EtwSetPerformanceTraceInformation
NTSTATUS __stdcall EtwSetPerformanceTraceInformation(
VOID *SystemInformation,
UINT64 SystemInformationLength,
VOID *PreviousMode){
INT8 v3;
unsigned int v4;
int v6;
_ETW_SILODRIVERSTATE *CurrentSiloState;
_KPROCESSOR_MODE v8;
_ETW_SILODRIVERSTATE *v9;
NTSTATUS result;
int v11;
int v12;
unsigned int v13;
int v14;
int v15;
unsigned int v16;
UINT64 v17;
_ETHREAD *v18;
_WMI_LOGGER_CONTEXT *v19;
INT64 v20;
NTSTATUS updated;
unsigned int v22;
VOID **v23;
_KPROFILE_SOURCE *v24;
UINT32 v25;
void *v26;
unsigned int v27;
unsigned int v28;
__int64 v29;
UINT64 v30;
_ETHREAD *v31;
_WMI_LOGGER_CONTEXT *v32;
__int64 v33;
UINT64 v34;
_ETHREAD *v35;
_WMI_LOGGER_CONTEXT *v36;
UINT64 v38;
_ETHREAD *v39;
_WMI_LOGGER_CONTEXT *v40;
size_t v41;
VOID **v42;
WCHAR *v43;
unsigned int v44;
unsigned int v45;
WCHAR *PoolWithTag;
WCHAR *v47;
char v48;
int CpuVendor;
unsigned int v50;
unsigned int v51;
UINT64 *v52;
UINT64 v53;
_ETHREAD *v54;
_WMI_LOGGER_CONTEXT *v55;
UINT64 LoggerId;
_ETHREAD *CurrentThread;
_WMI_LOGGER_CONTEXT *v58;
unsigned int v59;
unsigned int v60;
UINT64 v61;
_ETHREAD *v62;
_WMI_LOGGER_CONTEXT *v63;
char *v64;
char v65;
int v66;
PVOID P;
int v68;
unsigned int BucketCount;
unsigned int BucketCount_4;
__int128 v71;
wchar_t *Src;
int v73;
unsigned int v74;
int v75;
unsigned int v76;
int v77;
int v78;
int v79;
INT64 v80[2];
__int64 v81;
INT64 v82[2];
__int64 v83;
__int64 v84;
__int64 v85;
__int64 v86;
__int64 v87;
__int64 v88;
PERFINFO_GROUPMASK GroupMasks[4];
__int128 v90;
int v91[44];
INT64 v92;
int v93;
INT64 v94;
int v95;
int v96[4];
v3 = (char)PreviousMode;
v4 = SystemInformationLength;
if( (unsigned int)SystemInformationLength < 4 )
return -1073741811;
v6 = *(_DWORD *)SystemInformation;
v66 = *(_DWORD *)SystemInformation;
CurrentSiloState = EtwpGetCurrentSiloState((INT64)SystemInformation);
v9 = CurrentSiloState;
if( v6 > 16 )
{
if( v6 == 17 )
goto LABEL_144;
if( v6 != 18 )
{
switch( v6 )
{
case 19:
if( v4 < 0x18 )
return -1073741820;
*(_OWORD *)v82 = *(_OWORD *)SystemInformation;
v83 = *((_QWORD *)SystemInformation + 2);
LoggerId = LOWORD(v82[1]);
if( LOWORD(v82[1]) == 0xFFFF )
LoggerId = CurrentSiloState->SystemLoggerSettings.EtwpSystemLogger[0].LoggerId;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
v58 = EtwpAcquireLoggerContextByLoggerId(v9, LoggerId, 1u);
v20 = (INT64)v58;
if( !v58 )
goto LABEL_153;
v11 = EtwpCheckLoggerControlAccess(0x80ui64, v58);
if( v11 < 0 )
goto LABEL_79;
updated = EtwpUpdateLastBranchTracingConfiguration(v20, (INT64)v82);
LABEL_78:
v11 = updated;
goto LABEL_79;
case 20:
goto LABEL_119;
case 21:
if( v3 && !EtwpUserInAdminOrLogUsersGroup() )
return -1073741790;
if( v4 < 0x24 || *((_BYTE *)SystemInformation + 4) != 2 || v4 > 0x220 )
