EtwpGetTraceGuidInfo
NTSTATUS __stdcall EtwpGetTraceGuidInfo(
_ETW_SILODRIVERSTATE *SiloState,
_GUID *Provider,
VOID *Buffer,
UINT64 *OutBufferLen){
unsigned int v4;
int v5;
NTSTATUS v6;
unsigned __int16 *UserModeGlobalLogger;
unsigned int i;
__int64 v12;
__int64(*v13)[2];
_ETW_GUID_ENTRY *GuidEntryByGuid;
__int64 v16;
unsigned int v17;
_ETHREAD *CurrentThread;
_ETW_GUID_ENTRY *Flink;
unsigned int v20;
_DWORD *v21;
char v22;
__int64 v23;
_LIST_ENTRY *p_RegListHead;
_BYTE *v25;
int v26;
__int64 v27;
__int64 v28;
unsigned int j;
__int64 v30;
_OWORD *v31;
__int64 v32;
_OWORD *v33;
__int64 v34;
_LIST_ENTRY *v35;
int v36;
_DWORD *v37;
UINT64 v38;
int v39;
unsigned int k;
__int64 v41;
_OWORD *v42;
NTSTATUS v43;
__int64 v44;
__int64 v45;
__int64 v46;
int v47;
int v48;
unsigned int v49;
_BYTE *v50;
__int64 v51;
UINT64 uAugend;
UINT64 *v53;
v53 = OutBufferLen;
v4 = *(_DWORD *)OutBufferLen;
v5 = 0;
v6 = 0;
LODWORD(uAugend) = 8;
v47 = 0;
if( SiloState == (_ETW_SILODRIVERSTATE *)EtwpHostSiloState )
UserModeGlobalLogger = UKUSER_SHARED_DATA.UserModeGlobalLogger;
else
UserModeGlobalLogger = SiloState->SiloGlobals->UserSharedData->UserModeGlobalLogger;
for( i = 0; i < 0xA; ++i )
{
v12 = 2i64 * i;
v13 = (&EtwpUmglProviders)[2 * i];
if( (*v13)[0] == *(_QWORD *)&Provider->Data1 && (*v13)[1] == *(_QWORD *)Provider->Data4 )
{
memset(Buffer, 0i64, v4);
v16 = LOBYTE((&EtwpUmglProviders)[v12 + 1]);
v17 = 24;
if( LOBYTE(UserModeGlobalLogger[v16]) )
{
v17 = 56;
if( v4 >= 0x38 )
{
*((_DWORD *)Buffer + 3) = 1;
*((_DWORD *)Buffer + 6) = 1;
*((_WORD *)Buffer + 15) = LOBYTE(UserModeGlobalLogger[v16]);
*((_QWORD *)Buffer + 5) = HIBYTE(UserModeGlobalLogger[v16]);
}
}
else
{
if( v4 < 0x18 )
goto LABEL_17;
*((_DWORD *)Buffer + 3) = 0;
}
if( v17 <= v4 )
{
*(_DWORD *)Buffer = 1;
*((_DWORD *)Buffer + 5) = 1;
*((_DWORD *)Buffer + 4) = 0;
*((_DWORD *)Buffer + 2) = 0;
LABEL_18:
*(_DWORD *)OutBufferLen = v17;
return v6;
}
LABEL_17:
v6 = -1073741789;
goto LABEL_18;
}
}
GuidEntryByGuid = EtwpFindGuidEntryByGuid(SiloState, Provider, EtwTraceGuidType);
if( !GuidEntryByGuid )
return -1073741163;
memset(Buffer, 0i64, *(_DWORD *)OutBufferLen);
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
ExAcquirePushLockExclusiveEx(&GuidEntryByGuid->Lock, 0i64);
Flink = (_ETW_GUID_ENTRY *)GuidEntryByGuid->RegListHead.Flink;
v20 = uAugend;
GuidEntryByGuid->LockOwner = (_ETHREAD *)KeGetCurrentThread();
if( Flink != (_ETW_GUID_ENTRY *)&GuidEntryByGuid->RegListHead )
{
while( 1 )
{
v49 = v20;
v21 = (char *)Buffer + v20;
v22 = 0;
if( RtlULongAdd(v20, 0x10ui64, &uAugend) < 0 )
break;
v20 = uAugend;
v25 = (_BYTE *)(v23 + 98);
++v47;
v26 = 0;
v27 = v23;
v48 = 0;
v50 = (_BYTE *)(v23 + 98);
if( (*(_BYTE *)(v23 + 98) & 8) != 0 )
{
v22 = 1;
if( (GuidEntryByGuid->LastEnable._bf_b & 1) != 0 )
{
if( RtlULongAdd((unsigned int)uAugend, 0x20ui64, &uAugend) < 0 )
break;
v20 = uAugend;
v27 = v23;
v26 = 1;
v25 = v50;
if( (unsigned int)uAugend <= v4 )
{
*(_DWORD *)v28 = 1;
*(_BYTE *)(v28 + 4) = GuidEntryByGuid->LastEnable.Level;
*(_QWORD *)(v28 + 16) = GuidEntryByGuid->LastEnable.EnableFlags.QuadPart;
