IopLiveDumpAllocAndInitResources
NTSTATUS __stdcall IopLiveDumpAllocAndInitResources(_LIVEDUMP_CONTEXT *Context){
unsigned int v2;
_QWORD *v3;
INT64 v4;
UINT64 v5;
int MappingResources;
_DWORD *v7;
int v8;
__int64 v9;
unsigned __int64 v10;
VOID **PoolWithTag;
__int64 v12;
__int64 v13;
unsigned __int64 v14;
VOID **v15;
VOID *v16;
__int64 v17;
__int64 v18;
VOID **v19;
__int64 v20;
__int64 v21;
__int64 v22;
VOID **v23;
__int64 v24;
__int64 i;
INT64 v26;
INT64 v27;
INT64 v28;
__int64 v29;
__int64 v30;
VOID **v31;
__int64 v32;
unsigned __int64 v33;
__int64 v34;
VOID **v35;
VOID **v36;
__int64 v37;
char v38;
char v40;
__int64 v41;
__int64 v42;
__int64 v43;
unsigned __int64 v44;
_EVENT_DATA_DESCRIPTOR v45;
__int64 *v46;
__int64 v47;
char *v48;
__int64 v49;
__int64 *v50;
__int64 v51;
__int64 *v52;
__int64 v53;
unsigned __int64 *v54;
__int64 v55;
v2 = 0;
v3 = 0i64;
if( IopLiveDumpIsUnderMemoryPressure(*((_KEVENT **)Context + 103), *((_KEVENT **)Context + 104)) )
{
MappingResources = -1073741248;
goto LABEL_44;
}
*((_QWORD *)Context + 38) = Context;
IopLiveDumpResetCorralContext(Context + 76);
IopGetPhysicalMemoryBlock();
v3 = v7;
if( !v7 )
goto LABEL_4;
v8 = *v7;
if( !v8 )
{
MappingResources = -1073741595;
goto LABEL_44;
}
v9 = v3[2 * (unsigned int)(v8 - 1) + 2] + v3[2 * (unsigned int)(v8 - 1) + 3];
*((_QWORD *)Context + 11) = v9;
v10 = (((unsigned __int64)(v9 + 7) >> 3) + 7) & 0xFFFFFFFFFFFFFFF8ui64;
PoolWithTag = ExAllocatePoolWithTag(0x200ui64, (v10 + 4095) & 0xFFFFFFFFFFFFF000ui64, 1886217292i64);
*((_QWORD *)Context + 74) = PoolWithTag;
if( !PoolWithTag )
goto LABEL_4;
if( IopLiveDumpIsUnderMemoryPressure(*((_KEVENT **)Context + 103), *((_KEVENT **)Context + 104)) )
{
LABEL_9:
MappingResources = -1073741248;
goto LABEL_44;
}
*((_QWORD *)Context + 72) = *((_QWORD *)Context + 11);
*((_QWORD *)Context + 73) = v12;
RtlSetAllBitsEx((_RTL_BITMAP_EX *)Context + 36);
IopLiveDumpDiscardVirtualAddressRange(Context, *((VOID **)Context + 74), (v10 + 4095) & 0xFFFFFFFFFFFFF000ui64);
if( VslIsSecureKernelRunning() )
v13 += 2 * v10;
v14 = (v13 + 4095) & 0xFFFFFFFFFFFFF000ui64;
v15 = ExAllocatePoolWithTag(0x200ui64, v14, 1886217292i64);
*((_QWORD *)Context + 70) = v15;
if( !v15 )
goto LABEL_4;
if( IopLiveDumpIsUnderMemoryPressure(*((_KEVENT **)Context + 103), *((_KEVENT **)Context + 104)) )
goto LABEL_9;
*((_QWORD *)Context + 71) = v14;
memset(v16, 0i64, v14);
v17 = *((_QWORD *)Context + 70);
*(_QWORD *)(v17 + 8224) = v14;
v18 = *((_QWORD *)Context + 11);
*(_QWORD *)(v17 + 8240) = v18;
*((_QWORD *)Context + 68) = v18;
*((_QWORD *)Context + 69) = v17 + 8248;
RtlClearAllBitsEx((_RTL_BITMAP_EX *)Context + 34);
IopLiveDumpDiscardVirtualAddressRange(Context, *((VOID **)Context + 70), *((_QWORD *)Context + 71));
v19 = ExAllocatePoolWithTag(0x200ui64, (v10 + 4095) & 0xFFFFFFFFFFFFF000ui64, 1886217292i64);
*((_QWORD *)Context + 81) = v19;
if( !v19 )
goto LABEL_4;
if( IopLiveDumpIsUnderMemoryPressure(*((_KEVENT **)Context + 103), *((_KEVENT **)Context + 104)) )
goto LABEL_9;
*((_QWORD *)Context + 75) = *((_QWORD *)Context + 11);
*((_QWORD *)Context + 76) = v20;
RtlClearAllBitsEx((_RTL_BITMAP_EX *)(Context + 150));
IopLiveDumpDiscardVirtualAddressRange(Context, *((VOID **)Context + 81), (v10 + 4095) & 0xFFFFFFFFFFFFF000ui64);
if( VslIsSecureKernelRunning() )
{
*((_QWORD *)Context + 79) = v21;
*((_QWORD *)Context + 80) = v10 + v17 + 8248;
*((_QWORD *)Context + 77) = *((_QWORD *)Context + 11);
*((_QWORD *)Context + 78) = v17 + 8248 + 2 * v10;
}
else
{
*((_QWORD *)Context + 78) = *((_QWORD *)Context + 81);
*((_QWORD *)Context + 77) = v21;
