KeSetTracepoint
__int64 __fastcall KeSetTracepoint(
ULONG_PTR a1,
char a2,
ULONGLONG a3,
int a4,
__int64 a5,
__int64 a6,
__int64 a7,
__int64 a8,
_BYTE *a9){
INT64 v9;
ULONG_PTR v10;
__int64 v12;
__int64 v14;
int v16;
__int64 v17;
_BOOL8 v18;
__int64 v19;
__int64 v21;
__int64 *v22;
__int64 v23;
__int64 *v24;
VOID *PoolWithTag;
_ETHREAD *CurrentThread;
__int64 v27;
VOID *v28;
INT64 v29;
ULONGLONG v30;
INT64 *v31;
INT64 v32;
int v33;
BOOL v34;
BOOL v35;
int v36;
signed __int32 v37[8];
BOOL v38;
BOOL v39;
BOOL v40;
ULONG_PTR v41;
int v42;
BOOL v43;
PVOID BaseOfImage;
_BYTE *v45;
char v46[48];
BaseOfImage = 0i64;
v9 = 0i64;
v10 = a1;
v41 = a1;
v12 = (unsigned int)KiDynamicTraceEnabled;
v42 = a4;
v45 = a9;
v14 = 1i64;
if( (KiDynamicTraceEnabled & 2) == 0 && (!a2 || (KiDynamicTraceEnabled & 1) == 0) )
return(unsigned int)-1073741790;
if( !a1 && a2 || a3 > 0x7FFFFFFEFFFFi64 && a2 == 1 || a3 < 0xFFFF800000000000ui64 && !a2 )
return(unsigned int)-1073741811;
if( a1 )
{
v17 = *(_QWORD *)(a1 + 992);
if( ((v17 & 1) != 0 || v17) && (a2 || (KiDynamicTraceEnabled & 2) == 0) )
return(unsigned int)-1073741790;
}
v43 = (unsigned int)(a4 - 1) <= 1;
v18 = (unsigned int)(a4 - 2) <= 1;
v38 = (unsigned int)(a4 - 2) <= 1;
v39 = (unsigned int)(a4 - 4) <= 1;
v40 = (unsigned int)(a4 - 5) <= 1;
if( (unsigned int)(a4 - 2) <= 1 )
{
if( !a5 )
{
v19 = a7;
if( !a7 )
return(unsigned int)-1073741811;
LABEL_28:
if( v19 )
{
v23 = 5i64;
if( a2 )
v23 = 7i64;
v24 = &KiDynamicTraceCallouts[v23];
if( (KiDynamicTraceEnabled & 4) == 0 )
{
LABEL_34:
if( v19 == *v24 )
goto LABEL_35;
return(unsigned int)-1073741790;
}
if( v19 != *v24 )
{
DbgPrint("DTrace/NT: Overriding post-callback in DTrace test mode.\n", v12, v18, v14);
*v24 = a5;
goto LABEL_34;
}
}
LABEL_35:
v10 = v41;
goto LABEL_36;
}
v21 = 4i64;
if( a2 )
v21 = 6i64;
v12 = KiDynamicTraceEnabled & 4;
v22 = &KiDynamicTraceCallouts[v21];
if( (KiDynamicTraceEnabled & 4) != 0 )
{
if( a5 == *v22 )
{
LABEL_27:
v19 = a7;
goto LABEL_28;
}
DbgPrint((PCSTR)&stru_1407D2340.R15, v12, v18, 1i64);
*v22 = a5;
}
if( a5 != *v22 )
return(unsigned int)-1073741790;
goto LABEL_27;
}
if( a5 || a7 )
return(unsigned int)-1073741811;
LABEL_36:
if( (unsigned int)(a4 - 1) <= 1 || !a4 )
{
if( a3 >= 0xFFFF800000000000ui64 )
{
if( !RtlPcToFileHeader((void *)a3, &BaseOfImage) )
return(unsigned int)-1073741811;
if( !KiTpIsSupportedKernelTracepointLocation((UINT64)BaseOfImage, a3) )
return(unsigned int)-1073741637;
}
if( (unsigned int)(a4 - 1) <= 1 )
{
PoolWithTag = ExAllocatePoolWithTag(NonPagedPoolNx, 0x5Cui64, 0x70727446ui64);
v9 = (INT64)PoolWithTag;
if( !PoolWithTag )
return(unsigned int)-1073741670;
memset((INT64)PoolWithTag, 0i64);
*(_QWORD *)(v9 + 16) = v10;
*(_BYTE *)(v9 + 50) = a2;
*(_QWORD *)(v9 + 8) = a3;
}
}
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
