KeBugCheck2
VOID __stdcall __noreturn KeBugCheck2(UINT64 *TotalTransitions){
_LDR_DATA_TABLE_ENTRY *v1;
UINT64 v2;
UINT64 v3;
const char *v4;
UINT64 v5;
UINT64 v6;
_LDR_DATA_TABLE_ENTRY *v7;
UINT64 v8;
signed __int32 v9;
signed __int32 v10;
signed __int32 v11;
char v12;
UINT8 v13;
signed __int32 v14;
signed __int32 v15;
signed __int32 v16;
int v17;
size_t v18;
_CONTEXT *p_TriageContext;
__int64 v20;
_CONTEXT *Context;
__int128 v22;
char v23;
unsigned int v24;
VOID *v25;
UINT64 v26;
NTSTATUS IsSessionAddress;
INT64 v28;
_UNICODE_STRING *UnloadedDriver;
const char *v30;
UINT64 *v31;
UINT64 v32;
_UNICODE_STRING *p_BaseDllName;
INT64 v34;
_EPROCESS *Process;
int v36;
NTSTATUS IsEmptyAffinity;
INT64 v38;
char v39;
_KPRCB *v40;
__int64 CurrentIrql;
char v42;
int v43;
char v44;
unsigned int v45;
UINT64 v46;
_CONTEXT *v47;
_CONTEXT *v48;
__int64 v49;
__int64 v50;
__int128 v51;
__int64 v52;
char v53;
_FIRMWARE_REENTRY v54;
char v55;
char v56;
UINT8 InKernelOrHal;
bool v58;
bool v59;
bool v60;
char v61;
INT64 a7;
UINT64 BugCheckCode;
PCSTR Format;
int a9;
VOID *VirtualAddress;
int v67;
_KPRCB *Prcb;
_KERNEL_STACK_LIMITS Type;
_LDR_DATA_TABLE_ENTRY *DataTableEntry;
unsigned int Number;
UINT64 HighLimit;
UINT64 LowLimit;
INT64 a8;
_KAFFINITY_EX Dest;
_CONTEXT TriageContext;
INT8 Buffer[176];
char *PcValue;
UINT64 v79;
v4 = PcValue;
v5 = v2;
v6 = v79;
v7 = v1;
LODWORD(BugCheckCode) = (_DWORD)TotalTransitions;
v8 = v3;
memset(&Dest, 0i64, sizeof(Dest));
v58 = 1;
Buffer[0] = 0;
a7 = (INT64)KeGetCurrentThread();
a8 = (INT64)KiBugCheckProgress;
v60 = dword_140C508EC != 0;
DataTableEntry = 0i64;
InKernelOrHal = 0;
LOBYTE(a9) = 0;
v61 = 0;
Format = 0i64;
VirtualAddress = 0i64;
v59 = 1;
v67 = 0;
HighLimit = 0i64;
LowLimit = 0i64;
Type = BugcheckStackLimits;
if( KeGetCurrentIrql() < 2u )
{
KeGetCurrentIrql();
__writecr8(2ui64);
}
if( KeGetCurrentThread()->InitialStack )
{
v13 = KeQueryCurrentStackInformation(&Type, &LowLimit, &HighLimit);
v14 = KiBugCheckActive;
v15 = (16 * KeGetCurrentPrcb()->Number) | 3;
while( (v14 & 3) != 3 )
{
v16 = v14;
v14 = _InterlockedCompareExchange(&KiBugCheckActive, v15, v14);
if( v14 == v16 )
{
if( v13 )
{
if( (unsigned int)Type > MachineCheckStackLimits || (v17 = 929, !_bittest(&v17, Type)) )
{
v18 = HighLimit - LowLimit;
if( HighLimit - LowLimit > 0x6000 )
v18 = 24576;
memmove(&KiPreBugcheckStackSaveArea, (const VOID *)LowLimit, v18);
}
}
LABEL_22:
v55 = 1;
goto LABEL_8;
}
}
}
else
{
v9 = KiBugCheckActive;
v10 = (16 * KeGetCurrentPrcb()->Number) | 3;
while( (v9 & 3) != 3 )
{
v11 = v9;
v9 = _InterlockedCompareExchange(&KiBugCheckActive, v10, v9);
if( v9 == v11 )
goto LABEL_22;
}
}
v55 = 0;
LABEL_8:
if( KeSmapEnabled )
__stac();
Prcb = KeGetCurrentPrcb();
Number = Prcb->Number;
KeSaveSupervisorState(
(INT64)Prcb->ExtendedSupervisorState,
KUSER_SHARED_DATA.XState.EnabledSupervisorFeatures | 0x100);
