IopLiveDumpCallRemovePagesCallbacks
CHAR __fastcall IopLiveDumpCallRemovePagesCallbacks(INT64 a1){
_DWORD *v1;
unsigned int v2;
CHAR *v3;
UINT8 IsTracingEnabled;
KBUGCHECK_REASON_CALLBACK_RECORD *Flink;
KBUGCHECK_REASON_CALLBACK_RECORD **v6;
PUCHAR Component;
char v8;
bool v9;
int v10;
unsigned int v11;
int v12;
char *v13;
int v14;
INT64 Failure_4;
__int128 v18;
__int128 v19;
LIST_ENTRY *PreviousValidEntry[2];
KBUGCHECK_REASON_CALLBACK_RECORD *v21;
INT64 v22;
__int128 v23;
__int128 v24;
__int128 v25;
__int128 v26;
EVENT_DATA_DESCRIPTOR UserData;
v1 = (_DWORD *)a1;
v22 = a1;
v18 = 0i64;
v19 = 0i64;
v23 = 0i64;
v24 = 0i64;
v25 = 0i64;
v26 = 0i64;
v2 = 1;
Failure_4 = 1i64;
v3 = (CHAR *)CallbackIdentifier;
IsTracingEnabled = IopLiveDumpIsTracingEnabled();
if( IsTracingEnabled )
EtwWrite(
IopLiveDumpEtwRegHandle,
(EVENT_DESCRIPTOR *)&LIVEDUMP_EVENT_SIZING_WORKFLOW_REMOVEPAGES_CALLBACKS_START,
0i64,
0i64,
0i64);
Flink = KeBugCheckAddRemovePagesCallbackListHead;
v6 = &KeBugCheckAddRemovePagesCallbackListHead;
PreviousValidEntry[0] = (LIST_ENTRY *)&KeBugCheckAddRemovePagesCallbackListHead;
while( 1 )
{
PreviousValidEntry[1] = &Flink->Entry;
if( Flink == (KBUGCHECK_REASON_CALLBACK_RECORD *)&KeBugCheckAddRemovePagesCallbackListHead )
break;
v21 = Flink;
LOBYTE(v6) = KeValidateBugCheckCallbackRecord(Flink, KbCallbackRemovePages, PreviousValidEntry);
if( (_BYTE)v6 )
{
if( IsTracingEnabled )
{
Component = Flink->Component;
if( Component
&& (MmIsAddressValid(Component), v8)
&& RtlStringCbLengthA((PSTR)Flink->Component, (UINT64 *)0x101) >= 0 )
{
v3 = (CHAR *)Flink->Component;
v2 = ++Failure_4;
}
else
{
Failure_4 = 1i64;
v2 = 1;
v3 = (CHAR *)CallbackIdentifier;
}
UserData.Ptr = (unsigned __int64)v3;
UserData.Size = v2;
UserData.Reserved = 0;
EtwWrite(
IopLiveDumpEtwRegHandle,
(EVENT_DESCRIPTOR *)&LIVEDUMP_EVENT_SIZING_WORKFLOW_REMOVEPAGES_CALLBACK_START,
0i64,
1ui64,
&UserData);
}
*(_QWORD *)&v18 = 0i64;
HIDWORD(v18) = *v1;
do
{
v19 = 0ui64;
DWORD2(v18) = 0;
v9 = 0;
((void(__fastcall *)(__int64, KBUGCHECK_REASON_CALLBACK_RECORD *, __int128 *))v21->CallbackRoutine)(
6i64,
v21,
&v18);
if( *((_QWORD *)&v19 + 1) )
{
v10 = DWORD2(v18);
if( (DWORD2(v18) & 0x80000003) != 0 )
{
v11 = DWORD2(v18) & 0x80000000;
if( (SDWORD2(v18) & 0x80000000) != 0 )
{
v10 = DWORD2(v18) & 0x7FFFFFFF;
DWORD2(v18) &= ~0x80000000;
}
v9 = v11 != 0;
if( ((v10 - 1) & v10) != 0 )
{
v14 = -1073741811;
}
else
{
v12 = v10 & 1;
v13 = (char *)v19;
if( !v12 )
v13 = (char *)((unsigned __int64)v19 >> 12);
v23 = *(_OWORD *)(a1 + 576);
*(_QWORD *)&v25 = &v23;
v14 = IoFreeDumpRange((__int64)&v24, v13, *((unsigned __int64 *)&v19 + 1), 2 * (v12 ^ 1u));
}
if( v14 < 0 )
{
v9 = 0;
IopLiveDumpTraceRemovePagesCallbackFailure(v3, v2, (unsigned int)v14);
}
}
}
}
while( v9 );
if( IsTracingEnabled )
{
UserData.Ptr = (unsigned __int64)v3;
UserData.Size = v2;
UserData.Reserved = 0;
EtwWrite(
IopLiveDumpEtwRegHandle,
(EVENT_DESCRIPTOR *)&LIVEDUMP_EVENT_SIZING_WORKFLOW_REMOVEPAGES_CALLBACK_END,
0i64,
1ui64,
&UserData);
}
v1 = (_DWORD *)a1;
}
else if( !PreviousValidEntry[0] )
{
break;
}
Flink = (KBUGCHECK_REASON_CALLBACK_RECORD *)Flink->Entry.Flink;
v6 = &KeBugCheckAddRemovePagesCallbackListHead;
}
if( IsTracingEnabled )
LOBYTE(v6) = EtwWrite(
IopLiveDumpEtwRegHandle,
(EVENT_DESCRIPTOR *)&LIVEDUMP_EVENT_SIZING_WORKFLOW_REMOVEPAGES_CALLBACKS_END,
0i64,
0i64,
0i64);
return(char)v6;
}Referenced by:
IopLiveDumpEstimateMemoryPages