VfTriageSystem

UINT64 __stdcall VfTriageSystem(_LOADER_PARAMETER_BLOCK *LoaderBlock){
  unsigned int v1; 
  __int64 v4; 
  _LOADER_PARAMETER_EXTENSION *Extension; 
  void *TriageDumpBlock; 
  __int64 v7; 
  int v8; 
  _VERIFIER_TRIAGE_RULE *TriageDriverTargets; 
  INT64 v10; 
  _VERIFIER_TRIAGE_RULE *TriageRule; 
  const INT8 *v12; 
  _BYTE BugCheckCode[40]; 

  v1 = 0;
  DbgPrintEx(0x5Du, 3u, "CRASH TRIAGE: verifier triage global/registry settings %X \n", (unsigned int)ViVerifyTriage);
  if( MmVerifyDriverLevel != -1 || (_DWORD)ViVerifyAllDrivers )
  {
    DbgPrintEx(0x5Du, 3u, "CRASH TRIAGE: driver verifier settings present.\n");
    return 0i64;
  }
  if( ViVerifyTriage == -1 )
  {
    DbgPrintEx(0x5Du, 3u, "CRASH TRIAGE: triage skipped because it is not enabled by default.\n");
    return 0i64;
  }
  if( !ViVerifyTriage )
  {
    DbgPrintEx(0x5Du, 3u, "CRASH TRIAGE: triage skipped because it is disabled explicitely.\n");
    return 0i64;
  }
  if( ViVerifyTriage < 0 )
  {
    v1 = (unsigned __int16)ViVerifyTriage;
    v4 = (unsigned __int16)ViVerifyTriage;
    ViVerifyTriage = 1;
    DbgPrintEx(0x5Du, 3u, "CRASH TRIAGE: simulated crash code %X.\n", v4);
  }
  Extension = LoaderBlock->Extension;
  if( !Extension )
  {
    DbgPrintEx(0x5Du, 3u, "CRASH TRIAGE: null loader extension.\n");
    return 0i64;
  }
  if( Extension->Size < 0xE38 )
  {
    DbgPrintEx(0x5Du, 3u, "CRASH TRIAGE: unexpected loader extension size.\n");
    return 0i64;
  }
  TriageDumpBlock = Extension->TriageDumpBlock;
  if( TriageGetBugcheckData(
         TriageDumpBlock,
         (UINT64 *)BugCheckCode,
         (UINT64 *)&BugCheckCode[8],
         (UINT64 *)&BugCheckCode[16],
         (UINT64 *)&BugCheckCode[24],
         (UINT64 *)&BugCheckCode[32]) >= 0 )
  {
    v8 = 1;
    v7 = *(_QWORD *)BugCheckCode;
    DbgPrintEx(0x5Du, 3u, "CRASH TRIAGE: a real crash happened.\n");
  }
  else
  {
    if( !v1 )
    {
      DbgPrintEx(0x5Du, 3u, "CRASH TRIAGE: standard retail exit point.\n");
      return 0i64;
    }
    v7 = v1;
    v8 = 0;
    *(_QWORD *)BugCheckCode = v1;
    *(__m128i *)&BugCheckCode[8] = _mm_load_si128((const __m128i *)&_xmm_ffffffffffffffffffffffffffffffff);
    *(_OWORD *)&BugCheckCode[24] = *(_OWORD *)&BugCheckCode[8];
    DbgPrintEx(0x5Du, 3u, "CRASH TRIAGE: a fake crash will be simulated.\n");
  }
  DbgPrintEx(
    0x5Du,
    3u,
    "CRASH TRIAGE: previous crash was %Ix %Ix %Ix %Ix %Ix.\n",
    v7,
    *(_QWORD *)&BugCheckCode[8],
    *(_QWORD *)&BugCheckCode[16],
    *(_QWORD *)&BugCheckCode[24],
    *(_QWORD *)&BugCheckCode[32]);
  ViTriageCrashData = *(_OWORD *)BugCheckCode;
  qword_140C1CEA0 = *(_QWORD *)&BugCheckCode[32];
  xmmword_140C1CE90 = *(_OWORD *)&BugCheckCode[16];
  if( v8 )
  {
    if( MmTriageActiveInLastCrash(LoaderBlock) == 1 )
    {
      DbgPrintEx(0x5Du, 3u, "CRASH TRIAGE: triage skipped because it was active in previous crash or server system.\n");
      return 0i64;
    }
    if( !(unsigned int)ViTriageSameDriversFromDump(LoaderBlock, TriageDumpBlock) )
    {
      DbgPrintEx(0x5Du, 3u, "CRASH TRIAGE: some drivers changed from previous crash.\n");
      return 0i64;
    }
  }
  if( !(unsigned int)ViValidateTriageRules(&ViVerifyTriageRules, (unsigned int)ViVerifyTriageRulesSize) )
  {
    DbgPrintEx(0x5Du, 3u, "CRASH TRIAGE: triage disabled due to invalid registry rules.\n");
    return 0i64;
  }
  if( !(unsigned int)ViValidateTriageRules(&ViInternalTriageRules, 0x30ui64) )
  {
    DbgPrintEx(0x5Du, 3u, "CRASH TRIAGE: triage disabled due to invalid internal rules!\n");
    return 0i64;
  }
  TriageDriverTargets = 0i64;
  TriageRule = ViFindTriageRule(&ViVerifyTriageRules, (unsigned int)ViVerifyTriageRulesSize, (unsigned int)v7);
  if( !TriageRule )
  {
    TriageRule = ViFindTriageRule(&ViInternalTriageRules, 0x30ui64, (unsigned int)v7);
    if( !TriageRule )
    {
      DbgPrintEx(0x5Du, 3u, "CRASH TRIAGE: crash code %Ix will not be triaged.\n", v7);
      return 0i64;
    }
  }
  if( TriageRule->_bf_0 < 0x80000u )
  {
    TriageDriverTargets = ViFindTriageDriverTargets(v10, (unsigned int)ViVerifyTriageRulesSize, v12);
    if( TriageDriverTargets )
      DbgPrintEx(0x5Du, 3u, "CRASH TRIAGE: no `targets' rule found.\n");
  }
  if( !TriageRule->Features )
  {
    DbgPrintEx(0x5Du, 3u, "CRASH TRIAGE: triage disabled due to rule with null features.\n");
    return 0i64;
  }
  ViMakeVerifierSettings(TriageRule, TriageDriverTargets);
  DbgPrintEx(0x5Du, 3u, "CRASH TRIAGE: triage enabled!\n");
  return 1i64;
}

Referenced by: