NtSystemDebugControl

NTSTATUS __stdcall NtSystemDebugControl(
        _SYSDBG_COMMAND Command,
        VOID *InputBuffer,
        UINT64 InputBufferLength,
        VOID *OutputBuffer,
        UINT64 OutputBufferLength,
        UINT64 *ReturnLength){
  __int64 v7; 
  char PreviousMode; 
  int v12; 
  __int64 v13; 
  NTSTATUS v14; 
  __int32 v15; 
  __int32 v16; 
  __int32 v17; 
  __int32 v18; 
  __int32 v19; 
  __int32 v20; 
  __int32 v21; 
  unsigned __int64 v22; 
  unsigned int v23; 
  unsigned int v24; 
  size_t v25; 
  VOID **PoolWithTag; 
  __int32 v27; 
  __int32 v28; 
  __int32 v29; 
  char v30; 
  size_t BufferUsed[2]; 
  VOID **Size_4; 
  VOID *LockedBuffer; 
  VOID *LockVariable; 
  _SYSDBG_TRIAGE_DUMP TriageDumpRequest[4]; 
  __int128 v36; 
  __int128 v37; 
  VOID *Buffer; 
  _SYSDBG_LIVEDUMP_CONTROL SysLivedumpControl[30]; 

  v7 = (unsigned int)InputBufferLength;
  LODWORD(Size_4) = OutputBufferLength;
  BufferUsed[0] = 0;
  *(_OWORD *)TriageDumpRequest = 0i64;
  v36 = 0i64;
  v37 = 0i64;
  Buffer = 0i64;
  memset(SysLivedumpControl, 0i64, 0x40u);
  LockedBuffer = 0i64;
  LockVariable = 0i64;
  if( KdPitchDebugger && !KdLocalDebugEnabled && ((Command - 29) & 0xFFFFFFF7) != 0 )
    return -1073740972;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  v30 = PreviousMode;
  if( Command != (SysDbgClearUmAttachPid|SysDbgSetTracepoint)
    && !SeSinglePrivilegeCheck(*(_QWORD *)&SeDebugPrivilege, PreviousMode) )
  {
    return -1073741790;
  }
  v12 = 0;
  if( PreviousMode )
  {
    if( (_DWORD)v7 )
    {
      if( ((unsigned __int8)InputBuffer & 3) != 0 )
        ExRaiseDatatypeMisalignment();
      v13 = 0x7FFFFFFF0000i64;
      if( (unsigned __int64)InputBuffer + v7 > 0x7FFFFFFF0000i64 || (char *)InputBuffer + v7 < InputBuffer )
        MEMORY[0x7FFFFFFF0000] = 0;
    }
    else
    {
      v13 = 0x7FFFFFFF0000i64;
    }
    if( (_DWORD)OutputBufferLength )
      ProbeForWrite((UINT64)OutputBuffer, (unsigned int)OutputBufferLength, 4i64);
    if( ReturnLength )
    {
      if( (unsigned __int64)ReturnLength < 0x7FFFFFFF0000i64 )
        v13 = (__int64)ReturnLength;
      *(_DWORD *)v13 = *(_DWORD *)v13;
    }
    PreviousMode = v30;
  }
  if( Command > SysDbgSetKdUmExceptionEnable )
  {
    if( Command <= SysDbgClearUmBreakPid )
    {
      if( Command == SysDbgClearUmBreakPid )
        goto LABEL_64;
      v18 = Command - 29;
      if( !v18 )
      {
        if( (_DWORD)v7 == 56 && (unsigned int)OutputBufferLength >= 0x40000 )
        {
          *(_OWORD *)TriageDumpRequest = *(_OWORD *)InputBuffer;
          v36 = *((_OWORD *)InputBuffer + 1);
          v37 = *((_OWORD *)InputBuffer + 2);
          Buffer = (VOID *)*((_QWORD *)InputBuffer + 6);
          if( DWORD2(v37) || !HIDWORD(v37) || (TriageDumpRequest[0] & 0xFFFFFFFE) != 0 )
            return -1073741811;
          v22 = 8i64 * HIDWORD(v37);
          v23 = -1;
          if( v22 <= 0xFFFFFFFF )
            v23 = 8 * HIDWORD(v37);
          if( v22 > 0xFFFFFFFF )
            return -1073741811;
          v24 = 0x100000;
          if( (unsigned int)OutputBufferLength <= 0x100000 )
            v24 = (unsigned int)Size_4;
          v25 = v24;
          PoolWithTag = ExAllocatePoolWithTag(0x200ui64, v24, 1884181323i64);
          Size_4 = PoolWithTag;
          if( PoolWithTag )
          {
            v12 = ExLockUserBuffer(Buffer, v23, PreviousMode, IoReadAccess, &LockedBuffer, &LockVariable);
            if( v12 >= 0 )
            {
              memset(PoolWithTag, 0i64, v25);
              Buffer = LockedBuffer;
              v12 = DbgkCaptureLiveDump(TriageDumpRequest, PoolWithTag, v25, BufferUsed);
              if( v12 >= 0 )
              {
                if( BufferUsed[0] <= (unsigned int)OutputBufferLength )
                  memmove(OutputBuffer, PoolWithTag, BufferUsed[0]);
                else
                  v12 = -1073741823;
              }
              ExFreePoolWithTag(PoolWithTag, 0);
              ExUnlockUserBuffer(LockVariable);
            }
            else
            {
              ExFreePoolWithTag(PoolWithTag, 0);