if( !HiberContext )
goto LABEL_11;
if( *(&stru_140C23628 + 583) )
PoPowerDownActionInProgress = 0;
if( *((_BYTE *)HiberContext + 3) )
{
if( v55 )
{
DbgPrintEx(
0x65u,
0,
"\n"
"A bugcheck occurred during the late stages of hibernate suspend or resume.\n"
"Due to verification temporarily enabled by Po during this time,\n"
"regular bugcheck processing may not work.\n"
"\n");
if( (_DWORD)BugCheckCode == 10 )
DbgPrintEx(
0x65u,
0,
"Memory was accessed during this time that was not properly marked\n"
"for the boot phase of hibernate! Check the callstack and parameters\n"
"to find the pages that need to be marked.\n"
"\n");
}
a8 = 0i64;
v12 = 1;
}
else
{
LABEL_11:
v12 = 0;
}
p_TriageContext = &TriageContext;
v20 = 9i64;
v56 = v12;
Context = Prcb->Context;
do
{
*(_OWORD *)&p_TriageContext->P1Home = *(_OWORD *)&Context->P1Home;
*(_OWORD *)&p_TriageContext->P3Home = *(_OWORD *)&Context->P3Home;
*(_OWORD *)&p_TriageContext->P5Home = *(_OWORD *)&Context->P5Home;
*(_OWORD *)&p_TriageContext->ContextFlags = *(_OWORD *)&Context->ContextFlags;
*(_OWORD *)&p_TriageContext->SegGs = *(_OWORD *)&Context->SegGs;
*(_OWORD *)&p_TriageContext->Dr1 = *(_OWORD *)&Context->Dr1;
*(_OWORD *)&p_TriageContext->Dr3 = *(_OWORD *)&Context->Dr3;
p_TriageContext = (_CONTEXT *)((char *)p_TriageContext + 128);
v22 = *(_OWORD *)&Context->Dr7;
Context = (_CONTEXT *)((char *)Context + 128);
*(_OWORD *)&p_TriageContext[-1].LastExceptionToRip = v22;
--v20;
}
while( v20 );
v23 = v55;
*(_OWORD *)&p_TriageContext->P1Home = *(_OWORD *)&Context->P1Home;
*(_OWORD *)&p_TriageContext->P3Home = *(_OWORD *)&Context->P3Home;
*(_OWORD *)&p_TriageContext->P5Home = *(_OWORD *)&Context->P5Home;
*(_OWORD *)&p_TriageContext->ContextFlags = *(_OWORD *)&Context->ContextFlags;
*(_OWORD *)&p_TriageContext->SegGs = *(_OWORD *)&Context->SegGs;
if( !v55 )
{
v28 = a7;
goto LABEL_140;
}
if( ViVerifierEnabled )
VfNotifyVerifierOfEvent(2ui64);
if( !v12 )
KiSaveCurrentEtwTraceBuffer();
IoAddTriageDumpDataBlock(&Engine, (_BYTE *)0x60);
v24 = BugCheckCode;
if( (_DWORD)BugCheckCode == 229 )
{
KiScanBugCheckCallbackList();
((void(__fastcall *)(_QWORD))off_140C008A8)(0i64);
HalReturnToFirmware(HalRebootRoutine);
}
*(&KiBugCheckData + 1) = (UINT64)v7;
INT64 = v5;
if( (_DWORD)BugCheckCode == -1073741103 )
v24 = 195;
*(&INT64 + 1) = v8;
KiBugCheckData = v24;
LODWORD(BugCheckCode) = v24;
a5 = (UINT64)PcValue;
if( v24 > 0xCB )
{
if( v24 != 216 )
{
if( v24 == 234 )
{
KiBugCheckDriver = (_UNICODE_STRING *)v8;
goto LABEL_110;
}
if( v24 == 239 )
goto LABEL_57;
if( v24 != 252 )
{
if( v24 == 317 )
{
v67 = 8;
}
else if( v24 == 335 )
{
if( v5 < 0x100 && PcValue )
{
v34 = a7;
if( *((_QWORD *)PcValue + 1) )
v34 = *((_QWORD *)PcValue + 1);
a7 = v34;
}
Process = KeGetCurrentThread()->ApcState.Process;
v36 = Process->Flags3 >> 12;
LOBYTE(v36) = (Process->Flags3 & 0x1000) == 0;
