NtTraceEvent
NTSTATUS __stdcall NtTraceEvent(
VOID *TraceHandle,
UINT64 Flags,
UINT64 FieldSize,
VOID *Fields,
INT64 a5,
INT64 a6,
INT64 _1F0,
INT64 a8){
__int64 v9;
unsigned int v10;
unsigned __int16 v11;
unsigned int v12;
unsigned __int16 v13;
NTSTATUS v14;
PVOID v15;
UINT64 v16;
PVOID v17;
unsigned int v18;
__int64 v19;
__int64 v20;
char v21;
char v22;
__int64 v24;
volatile unsigned __int64 CycleTime;
_ETW_SILODRIVERSTATE *v26;
_ETW_SILODRIVERSTATE *EtwSiloState;
unsigned int LoggerId;
char PreviousMode;
_WMI_LOGGER_CONTEXT *v30;
_ESERVERSILO_GLOBALS *v31;
_ETW_GUID_ENTRY *GuidEntryByGuid;
_ETW_GUID_ENTRY *v33;
_ETHREAD *v34;
UINT8 *v35;
unsigned int v36;
char v37;
_ETW_SILODRIVERSTATE *v38;
unsigned int v39;
unsigned int v40;
char *v41;
_KSPIN_LOCK *v42;
_ETHREAD *CurrentThread;
_ESERVERSILO_GLOBALS *CurrentServerSiloGlobals;
__int64 v45;
bool v46;
_ETHREAD *v47;
UINT8 *v48;
char v49;
PVOID *Object;
UINT64 a7;
char v52;
_ETW_LOGGER_HANDLE LoggerHandle;
char v54;
int v55[2];
int MessageFlags;
int MessageFlags_4;
PSTR MessageArgList;
char v60;
INT16 v61;
UINT64 TraceHandlea;
int v63;
char v64[4];
__int64 v65;
UINT64 Keyword;
PVOID v67;
__int64 v68;
__int64 v69;
UINT64 v70;
int v71;
int v72;
int v73;
__int64 v74;
PSTR v75;
__int64 v76;
UINT64 v77;
INT64 a2;
int v79;
int v80;
_GUID Guid;
__int64 v82[2];
__int128 v83;
v9 = (unsigned int)FieldSize;
v10 = Flags;
v11 = (unsigned __int16)TraceHandle;
v12 = Flags & 0xFF00;
switch( v12 )
{
case 0x300u:
Keyword = (UINT64)KeGetCurrentThread();
if( *(_BYTE *)(Keyword + 562) )
{
if( ((unsigned __int8)Fields & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( (unsigned __int64)Fields + 120 > 0x7FFFFFFF0000i64 || (char *)Fields + 120 < Fields )
MEMORY[0x7FFFFFFF0000] = 0;
}
MessageArgList = (PSTR)*((_QWORD *)Fields + 11);
v75 = MessageArgList;
v55[0] = *((_DWORD *)Fields + 21);
v73 = v55[0];
v13 = *((_WORD *)Fields + 41);
v76 = v13;
MessageFlags_4 = *((_DWORD *)Fields + 28);
v72 = MessageFlags_4;
Keyword = *((_QWORD *)Fields + 6);
v77 = Keyword;
v52 = *((_BYTE *)Fields + 44);
v60 = v52;
v65 = 0i64;
if( *((_BYTE *)Fields + 80) )
v65 = (__int64)Fields + 96;
v67 = 0i64;
v14 = ObReferenceObjectByHandle(TraceHandle, 0x800ui64, EtwpRegistrationObjectType, 1, &v67, 0i64);
if( v14 >= 0 )
{
v68 = 0i64;
v15 = v67;
v16 = *((_QWORD *)v67 + 4);
TraceHandlea = v16;
v17 = (PVOID)*((_QWORD *)v67 + 5);
v67 = v17;
v18 = v10 >> 31;
*(_OWORD *)v82 = 0i64;
v83 = 0i64;
v19 = *((_QWORD *)v15 + 13);
v20 = v19 + 28;
if( !v19 )
v20 = 0i64;
v21 = *((_BYTE *)v15 + 100);
if( v21 )
{
v14 = EtwpWriteUserEvent(
v16,
v21,
v18,
v13,
