IoCaptureLiveDump
INT64 __fastcall IoCaptureLiveDump(INT64 a1, INT64 a2, INT64 a3, INT64 a4, INT64 a5, INT64 a6, GUID **a7){
INT64 v8;
KEVENT *v10;
EX_RUNDOWN_REF *v11;
UINT64 v12;
_ETHREAD *CurrentThread;
int inited;
void *v16;
HANDLE v17;
HANDLE v18;
struct EX_RUNDOWN_REF *SupervisorStateExtensionHost;
WCHAR v20;
void(__fastcall **ExtensionTable)(__int64);
__int64 v22;
WCHAR v23;
KEVENT *v24;
WCHAR v25;
VOID *PoolWithTag;
int v27;
KEVENT *v28;
INT64 v29;
int v30;
int v31;
INT64 v32;
_BYTE *v33;
int v34;
__int64 v35;
int v36;
__int64 v37;
__int64 v38;
INT64 v39;
UINT64 v40;
int v41;
const GUID *v42;
const GUID *v43;
char v44;
bool v45;
void *EventHandle;
HANDLE Handle;
HANDLE v48;
int v49;
int v50;
__int64 v51;
INT64 DestinationString[3];
KEVENT *v53;
KEVENT *v54;
INT64 v55;
__int64 v56;
unsigned __int64 v57;
__int64 v58;
unsigned __int64 v59;
__int128 v60;
struct _EVENT_DATA_DESCRIPTOR v61;
__int64 *v62;
__int64 v63;
char *v64;
__int64 v65;
bool *v66;
__int64 v67;
unsigned __int64 *v68;
__int64 v69;
struct _EVENT_DATA_DESCRIPTOR v70;
__int64 *v71;
__int64 v72;
unsigned __int64 *v73;
__int64 v74;
struct _EVENT_DATA_DESCRIPTOR v75;
int *v76;
int v77;
int v78;
DestinationString[0] = a6;
v8 = a3;
v49 = a1;
v55 = a3;
*(_OWORD *)&DestinationString[1] = 0i64;
EventHandle = 0i64;
v10 = 0i64;
v11 = 0i64;
v58 = *(_QWORD *)&KUSER_SHARED_DATA.InterruptTime.LowPart;
v12 = 0i64;
Handle = 0i64;
v48 = 0i64;
v53 = 0i64;
v54 = 0i64;
v60 = 0i64;
if( ForceDumpDisabled )
{
if( a7 )
*a7 = 0i64;
return 3221225659i64;
}
if( (_DWORD)BufferChunkSizeInBytes != KUSER_SHARED_DATA.LargePageMinimum )
{
LODWORD(BufferChunkSizeInBytes) = KUSER_SHARED_DATA.LargePageMinimum;
LODWORD(BufferChunkSizeInPages) = KUSER_SHARED_DATA.LargePageMinimum >> 12;
}
IopLiveDumpTraceInterfaceStart(0i64);
if( a7 )
*a7 = 0i64;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
v44 = ExAcquireResourceExclusiveLite(&IopLiveDumpLock, 0);
if( v44 != 1 )
{
inited = -1073741267;
LABEL_11:
v16 = EventHandle;
v17 = Handle;
v18 = v48;
goto LABEL_37;
}
SupervisorStateExtensionHost = (struct EX_RUNDOWN_REF *)KeGetSupervisorStateExtensionHost();
v11 = SupervisorStateExtensionHost;
if( SupervisorStateExtensionHost )
{
ExtensionTable = (void(__fastcall **)(__int64))ExGetExtensionTable(SupervisorStateExtensionHost);
IptInterface = (__int64)ExtensionTable;
if( !ExtensionTable )
goto LABEL_17;
LOBYTE(v22) = 1;
(*ExtensionTable)(v22);
if( !(*(unsigned __int8(**)(void))(IptInterface + 8))() )
{
(*(void(__fastcall **)(_QWORD))IptInterface)(0i64);
ExReleaseExtensionTable(v11);
IptInterface = 0i64;
}
if( !IptInterface )
LABEL_17:
v11 = 0i64;
}