a9 = v36;
}
goto LABEL_110;
}
LABEL_49:
if( !v79 )
{
if( !v8 || (v8 & 3) != 0 )
goto LABEL_110;
v6 = v8;
}
if( v24 == 142
|| (VirtualAddress = *(VOID **)(v6 + 360), KeGetCurrentThread()->ApcStateIndex != 1)
|| !MmIsSessionAddress(VirtualAddress)
|| (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 )
{
LABEL_110:
v28 = a7;
goto LABEL_111;
}
LABEL_57:
LOBYTE(a9) = 1;
goto LABEL_110;
}
DataTableEntry = v7;
p_BaseDllName = &v7->BaseDllName;
LABEL_109:
KiBugCheckDriver = p_BaseDllName;
goto LABEL_110;
}
switch( v24 )
{
case 0xCBu:
VirtualAddress = v7;
goto LABEL_110;
case 0xAu:
if( (unsigned __int64)PcValue >= ExPoolCodeStart && (unsigned __int64)PcValue < ExPoolCodeEnd )
{
KiBugCheckData = 197i64;
goto LABEL_110;
}
KiPcToFileHeader(PcValue, &DataTableEntry, 0i64, &InKernelOrHal);
if( InKernelOrHal != 1 )
{
KiBugCheckData = 209i64;
goto LABEL_110;
}
if( !KiPcToFileHeader(v7, &DataTableEntry, 1ui64, &InKernelOrHal) )
{
KiBugCheckDriver = (_UNICODE_STRING *)MmLocateUnloadedDriver((unsigned __int64)v7);
if( KiBugCheckDriver )
KiBugCheckData = 212i64;
goto LABEL_110;
}
p_BaseDllName = &DataTableEntry->BaseDllName;
KiBugCheckData = 211i64;
goto LABEL_109;
case 0x4Cu:
v31 = &KiBugCheckData + 1;
KiBugCheckData = (unsigned int)v7;
v32 = v5 - (_QWORD)(&KiBugCheckData + 1);
LOBYTE(a9) = 1;
v30 = (const char *)v8;
v61 = 1;
do
{
*v31 = *(UINT64 *)((char *)v31 + v32);
++v31;
}
while( (__int64)v31 < (__int64)&KiHardwareTrigger );
v28 = a7;
goto LABEL_112;
}
if( v24 != 80 )
{
if( v24 == 123 )
{
v58 = (v8 & 1) == 0;
v59 = (v8 & 2) == 0;
goto LABEL_110;
}
if( v24 != 142 && v24 != 190 )
goto LABEL_110;
goto LABEL_49;
}
v25 = 0i64;
if( v79 )
goto LABEL_63;
if( v8 && (v8 & 3) == 0 )
{
v6 = v8;
LABEL_63:
VirtualAddress = *(VOID **)(v6 + 360);
*(&INT64 + 1) = (UINT64)VirtualAddress;
v25 = KiPcToFileHeader(VirtualAddress, &DataTableEntry, 0i64, &InKernelOrHal);
if( KeGetCurrentThread()->ApcStateIndex == 1
&& MmIsSessionAddress(VirtualAddress)
&& (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) == 0 )
{
LOBYTE(a9) = 1;
}
goto LABEL_67;
}
InKernelOrHal = 1;
LABEL_67:
if( MmIsSpecialPoolAddress(v7) == 1 )
{
v26 = 213i64;
v12 = v56;
if( InKernelOrHal == 1 )
v26 = 204i64;
KiBugCheckData = v26;
goto LABEL_110;
}
if( VirtualAddress == v7 )
{
IsSessionAddress = MmIsSessionAddress(v7);
v28 = a7;
if( IsSessionAddress == 1 && (unsigned __int64)(*(_QWORD *)(a7 + 240) - 1i64) > 0xFFFF7FFFFFFFFFFEui64 )
{
KiBugCheckData = 207i64;
LABEL_76:
v12 = v56;
LABEL_111:
v30 = Format;
v4 = Format;
goto LABEL_112;
}
}
else
{
v28 = a7;
}
if( v25 )
goto LABEL_76;
UnloadedDriver = (_UNICODE_STRING *)MmLocateUnloadedDriver((unsigned __int64)v7);
v30 = Format;
v12 = v56;
v4 = Format;
KiBugCheckDriver = UnloadedDriver;
if( UnloadedDriver )
KiBugCheckData = 206i64;
LABEL_112:
if( v60 )
KiAttemptBugcheckRecovery();