MessageFlags_4,
(__int64)Fields,
v65,
v52,
Keyword,
v55[0],
(__int64)MessageArgList,
(__int64)v82,
0i64,
*((_WORD *)v15 + 49),
v20,
(__int64)&v68);
v16 = TraceHandlea;
v17 = v67;
}
v22 = *((_BYTE *)v15 + 101);
if( v22 )
{
v14 = EtwpWriteUserEvent(
v16,
v22,
v18,
v13,
MessageFlags_4,
(__int64)Fields,
v65,
v52,
Keyword,
v55[0],
(__int64)MessageArgList,
(__int64)v82,
(__int64)v17,
*((_WORD *)v15 + 49),
v20,
(__int64)&v68);
v16 = TraceHandlea;
}
if( *(_QWORD *)(v16 + 400) )
{
*(_OWORD *)v82 = 0i64;
v83 = 0i64;
v37 = *((_BYTE *)v15 + 102);
if( v37 )
{
v14 = EtwpWriteUserEvent(
*(_QWORD *)(v16 + 400),
v37,
v18,
0,
MessageFlags_4,
(__int64)Fields,
v65,
v52,
Keyword,
v55[0],
(__int64)MessageArgList,
(__int64)v82,
0i64,
*((_WORD *)v15 + 49),
v20,
(__int64)&v68);
v16 = TraceHandlea;
}
v49 = *((_BYTE *)v15 + 103);
if( v49 )
v14 = EtwpWriteUserEvent(
*(_QWORD *)(v16 + 400),
v49,
v18,
0,
MessageFlags_4,
(__int64)Fields,
v65,
v52,
Keyword,
v55[0],
(__int64)MessageArgList,
(__int64)v82,
*((_QWORD *)v67 + 50),
*((_WORD *)v15 + 49),
v20,
(__int64)&v68);
}
ObfDereferenceObjectWithTag(v15, 0x746C6644ui64);
}
return v14;
case 0x200u:
TraceHandlea = (UINT64)TraceHandle;
MessageArgList = 0i64;
if( (_DWORD)FieldSize == 40 )
{
if( KeGetCurrentThread()->PreviousMode == 1 )
{
*(_QWORD *)v55 = Fields;
if( ((unsigned __int8)Fields & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( (unsigned __int64)(*(_QWORD *)v55 + 40i64) > 0x7FFFFFFF0000i64
|| (unsigned __int64)(*(_QWORD *)v55 + 40i64) < *(_QWORD *)v55 )
{
MEMORY[0x7FFFFFFF0000] = 0;
}
MessageFlags = *(_DWORD *)(*(_QWORD *)v55 + 24i64);
if( (Flags & 0x80000000) != 0i64 )
{
LODWORD(MessageArgList) = *(_DWORD *)(*(_QWORD *)v55 + 32i64);
MessageFlags |= 0x80u;
}
else
{
MessageArgList = *(PSTR *)(*(_QWORD *)v55 + 32i64);
}
v24 = *(unsigned int *)(*(_QWORD *)v55 + 28i64);
MessageFlags_4 = v24;
if( (unsigned int)v24 <= 0x10000 )
{
if( (_DWORD)v24
&& ((unsigned __int64)&MessageArgList[v24] > 0x7FFFFFFF0000i64 || &MessageArgList[v24] < MessageArgList) )
{
MEMORY[0x7FFFFFFF0000] = 0;
}
HIDWORD(TraceHandlea) = v24;
return EtwpTraceMessageVa(
TraceHandlea,
MessageFlags | 0x40u,
(_GUID *)(*(_QWORD *)v55 + 8i64),
*(_WORD *)(*(_QWORD *)v55 + 4i64),
MessageArgList,
1);
}
v14 = -1073741811;
v71 = -1073741811;
return v14;
}
return -1073741637;
}
return -1073741811;
case 0x600u:
LoggerHandle.DereferenceAndLeave = 0;
EtwSiloState = PsGetCurrentServerSiloGlobals((_KSPIN_LOCK *)TraceHandle)->EtwSiloState;
LoggerId = v11;
if( v11 == 0xFFFF || !v11 )
LoggerId = EtwSiloState->SystemLoggerSettings.EtwpSystemLogger[0].LoggerId;
