IopLiveDumpWriteDumpFileWithExtraPages
INT64 __fastcall IopLiveDumpWriteDumpFileWithExtraPages(INT64 a1){
INT64 v1;
INT64 v2;
_OWORD *v4;
int SecureDumpHeader;
INT64 v6;
union _LARGE_INTEGER v7;
VOID *v8;
__int64 v9;
CHAR ExtraMergePages;
int v11;
__int64 v12;
int v13;
__int64 *v14;
_QWORD *v15;
_QWORD *v16;
char v17;
__int64 v18;
unsigned int v19;
INT64 v20;
CHAR v21;
int v22;
INT64 v23;
bool v24;
char *v25;
INT64 v26;
INT64 v27;
__int64 v28;
MDL *v29;
char v30;
_OWORD *PoolWithTag;
__int64 v32;
unsigned int v33;
__int128 v34;
int v35;
unsigned int v36;
int v37;
__int128 v38;
int v39;
__int128 v40;
__int64 v41;
UINT64 v42;
VOID *v43;
VOID *v44;
UINT64 v45;
char v47;
CHAR v48;
char v49;
union _LARGE_INTEGER ByteOffset;
_DWORD a4[2];
char *a3;
char *v53;
_QWORD *v54;
__int64 a5;
__int64 *v56;
__int64 v57;
__int64 v58;
PVOID Buffer;
__int64 v60;
INT64 v61;
INT64 a2;
INT64 CurrentThread;
VOID *v64;
__int64 v65;
__int128 Src[2];
__int128 v67;
v1 = *(_QWORD *)(a1 + 1024);
v2 = *(_QWORD *)(a1 + 560);
v53 = 0i64;
v57 = 0i64;
a4[1] = 0;
a3 = 0i64;
v4 = 0i64;
a5 = 0i64;
a4[0] = 0;
v64 = 0i64;
v65 = a1 + 680;
a2 = v1;
v67 = 0i64;
memset(Src, 0, sizeof(Src));
if( !v1 )
goto LABEL_2;
v6 = *(_QWORD *)(a1 + 1032);
v61 = v6;
if( !v6 )
goto LABEL_2;
if( *(_BYTE *)(a1 + 880) )
v7.QuadPart = *(_QWORD *)(v2 + 8224) + *(unsigned int *)(a1 + 888);
else
v7 = *(union _LARGE_INTEGER *)(v2 + 8224);
v8 = *(VOID **)(a1 + 64);
ByteOffset = v7;
v60 = -1i64;
CurrentThread = (INT64)KeGetCurrentThread();
v9 = *(_QWORD *)(a1 + 624);
v58 = 0i64;
v47 = 0;
if( *(_QWORD *)(a1 + 552) != v9 )
{
RtlClearAllBitsEx((_RTL_BITMAP_EX *)(a1 + 616));
v9 = *(_QWORD *)(a1 + 624);
}
if( v9 != *(_QWORD *)(a1 + 640) )
RtlClearAllBitsEx((_RTL_BITMAP_EX *)(a1 + 632));
*(_QWORD *)(a1 + 728) = 0i64;
*(_QWORD *)(a1 + 736) = 0i64;
IopLiveDumpGetNtMergePages(a1, v6, &a3, a4, &a5);
v56 = (__int64 *)v6;
ExtraMergePages = IopLiveDumpGetExtraMergePages((_QWORD *)a1, v1, &v53, &a4[1], &v57);
v11 = a4[0];
v12 = v1;
v54 = (_QWORD *)v1;
v13 = a4[1];
v48 = ExtraMergePages;
while( v13 || v11 )
{
if( v11 )
{
v14 = &v60;
if( v13 )
v14 = (__int64 *)v12;
v54 = v14;
}
else
{
v56 = &v60;
}
SecureDumpHeader = IopLiveDumpCheckTermination(a1, CurrentThread);
if( SecureDumpHeader < 0 )
goto LABEL_89;
if( v13 && v15[v13 - 1] < *v16 )
{
Buffer = v53;
v19 = v13 << 12;
v20 = a2;
v47 = v17;
v58 = v57;
v21 = IopLiveDumpGetExtraMergePages((_QWORD *)a1, a2, &v53, &a4[1], &v57);
v54 = (_QWORD *)v20;
goto LABEL_37;
}
if( v11 && v16[v11 - 1] < *v15 )
{
v22 = v11;
Buffer = a3;
v23 = v61;
v19 = v22 << 12;
v58 = a5;
v47 = 1;
IopLiveDumpGetNtMergePages(a1, v61, &a3, a4, &a5);
v56 = (__int64 *)v23;
