NtTraceEvent
NTSTATUS __stdcall NtTraceEvent(PVOID TraceHandle, UINT64 Flags, UINT64 FieldSize, PVOID Fields){
__int64 v5;
unsigned int v6;
unsigned __int16 v7;
unsigned int v8;
UINT64 v9;
NTSTATUS v10;
PVOID v11;
_ETW_GUID_ENTRY *v12;
_ETW_GUID_ENTRY *GroupEntry;
unsigned int v14;
__int64 v15;
VOID *Traits;
UINT8 v17;
UINT8 v18;
__int64 v20;
__int64 v21;
__int64 v22;
INT64 v23;
unsigned int v24;
CHAR v25;
__int64 v26;
__int64 *v27;
_ETW_GUID_ENTRY *GuidEntryByGuid;
INT64 v29;
_ETHREAD *v30;
unsigned int v31;
UINT8 v32;
_GUID *v33;
__int64 v34;
unsigned int v35;
unsigned int v36;
char *v37;
_ETHREAD *CurrentThread;
__int64 *CurrentServerSiloGlobals;
__int64 v40;
bool v41;
_ETHREAD *v42;
UINT8 v43;
PVOID *Object;
PVOID *Objecta;
PVOID *Objectb;
PVOID *Objectc;
UINT64 Level;
UINT64 Levela;
UINT64 UserDataCount;
UINT64 UserDataCounta;
BYTE v52;
CHAR v53;
char v54;
UINT64 v55;
int MessageFlags;
int MessageFlags_4;
_EVENT_DATA_DESCRIPTOR *UserData;
char v59;
BYTE v61;
__int16 v62;
_ETW_GUID_ENTRY *GuidEntry;
int Flagsa;
int Flags_4;
_GUID *RelatedActivityId;
UINT64 Keyword;
PVOID v68;
UINT64 EventKey;
_EVENT_DATA_DESCRIPTOR *v70;
UINT64 v71;
int v72;
int v73;
int v74;
int v75;
int v76;
_EVENT_DATA_DESCRIPTOR *v77;
UINT64 v78;
__int64 v79;
_EVENT_DATA_DESCRIPTOR *v80;
UINT64 v81;
UINT64 v82;
__int64 v83;
int v84;
int v85;
_GUID Guid;
UINT64 LoggerMask[2];
__int128 v88;
v5 = (unsigned int)FieldSize;
v6 = Flags;
v7 = (unsigned __int16)TraceHandle;
v8 = Flags & 0xFF00;
switch( v8 )
{
case 0x300u:
Keyword = (UINT64)KeGetCurrentThread();
if( *(_BYTE *)(Keyword + 562) )
{
if( ((unsigned __int8)Fields & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( (unsigned __int64)Fields + 120 > 0x7FFFFFFF0000i64 || (char *)Fields + 120 < Fields )
MEMORY[0x7FFFFFFF0000] = 0;
}
UserData = (_EVENT_DATA_DESCRIPTOR *)*((_QWORD *)Fields + 11);
v80 = UserData;
LODWORD(v55) = *((_DWORD *)Fields + 21);
v76 = v55;
v9 = *((unsigned __int16 *)Fields + 41);
v81 = v9;
MessageFlags_4 = *((_DWORD *)Fields + 28);
v75 = MessageFlags_4;
Keyword = *((_QWORD *)Fields + 6);
v82 = Keyword;
v52 = *((_BYTE *)Fields + 44);
v61 = v52;
RelatedActivityId = 0i64;
if( *((_BYTE *)Fields + 80) )
RelatedActivityId = (_GUID *)((char *)Fields + 96);
v68 = 0i64;
v10 = ObReferenceObjectByHandle(TraceHandle, 0x800u, EtwpRegistrationObjectType, 1, &v68, 0i64);
if( v10 >= 0 )
{
EventKey = 0i64;
v11 = v68;
v12 = (_ETW_GUID_ENTRY *)*((_QWORD *)v68 + 4);
GuidEntry = v12;
GroupEntry = (_ETW_GUID_ENTRY *)*((_QWORD *)v68 + 5);
v68 = GroupEntry;
v14 = v6 >> 31;
*(_OWORD *)LoggerMask = 0i64;
v88 = 0i64;
v15 = *((_QWORD *)v11 + 13);
Traits = (VOID *)(v15 + 28);
if( !v15 )
Traits = 0i64;
v17 = *((_BYTE *)v11 + 100);
if( v17 )
{
LODWORD(UserDataCount) = v55;
