MiLogHotPatchRundown
struct EX_RUNDOWN_REF *__stdcall MiLogHotPatchRundown(){
struct EX_RUNDOWN_REF *result;
_ETHREAD *CurrentThread;
RTL_BALANCED_NODE *v2;
unsigned __int64 i;
__int64 v4;
__int64 v5;
_QWORD **v6;
unsigned __int64 v7;
_QWORD *v8;
_QWORD *v9;
unsigned __int64 k;
_QWORD *v11;
unsigned __int64 j;
__int64 v13;
__int64 v14;
int v15;
_QWORD **v16;
unsigned __int64 v17;
_QWORD *v18;
_QWORD **v19;
unsigned __int64 v20;
_QWORD *v21;
_QWORD *v22;
unsigned __int64 m;
__int64 v24;
__int64 v25;
_QWORD **v26;
unsigned __int64 v27;
_QWORD *v28;
PVOID *n;
__int64 v30;
__int64 v31;
__int64 v32;
struct EX_RUNDOWN_REF *ii;
unsigned __int64 ProcessHotPatchContext;
INT64 *v35;
__int64 v36;
unsigned __int64 jj;
__int64 v38;
__int64 v39;
__int64 v40;
_QWORD **v41;
unsigned __int64 v42;
_QWORD *v43;
struct EX_RUNDOWN_REF *v44;
int v45;
int v46;
int v47;
int v48;
int v49;
int v50;
int v51;
int v52;
int v53;
int v54;
int v55;
int v56;
int v57;
int v58;
int v59;
unsigned int ProcessId;
int v61;
int v62;
int v63;
int v64;
int v65;
int v66;
CHAR *ImageFileName;
UINT Key;
__int64 v69;
_KAPC_STATE ApcState;
__int64 v71[17];
int v72[2];
__int64 v73[6];
char v74[16];
__int64 *v75;
__int64 v76;
int *v77;
__int64 v78;
int *v79;
__int64 v80;
int *v81;
__int64 v82;
int *v83;
__int64 v84;
int *v85;
__int64 v86;
__int64 v87;
int v88[2];
int *v89;
__int64 v90;
int *v91;
__int64 v92;
__int64 v93[15];
int v94[2];
__int64 v95[11];
int v96[2];
unsigned __int64 v97;
int v98;
int v99;
__int64 v100[11];
int v101[2];
void *retaddr;
result = (struct EX_RUNDOWN_REF *)&retaddr;
memset(&ApcState, 0, sizeof(ApcState));
ImageFileName = 0i64;
if( *(_QWORD *)&qword_140C4EC20 && dword_140C4C9F0 )
{
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 243);
ExAcquirePushLockSharedEx((UINT64)&MiHotPatchListLock, 0i64);
v2 = MiGlobalHotPatchList;
i = 0i64;
while( v2 )
{
i = (unsigned __int64)v2;
v2 = v2->Children[0];
}
while( i )
{
if( **(_DWORD **)&qword_140C4EC20 > 5u && tlgKeywordOn(*(__int64 *)&qword_140C4EC20, 32i64) )
{
v47 = *(_DWORD *)(i + 24);
v100[5] = 4i64;
v100[4] = (__int64)&v47;
v48 = *(_DWORD *)(i + 28);
v100[6] = (__int64)&v48;
v100[8] = (__int64)v101;
v100[10] = *(_QWORD *)(i + 40);
v101[0] = *(unsigned __int16 *)(i + 32);
v100[7] = 4i64;
v100[9] = 2i64;
v101[1] = 0;
tlgWriteEx_EtwWriteEx(v5, (unsigned __int8 *)&byte_140025107, v4, 1ui64, v45, v46, 6u, (__int64)v100);
}
v6 = *(_QWORD ***)(i + 8);
v7 = i;
if( v6 )
{
v8 = *v6;
for( i = *(_QWORD *)(i + 8); v8; v8 = (_QWORD *)*v8 )
i = (unsigned __int64)v8;
}
else
{
while( 1 )
{
i = *(_QWORD *)(i + 16) & 0xFFFFFFFFFFFFFFFCui64;
if( !i || *(_QWORD *)i == v7 )
break;
v7 = i;
}
}
}
v9 = (_QWORD *)MiUserSidPatchLists;
k = 0i64;
while( v9 )
{
k = (unsigned __int64)v9;
v9 = (_QWORD *)*v9;
}
while( k )
{
v11 = *(_QWORD **)(k + 24);