return -1073741820;
v44 = v4 - 34 + 184;
v45 = (v4 - 34) >> 1;
PoolWithTag = (WCHAR *)ExAllocatePoolWithTag(1ui64, v44, 1350005829i64);
v47 = PoolWithTag;
P = PoolWithTag;
if( !PoolWithTag )
return -1073741801;
wcsncpy_s(PoolWithTag + 92, v45, (WCHAR *)SystemInformation + 17, v45);
v94 = *((_QWORD *)SystemInformation + 2);
v95 = *((_DWORD *)SystemInformation + 6);
*((_DWORD *)v47 + 2) = *((_DWORD *)SystemInformation + 7);
v48 = *((_BYTE *)SystemInformation + 32);
CpuVendor = KiGetCpuVendor();
if( CpuVendor == 2 )
{
*(_BYTE *)v47 = *((_BYTE *)SystemInformation + 8);
*((_BYTE *)v47 + 1) = *((_BYTE *)SystemInformation + 9);
*((_BYTE *)v47 + 2) = *((_BYTE *)SystemInformation + 10);
*((_BYTE *)v47 + 3) = *((_BYTE *)SystemInformation + 11);
*((_BYTE *)v47 + 4) = *((_BYTE *)SystemInformation + 12);
*((_BYTE *)v47 + 5) = *((_BYTE *)SystemInformation + 13);
}
else if( CpuVendor == 1 )
{
*(_BYTE *)v47 = *((_BYTE *)SystemInformation + 8);
*((_BYTE *)v47 + 1) = *((_BYTE *)SystemInformation + 9);
}
EtwpGetMicroarchitecturalPmcAffinity((INT64)&v94, v47 + 8);
v11 = ((__int64(__fastcall *)(__int64, _QWORD, WCHAR *))off_140C00A70[0])(20i64, v44, v47);
if( v48 )
v11 = EtwpAddMicroarchitecturalPmcToRegistry((UINT8 *)v47, (INT64)&v94);
v26 = v47;
break;
case 22:
v71 = 0i64;
Src = 0i64;
memset(&v91[1], 0i64, 0xACu);
LODWORD(P) = 0;
if( v3 && !EtwpUserInAdminOrLogUsersGroup() )
return -1073741790;
if( v4 != 20 )
return -1073741820;
v92 = *((_QWORD *)SystemInformation + 1);
v93 = *((_DWORD *)SystemInformation + 4);
LODWORD(v71) = *((_DWORD *)SystemInformation + 1);
v11 = ((__int64(__fastcall *)(__int64, __int64, __int128 *, PVOID *))off_140C00A68[0])(1i64, 24i64, &v71, &P);
if( v11 < 0 )
return v11;
v91[0] = v71;
EtwpGetMicroarchitecturalPmcAffinity((INT64)&v92, (UINT16 *)&v91[2]);
v41 = wcsnlen(Src, 0xFFui64);
v42 = ExAllocatePoolWithTag(1ui64, 2i64 * (v41 + 1), 1350005829i64);
v43 = (WCHAR *)v42;
if( !v42 )
return -1073741801;
wcsncpy_s((WCHAR *)v42, v41 + 1, Src, v41);
v11 = ((__int64(__fastcall *)(__int64, __int64, int *))off_140C00A70[0])(21i64, 176i64, v91);
EtwpRemoveMicroarchitecturalPmcFromRegistry(v43, v41);
v26 = v43;
break;
case 23:
if( v4 >= 0x18 )
{
*(_OWORD *)v80 = *(_OWORD *)SystemInformation;
v81 = *((_QWORD *)SystemInformation + 2);
v38 = LOWORD(v80[1]);
if( LOWORD(v80[1]) == 0xFFFF )
v38 = CurrentSiloState->SystemLoggerSettings.EtwpSystemLogger[0].LoggerId;
v39 = (_ETHREAD *)KeGetCurrentThread();
--v39->Tcb.KernelApcDisable;
v40 = EtwpAcquireLoggerContextByLoggerId(v9, v38, 1u);
v20 = (INT64)v40;
if( v40 )
{
v11 = EtwpCheckLoggerControlAccess(0x80ui64, v40);
if( v11 < 0 )
goto LABEL_79;
updated = EtwpUpdateProcessorTraceConfiguration(v20, (INT64)v80);
