NtTraceControl
NTSTATUS __stdcall NtTraceControl(
UINT64 FunctionCode,
VOID *InBuffer,
UINT64 InBufferLen,
VOID *OutBuffer,
UINT64 OutBufferLen,
UINT64 *ReturnLength){
unsigned int v7;
VOID *v8;
unsigned int *v9;
char PreviousMode;
char *v11;
_ETW_SILODRIVERSTATE *CurrentSiloState;
int v13;
int v14;
__int64 v15;
int v16;
unsigned int v17;
unsigned int v18;
UINT64 v19;
unsigned int *PoolWithQuotaTag;
__int64 v21;
VOID *v23;
unsigned __int64 v24;
void *v25;
unsigned int v26;
__int64 v27;
UINT64 v28;
_ETW_SILODRIVERSTATE *v29;
UINT64 *v30;
__int64 v31;
unsigned int v33;
_FAST_MUTEX ReturnSize;
size_t NumberOfBytes;
NumberOfBytes = InBufferLen;
v7 = FunctionCode;
v33 = FunctionCode;
v8 = 0i64;
v9 = 0i64;
*(_QWORD *)&ReturnSize.Contention = 0i64;
ReturnSize.Count = 0;
PreviousMode = KeGetCurrentThread()->PreviousMode;
CurrentSiloState = EtwpGetCurrentSiloState(FunctionCode);
LOBYTE(v13) = 0;
if( PreviousMode )
{
v13 = v7 >> 31;
v14 = v7 & 0x7FFFFFFF;
if( (v7 & 0x80000000) == 0 )
v14 = v7;
v7 = v14;
v33 = v14;
v15 = 0x7FFFFFFF0000i64;
if( InBuffer )
{
if( NumberOfBytes )
{
v11 = (char *)InBuffer + NumberOfBytes;
if( (unsigned __int64)v11 > 0x7FFFFFFF0000i64 || v11 < InBuffer )
MEMORY[0x7FFFFFFF0000] = 0;
}
}
else
{
NumberOfBytes = 0;
}
if( OutBuffer )
ProbeForWrite((UINT64)OutBuffer, (unsigned int)OutBufferLen, 1i64);
else
LODWORD(OutBufferLen) = 0;
if( !ReturnLength )
{
LODWORD(v8) = -1073741811;
LODWORD(ReturnSize.Owner) = -1073741811;
goto LABEL_151;
}
if( (unsigned __int64)ReturnLength < 0x7FFFFFFF0000i64 )
v15 = (__int64)ReturnLength;
*(_DWORD *)v15 = *(_DWORD *)v15;
}
if( v7 <= 0x1B && (v16 = 134238208, _bittest(&v16, v7)) )
{
v17 = OutBufferLen;
v18 = NumberOfBytes;
}
else
{
v18 = NumberOfBytes;
v17 = OutBufferLen;
if( NumberOfBytes || (_DWORD)OutBufferLen )
{
v19 = (unsigned int)OutBufferLen;
if( NumberOfBytes > (unsigned int)OutBufferLen )
v19 = NumberOfBytes;
PoolWithQuotaTag = (unsigned int *)ExAllocatePoolWithQuotaTag((POOL_TYPE)9, v19, 0x50777445ui64);
v9 = PoolWithQuotaTag;
*(_QWORD *)&ReturnSize.Contention = PoolWithQuotaTag;
if( !PoolWithQuotaTag )
{
LODWORD(v8) = -1073741801;
goto LABEL_151;
}
memset(PoolWithQuotaTag, 0i64, OutBufferLen);
if( InBuffer )
memmove(v9, InBuffer, NumberOfBytes);
}
}
switch( v33 )
{
case 1u:
case 2u:
case 3u:
case 4u:
case 5u:
case 6u:
case 7u:
LODWORD(v8) = EtwpValidateUserModeLoggerInfo((_WMI_LOGGER_INFORMATION *)v9, v18, v17);
if( (int)v8 >= 0 )
{
if( (unsigned int)v21 <= 6 )
__asm { jmp rcx }
ReturnSize.Count = 176;
}
goto LABEL_139;
case 0xBu:
if( v18 != 96 || v17 != 96 )
goto LABEL_61;
LODWORD(v8) = EtwpRealtimeConnect((PVOID *)v9);
ReturnSize.Count = 96;
goto LABEL_139;
case 0xCu:
if( v17 != 16 )
goto LABEL_61;
EtwpCreateActivityId((_GUID *)OutBuffer);
v24 = v33;
goto LABEL_140;
case 0xDu:
if( v18 != 48 || v17 )
goto LABEL_61;
LODWORD(v8) = WdiDispatchControl(v9);
goto LABEL_139;
case 0xEu:
if( v18 != 8 || v17 )
goto LABEL_61;
*(_QWORD *)&ReturnSize.gap14[4] = PtrToUlong((VOID *)*(unsigned int *)InBuffer);