j = 0i64;
while( v11 )
{
j = (unsigned __int64)v11;
v11 = (_QWORD *)*v11;
}
while( j )
{
if( **(_DWORD **)&qword_140C4EC20 > 5u && tlgKeywordOn(*(__int64 *)&qword_140C4EC20, 32i64) )
{
v49 = *(_DWORD *)(j + 24);
v95[5] = 4i64;
v95[4] = (__int64)&v49;
v50 = *(_DWORD *)(j + 28);
v95[6] = (__int64)&v50;
v95[8] = (__int64)v96;
v95[10] = *(_QWORD *)(j + 40);
v96[0] = *(unsigned __int16 *)(j + 32);
v97 = k + 40;
v15 = *(unsigned __int8 *)(k + 41);
v95[7] = 4i64;
v95[9] = 2i64;
v96[1] = 0;
v99 = 0;
v98 = 4 * v15 + 8;
tlgWriteEx_EtwWriteEx(v14, (unsigned __int8 *)&word_14002515A, v13, 1ui64, v45, v46, 7u, (__int64)v95);
}
v16 = *(_QWORD ***)(j + 8);
v17 = j;
if( v16 )
{
v18 = *v16;
for( j = *(_QWORD *)(j + 8); v18; v18 = (_QWORD *)*v18 )
j = (unsigned __int64)v18;
}
else
{
while( 1 )
{
j = *(_QWORD *)(j + 16) & 0xFFFFFFFFFFFFFFFCui64;
if( !j || *(_QWORD *)j == v17 )
break;
v17 = j;
}
}
}
v19 = *(_QWORD ***)(k + 8);
v20 = k;
if( v19 )
{
v21 = *v19;
for( k = *(_QWORD *)(k + 8); v21; v21 = (_QWORD *)*v21 )
k = (unsigned __int64)v21;
}
else
{
while( 1 )
{
k = *(_QWORD *)(k + 16) & 0xFFFFFFFFFFFFFFFCui64;
if( !k || *(_QWORD *)k == v20 )
break;
v20 = k;
}
}
}
if( _InterlockedCompareExchange64((volatile signed __int64 *)&MiHotPatchListLock, 0i64, 17i64) != 17 )
ExfReleasePushLockShared((INT64 *)&MiHotPatchListLock);
KeAbPostRelease(&MiHotPatchListLock);
KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
MmAcquireLoadLock();
v22 = (_QWORD *)MiSecureImageActivePatches;
m = 0i64;
while( v22 )
{
m = (unsigned __int64)v22;
v22 = (_QWORD *)*v22;
}
while( m )
{
if( **(_DWORD **)&qword_140C4EC20 > 5u && tlgKeywordOn(*(__int64 *)&qword_140C4EC20, 32i64) )
{
v51 = *(_DWORD *)(m + 24);
v71[5] = 4i64;
v71[4] = (__int64)&v51;
v52 = *(_DWORD *)(m + 28);
v71[6] = (__int64)&v52;
v53 = *(_DWORD *)(m + 32);
v71[8] = (__int64)&v53;
v54 = *(_DWORD *)(m + 36);
v71[10] = (__int64)&v54;
v55 = *(_DWORD *)(m + 40);
v71[12] = (__int64)&v55;
v71[14] = (__int64)v72;
v71[16] = *(_QWORD *)(m + 56);
v72[0] = *(unsigned __int16 *)(m + 48);
v71[7] = 4i64;
v71[9] = 4i64;
v71[11] = 4i64;
v71[13] = 4i64;
v71[15] = 2i64;
v72[1] = 0;
tlgWriteEx_EtwWriteEx(v25, (unsigned __int8 *)&byte_1400251BD, v24, 1ui64, v45, v46, 9u, (__int64)v71);
}
v26 = *(_QWORD ***)(m + 8);
v27 = m;
if( v26 )
{
v28 = *v26;
for( m = *(_QWORD *)(m + 8); v28; v28 = (_QWORD *)*v28 )
m = (unsigned __int64)v28;
}
else
{
while( 1 )
{
m = *(_QWORD *)(m + 16) & 0xFFFFFFFFFFFFFFFCui64;
if( !m || *(_QWORD *)m == v27 )
break;
v27 = m;
}
}
}
for( n = (PVOID *)PsLoadedModuleList; n != &PsLoadedModuleList; n = (PVOID *)*n )
{
if( MiIsActiveSystemHotPatch((INT64)n)
&& **(_DWORD **)&qword_140C4EC20 > 5u
&& tlgKeywordOn(*(__int64 *)&qword_140C4EC20, 32i64) )
{
v56 = *(_DWORD *)(v31 + 120);
v93[5] = 4i64;
v93[4] = (__int64)&v56;
v57 = *(_DWORD *)(v31 + 156);
