IopMarkPagesForRunTimeTriageDataBlocks
NTSTATUS __stdcall IopMarkPagesForRunTimeTriageDataBlocks(
_MM_KERNEL_DUMP_CONTEXT *Context,
INT64 a2,
UINT64 a3,
UINT64 a4){
__int64 MaxValidMemorySizeDown;
int v9;
NTSTATUS result;
NTSTATUS v11;
char *v12;
unsigned __int16 v13;
UINT64 v14;
MaxValidMemorySizeDown = (unsigned int)IopGetMaxValidMemorySizeDown(*(VOID **)(a2 + 248));
IopGetMaxValidMemorySize(*(VOID **)(a2 + 248), 0x100ui64);
result = MmAddRangeToCrashDump(
Context,
(VOID *)(*(_QWORD *)(a2 + 248) - MaxValidMemorySizeDown),
(unsigned int)(v9 + MaxValidMemorySizeDown));
v11 = result;
if( result >= 0 )
{
v12 = &IopRunTimeContextOffsets;
v13 = 144;
while( 1 )
{
v14 = *(_QWORD *)(v13 + a2);
if( v14 < a3 || v14 >= a4 )
{
result = MmAddRangeToCrashDump(Context, (VOID *)(v14 & 0xFFFFFFFFFFFFF000ui64), 0x1000ui64);
v11 = result;
if( result < 0 )
break;
}
v12 += 2;
v13 = *(_WORD *)v12;
if( *(_WORD *)v12 == 0xFFFF )
return v11;
}
}
return result;
}Referenced by:
IopAddMiniDumpPagesToPartialKernelDump