LODWORD(v8) = EtwpRealtimeDisconnectConsumerByHandle(*(PVOID *)&ReturnSize.gap14[4]);
goto LABEL_139;
case 0xFu:
if( v18 != 160 || v17 - 160 > 0xFF60 )
goto LABEL_61;
LODWORD(v8) = EtwpRegisterUMGuid(CurrentSiloState, (_GUID *)v9, v17, v13, (INT64)&ReturnSize);
goto LABEL_139;
case 0x10u:
if( v18 || v17 - 72 > 0xFFB8 )
goto LABEL_61;
LODWORD(v8) = EtwpReceiveNotification(v9, v17, v13, (UINT64 *)&ReturnSize);
goto LABEL_139;
case 0x11u:
if( v18 < 0x48 || v17 != 72 || v9[1] != v18 )
goto LABEL_61;
if( *v9 == 3 )
{
if( v18 < 0x78 )
goto LABEL_61;
LODWORD(v8) = EtwpEnableGuid(CurrentSiloState, (_ETW_ENABLE_NOTIFICATION_PACKET *)v9, 1);
ReturnSize.Count = 72;
}
else
{
LODWORD(v8) = EtwpNotifyGuid(CurrentSiloState, (_ETWP_NOTIFICATION_HEADER *)v9, 1);
ReturnSize.Count = 72;
}
goto LABEL_139;
case 0x12u:
if( v18 < 0x48 || v9[1] != v18 )
goto LABEL_61;
v9[9] = (unsigned int)PsGetCurrentThreadProcessId();
LODWORD(v8) = EtwpSendReplyDataBlock((_ETWP_NOTIFICATION_HEADER *)v9);
goto LABEL_139;
case 0x13u:
if( v18 != 8 )
goto LABEL_61;
*(&ReturnSize.Count + 1) = 0;
LODWORD(v8) = EtwpReceiveReplyDataBlock(v9, v17, (UINT64 *)(&ReturnSize.Count + 1));
ReturnSize.Count = *(&ReturnSize.Count + 1);
goto LABEL_139;
case 0x14u:
if( v18 || v17 )
goto LABEL_61;
LODWORD(v8) = WdiUpdateSem();
goto LABEL_139;
case 0x15u:
ReturnSize.Count = v17;
LODWORD(v8) = EtwpGetTraceGuidList(CurrentSiloState, v9, (UINT64 *)&ReturnSize);
goto LABEL_139;
case 0x16u:
if( v18 != 16 )
goto LABEL_61;
ReturnSize.Count = v17;
LODWORD(v8) = EtwpGetTraceGuidInfo(CurrentSiloState, (_GUID *)v9, v9, (UINT64 *)&ReturnSize);
goto LABEL_139;
case 0x17u:
ReturnSize.Count = v17;
LODWORD(v8) = EtwpEnumerateTraceGuids(CurrentSiloState, v9, (UINT64 *)&ReturnSize);
goto LABEL_139;
case 0x18u:
if( v18 || v17 )
goto LABEL_61;
LODWORD(v8) = EtwpRegisterSecurityProvider(CurrentSiloState);
goto LABEL_139;
case 0x19u:
if( v18 != 4 || v17 != 16 )
goto LABEL_61;
LODWORD(v8) = EtwpQueryReferenceTime(CurrentSiloState, *v9, (_OBJECT_TYPE *)v9);
ReturnSize.Count = 16;
goto LABEL_139;
case 0x1Au:
if( v18 != 8 )
goto LABEL_61;
LODWORD(v8) = EtwpTrackProviderBinary(CurrentSiloState, (INT64 *)v9);
goto LABEL_139;
case 0x1Bu:
if( v18 != 4 )
goto LABEL_61;
v25 = (void *)*(unsigned int *)InBuffer;
*(_QWORD *)&ReturnSize.gap14[12] = v25;
if( !v25 )
goto LABEL_61;
LODWORD(v8) = EtwpAddNotificationEvent(v25, v13);
goto LABEL_139;
case 0x1Cu:
if( v18 < 8 )
goto LABEL_61;
v26 = v9[1];
if( 16i64 * v26 + 8 != v18 )
goto LABEL_61;
if( v26 )
v8 = v9 + 2;
LODWORD(v8) = EtwpUpdateDisallowList(CurrentSiloState, *v9, v26, v8);
goto LABEL_139;
case 0x1Eu:
if( v18 != 24 || v17 - 120 > 0xFF88 )
goto LABEL_61;
LODWORD(v8) = EtwpSetProviderTraitsUm((_ETW_REG_ENTRY *)v9, (_ETW_PROVIDER_TRAITS *)v17, &ReturnSize);
goto LABEL_139;
case 0x1Fu:
if( v18 != 16 || v17 )
goto LABEL_61;
LODWORD(v8) = EtwpUseDescriptorTypeUm((INT64)v9);
goto LABEL_139;
case 0x20u:
ReturnSize.Count = v17;
LODWORD(v8) = EtwpGetTraceGroupList(CurrentSiloState, v9, (UINT64 *)&ReturnSize);