LOBYTE(Level) = v52;
LODWORD(Objecta) = MessageFlags_4;
v10 = EtwpWriteUserEvent(
v12,
v17,
(unsigned __int16)v14,
v9,
(UINT64)Objecta,
(_EVENT_HEADER *)Fields,
RelatedActivityId,
Level,
Keyword,
UserDataCount,
UserData,
LoggerMask,
0i64,
*((_WORD *)v11 + 49),
Traits,
&EventKey);
v12 = GuidEntry;
GroupEntry = (_ETW_GUID_ENTRY *)v68;
}
v18 = *((_BYTE *)v11 + 101);
if( v18 )
{
LODWORD(UserDataCount) = v55;
LOBYTE(Level) = v52;
LODWORD(Objecta) = MessageFlags_4;
v10 = EtwpWriteUserEvent(
v12,
v18,
(unsigned __int16)v14,
v9,
(UINT64)Objecta,
(_EVENT_HEADER *)Fields,
RelatedActivityId,
Level,
Keyword,
UserDataCount,
UserData,
LoggerMask,
GroupEntry,
*((_WORD *)v11 + 49),
Traits,
&EventKey);
v12 = GuidEntry;
}
if( v12->HostEntry )
{
*(_OWORD *)LoggerMask = 0i64;
v88 = 0i64;
v32 = *((_BYTE *)v11 + 102);
if( v32 )
{
LODWORD(UserDataCount) = v55;
LOBYTE(Level) = v52;
v33 = RelatedActivityId;
LODWORD(Objecta) = MessageFlags_4;
v10 = EtwpWriteUserEvent(
v12->HostEntry,
v32,
(unsigned __int16)v14,
0i64,
(UINT64)Objecta,
(_EVENT_HEADER *)Fields,
RelatedActivityId,
Level,
Keyword,
UserDataCount,
UserData,
LoggerMask,
0i64,
*((_WORD *)v11 + 49),
Traits,
&EventKey);
v12 = GuidEntry;
}
else
{
v33 = RelatedActivityId;
}
v43 = *((_BYTE *)v11 + 103);
if( v43 )
{
LODWORD(UserDataCount) = v55;
LOBYTE(Level) = v52;
LODWORD(Objecta) = MessageFlags_4;
v10 = EtwpWriteUserEvent(
v12->HostEntry,
v43,
(unsigned __int16)v14,
0i64,
(UINT64)Objecta,
(_EVENT_HEADER *)Fields,
v33,
Level,
Keyword,
UserDataCount,
UserData,
LoggerMask,
*((_ETW_GUID_ENTRY **)v68 + 50),
*((_WORD *)v11 + 49),
Traits,
&EventKey);
}
}
ObfDereferenceObjectWithTag(v11, 0x746C6644ui64);
}
return v10;
case 0x200u:
GuidEntry = (_ETW_GUID_ENTRY *)TraceHandle;
UserData = 0i64;
if( (_DWORD)FieldSize == 40 )
{
if( *((_BYTE *)KeGetCurrentThread() + 562) == 1 )
{
v55 = (UINT64)Fields;
if( ((unsigned __int8)Fields & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( v55 + 40 > 0x7FFFFFFF0000i64 || v55 + 40 < v55 )
MEMORY[0x7FFFFFFF0000] = 0;
MessageFlags = *(_DWORD *)(v55 + 24);
if( (Flags & 0x80000000) != 0i64 )
{
LODWORD(UserData) = *(_DWORD *)(v55 + 32);
MessageFlags |= 0x80u;
}
else
{
UserData = *(_EVENT_DATA_DESCRIPTOR **)(v55 + 32);
}
v20 = *(unsigned int *)(v55 + 28);
MessageFlags_4 = v20;
if( (unsigned int)v20 <= 0x10000 )
{
if( (_DWORD)v20
&& ((unsigned __int64)UserData + v20 > 0x7FFFFFFF0000i64
|| (_EVENT_DATA_DESCRIPTOR *)((char *)UserData + v20) < UserData) )
{
MEMORY[0x7FFFFFFF0000] = 0;
}
HIDWORD(GuidEntry) = v20;
return EtwpTraceMessageVa(
(UINT64)GuidEntry,
MessageFlags | 0x40u,
(GUID *)(v55 + 8),
*(_WORD *)(v55 + 4),
(PSTR)UserData,
1);
}
v10 = -1073741811;
v74 = -1073741811;
return v10;
}
return -1073741637;
}
