8;
__int64 v10;
__int64 v11;
__int64 v12;
__int64 v13;
__int64 v14;
__int64 v15;
__int64 v16;
_MM_MIRROR_DISPATCH MirrorDispatch[2];
NTSTATUS(__stdcall *v18)(UINT64);
NTSTATUS(__stdcall *v19)(_LARGE_INTEGER, _LARGE_INTEGER);
__int128 v20;
_EVENT_DATA_DESCRIPTOR v21;
__int64 *v22;
int v23;
int v24;
__int64 *v25;
int v26;
int v27;
__int64 *v28;
int v29;
int v30;
__int64 *v31;
int v32;
int v33;
__int64 *v34;
int v35;
int v36;
__int64 *v37;
int v38;
int v39;
__int64 *v40;
int v41;
int v42;
v2 = Context + 76;
v20 = 0i64;
v3 = *(_QWORD *)&KUSER_SHARED_DATA.InterruptTime.LowPart;
*(_QWORD *)MirrorDispatch = IopLiveDumpStartMirroringCallback;
v18 = IopLiveDumpEndMirroringCallback;
v19 = IopLiveDumpMirrorPhysicalMemoryCallback;
v4 = Context[10] & 4;
SaveSupervisorState = 1;
v5 = v4 != 0;
v6 = Context[20];
DWORD2(v20) = v5 ? 657 : 593;
if( (v6 & 0x20) != 0 )
DWORD2(v20) = (v5 ? 657 : 593) | 0x100;
v7 = MmDuplicateMemory(MirrorDispatch);
if( (Context[20] & 0x80u) != 0 )
*((_QWORD *)Context + 64) = (unsigned __int64)(1000i64 * *((_QWORD *)Context + 63)) / *(&stru_140C452E0 + 85);
if( v7 < 0 || v7 == 258 )
{
if( (v2[2] & 1) != 0 )
IopLiveDumpUncorralProcessors(v2, 1u);
IopLiveDumpTraceMmDuplicateMemoryFailure((__int64)Context, v7);
if( v7 == 258 )
{
Context[20] |= 0x40u;
v7 = -1073740682;
}
}
else
{
if( VslIsSecureKernelRunning() && (*((_QWORD *)Context + 87) || *((_QWORD *)Context + 88)) )
VslFinalizeLiveDumpInSk((_QWORD *)Context + 24, (_QWORD *)Context + 25, (__int64)(Context + 36));
*((_QWORD *)Context + 60) = (*(_QWORD *)&KUSER_SHARED_DATA.InterruptTime.LowPart - v3) / 0x2710ui64;
IopLiveDumpTraceCaptureMemoryPages();
}
SaveSupervisorState = 0;
if( (unsigned int)dword_140C04498 > 5 && tlgKeywordOn((__int64)&dword_140C04498, 0x200000000000i64) )
{
v8 = *((_QWORD *)Context + 60);
v24 = 0;
v27 = 0;
v30 = 0;
v33 = 0;
v36 = 0;
v39 = 0;
v42 = 0;
v10 = v8;
v22 = &v10;
v11 = *((_QWORD *)Context + 61);
v25 = &v11;
v12 = *((_QWORD *)Context + 62);
v28 = &v12;
v13 = *((_QWORD *)Context + 64);
v31 = &v13;
v14 = *((_QWORD *)Context + 65);
v34 = &v14;
v15 = *((_QWORD *)Context + 66);
v37 = &v15;
v16 = *((_QWORD *)Context + 67);
v40 = &v16;
v23 = 8;
v26 = 8;
v29 = 8;
v32 = 8;
v35 = 8;
v38 = 8;
v41 = 8;
tlgWriteTransfer_EtwWriteTransfer(
(__int64)&dword_140C04498,
(unsigned __int8 *)&byte_140023C7F,
(const _GUID *)Context + 54,
(const _GUID *)Context + 53,
9u,
&v21);
}
return v7;
}Referenced by:
IoCaptureLiveDump