goto LABEL_78;
}
goto LABEL_153;
}
return -1073741820;
case 24:
goto LABEL_119;
case 25:
LOBYTE(v8) = v3;
return EtwpSetCoverageSamplerInformation(SystemInformation, v4, v8);
default:
return -1073741822;
}
v25 = 1350005829;
goto LABEL_118;
}
return EtwpSetSoftRestartInformation((__int64)SystemInformation, v4);
}
if( v6 == 16 )
{
if( v4 != 32 )
return -1073741820;
v33 = *((_QWORD *)SystemInformation + 1);
v86 = v33;
BucketCount_4 = *((_DWORD *)SystemInformation + 5);
BucketCount = *((_DWORD *)SystemInformation + 6);
if( !*((_BYTE *)SystemInformation + 16) )
return -1073741637;
v34 = (unsigned __int16)v33;
if( (unsigned __int16)v33 == 0xFFFF )
v34 = CurrentSiloState->SystemLoggerSettings.EtwpSystemLogger[0].LoggerId;
v35 = (_ETHREAD *)KeGetCurrentThread();
--v35->Tcb.KernelApcDisable;
v36 = EtwpAcquireLoggerContextByLoggerId(v9, v34, 1u);
v20 = (INT64)v36;
if( !v36 )
goto LABEL_153;
v11 = EtwpCheckLoggerControlAccess(0x80ui64, v36);
if( v11 >= 0 )
{
updated = EtwpEnableStackCaching((_WMI_LOGGER_CONTEXT *)v20, BucketCount_4, BucketCount);
goto LABEL_78;
}
goto LABEL_79;
}
if( v6 > 7 )
{
if( v6 != 10 )
{
if( v6 == 11 )
{
v65 = 0;
if( v4 < 0x10 )
return -1073741820;
v27 = v4 - 16;
if( (v27 & 3) != 0 )
return -1073741811;
v28 = v27 >> 2;
if( v28 > 1 )
return -1073741811;
v29 = *((_QWORD *)SystemInformation + 1);
v85 = v29;
if( v28 )
{
if( *((_DWORD *)SystemInformation + 4) != 1316 )
return -1073741811;
v65 = 1;
}
if( SeSinglePrivilegeCheck(*(_QWORD *)&SeSystemProfilePrivilege, v3) )
{
if( !PsIsCurrentThreadInServerSilo() )
{
v30 = (unsigned __int16)v29;
if( (unsigned __int16)v29 == 0xFFFF )
v30 = v9->SystemLoggerSettings.EtwpSystemLogger[0].LoggerId;
v31 = (_ETHREAD *)KeGetCurrentThread();
--v31->Tcb.KernelApcDisable;
v32 = EtwpAcquireLoggerContextByLoggerId((_ETW_SILODRIVERSTATE *)EtwpHostSiloState, v30, 1u);
v20 = (INT64)v32;
if( v32 )
{
v11 = EtwpCheckLoggerControlAccess(0x80ui64, v32);
if( v11 >= 0 )
{
if( v65 )
_InterlockedOr((volatile signed __int32 *)(v20 + 832), 0x400u);
else
_InterlockedAnd((volatile signed __int32 *)(v20 + 832), 0xFFFFFBFF);
}
goto LABEL_79;
}
goto LABEL_153;
}
return -1073741790;
}
}
else
{
if( v6 != 12 )
{
if( v6 > 13 )
goto LABEL_119;
return -1073741822;
}
if( v4 < 0x10 )
return -1073741820;
result = EtwpCheckCurrentUserGuidAccess((_GUID *)&SystemTraceControlGuid, 0x80ui64);
if( result < 0 )
return result;
if( SeSinglePrivilegeCheck(*(_QWORD *)&SeSystemProfilePrivilege, v3) )
{
if( PsIsCurrentThreadInServerSilo() )
return -1073741790;
v22 = (v4 - 16) >> 2;
if( v22 > EtwpMaxProfilingSources )
return -1073741811;
v23 = ExAllocatePoolWithTag(0x200ui64, 4i64 * v22, 1484223557i64);
v24 = (_KPROFILE_SOURCE *)v23;
P = v23;