            }
          }
          else
          {
            v12 = -1073741801;
          }
          goto LABEL_107;
        }
        return -1073741820;
      }
      v19 = v18 - 1;
      if( !v19 )
      {
        if( (_DWORD)OutputBufferLength == 1 )
        {
          *(_BYTE *)OutputBuffer = KdBlockEnable;
          goto LABEL_107;
        }
        return -1073741820;
      }
      v20 = v19 - 1;
      if( !v20 )
      {
        if( (_DWORD)v7 == 1 )
        {
          KdBlockEnable = *(_BYTE *)InputBuffer;
          goto LABEL_107;
        }
        return -1073741820;
      }
      v21 = v20 - 1;
      if( !v21 )
      {
        KdUmBreakMarker = -618808389;
        goto LABEL_106;
      }
      if( v21 != 1 )
        goto LABEL_97;
      if( (_DWORD)OutputBufferLength != 4 )
        return -1073741820;
      *(_DWORD *)OutputBuffer = KdUmBreakPid;
      if( KdResetUmBreakPid )
LABEL_64:
        KdUmBreakPid = 0;
LABEL_106:
      v12 = 0;
      goto LABEL_107;
    }
    v27 = Command - 35;
    if( v27 )
    {
      v28 = v27 - 1;
      if( v28 )
      {
        v29 = v28 - 1;
        if( v29 )
        {
          if( v29 != 1 )
            goto LABEL_97;
          if( (_DWORD)v7 != 16 || (_DWORD)OutputBufferLength )
            return -1073741820;
          v14 = ExpKdPullRemoteFileForUser(InputBuffer);
        }
        else
        {
          if( (_DWORD)v7 != 64 || (_DWORD)OutputBufferLength )
            return -1073741820;
          *(_OWORD *)SysLivedumpControl = *(_OWORD *)InputBuffer;
          *(_OWORD *)&SysLivedumpControl[4] = *((_OWORD *)InputBuffer + 1);
          *(_OWORD *)&SysLivedumpControl[8] = *((_OWORD *)InputBuffer + 2);
          *(_OWORD *)&SysLivedumpControl[12] = *((_OWORD *)InputBuffer + 3);
          v14 = DbgkCaptureLiveKernelDump(SysLivedumpControl);
        }
        goto LABEL_34;
      }
    }
    else
    {
      if( (_DWORD)OutputBufferLength != 4 )
        return -1073741820;
      *(_DWORD *)OutputBuffer = KdUmAttachPid;
      if( !KdResetUmAttachPid )
        goto LABEL_106;
    }
    KdUmAttachPid = 0;
    goto LABEL_106;
  }
  if( Command == SysDbgSetKdUmExceptionEnable )
  {
    if( (_DWORD)v7 == 1 )
    {
      KdIgnoreUmExceptions = *(_BYTE *)InputBuffer == 0;
      goto LABEL_107;
    }
    return -1073741820;
  }
  if( Command > SysDbgGetAutoKdEnable )
  {
    v15 = Command - 24;
    if( !v15 )
    {
      if( (_DWORD)v7 == 1 )
      {
        KdAutoEnableOnEvent = *(_BYTE *)InputBuffer != 0;
        goto LABEL_107;
      }
      return -1073741820;
    }
    v16 = v15 - 1;
    if( !v16 )
    {
      if( (_DWORD)OutputBufferLength == 4 )
      {
        *(_DWORD *)OutputBuffer = KdPrintBufferSize;
        goto LABEL_107;
      }
      return -1073741820;
    }
    v17 = v16 - 1;
    if( v17 )
    {
      if( v17 != 1 )
        goto LABEL_97;
      if( (_DWORD)OutputBufferLength == 1 )
      {
        *(_BYTE *)OutputBuffer = KdIgnoreUmExceptions == 0;
        goto LABEL_107;
      }
      return -1073741820;
    }
    if( (_DWORD)v7 != 4 )
      return -1073741820;
    BufferUsed[1] = 0;
    v14 = KdSetDbgPrintBufferSize(*(unsigned int *)InputBuffer);
LABEL_34:
    v12 = v14;
    goto LABEL_107;
  }
  if( Command == SysDbgGetAutoKdEnable )
  {
    if( (_DWORD)OutputBufferLength == 1 )
    {
      *(_BYTE *)OutputBuffer = KdAutoEnableOnEvent;
      goto LABEL_107;
    }
    return -1073741820;
  }
  if( Command < SysDbgQueryModuleInformation )
  {
LABEL_97:
    v12 = -1073741821;
    goto LABEL_107;
  }
  if( Command <= SysDbgQuerySpecialCalls )
    return -1073741822;
  if( Command != SysDbgBreakPoint )
  {
    if( Command > SysDbgCheckLowMemory )
    {
      if( Command == SysDbgEnableKernelDebugger )
        v14 = KdEnableDebugger();
      else
        v14 = KdDisableDebugger();
      goto LABEL_34;
    }
    return -1073741822;
  }
  if( (_BYTE)KdDebuggerEnabled == 1 )
    DbgBreakPointWithStatus(6u);
  else
    v12 = -1073741823;
LABEL_107:
  if( ReturnLength )
    *(_DWORD *)ReturnLength = BufferUsed[0];
  return v12;
}

Referenced by: