MiLogHotPatchRundown
VOID **__fastcall MiLogHotPatchRundown(_DOUBLE XMM0_8){
VOID **result;
_ETHREAD *CurrentThread;
_QWORD *v3;
unsigned __int64 i;
__int64 v5;
__int64 v6;
_QWORD **v7;
unsigned __int64 v8;
_QWORD *v9;
_RTL_BALANCED_NODE *Root;
unsigned __int64 k;
_QWORD *v12;
unsigned __int64 j;
__int64 v14;
__int64 v15;
int v16;
_QWORD **v17;
unsigned __int64 v18;
_QWORD *v19;
_QWORD **v20;
unsigned __int64 v21;
_QWORD *v22;
INT8 v23;
INT64 v24;
_QWORD *v25;
unsigned __int64 m;
__int64 v27;
__int64 v28;
_QWORD **v29;
unsigned __int64 v30;
_QWORD *v31;
INT64 n;
int v33;
__int64 v34;
__int64 v35;
__int64 v36;
_EPROCESS *ii;
_EX_PUSH_LOCK *ProcessHotPatchContext;
_EX_PUSH_LOCK *v39;
__int64 bf_0;
unsigned __int64 Value;
__int64 v42;
__int64 v43;
__int64 v44;
_QWORD **v45;
unsigned __int64 v46;
_QWORD *v47;
_EPROCESS *v48;
int v49;
int v50;
int v51;
int v52;
int v53;
int v54;
int v55;
int v56;
int v57;
int v58;
int v59;
int v60;
int v61;
int v62;
int v63;
unsigned int ProcessId;
int v65;
int v66;
int v67;
int v68;
int v69;
int v70;
INT8 *ImageFileName;
UINT64 Key;
__int64 v73;
_KAPC_STATE ApcState;
__int64 v75[17];
int v76[2];
__int64 v77[6];
INT64 v78[15];
int v79[2];
int *v80;
__int64 v81;
int *v82;
__int64 v83;
__int64 v84[15];
int v85[2];
__int64 v86[11];
int v87[2];
unsigned __int64 v88;
int v89;
int v90;
__int64 v91[11];
int v92[2];
void *retaddr;
result = &retaddr;
memset(&ApcState, 0, sizeof(ApcState));
ImageFileName = 0i64;
if( *(&stru_140C4DB30 + 542) && dword_140C4C9F0 )
{
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.SpecialApcDisable;
ExAcquirePushLockSharedEx(&MiHotPatchListLock, 0i64);
v3 = (_QWORD *)MiGlobalHotPatchList;
i = 0i64;
while( v3 )
{
i = (unsigned __int64)v3;
v3 = (_QWORD *)*v3;
}
while( i )
{
if( **(&stru_140C4DB30 + 542) > 5u && tlgKeywordOn(*(&stru_140C4DB30 + 542), 32i64) )
{
v51 = *(_DWORD *)(i + 24);
v91[5] = 4i64;
v91[4] = (__int64)&v51;
v52 = *(_DWORD *)(i + 28);
v91[6] = (__int64)&v52;
v91[8] = (__int64)v92;
v91[10] = *(_QWORD *)(i + 40);
v92[0] = *(unsigned __int16 *)(i + 32);
v91[7] = 4i64;
v91[9] = 2i64;
v92[1] = 0;
tlgWriteEx_EtwWriteEx(v6, (unsigned __int8 *)&byte_140025107, v5, 1u, v49, v50, 6u, (__int64)v91);
}
v7 = *(_QWORD ***)(i + 8);
v8 = i;
if( v7 )
{
v9 = *v7;
for( i = *(_QWORD *)(i + 8); v9; v9 = (_QWORD *)*v9 )
i = (unsigned __int64)v9;
}
else
{
while( 1 )
{
i = *(_QWORD *)(i + 16) & 0xFFFFFFFFFFFFFFFCui64;
if( !i || *(_QWORD *)i == v8 )
break;
v8 = i;
}
}
}
Root = MiUserSidPatchLists.Root;
k = 0i64;
while( Root )
{
k = (unsigned __int64)Root;
Root = Root->Children[0];
}
while( k )
{
v12 = *(_QWORD **)(k + 24);
j = 0i64;
while( v12 )
{
j = (unsigned __int64)v12;
v12 = (_QWORD *)*v12;
}
while( j )
{
if( **(&stru_140C4DB30 + 542) > 5u && tlgKeywordOn(*(&stru_140C4DB30 + 542), 32i64) )
