IopLiveDumpEndMirroringCallback
NTSTATUS __stdcall IopLiveDumpEndMirroringCallback(UINT64 PassNumber){
GUID *v1;
INT64 v2;
NTSTATUS v3;
unsigned int Data1;
INT64 MillisecondCounter;
INT64 v6;
struct _KPRCB *CurrentPrcb;
struct _KPRCB *v8;
__int64 v9;
__int128 *v10;
__int128 *v11;
__int64 v12;
__int128 v13;
unsigned int v14;
INT64 v15;
UINT64 *p_Data1;
UINT64 v17;
unsigned int v18;
__int64 v19;
INT64 v20;
__int64 v21;
INT64 v22;
v1 = IopLiveDumpContext;
v2 = 0i64;
if( (_DWORD)PassNumber )
{
if( (_DWORD)PassNumber == 1 )
{
IopLiveDumpTraceMirroringPhase1End();
Data1 = v1[5].Data1;
if( (Data1 & 0x80u) != 0 )
{
MillisecondCounter = IopLiveDumpGetMillisecondCounter(0);
Data1 = v1[5].Data1;
v2 = MillisecondCounter;
v6 = MillisecondCounter - qword_140CF50C0;
if( (Data1 & 1) != 0 )
*(_QWORD *)&v1[28].Data1 = v6;
else
*(_QWORD *)&v1[31].Data1 = v6;
}
if( (Data1 & 1) != 0 )
{
CurrentPrcb = KeGetCurrentPrcb();
RtlCaptureContext(*((PCONTEXT *)CurrentPrcb + 4280));
KiSaveProcessorControlState((_KPROCESSOR_STATE *)((char *)CurrentPrcb + 256));
}
else
{
v8 = KeGetCurrentPrcb();
v9 = *(_QWORD *)&v1[35].Data1;
RtlCaptureContext(*((PCONTEXT *)v8 + 4280));
KiSaveProcessorControlState((_KPROCESSOR_STATE *)((char *)v8 + 256));
v10 = (__int128 *)(v9 + 840);
if( v10 )
{
memset((INT64)v10, 0i64);
v11 = (__int128 *)*((_QWORD *)v8 + 4280);
v12 = 9i64;
do
{
v13 = *v11;
v11 += 8;
*v10 = v13;
v10 += 8;
*(v10 - 7) = *(v11 - 7);
*(v10 - 6) = *(v11 - 6);
*(v10 - 5) = *(v11 - 5);
*(v10 - 4) = *(v11 - 4);
*(v10 - 3) = *(v11 - 3);
*(v10 - 2) = *(v11 - 2);
*(v10 - 1) = *(v11 - 1);
--v12;
}
while( v12 );
*v10 = *v11;
v10[1] = v11[1];
v10[2] = v11[2];
v10[3] = v11[3];
v10[4] = v11[4];
}
if( SaveSupervisorState )
{
KeSaveSupervisorState(
*((_QWORD *)KeGetCurrentPrcb() + 216),
KUSER_SHARED_DATA.XState.EnabledSupervisorFeatures | 0x100);
v1[26].Data4[1] = 1;
}
}
v14 = v1[5].Data1;
if( (v14 & 0x80u) != 0 )
{
v15 = IopLiveDumpGetMillisecondCounter(0);
IopLiveDumpTraceCaptureProcessorContextDuration(v1, v15 - v2);
v14 = v1[5].Data1;
}
p_Data1 = 0i64;
if( (v14 & 1) == 0 )
p_Data1 = (UINT64 *)&v1[43].Data1;
v3 = IopLiveDumpMarkRequiredDumpData((__int64)v1, (__int64(__fastcall *)(_QWORD, __int64, __int64))p_Data1);
if( v3 >= 0 )
{
if( (v1[5].Data1 & 1) != 0
&& (v17 = RtlNumberOfSetBitsEx((_RTL_BITMAP_EX *)&v1[34]),
v18 = v1[5].Data1,
*(_QWORD *)v1[6].Data4 = v17,
(v18 & 0x200) != 0)
&& v17 > (*(_QWORD *)v1[65].Data4 >> 12) + (unsigned __int64)((*(_QWORD *)v1[65].Data4 & 0xFFFi64) != 0) )
{
v3 = -1073741670;
v1[5].Data1 = v18 | 0x400;
}
else
{
v3 = IopLiveDumpMarkImportantDumpData((_RTL_BITMAP_EX *)v1, p_Data1);
if( v3 >= 0 )
{
if( (v1[5].Data1 & 1) != 0 )
{
IopLiveDumpPopulateBitmapForDump((__int64)v1, v19);
}
else
{
IoFillDumpHeader(*(_QWORD *)&v1[35].Data1, (PWSTR)6);
if( *(_QWORD *)v1[43].Data4 || *(_QWORD *)&v1[44].Data1 )
{
if( (v1[5].Data1 & 0x80u) != 0 )
v2 = IopLiveDumpGetMillisecondCounter(0);
HvlCollectLivedump(v20, *(_QWORD *)&v1[13].Data1, &v1[12].Data1, (INT64)&v1[9]);
if( (v1[5].Data1 & 0x80u) != 0 )
{
*(_QWORD *)&v1[33].Data1 = IopLiveDumpGetMillisecondCounter(0) - v2;
IopLiveDumpTraceCaptureHvlCollectLiveDumpDuration(v1);
}
}
IopLiveDumpGenerateIptSecondaryData();
IopLiveDumpPopulateBitmapForDump((__int64)v1, v21);
IopLiveDumpStartDumpDataBuffering(v1);
}
v3 = 0;
}
}
}
IopLiveDumpUncorralProcessors((INT64)&v1[19], 0);
if( (v1[5].Data1 & 0x80u) != 0 )
{
v22 = IopLiveDumpGetMillisecondCounter(0) - qword_140CF50C0;
if( (v1[5].Data1 & 1) != 0 )
*(_QWORD *)v1[27].Data4 = v22;
else
*(_QWORD *)v1[30].Data4 = v22;
}
}
else
{
return -1073741595;
}
}
else
{
IopLiveDumpTraceMirroringPhase0End();
*(_QWORD *)&v1[12].Data1 = 0i64;
*(_QWORD *)v1[12].Data4 = 0i64;
IopLiveDumpCorralProcessors(&v1[19]);
v3 = 0;
if( (v1[5].Data1 & 0x80u) != 0 )
qword_140CF50C0 = IopLiveDumpGetMillisecondCounter(0);
}
return v3;
}Referenced by:
No references.