if( (*(_DWORD *)(DestinationString[0] + 24) & 0x10) != 0 )
{
RtlInitUnicodeString((PUNICODE_STRING)&DestinationString[1], L"\\KernelObjects\\LowNonPagedPoolCondition", v20);
v10 = IoCreateNotificationEvent((UNICODE_STRING *)&DestinationString[1], &EventHandle);
RtlInitUnicodeString((PUNICODE_STRING)&DestinationString[1], L"\\KernelObjects\\LowMemoryCondition", v23);
v53 = IoCreateNotificationEvent((UNICODE_STRING *)&DestinationString[1], &Handle);
v24 = v53;
RtlInitUnicodeString((PUNICODE_STRING)&DestinationString[1], L"\\KernelObjects\\HighCommitCondition", v25);
v54 = IoCreateNotificationEvent((UNICODE_STRING *)&DestinationString[1], &v48);
if( IopLiveDumpIsUnderMemoryPressure(v10, v24) )
{
inited = -1073741248;
goto LABEL_11;
}
v8 = v55;
}
PoolWithTag = ExAllocatePoolWithTag(NonPagedPoolNx, 0x430ui64, 0x706D644Cui64);
v12 = (UINT64)PoolWithTag;
if( !PoolWithTag )
{
inited = -1073741670;
goto LABEL_11;
}
memset((INT64)PoolWithTag, 0i64);
v27 = v49;
*(_DWORD *)(v12 + 80) &= 0xFFFFFFF3;
*(_DWORD *)v12 = v27;
*(_QWORD *)(v12 + 32) = a5;
*(_QWORD *)(v12 + 800) = EventHandle;
*(_QWORD *)(v12 + 808) = Handle;
*(_QWORD *)(v12 + 816) = v48;
*(_QWORD *)(v12 + 832) = v53;
v28 = v54;
*(_QWORD *)(v12 + 8) = a2;
v17 = 0i64;
*(_QWORD *)(v12 + 16) = v8;
v16 = 0i64;
*(_QWORD *)(v12 + 24) = a4;
v18 = 0i64;
*(_QWORD *)(v12 + 840) = v28;
IopLiveDumpContext = (GUID *)v12;
*(_QWORD *)(v12 + 824) = v10;
IopLiveDumpInitRegistrySettings(v12);
if( (*(_DWORD *)(v12 + 80) & 0x200) != 0 && !*(_QWORD *)(v12 + 1048) )
goto LABEL_26;
EtwActivityIdControl(5u, (LPGUID)(v12 + 848));
EtwActivityIdControl(1u, (LPGUID)(v12 + 864));
if( (unsigned int)dword_140C04498 > 5 && tlgKeywordOn((__int64)&dword_140C04498, 0x200000000000i64) )
{
v30 = *(_DWORD *)(v12 + 1040);
v78 = 0;
v50 = v30;
v77 = 4;
v76 = &v50;
tlgWriteTransfer_EtwWriteTransfer(
(__int64)&dword_140C04498,
(unsigned __int8 *)&word_1400237BE,
(const GUID *)(v12 + 864),
(const GUID *)(v12 + 848),
3u,
&v75);
}
IopLiveDumpValidateParameters(v12, DestinationString[0], v29);
inited = v31;
if( v31 < 0 )
goto LABEL_37;
if( (*(_DWORD *)(v12 + 80) & 0x80u) != 0 )
{
KeQueryPerformanceCounter(&PerformanceFrequency);
IopLiveDumpGetMillisecondCounter(1);
}
if( (*(_DWORD *)(v12 + 40) & 8) != 0 && !a7 )
{
LABEL_26:
inited = -1073741811;
}
else
{
inited = IopLiveDumpAllocAndInitResources(v12);
if( inited >= 0 )
inited = IopLiveDumpCaptureMemoryPages(v12);
}
LABEL_37:
if( IptInterface )
{
(*(void(__fastcall **)(_QWORD))IptInterface)(0i64);
ExReleaseExtensionTable(v11);
IptInterface = 0i64;
}
if( v16 )
ZwClose(v16);
if( v17 )
ZwClose(v17);
if( v18 )
ZwClose(v18);
v32 = DestinationString[0];