goto LABEL_139;
case 0x21u:
if( v18 != 16 )
goto LABEL_61;
ReturnSize.Count = v17;
LODWORD(v8) = EtwpGetTraceGroupInfo(CurrentSiloState, (_GUID *)v9, v9, (UINT64 *)&ReturnSize);
goto LABEL_139;
case 0x22u:
if( v18 != 8 )
goto LABEL_61;
ReturnSize.Count = v17;
LODWORD(v8) = EtwpGetDisallowList(CurrentSiloState, (UINT64 *)v9, v9, (UINT64 *)&ReturnSize);
goto LABEL_139;
case 0x23u:
if( v18 != 16 || v17 )
goto LABEL_61;
LODWORD(v8) = EtwpSetCompressionSettings((_KSPIN_LOCK *)v9);
goto LABEL_139;
case 0x24u:
if( v18 != 8 || v17 != 16 )
goto LABEL_61;
ReturnSize.Count = 16;
LODWORD(v8) = EtwpGetCompressionSettings((_KSPIN_LOCK *)v9, v9);
goto LABEL_139;
case 0x25u:
if( v18 < 0xC )
goto LABEL_61;
v27 = *((unsigned __int16 *)v9 + 4);
if( (unsigned int)v27 > 0x10 )
{
LODWORD(v8) = -1073741811;
goto LABEL_139;
}
v28 = v9[1];
if( (unsigned int)(v28 - 1) <= 3 )
{
LODWORD(v8) = -1073741811;
goto LABEL_139;
}
if( (_WORD)v27 )
{
if( !(_DWORD)v28 )
{
LODWORD(v8) = -1073741811;
goto LABEL_139;
}
}
else if( (_DWORD)v28 )
{
LABEL_61:
LODWORD(v8) = -1073741811;
goto LABEL_139;
}
if( 16 * v27 + 12 != v18 )
goto LABEL_61;
if( (_WORD)v27 )
v8 = v9 + 3;
LODWORD(v8) = EtwpUpdatePeriodicCaptureState(*v9, v28, v27, (UINT8 *)v8);
LABEL_139:
v23 = OutBuffer;
v24 = v33;
LABEL_140:
if( (int)v8 < 0 )
{
v30 = ReturnLength;
}
else
{
if( ReturnSize.Count )
memmove(v23, v9, ReturnSize.Count);
v30 = ReturnLength;
*(_DWORD *)ReturnLength = ReturnSize.Count;
}
if( (_DWORD)v8 == -1073741789 && ((unsigned int)(v24 - 15) <= 1 || (unsigned int)(v24 - 21) <= 1)
|| (unsigned int)v24 <= 0x28 && (v31 = 0x1D700880000i64, _bittest64(&v31, v24)) )
{
*(_DWORD *)v30 = ReturnSize.Count;
}
LABEL_151:
if( v9 )
ExFreePoolWithTag(v9, 0);
return(int)v8;
case 0x26u:
if( v18 < 8 || (v18 & 7) != 0 || v17 < 2 )
goto LABEL_61;
LODWORD(v8) = EtwpGetPrivateSessionTraceHandle();
if( !(_DWORD)v8 )
{
ReturnSize.Count = 2;
*(_WORD *)v9 = 0;
}
goto LABEL_139;
case 0x27u:
if( v18 < 2 || v17 < 8 )
goto LABEL_61;
v29 = EtwpGetCurrentSiloState((INT64)v11);
LODWORD(v8) = EtwpRegisterPrivateSession((__int64)v29, *(_WORD *)v9, (_WORD *)v9 + 2, v9);
if( !(_DWORD)v8 )
ReturnSize.Count = 8;
goto LABEL_139;
case 0x28u:
if( v18 < 8 || v17 < 2 )
goto LABEL_61;
LODWORD(v8) = EtwpQuerySessionDemuxObject(*(VOID **)v9, (UINT16 *)v9);
if( !(_DWORD)v8 )
ReturnSize.Count = 2;
goto LABEL_139;
case 0x29u:
if( v18 < 8 )
goto LABEL_61;
LODWORD(v8) = EtwpSetProviderBinaryTracking(CurrentSiloState, *v9, *((_BYTE *)v9 + 4));
goto LABEL_139;
case 0x2Au:
v24 = v33;
v23 = OutBuffer;
if( v17 < 4 )
goto LABEL_135;
*v9 = CurrentSiloState->MaxLoggers;
ReturnSize.Count = 4;
goto LABEL_140;
case 0x2Bu:
v24 = v33;
v23 = OutBuffer;
if( v17 < 4 )
{
LABEL_135:
LODWORD(v8) = -1073741811;
}
else
{
*v9 = EtwpMaxPmcCounter;
ReturnSize.Count = 4;
}
goto LABEL_140;
default:
LODWORD(v8) = -1073741808;
goto LABEL_139;
}
}Referenced by:
PerfDiagpProxyWorker
PerfDiagpSaveActiveDCLLogFileName
PerfDiagpUpdatePerfDiagLoggerEnableFlags