return -1073741811;
case 0x600u:
v53 = 0;
v23 = PsGetCurrentServerSiloGlobals()[108];
v24 = v7;
if( v7 == 0xFFFF || !v7 )
v24 = *(unsigned __int8 *)(v23 + 4208);
if( v24 >= *(_DWORD *)(v23 + 16) )
return -1073741816;
v25 = *((_BYTE *)KeGetCurrentThread() + 562);
v26 = EtwpOpenLogger(v24, v23, v25, &v53);
if( !v26 )
return -1073741816;
if( (*(_DWORD *)(v26 + 12) & 0x2000000) != 0 )
{
v40 = 32i64 * *(unsigned __int8 *)(v26 + 834) + v23 + 4260;
v41 = v40 && (*(_DWORD *)(v40 + 4) & 0x28) != 0;
v10 = EtwpSetMark(v26, Fields, v5, v41, v25);
}
else
{
v10 = -1073741811;
}
EtwpCloseLogger(v24, v23, v53);
return v10;
}
if( v8 <= 0x600 )
{
switch( v8 )
{
case 0x100u:
return EtwTraceEvent(
(UINT16)TraceHandle,
(UINT16 *)Fields,
0x30ui64,
(((int)Flags >> 31) & 0xFFF60000) - 1072431104,
*((_BYTE *)KeGetCurrentThread() + 562));
case 0x400u:
v34 = PsGetCurrentServerSiloGlobals()[108];
v35 = v7;
v36 = 0;
if( (_WORD)v35 != 0xFFFF )
v36 = v35;
if( v36 < *(_DWORD *)(v34 + 16) )
{
if( (unsigned int)v5 > 0xFFDF )
return -1073741675;
if( *((_BYTE *)KeGetCurrentThread() + 562) == 1 )
{
if( ((unsigned __int8)Fields & 3) != 0 )
ExRaiseDatatypeMisalignment();
v37 = (char *)Fields + v5 + 32;
if( (unsigned __int64)v37 > 0x7FFFFFFF0000i64 || v37 < Fields )
MEMORY[0x7FFFFFFF0000] = 0;
v79 = (__int64)Fields + 32;
v62 = *((_WORD *)Fields + 3);
v83 = (__int64)Fields + 32;
v84 = v5;
v85 = 0;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
CurrentServerSiloGlobals = PsGetCurrentServerSiloGlobals();
EtwpLogSystemEventUnsafe(
CurrentServerSiloGlobals[108],
(__int64)&v83,
(__int64)CurrentThread,
v36,
1u,
v62,
v6 & 0xC00F00FF | 0x3100);
return 0;
}
return -1073741637;
}
return -1073741811;
case 0x500u:
v21 = *((_QWORD *)KeGetCurrentThread() + 143);
v22 = PsGetCurrentServerSiloGlobals()[108];
if( *(_DWORD *)(v22 + 4072) == (_DWORD)v21 )
{
if( ((unsigned __int8)Fields & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( (unsigned __int64)Fields + 120 > 0x7FFFFFFF0000i64 || (char *)Fields + 120 < Fields )
MEMORY[0x7FFFFFFF0000] = 0;
v77 = (_EVENT_DATA_DESCRIPTOR *)*((_QWORD *)Fields + 11);
v72 = *((_DWORD *)Fields + 21);
v73 = *((_DWORD *)Fields + 28);
v78 = *((_QWORD *)Fields + 6);
v59 = *((_BYTE *)Fields + 44);
LODWORD(UserDataCount) = v72;
LOBYTE(Level) = v59;
LODWORD(Object) = v73;
return EtwpWriteUserEvent(
(_ETW_GUID_ENTRY *)(v22 + 24),
*(_BYTE *)(v22 + 4064),
0i64,
0i64,
(UINT64)Object,
(_EVENT_HEADER *)Fields,
0i64,
Level,
v78,
UserDataCount,
v77,
0i64,
0i64,
0,
0i64,
0i64);
}
return -1073741790;
}
return -1073741811;
}
if( v8 != 1792 )
{
if( v8 == 2048 )
return EtwTraceEvent(
(UINT16)TraceHandle,
(UINT16 *)Fields,
0x48ui64,
(((int)Flags >> 31) & 0xFFF60000) - 1072365568,
*((_BYTE *)KeGetCurrentThread() + 562));
