SepGetStackTraceHash
UINT64 __fastcall SepGetStackTraceHash(_DWORD *a1){
UINT64 result;
unsigned int v3;
unsigned __int16 v4;
int v5;
int v6;
UINT64 BackTraceHash;
__int128 MemoryInformation;
__int64 v9;
void *BackTrace[16];
LODWORD(BackTraceHash) = 0;
memset((INT64)BackTrace, 0i64);
v9 = 0i64;
MemoryInformation = 0i64;
RtlCaptureStackBackTrace(2ui64, 0x10ui64, BackTrace, &BackTraceHash);
result = RtlWalkFrameChain(BackTrace, 0x10ui64, 1ui64);
v3 = result;
v4 = 0;
if( (unsigned int)result > 0x10 )
v3 = 16;
if( v3 )
{
do
{
if( ZwQueryVirtualMemory(
(PVOID)0xFFFFFFFFFFFFFFFFi64,
BackTrace[v4],
MemoryWorkingSetExList|MemorySectionName,
&MemoryInformation,
0x18ui64,
0i64) < 0
|| (unsigned __int64)BackTrace[v4] < (unsigned __int64)MemoryInformation )
{
v5 = (int)BackTrace[v4];
}
else
{
v5 = LODWORD(BackTrace[v4]) - MemoryInformation;
}
v6 = BackTraceHash + v5;
result = ++v4;
LODWORD(BackTraceHash) = v6;
}
while( v4 < v3 );
}
else
{
v6 = BackTraceHash;
}
*a1 = v6;
return result;
}Referenced by:
NtQueryInformationToken
SepLogLpacAccessFailure