EtwpSetCoverageSamplerInformation
NTSTATUS __stdcall EtwpSetCoverageSamplerInformation(VOID *Address, _SIZE_T Length, _KPROCESSOR_MODE AccessMode){
INT8 v3;
INT64 v4;
char *v5;
char *v6;
int inserted;
__int64 v8;
__int64 v9;
__int64 v10;
_OWORD *v11;
char *v12;
__int64 v13;
unsigned int v14;
UINT64 v15;
unsigned int v16;
unsigned int v17;
char v18;
UINT64 v19;
UINT64 v20;
UINT64 v21;
UINT64 v22;
UINT64 v23;
UINT64 v24;
UINT64 v25;
UINT64 v26;
UINT64 v27;
UINT64 v28;
UINT64 v29;
UINT64 v30;
UINT64 v31;
UINT64 v32;
UINT64 v33;
int v34;
UINT64 v35;
UINT64 v36;
UINT64 v37;
char v38;
unsigned int v39;
char i;
unsigned int v41;
_OWORD *v42;
char *v43;
char *v44;
__int64 v45;
POBJECT_HANDLE_INFORMATION HandleInformation;
UINT64 PagedPoolCharge;
UINT64 NonPagedPoolCharge;
char v50;
PVOID BugCheckParameter2;
PVOID v52;
_HANDLE Handle[4];
_OBJECT_ATTRIBUTES ObjectAttributes;
char v55[8];
PVOID v56;
char v57;
UINT64 v58;
UINT64 v59;
UINT64 v60;
UINT64 v61;
UINT64 v62;
UINT64 v63;
UINT64 v64;
UINT64 v65;
UINT64 v66[32];
__int16 v67;
__int16 v68;
__int64 v69;
_HANDLE v70[2];
v3 = AccessMode;
v4 = (unsigned int)Length;
v5 = (char *)Address;
v6 = 0i64;
BugCheckParameter2 = 0i64;
v52 = 0i64;
*(&ObjectAttributes.Length + 1) = 0;
*(&ObjectAttributes.Attributes + 1) = 0;
v50 = 0;
if( (unsigned int)Length < 0x10 )
goto LABEL_2;
*(_OWORD *)Handle = *(_OWORD *)Address;
if( BYTE1(Handle[1]) != 0xCF )
goto LABEL_4;
v8 = LOBYTE(Handle[1]);
if( LOBYTE(Handle[1]) )
{
v9 = (unsigned int)LOBYTE(Handle[1]) - 2;
if( LOBYTE(Handle[1]) != 2 )
{
if( LOBYTE(Handle[1]) != 3 )
{
inserted = -1073741821;
goto LABEL_51;
}
LABEL_4:
inserted = -1073741637;
goto LABEL_51;
}
LODWORD(v9) = (unsigned __int8)AccessMode;
inserted = ExCheckFullProcessInformationAccess(v9);
if( inserted < 0 )
goto LABEL_51;
if( (_DWORD)v4 == 40 )
{
*(_OWORD *)&ObjectAttributes.Length = *(_OWORD *)v5;
*(_OWORD *)&ObjectAttributes.ObjectName = *((_OWORD *)v5 + 1);
ObjectAttributes.SecurityDescriptor = (void *)*((_QWORD *)v5 + 4);
BugCheckParameter2 = 0i64;
inserted = ObReferenceObjectByHandle(
*(VOID **)&Handle[2],
1ui64,
*(&ExBootDevicesRemovedEvent + 150),
v3,
&BugCheckParameter2,
0i64);
v6 = (char *)BugCheckParameter2;
if( inserted >= 0 )
{
inserted = EtwpCoverageSamplerSetBloomFilter(BugCheckParameter2);
if( inserted >= 0 )
{
LABEL_50:
inserted = 0;
goto LABEL_51;
}
}
goto LABEL_51;
}
LABEL_2:
inserted = -1073741820;