if( v23 )
{
memmove(v23, (char *)SystemInformation + 16, 4 * v22);
v11 = EtwpSetPmcProfileSource(v24, v22);
v25 = 0;
v26 = v24;
LABEL_118:
ExFreePoolWithTag(v26, v25);
return v11;
}
return -1073741801;
}
}
return -1073741727;
}
LABEL_144:
if( v4 >= 0x10 )
{
v59 = v4 - 16;
if( (v59 & 3) == 0 )
{
v60 = v59 >> 2;
if( (unsigned __int16)v60 <= 4u )
{
if( !PsIsCurrentThreadInServerSilo() )
{
v88 = *((_QWORD *)SystemInformation + 1);
memmove(v96, (char *)SystemInformation + 16, 4 * (unsigned __int16)v60);
v61 = (unsigned __int16)v88;
if( (unsigned __int16)v88 == 0xFFFF )
v61 = v9->SystemLoggerSettings.EtwpSystemLogger[0].LoggerId;
v62 = (_ETHREAD *)KeGetCurrentThread();
--v62->Tcb.KernelApcDisable;
v63 = EtwpAcquireLoggerContextByLoggerId(v9, v61, 1u);
v20 = (INT64)v63;
if( v63 )
{
if( (v63->LoggerMode & 0x2000000) == 0 )
{
EtwpReleaseLoggerContext(v63, 1u);
v11 = -1073741811;
goto LABEL_156;
}
v11 = EtwpCheckSystemTraceAccess(v63, 0x80ui64);
if( v11 >= 0 )
{
v64 = (char *)&ExBootDevicesRemovedEvent + 1760;
if( v66 != 10 )
v64 = (char *)&ExBootDevicesRemovedEvent + 1568;
EtwpUpdateTagFilter(v96, v60, (__int64)&v64[20 * *(unsigned __int8 *)(v20 + 834)]);
}
goto LABEL_79;
}
goto LABEL_153;
}
return -1073741790;
}
}
return -1073741811;
}
return -1073741820;
}
switch( v6 )
{
case 7:
if( v4 == 16 )
{
result = EtwpCheckCurrentUserGuidAccess((_GUID *)&SystemTraceControlGuid, 0x80ui64);
v11 = result;
if( result < 0 )
return result;
if( PsIsCurrentThreadInServerSilo() )
return -1073741790;
v77 = *((_DWORD *)SystemInformation + 1);
v78 = *((_DWORD *)SystemInformation + 2);
v79 = *((_DWORD *)SystemInformation + 3);
KeWaitForSingleObject((UINT64)&ExBootDevicesRemovedEvent + 2368, 0, 0, 0, 0i64);
EtwpExecutiveResourceReleaseSampleRate = v77;
EtwpExecutiveResourceContentionSampleRate = v78;
EtwpExecutiveResourceTimeout = v79;
goto LABEL_28;
}
return -1073741820;
case 1:
if( v4 != 48 )
return -1073741820;
v84 = *((_QWORD *)SystemInformation + 1);
*(_OWORD *)GroupMasks = *((_OWORD *)SystemInformation + 1);
v90 = *((_OWORD *)SystemInformation + 2);
v17 = (unsigned __int16)v84;
if( (unsigned __int16)v84 == 0xFFFF )
v17 = CurrentSiloState->SystemLoggerSettings.EtwpSystemLogger[0].LoggerId;
v18 = (_ETHREAD *)KeGetCurrentThread();
--v18->Tcb.KernelApcDisable;
v19 = EtwpAcquireLoggerContextByLoggerId(v9, v17, 1u);
v20 = (INT64)v19;
if( !v19 )
goto LABEL_153;
if( (v19->LoggerMode & 0x2000000) == 0 )
{
EtwpReleaseLoggerContext(v19, 1u);
KeLeaveCriticalRegion();
return -1073741811;
}
v11 = EtwpCheckSystemTraceAccess(v19, 0x80ui64);
if( v11 >= 0 )
{
updated = EtwpUpdateGroupMasks((_WMI_LOGGER_CONTEXT *)v20, GroupMasks);
goto LABEL_78;
}
LABEL_79:
EtwpReleaseLoggerContext((_WMI_LOGGER_CONTEXT *)v20, 1u);