if( v8 == 2304 )
{
if( (_DWORD)Flags == 2304 && (_DWORD)FieldSize && Fields )
return EtwTraceRaw((UINT64)TraceHandle, Fields, (unsigned int)FieldSize, *((_BYTE *)KeGetCurrentThread() + 562));
return -1073741811;
}
return -1073741811;
}
Guid = 0i64;
if( !TraceHandle )
return -1073741811;
if( ((unsigned __int8)Fields & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( (unsigned __int64)Fields + 120 > 0x7FFFFFFF0000i64 || (char *)Fields + 120 < Fields )
MEMORY[0x7FFFFFFF0000] = 0;
if( ((unsigned __int8)TraceHandle & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( (unsigned __int64)TraceHandle + 16 > 0x7FFFFFFF0000i64 || (char *)TraceHandle + 16 < TraceHandle )
MEMORY[0x7FFFFFFF0000] = 0;
v70 = (_EVENT_DATA_DESCRIPTOR *)*((_QWORD *)Fields + 11);
Flagsa = *((_DWORD *)Fields + 21);
Flags_4 = *((_DWORD *)Fields + 28);
v71 = *((_QWORD *)Fields + 6);
v54 = *((_BYTE *)Fields + 44);
Guid = *(_GUID *)TraceHandle;
v27 = PsGetCurrentServerSiloGlobals();
GuidEntryByGuid = EtwpFindGuidEntryByGuid((_ETW_SILODRIVERSTATE *)v27[108], &Guid, EtwTraceGuidType);
v29 = (INT64)GuidEntryByGuid;
if( GuidEntryByGuid )
{
if( GuidEntryByGuid->ProviderEnableInfo.IsEnabled )
{
v10 = EtwpAccessCheck(GuidEntryByGuid->SecurityDescriptor, 0x800ui64, 0i64);
if( v10 >= 0 )
{
v52 = 0;
v30 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v30 + 242);
ExAcquirePushLockExclusiveEx(v29 + 408, 0i64);
*(_QWORD *)(v29 + 416) = KeGetCurrentThread();
EtwpUpdateEnableMask(v29, 0, 0, 1, &v52);
*(_QWORD *)(v29 + 416) = 0i64;
ExReleasePushLockEx(v29 + 408, 0i64);
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
v31 = v6 >> 31;
LODWORD(UserDataCount) = Flagsa;
LOBYTE(Level) = v54;
LODWORD(Objectb) = Flags_4;
v10 = EtwpWriteUserEvent(
(_ETW_GUID_ENTRY *)v29,
v52,
(unsigned __int16)v31,
0i64,
(UINT64)Objectb,
(_EVENT_HEADER *)Fields,
0i64,
Level,
v71,
UserDataCount,
v70,
0i64,
0i64,
0,
0i64,
0i64);
if( *(_QWORD *)(v29 + 400) )
{
v52 = 0;
v42 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v42 + 242);
ExAcquirePushLockExclusiveEx(v29 + 408, 0i64);
*(_QWORD *)(v29 + 416) = KeGetCurrentThread();
EtwpUpdateEnableMask(*(_QWORD *)(v29 + 400), 0, 1, 1, &v52);
*(_QWORD *)(v29 + 416) = 0i64;
ExReleasePushLockEx(v29 + 408, 0i64);
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
LODWORD(UserDataCounta) = Flagsa;
LOBYTE(Levela) = v54;
LODWORD(Objectc) = Flags_4;
v10 = EtwpWriteUserEvent(
*(_ETW_GUID_ENTRY **)(v29 + 400),
v52,
(unsigned __int16)v31,
0i64,
(UINT64)Objectc,
(_EVENT_HEADER *)Fields,
0i64,
Levela,
v71,
UserDataCounta,
v70,
0i64,
0i64,
0,
0i64,
0i64);
}
}
EtwpUnreferenceGuidEntry((PVOID)v29);
return v10;
}
EtwpUnreferenceGuidEntry(GuidEntryByGuid);
}
return -1073741054;
}Referenced by:
No references.