if( (*(_DWORD *)(DestinationString[0] + 24) & 0x10) != 0
&& inited == -1073741248
&& IopLiveDumpIsTracingEnabled() == 1 )
{
EtwWrite(IopLiveDumpEtwRegHandle, (EVENT_DESCRIPTOR *)&LIVEDUMP_EVENT_MEMORY_PRESSURE_ABORT, 0i64, 0i64, 0i64);
}
if( v44 )
{
IopLiveDumpContext = 0i64;
ExReleaseResourceLite(&IopLiveDumpLock);
}
KeLeaveCriticalRegion();
if( inited >= 0 )
{
inited = SecureDump_GetSecureDumpSettings(v12 + 880);
if( inited >= 0 )
{
if( *v33 )
{
v34 = *(_DWORD *)(v12 + 888);
if( !v34 || !*(_BYTE *)(v12 + 881) || *(_DWORD *)(v12 + 884) != 4096 || (v34 & 0xFFF) != 0 )
inited = -1073741823;
}
if( inited >= 0 )
{
if( (*(_DWORD *)(v12 + 40) & 8) != 0 )
{
inited = -1073741802;
*a7 = (GUID *)v12;
}
else
{
IopLiveDumpTrace((_EVENT_DESCRIPTOR *)&LIVEDUMP_EVENT_WRITE_DUMPDATA_TO_FILE_START);
v35 = *(_QWORD *)&KUSER_SHARED_DATA.InterruptTime.LowPart;
if( *(_QWORD *)(v12 + 192) || *(_QWORD *)(v12 + 200) )
v36 = IopLiveDumpWriteDumpFileWithExtraPages(v12);
else
v36 = IopLiveDumpWriteDumpFile(v12);
inited = v36;
if( (unsigned int)dword_140C04498 > 5 && tlgKeywordOn((__int64)&dword_140C04498, 0x200000000000i64) )
{
v37 = *(_QWORD *)(v12 + 560);
v72 = 8i64;
v38 = *(_QWORD *)(v37 + 4000);
v71 = &v56;
v56 = v38;
v74 = 8i64;
v73 = &v57;
v57 = (*(_QWORD *)&KUSER_SHARED_DATA.InterruptTime.LowPart - v35) / 0x2710ui64;
tlgWriteTransfer_EtwWriteTransfer(
(__int64)&dword_140C04498,
(unsigned __int8 *)byte_140023905,
(const GUID *)(v12 + 864),
(const GUID *)(v12 + 848),
4u,
&v70);
}
IopLiveDumpTraceDumpFileWriteEnd(v12, 0i64, inited);
if( inited >= 0 && (*(_DWORD *)(v12 + 80) & 2) != 0 )
inited = 261;
}
}
}
}
IopLiveDumpTraceInterfaceEnd((__int64)v33, 0i64, inited);
if( (unsigned int)dword_140C04498 > 5 && tlgKeywordOn((__int64)&dword_140C04498, 0x200000000000i64) )
{
v41 = *(_DWORD *)(v32 + 24);
v62 = &v51;
v42 = (const GUID *)(v12 + 848);
LODWORD(v51) = inited;
v44 = (v41 & 8) != 0;
v45 = (v41 & 0x10) != 0;
v64 = &v44;
v66 = &v45;
v63 = 4i64;
v65 = 1i64;
v67 = 1i64;
v69 = 8i64;
v59 = (*(_QWORD *)&KUSER_SHARED_DATA.InterruptTime.LowPart - v58) / 0x2710ui64;
v68 = &v59;
if( v12 )
{
v43 = (const GUID *)(v12 + 864);
}
else
{
v42 = (const GUID *)&v60;
v43 = (const GUID *)&v60;
}
tlgWriteTransfer_EtwWriteTransfer((__int64)&dword_140C04498, (unsigned __int8 *)&word_14002388E, v43, v42, 6u, &v61);
}
if( v12 )
{
if( (*(_DWORD *)(v12 + 40) & 8) == 0 )
EtwActivityIdControl(2u, (LPGUID)(v12 + 848));
if( inited != -1073741802 )
{
IopLiveDumpReleaseResources(v12, v39, v40);
ExFreePoolWithTag((PVOID)v12, 0x706D644Cu);
}
}
return(unsigned int)inited;
}Referenced by:
DbgkCaptureLiveKernelDump
DbgkpWerCaptureLiveFullDump