LABEL_156:
KeLeaveCriticalRegion();
return v11;
case 3:
if( v4 == 8 )
{
if( PsIsCurrentThreadInServerSilo() )
return -1073741790;
v16 = *((_DWORD *)SystemInformation + 1);
v76 = v16;
KeWaitForSingleObject((UINT64)&ExBootDevicesRemovedEvent + 2368, 0, 0, 0, 0i64);
v11 = NtSetIntervalProfile(v16, ProfileTime);
if( v11 >= 0 )
LODWORD(EtwpProfileInterval) = v16;
LABEL_28:
KeReleaseMutex((_KMUTANT *)((char *)&ExBootDevicesRemovedEvent + 2368), 0);
return v11;
}
return -1073741820;
case 5:
if( ((v4 - 16) & 0xFFFFFFFB) == 0 )
{
result = EtwpCheckCurrentUserGuidAccess((_GUID *)&SystemTraceControlGuid, 0x80ui64);
v11 = result;
if( result < 0 )
return result;
if( PsIsCurrentThreadInServerSilo() )
return -1073741790;
v12 = *((_DWORD *)SystemInformation + 1);
v73 = v12;
if( !v12 )
return -1073741811;
v13 = *((_DWORD *)SystemInformation + 2);
v74 = v13;
if( v13 < 0x3E8 )
return -1073741811;
v14 = *((_DWORD *)SystemInformation + 3);
v75 = v14;
if( !v14 )
return -1073741811;
v15 = EtwpSpinLockHoldThreshold;
v68 = EtwpSpinLockHoldThreshold;
if( v4 == 20 )
{
v15 = *((_DWORD *)SystemInformation + 4);
v68 = v15;
if( (unsigned int)(v15 - 1) <= 0xF423E )
return -1073741811;
}
KeWaitForSingleObject((UINT64)&ExBootDevicesRemovedEvent + 2368, 0, 0, 0, 0i64);
EtwpSpinLockHoldThreshold = v15;
EtwpSpinLockSpinThreshold = v12;
EtwpSpinLockAcquireSampleRate = v13;
EtwpSpinLockContentionSampleRate = v14;
goto LABEL_28;
}
return -1073741820;
}
if( v6 != 6 )
return -1073741822;
LABEL_119:
if( v4 < 0x10 )
return -1073741820;
v50 = v4 - 16;
if( (v50 & 3) == 0 )
{
if( !PsIsCurrentThreadInServerSilo() || (unsigned int)(v6 - 14) > 1 )
{
v51 = v50 >> 2;
v52 = (UINT64 *)((char *)SystemInformation + 16);
v87 = *((_QWORD *)SystemInformation + 1);
v53 = (unsigned __int16)v87;
if( (unsigned __int16)v87 == 0xFFFF )
v53 = v9->SystemLoggerSettings.EtwpSystemLogger[0].LoggerId;
v54 = (_ETHREAD *)KeGetCurrentThread();
--v54->Tcb.KernelApcDisable;
v55 = EtwpAcquireLoggerContextByLoggerId(v9, v53, 1u);
v20 = (INT64)v55;
if( v55 )
{
v11 = EtwpCheckLoggerControlAccess(0x80ui64, v55);
if( v11 < 0 )
goto LABEL_79;
switch( v66 )
{
case 6:
updated = EtwpUpdateStackTracing((_WMI_LOGGER_CONTEXT *)v20, v52, v51);
break;
case 15:
updated = EtwpUpdatePmcCounters((_WMI_LOGGER_CONTEXT *)v20, (_KPROFILE_SOURCE *)v52, v51);
break;
case 14:
updated = EtwpUpdatePmcEvents((_WMI_LOGGER_CONTEXT *)v20, v52, v51);
break;
case 20:
EtwpUpdateLastBranchTracingEvents(v20, (INT64)v52, v51);
goto LABEL_79;
default:
updated = EtwpUpdateProcessorTraceEvents(v20, (INT64)v52, v51);
break;
}
goto LABEL_78;
}
LABEL_153:
v11 = -1073741162;
goto LABEL_156;
}
return -1073741790;
}
return -1073741811;
}Referenced by:
NtSetSystemInformation