goto LABEL_51;
}
if( !(_BYTE)AccessMode )
goto LABEL_4;
LOBYTE(v8) = AccessMode;
inserted = ExCheckFullProcessInformationAccess(v8);
if( inserted < 0 )
goto LABEL_51;
if( (unsigned int)v4 < 0x280 )
goto LABEL_2;
v10 = 4i64;
ProbeForWrite((UINT64)v5, v4, 4i64);
v11 = v5;
v12 = v55;
v13 = 5i64;
do
{
*(_OWORD *)v12 = *v11;
*((_OWORD *)v12 + 1) = v11[1];
*((_OWORD *)v12 + 2) = v11[2];
*((_OWORD *)v12 + 3) = v11[3];
*((_OWORD *)v12 + 4) = v11[4];
*((_OWORD *)v12 + 5) = v11[5];
*((_OWORD *)v12 + 6) = v11[6];
v12 += 128;
*((_OWORD *)v12 - 1) = v11[7];
v11 += 8;
--v13;
}
while( v13 );
EtwpCovSampApplyBounds(&v58, 0x400ui64, 0x10ui64, 0x4000ui64);
EtwpCovSampApplyBounds(v66, 0x100ui64, v15, v14);
EtwpCovSampApplyBounds((UINT64 *)((char *)v66 + 4), 0x800ui64, v16, 0x10000ui64);
v17 = HIDWORD(v66[0]);
if( ((HIDWORD(v66[0]) - 1) & HIDWORD(v66[0])) != 0 )
{
v18 = -1;
if( HIDWORD(v66[0]) )
{
do
{
++v18;
v17 >>= 1;
}
while( v17 );
}
v17 = 1 << v18;
}
if( (v57 & 0x40) != 0 )
v17 = 0;
HIDWORD(v66[0]) = v17;
EtwpCovSampApplyBounds(&v62, 0x3E8ui64, 1ui64, 0x6B49D200ui64);
EtwpCovSampApplyBounds(&v63, 1ui64, v19, v20);
EtwpCovSampApplyBounds(&v64, 1ui64, v21, v22);
EtwpCovSampApplyBounds(&v65, 1ui64, v23, v24);
EtwpCovSampApplyBounds((UINT64 *)((char *)&v62 + 4), 0i64, 0i64, v25);
EtwpCovSampApplyBounds((UINT64 *)((char *)&v63 + 4), 0i64, v26, v27);
EtwpCovSampApplyBounds((UINT64 *)((char *)&v64 + 4), 0i64, v28, v29);
EtwpCovSampApplyBounds((UINT64 *)((char *)&v65 + 4), 0i64, v30, v31);
EtwpCovSampApplyBounds((UINT64 *)((char *)&v59 + 4), 8ui64, 1ui64, 0x80ui64);
EtwpCovSampApplyBounds(&v60, 0x20000ui64, 0x4000ui64, 0x100000ui64);
EtwpCovSampApplyBounds((UINT64 *)((char *)&v60 + 4), 4ui64, 2ui64, 0x100ui64);
v34 = HIDWORD(v60);
if( (v57 & 0x80) != 0 )
v34 = 0;
HIDWORD(v60) = v34;
EtwpCovSampApplyBounds(&v61, 4ui64, v32, v33);
EtwpCovSampApplyBounds((UINT64 *)((char *)&v61 + 4), 0x10ui64, 4ui64, v35);
EtwpCovSampApplyBounds((UINT64 *)((char *)&v58 + 4), 0x400ui64, 0x10ui64, 0x8000000ui64);
EtwpCovSampApplyBounds(&v59, 0x10000ui64, v36, v37);
v39 = 4 * LODWORD(v66[0]);
if( HIDWORD(v58) >= 4 * LODWORD(v66[0]) )
v39 = HIDWORD(v58);
if( ((v39 - 1) & v39) != 0 )
{
for( i = v38; v39; v39 >>= 1 )
++i;
v39 = 1 << i;
}
HIDWORD(v58) = v39;
v41 = v59;
if( (((_DWORD)v59 - 1) & (unsigned int)v59) != 0 )
{
if( (_DWORD)v59 )
{
do
{
++v38;
v41 >>= 1;
}
while( v41 );
}
v41 = 1 << v38;
}
if( v41 < v39 )
v41 = v39;
LODWORD(v59) = v41;
v68 = 0;
v67 = 0;
ObjectAttributes.Length = 48;
memset(&ObjectAttributes.RootDirectory, 0, 20);
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
LODWORD(NonPagedPoolCharge) = 0;
LODWORD(PagedPoolCharge) = 0;
LODWORD(HandleInformation) = 1224;
inserted = ObCreateObject(
0,
*(&ExBootDevicesRemovedEvent + 150),
&ObjectAttributes,
v3,
0i64,
(UINT64)HandleInformation,
PagedPoolCharge,
NonPagedPoolCharge,
&BugCheckParameter2);
v6 = (char *)BugCheckParameter2;
if( inserted >= 0 )
{
EtwpCoverageSamplerInitialize((INT64)BugCheckParameter2);
v42 = v6 + 24;
v43 = &v57;
do
{
*v42 = *(_OWORD *)v43;
v42[1] = *((_OWORD *)v43 + 1);
v42[2] = *((_OWORD *)v43 + 2);
v42[3] = *((_OWORD *)v43 + 3);
v42[4] = *((_OWORD *)v43 + 4);
v42[5] = *((_OWORD *)v43 + 5);
v42[6] = *((_OWORD *)v43 + 6);
v42 += 8;
*(v42 - 1) = *((_OWORD *)v43 + 7);
v43 += 128;
--v10;
}
while( v10 );
*v42 = *(_OWORD *)v43;
v42[1] = *((_OWORD *)v43 + 1);
v42[2] = *((_OWORD *)v43 + 2);
v42[3] = *((_OWORD *)v43 + 3);
v42[4] = *((_OWORD *)v43 + 4);
*((_DWORD *)v6 + 283) = EtwpCovSampSplitSegments((PWCHAR)v6 + 180);
*((_DWORD *)v6 + 282) = EtwpCovSampSplitSegments((PWCHAR)v6 + 52);
if( !v69 || (inserted = EtwpCoverageSamplerSetBloomFilter(v6), inserted >= 0) )
{
*(_QWORD *)Handle = 0i64;
inserted = ObReferenceObjectByHandle(
*(VOID **)v70,
0x1F0003ui64,
(_OBJECT_TYPE *)ExEventObjectType,
v3,
(VOID **)Handle,
0i64);
*((_QWORD *)v6 + 145) = *(_QWORD *)Handle;
if( inserted >= 0 )
{
v50 = 1;
inserted = EtwpCoverageSamplerStart(v6);
if( inserted >= 0 )
{
ObfReferenceObject(v6);
inserted = ObInsertObject(v6, 0i64, 1, 0i64, 0i64, &v52);
if( inserted >= 0 )
{
v56 = v52;
v55[6] = 0;
v44 = v55;
v45 = 5i64;
do
{
*(_OWORD *)v5 = *(_OWORD *)v44;
*((_OWORD *)v5 + 1) = *((_OWORD *)v44 + 1);
*((_OWORD *)v5 + 2) = *((_OWORD *)v44 + 2);
*((_OWORD *)v5 + 3) = *((_OWORD *)v44 + 3);
*((_OWORD *)v5 + 4) = *((_OWORD *)v44 + 4);
*((_OWORD *)v5 + 5) = *((_OWORD *)v44 + 5);
*((_OWORD *)v5 + 6) = *((_OWORD *)v44 + 6);
v5 += 128;
*((_OWORD *)v5 - 1) = *((_OWORD *)v44 + 7);
v44 += 128;
--v45;
}
while( v45 );
v52 = 0i64;
goto LABEL_50;
}
}
}
}
}
LABEL_51:
if( v52 )
NtClose((UINT64)v52);
if( v6 )
{
if( inserted < 0 && v50 )
EtwpCoverageSamplerStop((INT64)v6);
HalPutDmaAdapter((PADAPTER_OBJECT)v6);
}
return inserted;
}Referenced by:
EtwSetPerformanceTraceInformation