PfTAccessTracingCleanup
void __fastcall PfTAccessTracingCleanup(__int64 a1, __int64 a2, int a3){
_ETHREAD *CurrentThread;
bool v6;
volatile INT64 *v7;
unsigned int DefaultPagePriority;
INT64 v9;
PSLIST_ENTRY v10;
_MM_PAGE_ACCESS_INFO_HEADER *v11;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v6 = a3 == 4;
--*((_WORD *)CurrentThread + 242);
v7 = (volatile INT64 *)(a1 + 16);
ExAcquirePushLockExclusiveEx(a1 + 16, 0i64);
*(_DWORD *)(a1 + 12) |= a3;
DefaultPagePriority = MmGetDefaultPagePriority();
MmSetAccessLogging(0i64, DefaultPagePriority);
dword_140CEBEA8 = 0;
ExWaitForRundownProtectionRelease((EX_RUNDOWN_REF *)&stru_140CEBE88);
v10 = RtlpInterlockedFlushSList((PSLIST_HEADER)&word_140CEBEC0);
while( v10 )
{
v11 = (_MM_PAGE_ACCESS_INFO_HEADER *)v10;
LOBYTE(v9) = v6;
v10 = v10->Next;
MmFreeAccessPfnBuffer(v11, v9);
}
MmEnablePeriodicAccessClearing(0);
PfTAccessTracingInitialize(a1, (INT64)&PfKernelGlobals, 1i64);
if( (_InterlockedExchangeAdd64(v7, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(v7);
KeAbPostRelease((PVOID)v7);
KeLeaveCriticalRegion();
}Referenced by:
PfTCleanup
PfTTraceListAdd
PfpPowerActionStartScenarioTracing