if( LoggerId >= EtwSiloState->MaxLoggers )
return -1073741816;
PreviousMode = KeGetCurrentThread()->PreviousMode;
v30 = EtwpOpenLogger(LoggerId, EtwSiloState, PreviousMode, &LoggerHandle);
if( !v30 )
return -1073741816;
if( (v30->LoggerMode & 0x2000000) != 0 )
{
v45 = (__int64)&EtwSiloState->SystemLoggerSettings.EtwpGroupMasks[BYTE2(v30->$B4A554AA980A5EA7570A49F99BAE17BC::_bf_0)];
v46 = v45 && (*(_DWORD *)(v45 + 4) & 0x28) != 0;
v14 = EtwpSetMark((UINT64)v30, (_ETW_SET_MARK_INFORMATION *)Fields, (unsigned int)v9, v46, PreviousMode);
}
else
{
v14 = -1073741811;
}
EtwpCloseLogger(LoggerId, EtwSiloState, LoggerHandle);
return v14;
}
if( v12 <= 0x600 )
{
switch( v12 )
{
case 0x100u:
return EtwTraceEvent(
(_KSPIN_LOCK *)TraceHandle,
(unsigned __int16 *)Fields,
0x30u,
(((int)Flags >> 31) & 0xFFF60000) - 1072431104,
KeGetCurrentThread()->PreviousMode);
case 0x400u:
v38 = PsGetCurrentServerSiloGlobals((_KSPIN_LOCK *)TraceHandle)->EtwSiloState;
v39 = v11;
v40 = 0;
if( (_WORD)v39 != 0xFFFF )
v40 = v39;
if( v40 < v38->MaxLoggers )
{
if( (unsigned int)v9 > 0xFFDF )
return -1073741675;
if( KeGetCurrentThread()->PreviousMode == 1 )
{
if( ((unsigned __int8)Fields & 3) != 0 )
ExRaiseDatatypeMisalignment();
v41 = (char *)Fields + v9 + 32;
if( (unsigned __int64)v41 > 0x7FFFFFFF0000i64 || v41 < Fields )
MEMORY[0x7FFFFFFF0000] = 0;
v42 = (_KSPIN_LOCK *)((char *)Fields + 32);
v74 = (__int64)Fields + 32;
v61 = *((_WORD *)Fields + 3);
a2 = (INT64)Fields + 32;
v79 = v9;
v80 = 0;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
CurrentServerSiloGlobals = PsGetCurrentServerSiloGlobals(v42);
LODWORD(a7) = v10 & 0xC00F00FF | 0x3100;
LODWORD(Object) = 1;
EtwpLogSystemEventUnsafe(
CurrentServerSiloGlobals->EtwSiloState,
(INT64)&a2,
(INT64)CurrentThread,
v40,
(INT64)Object,
v61,
a7);
return 0;
}
return -1073741637;
}
return -1073741811;
case 0x500u:
CycleTime = KeGetCurrentThread()[1].CycleTime;
v26 = PsGetCurrentServerSiloGlobals((_KSPIN_LOCK *)TraceHandle)->EtwSiloState;
if( v26->EtwpSecurityProviderPID == (_DWORD)CycleTime )
{
if( ((unsigned __int8)Fields & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( (unsigned __int64)Fields + 120 > 0x7FFFFFFF0000i64 || (char *)Fields + 120 < Fields )
MEMORY[0x7FFFFFFF0000] = 0;
return EtwpWriteUserEvent(
(__int64)&v26->EtwpSecurityProviderGuidEntry,
v26->EtwpSecurityProviderEnableMask,
0,
0,
*((_DWORD *)Fields + 28),
(__int64)Fields,
0i64,
*((_BYTE *)Fields + 44),
*((_QWORD *)Fields + 6),
*((_DWORD *)Fields + 21),
*((_QWORD *)Fields + 11),
0i64,
0i64,
0,
0i64,
0i64);
}
return -1073741790;
}
return -1073741811;
}
if( v12 != 1792 )
