MmSetAccessLogging
VOID __stdcall MmSetAccessLogging(UINT64 Enable, UINT64 MinLoggingPriority){
int v2;
int v3;
_KLOCK_QUEUE_HANDLE LockHandle;
v2 = MinLoggingPriority;
v3 = Enable;
memset(&LockHandle, 0, sizeof(LockHandle));
KeAcquireInStackQueuedSpinLock((PKSPIN_LOCK)&stru_140C4DB30 + 330, &LockHandle);
*(&stru_140C4DB30 + 654) = v3;
*(&stru_140C4DB30 + 655) = v2;
if( v3 )
{
KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
__writecr8(LockHandle.OldIrql);
if( !*(&stru_140C4DB30 + 378) )
KeInsertQueueDpc((UINT64)&stru_140C4DB30 + 3032, 0i64, 0i64);
}
else
{
if( *(&stru_140C4DB30 + 326) )
{
if( *(&stru_140C4DB30 + 326) == 2i64 )
*(&stru_140C4DB30 + 326) = 3i64;
}
else
{
*(&stru_140C4DB30 + 323) = 0i64;
*(&stru_140C4DB30 + 325) = MiEmptyAccessLogs;
*(&stru_140C4DB30 + 326) = 1i64;
ExQueueWorkItem((PWORK_QUEUE_ITEM)((char *)&stru_140C4DB30 + 2584), DelayedWorkQueue);
}
KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
__writecr8(LockHandle.OldIrql);
}
}Referenced by:
PfTAccessTracingCleanup
PfTAccessTracingStart
PfTSetTracingPriority