NtSystemDebugControl
INT64 __fastcall NtSystemDebugControl(
_SYSDBG_COMMAND Command,
void *InputBuffer,
UINT64 InputBufferLength,
void *OutputBuffer,
UINT64 OutputBufferLength,
UINT *ReturnLength){
__int64 v7;
INT8 v11;
int v12;
__int64 v13;
int v14;
__int32 v15;
__int32 v16;
__int32 v17;
__int32 v18;
__int32 v19;
__int32 v20;
__int32 v21;
unsigned __int64 v22;
unsigned int v23;
unsigned int v24;
unsigned int v25;
UINT8 *PoolWithTag;
__int32 v27;
__int32 v28;
__int32 v29;
INT8 v30;
size_t Size;
SIZE_T NumberOfBytes;
VOID *LockedBuffer;
PVOID P;
INT64 v35[2];
__int128 v36;
__int128 v37;
VOID *Buffer;
__int128 v39[7];
v7 = (unsigned int)InputBufferLength;
LODWORD(NumberOfBytes) = OutputBufferLength;
LODWORD(Size) = 0;
*(_OWORD *)v35 = 0i64;
v36 = 0i64;
v37 = 0i64;
Buffer = 0i64;
memset((INT64)v39, 0i64);
LockedBuffer = 0i64;
P = 0i64;
if( KdPitchDebugger && !*(_BYTE *)KdLocalDebugEnabled && ((Command - 29) & 0xFFFFFFF7) != 0 )
return 3221226324i64;
v11 = *((_BYTE *)KeGetCurrentThread() + 562);
v30 = v11;
if( Command != (SysDbgClearUmAttachPid|SysDbgSetTracepoint)
&& !SeSinglePrivilegeCheck(*(_QWORD *)&SeDebugPrivilege, v11) )
{
return 3221225506i64;
}
v12 = 0;
if( v11 )
{
if( (_DWORD)v7 )
{
if( ((unsigned __int8)InputBuffer & 3) != 0 )
ExRaiseDatatypeMisalignment();
v13 = 0x7FFFFFFF0000i64;
if( (unsigned __int64)InputBuffer + v7 > 0x7FFFFFFF0000i64 || (char *)InputBuffer + v7 < InputBuffer )
MEMORY[0x7FFFFFFF0000] = 0;
}
else
{
v13 = 0x7FFFFFFF0000i64;
}
if( (_DWORD)OutputBufferLength )
ProbeForWrite(OutputBuffer, (unsigned int)OutputBufferLength, 4ui64);
if( ReturnLength )
{
if( (unsigned __int64)ReturnLength < 0x7FFFFFFF0000i64 )
v13 = (__int64)ReturnLength;
*(_DWORD *)v13 = *(_DWORD *)v13;
}
v11 = v30;
}
if( Command > SysDbgSetKdUmExceptionEnable )
{
if( Command <= SysDbgClearUmBreakPid )
{
if( Command == SysDbgClearUmBreakPid )
goto LABEL_64;
v18 = Command - 29;
if( !v18 )
{
if( (_DWORD)v7 == 56 && (unsigned int)OutputBufferLength >= 0x40000 )
{
*(_OWORD *)v35 = *(_OWORD *)InputBuffer;
v36 = *((_OWORD *)InputBuffer + 1);
v37 = *((_OWORD *)InputBuffer + 2);
Buffer = (VOID *)*((_QWORD *)InputBuffer + 6);
if( DWORD2(v37) || !HIDWORD(v37) || (v35[0] & 0xFFFFFFFE) != 0 )
return 3221225485i64;
v22 = 8i64 * HIDWORD(v37);
v23 = -1;
if( v22 <= 0xFFFFFFFF )
v23 = 8 * HIDWORD(v37);
if( v22 > 0xFFFFFFFF )
return 3221225485i64;
v24 = 0x100000;
if( (unsigned int)OutputBufferLength <= 0x100000 )
v24 = NumberOfBytes;
v25 = v24;
PoolWithTag = (UINT8 *)ExAllocatePoolWithTag(NonPagedPoolNx, v24, 0x704E534Bui64);
NumberOfBytes = (SIZE_T)PoolWithTag;
if( PoolWithTag )
{
v12 = ExLockUserBuffer(Buffer, v23, v11, IoReadAccess, &LockedBuffer, &P);
if( v12 >= 0 )
{
memset((INT64)PoolWithTag, 0i64);
Buffer = LockedBuffer;
v12 = DbgkCaptureLiveDump((INT64)v35, (INT64)PoolWithTag, v25, (INT64)&Size);
if( v12 >= 0 )
{
if( (unsigned int)Size <= (unsigned int)OutputBufferLength )
memmove((UINT8 *)OutputBuffer, PoolWithTag, (unsigned int)Size);
else
v12 = -1073741823;
}
ExFreePoolWithTag(PoolWithTag, 0);
ExUnlockUserBuffer(P);
}
else
{
ExFreePoolWithTag(PoolWithTag, 0);
}
}
else
{
v12 = -1073741801;
}
goto LABEL_107;
}
return 3221225476i64;
}
v19 = v18 - 1;
if( !v19 )
{
if( (_DWORD)OutputBufferLength == 1 )
{
*(_BYTE *)OutputBuffer = KdBlockEnable;
goto LABEL_107;
}
return 3221225476i64;
}
v20 = v19 - 1;
if( !v20 )
{
if( (_DWORD)v7 == 1 )
{
KdBlockEnable = *(_BYTE *)InputBuffer;
goto LABEL_107;
}
return 3221225476i64;
}
v21 = v20 - 1;
if( !v21 )
{
KdUmBreakMarker = -618808389;
goto LABEL_106;
}
if( v21 != 1 )
goto LABEL_97;
if( (_DWORD)OutputBufferLength != 4 )
return 3221225476i64;
*(_DWORD *)OutputBuffer = KdUmBreakPid;
if( KdResetUmBreakPid )
LABEL_64:
KdUmBreakPid = 0;
LABEL_106:
v12 = 0;
goto LABEL_107;
}
v27 = Command - 35;
if( v27 )
{
v28 = v27 - 1;
if( v28 )
{
v29 = v28 - 1;
if( v29 )
{
if( v29 != 1 )
goto LABEL_97;
if( (_DWORD)v7 != 16 || (_DWORD)OutputBufferLength )
return 3221225476i64;
v14 = ExpKdPullRemoteFileForUser(InputBuffer);
}
else
{
if( (_DWORD)v7 != 64 || (_DWORD)OutputBufferLength )
return 3221225476i64;
v39[0] = *(_OWORD *)InputBuffer;
v39[1] = *((_OWORD *)InputBuffer + 1);
v39[2] = *((_OWORD *)InputBuffer + 2);
v39[3] = *((_OWORD *)InputBuffer + 3);
v14 = DbgkCaptureLiveKernelDump((__int64)v39);
}
goto LABEL_34;
}
}
else
{
if( (_DWORD)OutputBufferLength != 4 )
return 3221225476i64;
*(_DWORD *)OutputBuffer = KdUmAttachPid;
if( !KdResetUmAttachPid )
goto LABEL_106;
}
KdUmAttachPid = 0;
goto LABEL_106;
}
if( Command == SysDbgSetKdUmExceptionEnable )
{
if( (_DWORD)v7 == 1 )
{
KdIgnoreUmExceptions = *(_BYTE *)InputBuffer == 0;
goto LABEL_107;
}
return 3221225476i64;
}
if( Command > SysDbgGetAutoKdEnable )
{
v15 = Command - 24;
if( !v15 )
{
if( (_DWORD)v7 == 1 )
{
KdAutoEnableOnEvent = *(_BYTE *)InputBuffer != 0;
goto LABEL_107;
}
return 3221225476i64;
}
v16 = v15 - 1;
if( !v16 )
{
if( (_DWORD)OutputBufferLength == 4 )
{
*(_DWORD *)OutputBuffer = KdPrintBufferSize;
goto LABEL_107;
}
return 3221225476i64;
}
v17 = v16 - 1;
if( v17 )
{
if( v17 != 1 )
goto LABEL_97;
if( (_DWORD)OutputBufferLength == 1 )
{
*(_BYTE *)OutputBuffer = KdIgnoreUmExceptions == 0;
goto LABEL_107;
}
return 3221225476i64;
}
if( (_DWORD)v7 != 4 )
return 3221225476i64;
HIDWORD(Size) = 0;
v14 = KdSetDbgPrintBufferSize(*(unsigned int *)InputBuffer);
LABEL_34:
v12 = v14;
goto LABEL_107;
}
if( Command == SysDbgGetAutoKdEnable )
{
if( (_DWORD)OutputBufferLength == 1 )
{
*(_BYTE *)OutputBuffer = KdAutoEnableOnEvent;
goto LABEL_107;
}
return 3221225476i64;
}
if( Command < SysDbgQueryModuleInformation )
{
LABEL_97:
v12 = -1073741821;
goto LABEL_107;
}
if( Command <= SysDbgQuerySpecialCalls )
return 3221225474i64;
if( Command != SysDbgBreakPoint )
{
if( Command > SysDbgCheckLowMemory )
{
if( Command == SysDbgEnableKernelDebugger )
v14 = KdEnableDebugger();
else
v14 = KdDisableDebugger();
goto LABEL_34;
}
return 3221225474i64;
}
if( (_BYTE)KdDebuggerEnabled == 1 )
DbgBreakPointWithStatus(6u);
else
v12 = -1073741823;
LABEL_107:
if( ReturnLength )
*ReturnLength = Size;
return(unsigned int)v12;
}Referenced by:
No references.