{
v53 = *(_DWORD *)(j + 24);
v86[5] = 4i64;
v86[4] = (__int64)&v53;
v54 = *(_DWORD *)(j + 28);
v86[6] = (__int64)&v54;
v86[8] = (__int64)v87;
v86[10] = *(_QWORD *)(j + 40);
v87[0] = *(unsigned __int16 *)(j + 32);
v88 = k + 40;
v16 = *(unsigned __int8 *)(k + 41);
v86[7] = 4i64;
v86[9] = 2i64;
v87[1] = 0;
v90 = 0;
v89 = 4 * v16 + 8;
tlgWriteEx_EtwWriteEx(v15, (unsigned __int8 *)&word_14002515A, v14, 1u, v49, v50, 7u, (__int64)v86);
}
v17 = *(_QWORD ***)(j + 8);
v18 = j;
if( v17 )
{
v19 = *v17;
for( j = *(_QWORD *)(j + 8); v19; v19 = (_QWORD *)*v19 )
j = (unsigned __int64)v19;
}
else
{
while( 1 )
{
j = *(_QWORD *)(j + 16) & 0xFFFFFFFFFFFFFFFCui64;
if( !j || *(_QWORD *)j == v18 )
break;
v18 = j;
}
}
}
v20 = *(_QWORD ***)(k + 8);
v21 = k;
if( v20 )
{
v22 = *v20;
for( k = *(_QWORD *)(k + 8); v22; v22 = (_QWORD *)*v22 )
k = (unsigned __int64)v22;
}
else
{
while( 1 )
{
k = *(_QWORD *)(k + 16) & 0xFFFFFFFFFFFFFFFCui64;
if( !k || *(_QWORD *)k == v21 )
break;
v21 = k;
}
}
}
if( _InterlockedCompareExchange64(&MiHotPatchListLock._bf_0, 0i64, 17i64) != 17 )
ExfReleasePushLockShared(&MiHotPatchListLock);
KeAbPostRelease(&MiHotPatchListLock);
KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
MmAcquireLoadLock(v24, v23);
v25 = (_QWORD *)MiSecureImageActivePatches;
m = 0i64;
while( v25 )
{
m = (unsigned __int64)v25;
v25 = (_QWORD *)*v25;
}
while( m )
{
if( **(&stru_140C4DB30 + 542) > 5u && tlgKeywordOn(*(&stru_140C4DB30 + 542), 32i64) )
{
v55 = *(_DWORD *)(m + 24);
v75[5] = 4i64;
v75[4] = (__int64)&v55;
v56 = *(_DWORD *)(m + 28);
v75[6] = (__int64)&v56;
v57 = *(_DWORD *)(m + 32);
v75[8] = (__int64)&v57;
v58 = *(_DWORD *)(m + 36);
v75[10] = (__int64)&v58;
v59 = *(_DWORD *)(m + 40);
v75[12] = (__int64)&v59;
v75[14] = (__int64)v76;
v75[16] = *(_QWORD *)(m + 56);
v76[0] = *(unsigned __int16 *)(m + 48);
v75[7] = 4i64;
v75[9] = 4i64;
v75[11] = 4i64;
v75[13] = 4i64;
v75[15] = 2i64;
v76[1] = 0;
tlgWriteEx_EtwWriteEx(v28, (unsigned __int8 *)&byte_1400251BD, v27, 1u, v49, v50, 9u, (__int64)v75);
}
v29 = *(_QWORD ***)(m + 8);
v30 = m;
if( v29 )
{
v31 = *v29;
for( m = *(_QWORD *)(m + 8); v31; v31 = (_QWORD *)*v31 )
m = (unsigned __int64)v31;
}
else
{
while( 1 )
{
m = *(_QWORD *)(m + 16) & 0xFFFFFFFFFFFFFFFCui64;
if( !m || *(_QWORD *)m == v30 )
break;
v30 = m;
}
}
}
for( n = PsLoadedModuleList; (INT64 *)n != &PsLoadedModuleList; n = *(_QWORD *)n )
{
LOBYTE(v33) = MiIsActiveSystemHotPatch(n);
if( v33 && **(&stru_140C4DB30 + 542) > 5u && tlgKeywordOn(*(&stru_140C4DB30 + 542), 32i64) )
{
v60 = *(_DWORD *)(v35 + 120);
v84[5] = 4i64;
v84[4] = (__int64)&v60;
v61 = *(_DWORD *)(v35 + 156);
v84[6] = (__int64)&v61;
v62 = *(_DWORD *)(n + 120);
v84[8] = (__int64)&v62;
v63 = *(_DWORD *)(n + 156);
v84[10] = (__int64)&v63;
v84[12] = (__int64)v85;
