MmAddPrivateDataToCrashDump
NTSTATUS __stdcall MmAddPrivateDataToCrashDump(_MM_KERNEL_DUMP_CONTEXT *Context, UINT64 Flags){
NTSTATUS v2;
char v3;
NTSTATUS v5;
_KPRCB **v6;
__int64 v7;
int v8;
NTSTATUS v9;
NTSTATUS v10;
void **v11;
NTSTATUS v12;
int v13;
v2 = 0;
v3 = Flags;
if( (Flags & 1) != 0 )
{
v5 = MmAddRangeToCrashDump(Context, MmPfnDatabase, 0x30000000000ui64);
if( v5 < 0 )
v2 = v5;
}
if( (v3 & 2) != 0 && (_DWORD)KeNumberProcessors_0 )
{
v6 = &KiProcessorBlock;
v7 = (unsigned int)KeNumberProcessors_0;
do
{
v8 = (*(__int64(__fastcall **)(_MM_KERNEL_DUMP_CONTEXT *, unsigned __int64, __int64))Context)(
Context,
(*v6++)->CurrentThread->Tcb.ApcState.Process->Pcb.DirectoryTableBase >> 12,
1i64);
if( v8 < 0 )
v2 = v8;
--v7;
}
while( v7 );
}
if( (v3 & 4) != 0 )
{
v9 = MmAddRangeToCrashDump(Context, (VOID *)PsNtosImageBase, PsNtosImageEnd - PsNtosImageBase);
if( v9 < 0 )
v2 = v9;
}
if( (v3 & 8) != 0 )
{
v10 = MmAddRangeToCrashDump(Context, PsHalImageBase, PsHalImageEnd - (_QWORD)PsHalImageBase);
if( v10 < 0 )
v2 = v10;
}
if( (v3 & 0x10) != 0 )
{
v11 = (void **)*(&stru_140C4DB30 + 546);
while( v11 != (void **)((char *)&stru_140C4DB30 + 4368) )
{
v12 = MmAddRangeToCrashDump(Context, v11 - 16, 0x5000ui64);
v11 = (void **)*v11;
if( v12 < 0 )
v2 = v12;
}
}
if( (v3 & 0x20) != 0 )
{
v13 = MiAddPartitionDataToCrashDump(Context);
if( v13 < 0 )
return v13;
}
return v2;
}Referenced by:
IopAddLiveDumpPagesToPartialKernelDump
IopLiveDumpMarkImportantDumpData
IopLiveDumpMarkRequiredDumpData