IopLiveDumpMirrorPhysicalMemoryCallback
NTSTATUS __stdcall IopLiveDumpMirrorPhysicalMemoryCallback(
_LARGE_INTEGER PhysicalAddress,
_LARGE_INTEGER NumberOfBytes){
UINT64 PerformanceCounter;
_GUID *v3;
unsigned __int64 v6;
unsigned __int64 v7;
unsigned __int64 v8;
unsigned __int64 v9;
UINT64 NextForwardRunClear;
UINT64 v11;
UINT64 v12;
_RTL_BITMAP_EX *Data4;
int v14;
UINT64 v15;
_RTL_BITMAP_EX BitMapHeader;
_MMPFN_IDENTITY Identity[4];
unsigned __int64 v19;
UINT64 StartingRunIndex;
UINT64 v21;
StartingRunIndex = 0i64;
PerformanceCounter = 0i64;
v3 = IopLiveDumpContext;
if( (IopLiveDumpContext[5].Data1 & 0x80u) != 0 )
PerformanceCounter = KeQueryPerformanceCounter(0i64);
v6 = *(_QWORD *)&v3[36].Data1;
v7 = (unsigned __int64)PhysicalAddress.QuadPart >> 12;
v8 = (NumberOfBytes.QuadPart >> 12) + ((NumberOfBytes.anonymous_0.LowPart & 0xFFF) != 0i64);
v9 = v8 + v7 - 1;
if( v7 < v6 )
{
if( v9 >= v6 )
{
v9 = v6 - 1;
v8 = v6 - v7;
}
if( v8 )
{
BitMapHeader.SizeOfBitMap = v9 + 1;
BitMapHeader.Buffer = *(unsigned __int64 **)v3[36].Data4;
while( 1 )
{
NextForwardRunClear = RtlFindNextForwardRunClearEx(&BitMapHeader, v7, &StartingRunIndex);
v11 = NextForwardRunClear ? StartingRunIndex - v7 : v8;
if( v11 )
break;
LABEL_22:
if( v8 <= v11 + NextForwardRunClear )
{
v8 = 0i64;
}
else
{
v7 = NextForwardRunClear + StartingRunIndex;
v8 -= v11 + NextForwardRunClear;
}
if( !v8 )
goto LABEL_26;
}
v12 = v7;
v21 = v11;
while( 1 )
{
if( (*(_DWORD *)v3[2].Data4 & 4) == 0 )
goto LABEL_14;
*(_OWORD *)Identity = 0i64;
v19 = 0i64;
MmTryIdentifyPage(v12, Identity);
if( v14 )
break;
LABEL_21:
++v12;
if( !--v21 )
goto LABEL_22;
}
if( v19 >= 0xFFFF800000000000ui64 )
{
LABEL_14:
Data4 = (_RTL_BITMAP_EX *)v3[37].Data4;
}
else
{
if( (*(_DWORD *)v3[2].Data4 & 4) == 0 || v19 - 1 > 0x7FFFFFFEFFFEi64 )
goto LABEL_21;
Data4 = (_RTL_BITMAP_EX *)&v3[41];
}
RtlSetBitsEx(Data4, v12, 1ui64);
goto LABEL_21;
}
}
LABEL_26:
if( (v3[5].Data1 & 0x80u) != 0 )
{
v15 = KeQueryPerformanceCounter(0i64) - PerformanceCounter;
if( (v3[5].Data1 & 1) != 0 )
{
*(_QWORD *)v3[29].Data4 += NumberOfBytes.QuadPart;
*(_QWORD *)v3[28].Data4 += v15;
}
else
{
*(_QWORD *)v3[32].Data4 += NumberOfBytes.QuadPart;
*(_QWORD *)v3[31].Data4 += v15;
}
}
return 0;
}Referenced by:
No references.