off_140C008C8[0]();
HvlEnlightenments &= 0x2000u;
IoSaveBugCheckProgress(0x60ui64);
IsEmptyAffinity = KeIsEmptyAffinityEx(&KiNmiInProgress.Count);
((void(__fastcall *)(bool))off_140C00698[0])(IsEmptyAffinity == 0);
KiFilterBugCheckInfo(&BugCheckCode, (__int64)&KiBugCheckData);
HvlLogGuestCrashInformation((unsigned int)KiBugCheckData, *(&KiBugCheckData + 1), INT64, *(&INT64 + 1), a5);
if( KiBugCheckDriver )
{
KiBugCheckUnicodeToAnsi(&KiBugCheckDriver->Length, Buffer);
}
else if( VirtualAddress )
{
LOBYTE(v38) = 1;
KiDumpParameterImages(Buffer, (UINT64 *)&VirtualAddress, 1ui64, v38);
}
if( !KdPitchDebugger )
qword_140C00B48 = (__int64)&TriageContext;
if( (_DWORD)BugCheckCode == 226
|| !(_BYTE)KdDebuggerEnabled && !KdEventLoggingEnabled
|| KiHypervisorInitiatedCrashDump
|| (KdRefreshDebuggerNotPresent(), v39) && !KdEventLoggingPresent )
{
v23 = v55;
LABEL_140:
v40 = Prcb;
goto LABEL_141;
}
v40 = Prcb;
if( !Prcb->NmiActive )
{
DbgPrintEx(
0x65u,
0,
"\n*** Fatal System Error: 0x%08lx\n(0x%p,0x%p,0x%p,0x%p)\n\n",
(unsigned int)KiBugCheckData,
(const void *)*(&KiBugCheckData + 1),
(const void *)INT64,
(const void *)*(&INT64 + 1),
(const void *)a5);
if( KiBugCheckDriver )
DbgPrintEx(0x65u, 0, "Driver at fault: %s.\n", Buffer);
if( v61 )
{
if( v30 )
DbgPrintEx(0x65u, 0, v30);
if( v4 )
DbgPrintEx(0x65u, 0, v4);
}
}
if( (_BYTE)KdDebuggerEnabled && !(_BYTE)KdDebuggerNotPresent )
KiBugCheckDebugBreak(3ui64);
v23 = v55;
LABEL_141:
_disable();
CurrentIrql = KeGetCurrentIrql();
__writecr8(0xFui64);
if( v23 )
{
if( (unsigned int)KeNumberProcessors_0 > 1 && !KiHypervisorInitiatedCrashDump )
{
KiSetDebuggerOwner(v40);
KeCopyAffinityEx(&Dest, &KeActiveProcessors);
KeRemoveProcessorAffinityEx(&Dest.Count, v40->Number);
KiSendFreeze(&Dest, 0);
KeStallExecutionProcessor(0xF4240u);
}
IoInitializeBugCheckProgress((unsigned int)BugCheckCode, (UINT64)v7);
IoSaveBugCheckProgress(1ui64);
v42 = v59;
if( v12 )
{
v44 = v58;
}
else
{
if( qword_140C50960 && v59 )
v43 = v67;
else
v43 = v67 | 4;
v44 = v58;
v45 = v43 | 2;
if( v60 )
v45 = v43;
v46 = v45 | 1;
if( v58 )
v46 = v45;
KiDisplayBlueScreen(v46);
}
HvlPrepareForRootCrashdump();
if( !v12 )
{
KiInvokeBugCheckEntryCallbacks();
IoSaveBugCheckProgress(2ui64);
KiInvokeBugCheckAddTriageDumpDataCallbacks();
IoSaveBugCheckProgress(5ui64);
}
if( !(_BYTE)KdDebuggerEnabled && !KdPitchDebugger )
KdEnableDebuggerWithLock(0);
v47 = v40->Context;
v48 = &TriageContext;
v49 = 9i64;
v50 = 128i64;
do
{
*(_OWORD *)&v47->P1Home = *(_OWORD *)&v48->P1Home;
*(_OWORD *)&v47->P3Home = *(_OWORD *)&v48->P3Home;
*(_OWORD *)&v47->P5Home = *(_OWORD *)&v48->P5Home;
*(_OWORD *)&v47->ContextFlags = *(_OWORD *)&v48->ContextFlags;
*(_OWORD *)&v47->SegGs = *(_OWORD *)&v48->SegGs;
*(_OWORD *)&v47->Dr1 = *(_OWORD *)&v48->Dr1;
*(_OWORD *)&v47->Dr3 = *(_OWORD *)&v48->Dr3;
v47 = (_CONTEXT *)((char *)v47 + 128);
