ExAddPrivateDataToCrashDump
NTSTATUS __fastcall ExAddPrivateDataToCrashDump(_MM_KERNEL_DUMP_CONTEXT *Context){
NTSTATUS v1;
VOID **v2;
unsigned int v3;
NTSTATUS v5;
int v6;
v1 = 0;
v2 = (VOID **)((char *)&WheapDeferredInternalLogsEventLock + 2976);
v3 = 0;
while( 1 )
{
if( *v2 )
{
v5 = MmAddRangeToCrashDump(Context, *v2, 56 * PoolTrackTableSize);
if( v5 < 0 )
{
v1 = v5;
if( v5 == -1073741789 )
break;
}
}
++v3;
++v2;
if( v3 >= 0x500 )
{
v6 = MmAddRangeToCrashDump(Context, ExpSessionPoolTrackTable, 56 * ExpSessionPoolTrackTableSize);
if( v6 < 0 )
return v6;
return v1;
}
}
return v1;
}Referenced by:
IopAddLiveDumpPagesToPartialKernelDump
IopLiveDumpMarkImportantDumpData