v84[14] = *(_QWORD *)(n + 80);
v85[0] = *(unsigned __int16 *)(n + 72);
v84[7] = 4i64;
v84[9] = 4i64;
v84[11] = 4i64;
v84[13] = 2i64;
v85[1] = 0;
tlgWriteEx_EtwWriteEx(v36, (unsigned __int8 *)&byte_140025253, v34, 1u, v49, v50, 8u, (__int64)v84);
}
}
MmReleaseLoadLock(CurrentThread);
for( ii = 0i64; ; ii = v48 )
{
result = (VOID **)PsGetNextProcess(ii);
v48 = (_EPROCESS *)result;
if( !result )
return result;
if( ExAcquireRundownProtection((_EX_RUNDOWN_REF *)result + 139) )
break;
LABEL_92:
;
}
KiStackAttachProcess(v48, 0i64, &ApcState);
ProcessHotPatchContext = (_EX_PUSH_LOCK *)MiGetProcessHotPatchContext((__int64)v48, 0);
if( !ProcessHotPatchContext )
{
LABEL_91:
KiUnstackDetachProcess(&ApcState, 0i64);
ExReleaseRundownProtection(&v48->RundownProtect);
goto LABEL_92;
}
MiFillLogProcessInfo(&v48->Vm.Instance, &Key, &ImageFileName);
--CurrentThread->Tcb.SpecialApcDisable;
v39 = ProcessHotPatchContext + 2;
ExAcquirePushLockSharedEx(ProcessHotPatchContext + 2, 0i64);
bf_0 = ProcessHotPatchContext[1]._bf_0;
if( (bf_0 & 1) != 0 )
{
if( bf_0 == 1 )
{
LABEL_88:
if( _InterlockedCompareExchange64(&v39->_bf_0, 0i64, 17i64) != 17 )
ExfReleasePushLockShared(v39);
KeAbPostRelease(v39);
KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
goto LABEL_91;
}
Value = bf_0 ^ ((unsigned __int64)ProcessHotPatchContext | 1);
}
else
{
Value = ProcessHotPatchContext[1].Value;
}
while( Value )
{
if( *(_DWORD *)(Value + 88) )
{
v42 = *(&stru_140C4DB30 + 542);
if( **(&stru_140C4DB30 + 542) > 5u )
{
if( tlgKeywordOn(*(&stru_140C4DB30 + 542), 32i64) )
{
ProcessId = (unsigned int)PsGetProcessId(v48);
v77[4] = (__int64)&ProcessId;
v77[5] = 4i64;
tlgCreate1Sz_char((INT64)v78, ImageFileName);
v43 = *(_QWORD *)(Value + 24);
v78[2] = (INT64)&v73;
v65 = *(_DWORD *)(Value + 48);
v78[4] = (INT64)&v65;
v66 = *(_DWORD *)(Value + 52);
v78[6] = (INT64)&v66;
v67 = *(_DWORD *)(Value + 80);
v78[8] = (INT64)&v67;
v68 = *(_DWORD *)(Value + 84);
v78[10] = (INT64)&v68;
v78[12] = (INT64)v79;
v78[14] = *(_QWORD *)(Value + 72);
v79[0] = *(unsigned __int16 *)(Value + 64);
v69 = *(_DWORD *)(Value + 88);
v80 = &v69;
v70 = *(_DWORD *)(Value + 32);
v82 = &v70;
v73 = v43;
v78[3] = 8i64;
v78[5] = 4i64;
v78[7] = 4i64;
v78[9] = 4i64;
v78[11] = 4i64;
v78[13] = 2i64;
v79[1] = 0;
v81 = 4i64;
v83 = 4i64;
tlgWriteEx_EtwWriteEx(v42, (unsigned __int8 *)&byte_14002504D, v44, 1u, v49, v50, 0xDu, (__int64)v77);
}
}
}
v45 = *(_QWORD ***)(Value + 8);
v46 = Value;
if( v45 )
{
v47 = *v45;
for( Value = *(_QWORD *)(Value + 8); v47; v47 = (_QWORD *)*v47 )
Value = (unsigned __int64)v47;
}
else
{
while( 1 )
{
Value = *(_QWORD *)(Value + 16) & 0xFFFFFFFFFFFFFFFCui64;
if( !Value || *(_QWORD *)Value == v46 )
break;
v46 = Value;
}
}
}
goto LABEL_88;
}
return result;
}Referenced by:
MiTracingEnabledCallback