v22 = *((_QWORD *)Context + 81);
*((_QWORD *)Context + 79) = *((_QWORD *)Context + 11);
*((_QWORD *)Context + 80) = v22;
}
v23 = ExAllocatePoolWithTag(0x200ui64, (v10 + 4095) & 0xFFFFFFFFFFFFF000ui64, 1886217292i64);
*((_QWORD *)Context + 84) = v23;
if( !v23 )
{
LABEL_4:
MappingResources = -1073741670;
goto LABEL_44;
}
if( IopLiveDumpIsUnderMemoryPressure(*((_KEVENT **)Context + 103), *((_KEVENT **)Context + 104)) )
goto LABEL_9;
*((_QWORD *)Context + 82) = *((_QWORD *)Context + 11);
*((_QWORD *)Context + 83) = v24;
RtlClearAllBitsEx((_RTL_BITMAP_EX *)Context + 41);
IopLiveDumpDiscardVirtualAddressRange(Context, *((VOID **)Context + 84), (v10 + 4095) & 0xFFFFFFFFFFFFF000ui64);
for( i = *((_QWORD *)Context + 7); i; i = *(_QWORD *)(i + 32) )
IopLiveDumpDiscardVirtualAddressRange(Context, *(VOID **)(i + 16), *(unsigned int *)(i + 24));
MappingResources = IopLiveDumpAllocateMappingResources(Context);
if( MappingResources >= 0 )
{
if( IopLiveDumpIsUnderMemoryPressure(*((_KEVENT **)Context + 103), *((_KEVENT **)Context + 104)) )
goto LABEL_9;
MappingResources = IopLiveDumpEstimateMemoryPages(Context);
if( MappingResources < 0 )
goto LABEL_44;
MappingResources = IopLiveDumpAllocateDumpBuffers(Context);
if( MappingResources >= 0 )
{
MappingResources = IopLiveDumpAllocateExtraBuffers(Context, v26, v27, v28);
if( MappingResources >= 0 )
{
if( IptInterface )
MappingResources = IopLiveDumpAllocateIptBuffers(Context);
if( MappingResources >= 0 )
IopLiveDumpTraceBufferAllocation(Context);
}
}
v29 = (unsigned int)KeNumberProcessors_0;
v30 = (unsigned int)KeNumberProcessors_0;
v31 = ExAllocatePoolWithTag(0x200ui64, 8i64 * (unsigned int)KeNumberProcessors_0, 1886217292i64);
*((_QWORD *)Context + 127) = v31;
if( v31 )
{
v32 = (unsigned int)BufferChunkSizeInPages;
Context[252] = v29;
v33 = (8 * v32 + 4095) & 0xFFFFFFFFFFFFF000ui64;
if( (_DWORD)v29 )
{
v34 = 0i64;
while( 1 )
{
*(_QWORD *)(v34 + *((_QWORD *)Context + 127)) = ExAllocatePoolWithTag(0x200ui64, v33, 1886217292i64);
if( !*(_QWORD *)(v34 + *((_QWORD *)Context + 127)) )
break;
++v2;
v34 += 8i64;
if( v2 >= (unsigned int)v29 )
{
v30 = v29;
goto LABEL_40;
}
}
}
else
{
LABEL_40:
v35 = ExAllocatePoolWithTag(0x200ui64, v33, 1886217292i64);
*((_QWORD *)Context + 128) = v35;
if( v35 )
{
v36 = ExAllocatePoolWithTag(0x200ui64, v33, 1886217292i64);
*((_QWORD *)Context + 129) = v36;
if( v36 )
{
if( !IopLiveDumpIsUnderMemoryPressure(*((_KEVENT **)Context + 103), *((_KEVENT **)Context + 104)) )
{
IopLiveDumpDiscardVirtualAddressRange(Context, *((VOID **)Context + 127), v33 * v30);
IopLiveDumpDiscardVirtualAddressRange(Context, *((VOID **)Context + 128), v33);
IopLiveDumpDiscardVirtualAddressRange(Context, *((VOID **)Context + 129), v33);
goto LABEL_44;
}
goto LABEL_9;
}
}
}
}
else
{
Context[252] = 0;
}
goto LABEL_4;
}
LABEL_44:
if( (unsigned int)dword_140C04498 > 5 && tlgKeywordOn((__int64)&dword_140C04498, 0x200000000000i64) )
{
v41 = *((_QWORD *)Context + 85);
v47 = 8i64;
v46 = &v41;
v38 = Context[11] & 1;
v49 = 1i64;
v40 = v38;
v48 = &v40;
v42 = *((_QWORD *)Context + 87);
v50 = &v42;
v43 = *((_QWORD *)Context + 88);
v52 = &v43;
v51 = 8i64;
v53 = 8i64;
v55 = 8i64;
v54 = &v44;
v44 = (*(_QWORD *)&KUSER_SHARED_DATA.InterruptTime.LowPart - v37) / 0x2710ui64;
tlgWriteTransfer_EtwWriteTransfer(
(__int64)&dword_140C04498,
(unsigned __int8 *)&word_140023BF6,
(const _GUID *)Context + 54,
(const _GUID *)Context + 53,
7u,
&v45);
}
if( v3 )
ExFreePoolWithTag(v3, 0);
if( MappingResources < 0 )
IopLiveDumpReleaseResources((INT64)Context, v4, v5);
return MappingResources;
}Referenced by:
IoCaptureLiveDump