v93[6] = (__int64)&v57;
v58 = *((_DWORD *)n + 30);
v93[8] = (__int64)&v58;
v59 = *((_DWORD *)n + 39);
v93[10] = (__int64)&v59;
v93[12] = (__int64)v94;
v93[14] = (__int64)n[10];
v94[0] = *((unsigned __int16 *)n + 36);
v93[7] = 4i64;
v93[9] = 4i64;
v93[11] = 4i64;
v93[13] = 2i64;
v94[1] = 0;
tlgWriteEx_EtwWriteEx(v32, (unsigned __int8 *)&byte_140025253, v30, 1ui64, v45, v46, 8u, (__int64)v93);
}
}
MmReleaseLoadLock(CurrentThread);
for( ii = 0i64; ; ii = v44 )
{
result = (struct EX_RUNDOWN_REF *)PsGetNextProcess(ii);
v44 = result;
if( !result )
return result;
if( ExAcquireRundownProtection(result + 139) )
break;
LABEL_92:
;
}
KiStackAttachProcess((_KPROCESS *)v44, 0i64, &ApcState);
ProcessHotPatchContext = (unsigned __int64)MiGetProcessHotPatchContext((INT64)v44, 0i64);
if( !ProcessHotPatchContext )
{
LABEL_91:
KiUnstackDetachProcess(&ApcState, 0i64);
ExReleaseRundownProtection(v44 + 139);
goto LABEL_92;
}
MiFillLogProcessInfo((_MMSUPPORT_INSTANCE *)&v44[208], &Key, &ImageFileName);
--*((_WORD *)CurrentThread + 243);
v35 = (INT64 *)(ProcessHotPatchContext + 16);
ExAcquirePushLockSharedEx(ProcessHotPatchContext + 16, 0i64);
v36 = *(_QWORD *)(ProcessHotPatchContext + 8);
if( (v36 & 1) != 0 )
{
if( v36 == 1 )
{
LABEL_88:
if( _InterlockedCompareExchange64(v35, 0i64, 17i64) != 17 )
ExfReleasePushLockShared(v35);
KeAbPostRelease(v35);
KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
goto LABEL_91;
}
jj = v36 ^ (ProcessHotPatchContext | 1);
}
else
{
jj = *(_QWORD *)(ProcessHotPatchContext + 8);
}
while( jj )
{
if( *(_DWORD *)(jj + 88) )
{
v38 = *(_QWORD *)&qword_140C4EC20;
if( **(_DWORD **)&qword_140C4EC20 > 5u )
{
if( tlgKeywordOn(*(__int64 *)&qword_140C4EC20, 32i64) )
{
ProcessId = (unsigned int)PsGetProcessId((PEPROCESS)v44);
v73[4] = (__int64)&ProcessId;
v73[5] = 4i64;
tlgCreate1Sz_char((__int64)v74, ImageFileName);
v39 = *(_QWORD *)(jj + 24);
v75 = &v69;
v61 = *(_DWORD *)(jj + 48);
v77 = &v61;
v62 = *(_DWORD *)(jj + 52);
v79 = &v62;
v63 = *(_DWORD *)(jj + 80);
v81 = &v63;
v64 = *(_DWORD *)(jj + 84);
v83 = &v64;
v85 = v88;
v87 = *(_QWORD *)(jj + 72);
v88[0] = *(unsigned __int16 *)(jj + 64);
v65 = *(_DWORD *)(jj + 88);
v89 = &v65;
v66 = *(_DWORD *)(jj + 32);
v91 = &v66;
v69 = v39;
v76 = 8i64;
v78 = 4i64;
v80 = 4i64;
v82 = 4i64;
v84 = 4i64;
v86 = 2i64;
v88[1] = 0;
v90 = 4i64;
v92 = 4i64;
tlgWriteEx_EtwWriteEx(v38, (unsigned __int8 *)&byte_14002504D, v40, 1ui64, v45, v46, 0xDu, (__int64)v73);
}
}
}
v41 = *(_QWORD ***)(jj + 8);
v42 = jj;
if( v41 )
{
v43 = *v41;
for( jj = *(_QWORD *)(jj + 8); v43; v43 = (_QWORD *)*v43 )
jj = (unsigned __int64)v43;
}
else
{
while( 1 )
{
jj = *(_QWORD *)(jj + 16) & 0xFFFFFFFFFFFFFFFCui64;
if( !jj || *(_QWORD *)jj == v42 )
break;
v42 = jj;
}
}
}
goto LABEL_88;
}
return result;
}Referenced by:
MiTracingEnabledCallback