v11 = a4[0];
goto LABEL_38;
}
v49 = 0;
v24 = *v16 == *v15;
if( *v16 < *v15 )
{
v25 = a3;
Buffer = a3;
goto LABEL_30;
}
Buffer = v53;
v49 = 1;
if( v24 )
{
v25 = a3;
LABEL_30:
v24 = v11-- == 1;
a4[0] = v11;
if( v24 )
{
v26 = v61;
v47 = 1;
v58 = a5;
IopLiveDumpGetNtMergePages(a1, v61, &a3, a4, &a5);
v15 = v54;
v18 = 4096i64;
v17 = v48;
v11 = a4[0];
v56 = (__int64 *)v26;
}
else
{
a3 = &v25[v18];
v56 = v16 + 1;
}
}
v19 = v18;
if( !v49 )
goto LABEL_38;
v24 = v13-- == 1;
a4[1] = v13;
if( !v24 )
{
v53 += v18;
v54 = v15 + 1;
goto LABEL_38;
}
v27 = a2;
v47 = v17;
v58 = v57;
v21 = IopLiveDumpGetExtraMergePages((_QWORD *)a1, a2, &v53, &a4[1], &v57);
v54 = (_QWORD *)v27;
v19 = 4096;
LABEL_37:
v13 = a4[1];
v48 = v21;
LABEL_38:
SecureDumpHeader = IopLiveDumpWriteBuffer(v8, Buffer, v19, &ByteOffset);
if( SecureDumpHeader < 0 )
goto LABEL_89;
v12 = (__int64)v54;
if( v47 )
{
v28 = v58;
v29 = *(MDL **)(*(_QWORD *)(a1 + 760) + 8 * v58);
if( v29 )
{
MmFreePagesFromMdl(v29);
ExFreePoolWithTag(*(PVOID *)(*(_QWORD *)(a1 + 760) + 8 * v28), 0);
*(_QWORD *)(*(_QWORD *)(a1 + 760) + 8 * v28) = 0i64;
}
else
{
MmFreeIndependentPages(*(PVOID *)(*(_QWORD *)(a1 + 752) + 8 * v58), (unsigned int)BufferChunkSizeInBytes);
}
v12 = (__int64)v54;
*(_QWORD *)(*(_QWORD *)(a1 + 752) + 8 * v28) = 0i64;
v47 = 0;
}
}
v30 = *(_BYTE *)(a1 + 880);
if( !v30 )
goto LABEL_47;
PoolWithTag = ExAllocatePoolWithTag(NonPagedPoolNx, 0x1000ui64, 0x706D644Cui64);
v4 = PoolWithTag;
if( !PoolWithTag )
{
LABEL_2:
SecureDumpHeader = -1073741670;
goto LABEL_89;
}
memset((INT64)PoolWithTag, 0i64);
v30 = *(_BYTE *)(a1 + 880);
LABEL_47:
LODWORD(v67) = 1886221636;
*(_QWORD *)((char *)&v67 + 4) = 0x10626F6C42i64;
HIDWORD(v67) = NtBuildNumber;
if( v30 )
{
v32 = 1i64;
*v4 = v67;
goto LABEL_51;
}
SecureDumpHeader = IopLiveDumpWriteBuffer(v8, &v67, 0x10ui64, &ByteOffset);
if( SecureDumpHeader >= 0 )
{
v32 = 0i64;
LABEL_51:
v33 = 32;
DWORD1(Src[1]) = *(_DWORD *)(a1 + 184);
v34 = *(_OWORD *)(a1 + 160);
LODWORD(Src[0]) = 32;
HIDWORD(Src[1]) = 0;
*(__int128 *)((char *)Src + 4) = v34;
if( *(_BYTE *)(a1 + 880) )
{
v35 = 4096;
DWORD2(Src[1]) = 4064 - v32 * 16;
memmove((UINT8 *)&v4[v32], (UINT8 *)Src, 0x20ui64);
while( 1 )
{
SecureDumpHeader = IopLiveDumpWriteBuffer(v8, v4, 0x1000ui64, &ByteOffset);
if( SecureDumpHeader < 0 )
goto LABEL_87;
v35 -= 4096;
memset((INT64)v4, 0i64);
if( v33 != LODWORD(Src[0]) )
{
v36 = LODWORD(Src[0]) - v33;
if( LODWORD(Src[0]) - v33 > 0x1000 )
v36 = 4096;
memmove((UINT8 *)v4, (UINT8 *)Src + v33, v36);
v33 += v36;
}
if( !v35 )
goto LABEL_62;
}
}
DWORD2(Src[1]) = ((ByteOffset.LowPart + 4127) & 0xFFFFF000) - ByteOffset.LowPart;