ExAcquirePushLockExclusiveEx((UINT64)&KiTpStateLock, 0i64);
v27 = KiTpHashTable;
if( KiTpHashTable )
{
LABEL_53:
v29 = 0i64;
v30 = (a3 >> 4) & 0x3FFF;
v31 = (INT64 *)(v27 + 8 * v30);
v32 = *v31;
if( *v31 )
{
while( *(_QWORD *)(v32 + 8) != a3 || *(_QWORD *)(v32 + 16) != v41 )
{
v31 = (INT64 *)v32;
v32 = *(_QWORD *)v32;
if( !v32 )
goto LABEL_57;
}
v29 = v32;
if( *(_BYTE *)(v32 + 50) != a2 )
{
v16 = -1073741811;
goto LABEL_104;
}
}
LABEL_57:
if( v42 )
{
v33 = v43;
if( !v43 )
goto LABEL_71;
if( v29 && !*(_BYTE *)(v29 + 24) )
v33 = *(_BYTE *)(v29 + 25) != 0 && v43;
if( v33 )
{
if( v29 )
{
v16 = -1073740008;
goto LABEL_104;
}
v16 = KiTpSetupCompletion(v41, a2, *(const void **)(v9 + 8), (void *)(v9 + 51), 1u, v9 + 52);
if( v16 < 0 )
goto LABEL_104;
++KiTpRegisteredCount;
v31 = (INT64 *)(KiTpHashTable + 8 * v30);
*(_QWORD *)v9 = *v31;
*v31 = v9;
_InterlockedOr(v37, 0);
v34 = v38;
v29 = v9;
v9 &= -(__int64)v38;
}
else
{
LABEL_71:
if( !v29 )
{
v16 = -1073741275;
goto LABEL_104;
}
v34 = v38;
}
if( v34 )
{
if( !*(_BYTE *)(v29 + 48) )
{
if( ++KiTpEnabledCount == 1 )
_InterlockedOr(&KiDynamicTraceMask, 2u);
v16 = KiTpWriteBreakpoint(v29, 1);
if( v16 < 0 )
{
if( v29 == v9 )
{
*v31 = *(_QWORD *)v29;
_InterlockedOr(v37, 0);
--KiTpRegisteredCount;
}
if( !--KiTpEnabledCount )
_InterlockedAnd(&KiDynamicTraceMask, 0xFFFFFFFD);
goto LABEL_104;
}
*(_BYTE *)(v29 + 48) = 1;
}
*(_QWORD *)(v29 + 32) = a6;
*(_QWORD *)(v29 + 40) = a8;
_InterlockedOr(v37, 0);
v9 = 0i64;
*(_BYTE *)(v29 + 24) = a5 != 0;
*(_BYTE *)(v29 + 25) = a7 != 0;
}
v35 = v40;
v36 = v39;
if( v40 && *(_BYTE *)(v29 + 48) )
v36 = 1;
if( v36 )
{
if( *(_BYTE *)(v29 + 48) )
{
if( (int)KiTpWriteBreakpoint(v29, 0) >= 0 )
{
if( !--KiTpEnabledCount )
_InterlockedAnd(&KiDynamicTraceMask, 0xFFFFFFFD);
v35 = v40;
*(_BYTE *)(v29 + 48) = 0;
}
else
{
v35 = 0;
}
}
*(_WORD *)(v29 + 24) = 0;
_InterlockedOr(v37, 0);
while( KiTpActiveTrapsCount )
_mm_pause();
*(_QWORD *)(v29 + 32) = 0i64;
*(_QWORD *)(v29 + 40) = 0i64;
}
if( v35 )
{
*v31 = *(_QWORD *)v29;
_InterlockedOr(v37, 0);
--KiTpRegisteredCount;
v9 = v29;
}
}
else if( !v29 )
{
v16 = KiTpSetupCompletion(v41, a2, (const void *)a3, 0i64, 0, (__int64)v46);
goto LABEL_104;
}
if( v45 )
*v45 = *(_BYTE *)(v29 + 51);
v16 = 0;
goto LABEL_104;
}
v28 = ExAllocatePoolWithTag(NonPagedPoolNx, 0x20000ui64, 0x70727446ui64);
v27 = (__int64)v28;
if( v28 )
{
memset((INT64)v28, 0i64);
KiTpHashTable = v27;
goto LABEL_53;
}
v16 = -1073741670;
LABEL_104:
if( v9 )
{
while( KiTpActiveTrapsCount )
_mm_pause();
ExFreePoolWithTag((PVOID)v9, 0x70727446u);
}
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&KiTpStateLock, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)&KiTpStateLock);
KeAbPostRelease(&KiTpStateLock);
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
return(unsigned int)v16;
}Referenced by:
No references.