*(_WORD *)(v28 + 6) = GuidEntryByGuid->LastEnable.LoggerId;
}
}
}
else if( *(_BYTE *)(v23 + 100) || *(_BYTE *)(v23 + 101) )
{
for( j = 0; j < 8; ++j )
{
v30 = 32 * (j + 4i64);
if( *(_DWORD *)((char *)&GuidEntryByGuid->GuidList.Flink + v30)
&& ((unsigned __int8)(1 << j) & *(_BYTE *)(v23 + 100)) != 0 )
{
v48 = v26 + 1;
if( RtlULongAdd(v20, 0x20ui64, &uAugend) < 0 )
goto LABEL_57;
v20 = uAugend;
v26 = v48;
if( (unsigned int)uAugend <= v4 )
{
*v31 = *(_LIST_ENTRY *)((char *)&GuidEntryByGuid->GuidList + v30);
v31[1] = *(_LIST_ENTRY *)((char *)&GuidEntryByGuid->SiloGuidList + v30);
}
}
v32 = *(_QWORD *)(v23 + 40);
v51 = v32;
if( v32 && *(_DWORD *)(v32 + v30) && ((unsigned __int8)(1 << j) & *(_BYTE *)(v23 + 101)) != 0 )
{
v48 = v26 + 1;
if( RtlULongAdd(v20, 0x20ui64, &uAugend) < 0 )
goto LABEL_57;
v20 = uAugend;
if( (unsigned int)uAugend <= v4 )
{
*v33 = *(_OWORD *)(v51 + v34);
v33[1] = *(_OWORD *)(v51 + v34 + 16);
}
}
v26 = v48;
}
v25 = v50;
p_RegListHead = &GuidEntryByGuid->RegListHead;
v22 = 0;
v27 = v23;
}
v35 = *(_LIST_ENTRY **)v23;
if( v20 <= v4 )
{
if( v22 == 1 )
v21[3] = 1;
if( (*v25 & 2) != 0 )
v36 = *(_DWORD *)(*(_QWORD *)(v27 + 80) + 1088i64);
else
v36 = 0;
v21[2] = v36;
v21[1] = v26;
if( v35 == p_RegListHead )
{
*v21 = 0;
LABEL_53:
v5 = v47;
goto LABEL_54;
}
*v21 = v20 - v49;
}
if( v35 == p_RegListHead )
goto LABEL_53;
}
LABEL_57:
GuidEntryByGuid->LockOwner = 0i64;
ExReleasePushLockEx((_DWORD)GuidEntryByGuid + 408, 0);
KeLeaveCriticalRegion();
LABEL_58:
v20 = uAugend;
v6 = -2147483643;
goto LABEL_59;
}
LABEL_54:
GuidEntryByGuid->LockOwner = 0i64;
ExReleasePushLockEx((_DWORD)GuidEntryByGuid + 408, 0);
KeLeaveCriticalRegion();
if( !v5 )
{
v5 = 2;
v47 = 2;
if( RtlULongAdd(v20, 0x10ui64, &uAugend) >= 0 )
{
v38 = (unsigned int)uAugend;
v39 = 0;
for( k = 0; k < 8; ++k )
{
if( GuidEntryByGuid->EnableInfo[k].IsEnabled )
{
++v39;
if( RtlULongAdd(v38, 0x20ui64, &uAugend) < 0 )
goto LABEL_58;
v38 = (unsigned int)uAugend;
if( (unsigned int)uAugend <= v4 )
{
*v42 = *(_LIST_ENTRY *)((char *)&GuidEntryByGuid->GuidList + v41);
v42[1] = *(_LIST_ENTRY *)((char *)&GuidEntryByGuid->SiloGuidList + v41);
}
}
}
if( (unsigned int)v38 <= v4 )
{
v37[2] = 0;
v37[1] = v39;
*v37 = v38 - v20;
v37[3] = 2;
}
if( RtlULongAdd(v38, 0x10ui64, &uAugend) < 0 )
goto LABEL_58;
v43 = RtlULongAdd((unsigned int)uAugend, 0x20ui64, &uAugend);
v20 = uAugend;
if( v43 < 0 )
{
v6 = -2147483643;
goto LABEL_59;
}
if( (unsigned int)uAugend > v4 )
{
LABEL_59:
v5 = v47;
}
else
{
*(_QWORD *)(v44 + 4) = v46;
*(_DWORD *)v44 = v46;
*(_DWORD *)(v44 + 12) = 3;
*(_DWORD *)v45 = GuidEntryByGuid->LastEnable._bf_b & 1;
v5 = 2;
if( (GuidEntryByGuid->LastEnable._bf_b & 1) != 0 )
{
*(_DWORD *)(v44 + 4) = 1;
*(_BYTE *)(v45 + 4) = GuidEntryByGuid->LastEnable.Level;
*(_QWORD *)(v45 + 16) = GuidEntryByGuid->LastEnable.EnableFlags.QuadPart;
*(_WORD *)(v45 + 6) = GuidEntryByGuid->LastEnable.LoggerId;
}
}
}
else
{
v20 = uAugend;
v6 = -2147483643;
}
}
EtwpUnreferenceGuidEntry(GuidEntryByGuid);
if( v6 >= 0 )
{
if( v20 > v4 )
v6 = -1073741789;
else
*(_DWORD *)Buffer = v5;
}
*(_DWORD *)v53 = v20;
return v6;
}Referenced by:
NtTraceControl