SecureDumpHeader = IopLiveDumpWriteBuffer(v8, Src, 0x20ui64, &ByteOffset);
if( SecureDumpHeader >= 0 )
{
ByteOffset.QuadPart += DWORD2(Src[1]);
LABEL_62:
SecureDumpHeader = IopLiveDumpWriteBuffer(v8, *(VOID **)(a1 + 176), *(unsigned int *)(a1 + 184), &ByteOffset);
if( SecureDumpHeader >= 0 )
{
v37 = *(_DWORD *)(a1 + 984);
if( !v37
|| (v38 = *(_OWORD *)(a1 + 960),
*((_QWORD *)&Src[1] + 1) = 0i64,
LODWORD(Src[0]) = 32,
DWORD1(Src[1]) = v37,
*(__int128 *)((char *)Src + 4) = v38,
SecureDumpHeader = IopLiveDumpWriteBuffer(v8, Src, 0x20ui64, &ByteOffset),
SecureDumpHeader >= 0)
&& (SecureDumpHeader = IopLiveDumpWriteBuffer(
v8,
*(VOID **)(a1 + 976),
*(unsigned int *)(a1 + 984),
&ByteOffset),
SecureDumpHeader >= 0) )
{
v39 = *(_DWORD *)(a1 + 936);
if( !v39
|| (v40 = *(_OWORD *)(a1 + 912),
*((_QWORD *)&Src[1] + 1) = 0i64,
LODWORD(Src[0]) = 32,
DWORD1(Src[1]) = v39,
*(__int128 *)((char *)Src + 4) = v40,
SecureDumpHeader = IopLiveDumpWriteBuffer(v8, Src, 0x20ui64, &ByteOffset),
SecureDumpHeader >= 0)
&& (SecureDumpHeader = IopLiveDumpWriteBuffer(
v8,
*(VOID **)(a1 + 928),
*(unsigned int *)(a1 + 936),
&ByteOffset),
SecureDumpHeader >= 0) )
{
v41 = *(_QWORD *)(a1 + 624);
if( *(_QWORD *)(a1 + 552) != v41 )
{
RtlMergeBitMapsEx((UINT64 *)(a1 + 544), (INT64 *)(a1 + 616));
v41 = *(_QWORD *)(a1 + 624);
}
if( v41 != *(_QWORD *)(a1 + 640) )
RtlMergeBitMapsEx((UINT64 *)(a1 + 544), (INT64 *)(a1 + 632));
*(_DWORD *)(v2 + 0x2000) = 1347241043;
*(_DWORD *)(v2 + 8196) = 1347245380;
*(_QWORD *)(v2 + 8232) = RtlNumberOfSetBitsEx((_RTL_BITMAP_EX *)(a1 + 544));
if( *(_BYTE *)(a1 + 880) )
*(_QWORD *)(v2 + 4000) = ByteOffset.QuadPart - *(unsigned int *)(a1 + 888);
else
*(union _LARGE_INTEGER *)(v2 + 4000) = ByteOffset;
*(_DWORD *)(v2 + 4176) |= 0x10u;
if( *(_BYTE *)(a1 + 880) )
{
v42 = *(unsigned int *)(a1 + 888);
ByteOffset.QuadPart = v42;
v43 = ExAllocatePoolWithTag(NonPagedPoolNx, v42, 0x706D644Cui64);
v44 = v43;
if( !v43 )
{
SecureDumpHeader = -1073741670;
goto LABEL_87;
}
SecureDumpHeader = SecureDump_Get_SecureDumpHeader(v2, (INT64)v43, *(unsigned int *)(a1 + 888));
if( SecureDumpHeader >= 0 )
{
LABEL_82:
SecureDumpHeader = IopLiveDumpWriteBuffer(v8, (VOID *)v2, *(unsigned int *)(v2 + 8224), &ByteOffset);
if( SecureDumpHeader >= 0 && *(_BYTE *)(a1 + 880) )
{
v45 = *(unsigned int *)(a1 + 888);
ByteOffset.QuadPart = 0i64;
SecureDumpHeader = IopLiveDumpWriteBuffer(v8, v44, v45, &ByteOffset);
}
}
if( v44 )
ExFreePoolWithTag(v44, 0);
goto LABEL_87;
}
v44 = v64;
ByteOffset.QuadPart = 0i64;
goto LABEL_82;
}
}
}
}
}
LABEL_87:
if( v4 )
ExFreePoolWithTag(v4, 0);
LABEL_89:
IopLiveDumpFreeDumpBuffers(v65);
return(unsigned int)SecureDumpHeader;
}Referenced by:
IoCaptureLiveDump