v51 = *(_OWORD *)&v48->Dr7;
v48 = (_CONTEXT *)((char *)v48 + 128);
*(_OWORD *)&v47[-1].LastExceptionToRip = v51;
--v49;
}
while( v49 );
*(_OWORD *)&v47->P1Home = *(_OWORD *)&v48->P1Home;
*(_OWORD *)&v47->P3Home = *(_OWORD *)&v48->P3Home;
*(_OWORD *)&v47->P5Home = *(_OWORD *)&v48->P5Home;
*(_OWORD *)&v47->ContextFlags = *(_OWORD *)&v48->ContextFlags;
*(_OWORD *)&v47->SegGs = *(_OWORD *)&v48->SegGs;
if( v42 )
{
if( (_DWORD)BugCheckCode == 265 )
{
KiMarkBugCheckRegions(*(&KiBugCheckData + 1), INT64, *(&INT64 + 1), a5);
if( a5 == 47 )
{
v52 = *(&INT64 + 1);
if( MmIsAddressValid(*(&INT64 + 1) + 1928) )
IoAddTriageDumpDataBlock(*(VOID **)(v52 + 1928), (_BYTE *)0x1000);
}
}
KdDecodeDataBlock();
if( (_DWORD)BugCheckCode == 395 )
{
if( *(&KiBugCheckData + 1) != 396 )
{
LABEL_178:
IoWriteCrashDump(
(unsigned int)KiBugCheckData,
*(&KiBugCheckData + 1),
(const UINT16 *)INT64,
*(&INT64 + 1),
a5,
&TriageContext,
v28,
a8,
a9);
IoSaveBugCheckProgress(3ui64);
goto LABEL_186;
}
if( *(&KiSwapEvent + 1155) )
IoAddTriageDumpDataBlock((char *)&KiSwapEvent + 4620, (_BYTE *)4);
IoAddTriageDumpDataBlock(&VslpTraceLog, (_BYTE *)0xA08);
if( VslpHotpatchLog )
{
IoAddTriageDumpDataBlock(&VslpHotpatchLog, (_BYTE *)8);
IoAddTriageDumpDataBlock(VslpHotpatchLog, (_BYTE *)0x50008);
}
}
if( (_DWORD)BugCheckCode == 239 )
{
PoAddPowerTriageData();
if( *(&ExBootDevicesRemovedEvent + 216) )
{
IoAddTriageDumpDataBlock((char *)&ExBootDevicesRemovedEvent + 864, (_BYTE *)0x30);
if( *(&ExBootDevicesRemovedEvent + 440) )
IoAddTriageDumpDataBlock(*(&ExBootDevicesRemovedEvent + 111), (_BYTE *)*(&ExBootDevicesRemovedEvent + 440));
}
}
goto LABEL_178;
}
}
else
{
v53 = KiBugCheckActive;
if( Number != (unsigned int)KiBugCheckActive >> 4 )
{
while( 1 )
{
KiCheckForFreezeExecution(0i64, 0i64);
_mm_pause();
}
}
if( KiHypervisorInitiatedCrashDump || (KiBugCheckActive & 0xCu) >= 8 )
{
while( 1 )
((void(__fastcall *)(__int64))off_140C005D8)(CurrentIrql);
}
IoSetBugCheckProgressFlag(0x20000ui64);
_InterlockedExchangeAdd(&KiBugCheckActive, 4u);
if( (v53 & 0xC) != 0 )
KiBugCheckDebugBreak(4ui64);
v44 = v58;
}
LABEL_186:
if( !VslVsmEnabled )
{
if( (HvlpFlags & 2) != 0 )
HvlNotifyRootCrashdump(2ui64);
HvlEnlightenments = HvlpEnlightenments;
((void(__fastcall *)(_CONTEXT *, __int64, __int64))off_140C007A8[0])(v48, v49, v50);
}
IoSaveBugCheckProgress(0x63ui64);
if( !v56 )
KiScanBugCheckCallbackList();
off_140C008B8[0]();
IoSaveBugCheckProgress(4ui64);
if( v60 )
{
KiResumeForReboot = 1;
KiSendThawExecution();
KiBugcheckUnloadDebugSymbols();
((void(__fastcall *)(_QWORD))off_140C008A8)(0i64);
if( PoPowerDownActionInProgress && !PoPowerResetActionInProgress
|| PoModernStandbyActionInProgress
|| (v54 = HalRebootRoutine, !v44) )
{
v54 = HalPowerDownRoutine;
}
HalReturnToFirmware(v54);
}
KiBugCheckDebugBreak(4ui64);
}Referenced by:
KeBugCheckEx