{
if( v12 == 2048 )
return EtwTraceEvent(
(_KSPIN_LOCK *)TraceHandle,
(unsigned __int16 *)Fields,
0x48u,
(((int)Flags >> 31) & 0xFFF60000) - 1072365568,
KeGetCurrentThread()->PreviousMode);
if( v12 == 2304 )
{
if( (_DWORD)Flags == 2304 && (_DWORD)FieldSize && Fields )
return EtwTraceRaw((UINT64)TraceHandle, Fields, (unsigned int)FieldSize, KeGetCurrentThread()->PreviousMode);
return -1073741811;
}
return -1073741811;
}
Guid = 0i64;
if( !TraceHandle )
return -1073741811;
if( ((unsigned __int8)Fields & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( (unsigned __int64)Fields + 120 > 0x7FFFFFFF0000i64 || (char *)Fields + 120 < Fields )
MEMORY[0x7FFFFFFF0000] = 0;
if( ((unsigned __int8)TraceHandle & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( (unsigned __int64)TraceHandle + 16 > 0x7FFFFFFF0000i64 || (char *)TraceHandle + 16 < TraceHandle )
MEMORY[0x7FFFFFFF0000] = 0;
v69 = *((_QWORD *)Fields + 11);
v63 = *((_DWORD *)Fields + 21);
*(_DWORD *)v64 = *((_DWORD *)Fields + 28);
v70 = *((_QWORD *)Fields + 6);
v54 = *((_BYTE *)Fields + 44);
Guid = *(_GUID *)TraceHandle;
v31 = PsGetCurrentServerSiloGlobals((_KSPIN_LOCK *)TraceHandle);
GuidEntryByGuid = EtwpFindGuidEntryByGuid(v31->EtwSiloState, &Guid, EtwTraceGuidType);
v33 = GuidEntryByGuid;
if( GuidEntryByGuid )
{
if( GuidEntryByGuid->ProviderEnableInfo.IsEnabled )
{
v14 = EtwpAccessCheck(GuidEntryByGuid->SecurityDescriptor, 0x800ui64, 0i64);
if( v14 >= 0 )
{
v34 = (_ETHREAD *)KeGetCurrentThread();
--v34->Tcb.KernelApcDisable;
ExAcquirePushLockExclusiveEx(&v33->Lock, 0i64);
v33->LockOwner = (_ETHREAD *)KeGetCurrentThread();
LOBYTE(v35) = 1;
EtwpUpdateEnableMask(v33, 0, 0, v35);
v33->LockOwner = 0i64;
ExReleasePushLockEx((_DWORD)v33 + 408, 0);
KeLeaveCriticalRegionThread(KeGetCurrentThread());
v36 = v10 >> 31;
v14 = EtwpWriteUserEvent(
(__int64)v33,
0,
v36,
0,
v64[0],
(__int64)Fields,
0i64,
v54,
v70,
v63,
v69,
0i64,
0i64,
0,
0i64,
0i64);
if( v33->HostEntry )
{
v47 = (_ETHREAD *)KeGetCurrentThread();
--v47->Tcb.KernelApcDisable;
ExAcquirePushLockExclusiveEx(&v33->Lock, 0i64);
v33->LockOwner = (_ETHREAD *)KeGetCurrentThread();
LOBYTE(v48) = 1;
EtwpUpdateEnableMask(v33->HostEntry, 0, 1, v48);
v33->LockOwner = 0i64;
ExReleasePushLockEx((_DWORD)v33 + 408, 0);
KeLeaveCriticalRegionThread(KeGetCurrentThread());
v14 = EtwpWriteUserEvent(
(__int64)v33->HostEntry,
0,
v36,
0,
v64[0],
(__int64)Fields,
0i64,
v54,
v70,
v63,
v69,
0i64,
0i64,
0,
0i64,
0i64);
}
}
EtwpUnreferenceGuidEntry(v33);
return v14;
}
EtwpUnreferenceGuidEntry(GuidEntryByGuid);
}
return -1073741054;
}Referenced by:
No references.