IoWriteCrashDump
BOOL __stdcall IoWriteCrashDump(
UINT32 BugCheckCode,
PVOID BugCheckParameter1,
PVOID BugCheckParameter2,
PVOID BugCheckParameter3,
PVOID BugCheckParameter4,
PVOID ContextSave,
_ETHREAD *Thread,
PBOOLEAN Reboot){
_KTHREAD *v8;
bool v9;
int v10;
PVOID v11;
BOOL result;
unsigned int v14;
_DWORD *v15;
__int64 v16;
__int64 v17;
_QWORD *v18;
_OWORD *v19;
PVOID v20;
PVOID a5;
_OWORD *v22;
__int128 v23;
unsigned __int64 v24;
__int64 v25;
int v26;
_QWORD *v27;
unsigned int v28;
int v29;
UINT64 v30;
int v31;
UINT64 v32;
_KTRAP_FRAME *TrapFrame;
UINT64 v34;
char v35;
CHAR v36;
_RTL_BITMAP_EX BitMapHeader;
unsigned int v40;
int v41;
int v42;
_ETHREAD *v43;
PVOID v44;
UINT64 v45[6];
UINT64 BugCheckParameters[4];
char v47;
v8 = Thread;
v9 = 0;
v10 = 0;
v11 = BugCheckParameter1;
v43 = Thread;
v40 = 0;
v42 = 0;
v36 = 0;
v44 = BugCheckParameter1;
v41 = 3583;
KdCheckForDebugBreak();
if( CapsuleTriageDumpBlockInitialized == 1 )
{
LOBYTE(result) = IopWriteCapsuleTriageDumpToFirmware(
BugCheckCode,
(UINT64)v11,
(UINT64)BugCheckParameter2,
(UINT64)BugCheckParameter3,
(UINT64)BugCheckParameter4,
(_CONTEXT *)ContextSave,
(_KTHREAD *)Thread,
TrapFrame);
return result;
}
BugCheckParameters[0] = (UINT64)v11;
BugCheckParameters[1] = (UINT64)BugCheckParameter2;
BugCheckParameters[2] = (UINT64)BugCheckParameter3;
BugCheckParameters[3] = (UINT64)BugCheckParameter4;
MmSnapTriageDumpInformation((CONTEXT *)ContextSave, BugCheckParameters);
if( CrashdmpDumpBlock )
{
if( (*(_DWORD *)(CrashdmpDumpBlock + 1368) & 1) != 0 && *(_DWORD *)(CrashdmpDumpBlock + 1336) == 6 )
{
v14 = 0;
v15 = (_DWORD *)(CrashdmpDumpBlock + 1372);
while( *v15 != BugCheckCode )
{
++v14;
++v15;
if( v14 >= 8 )
goto LABEL_11;
}
*(_DWORD *)(CrashdmpDumpBlock + 1336) = 5;
}
LABEL_11:
if( !Reboot )
{
v40 = 1;
v41 = 3319;
*(_QWORD *)(CrashdmpDumpBlock + 8) = 0i64;
}
((void(__fastcall *)(__int64, _QWORD, _QWORD))qword_140C509D0)(1i64, 0i64, v40);
VfDisableHalVerifier();
LOBYTE(v16) = 1;
v35 = ((__int64(__fastcall *)(__int64))qword_140C50A00)(v16);
IoSaveBugCheckProgress(0x20ui64);
v17 = 9i64;
v18 = BugCheckParameter2;
v19 = ContextSave;
v20 = BugCheckParameter3;
a5 = BugCheckParameter4;
*(_DWORD *)(CrashdmpDumpBlock + 24) = BugCheckCode;
*(_QWORD *)(CrashdmpDumpBlock + 32) = v11;
*(_QWORD *)(CrashdmpDumpBlock + 40) = BugCheckParameter2;
*(_QWORD *)(CrashdmpDumpBlock + 48) = BugCheckParameter3;
*(_QWORD *)(CrashdmpDumpBlock + 56) = BugCheckParameter4;
v22 = (_OWORD *)(CrashdmpDumpBlock + 64);
do
{
*v22 = *v19;
v22[1] = v19[1];
v22[2] = v19[2];
v22[3] = v19[3];
v22[4] = v19[4];
v22[5] = v19[5];
v22[6] = v19[6];
v22 += 8;
v23 = v19[7];
v19 += 8;
*(v22 - 1) = v23;
--v17;
}
while( v17 );
*v22 = *v19;
v22[1] = v19[1];
v22[2] = v19[2];
v22[3] = v19[3];
v22[4] = v19[4];
*(_QWORD *)(CrashdmpDumpBlock + 1296) = &KdDebuggerDataBlock;
*(_QWORD *)(CrashdmpDumpBlock + 1304) = &PsActiveProcessHead;
*(_QWORD *)(CrashdmpDumpBlock + 1312) = &PsLoadedModuleList;
*(_QWORD *)(CrashdmpDumpBlock + 1320) = MmPfnDatabase;
*(_QWORD *)(CrashdmpDumpBlock + 16) = &KeBugCheckReasonCallbackListHead;
*(_QWORD *)(CrashdmpDumpBlock + 1416) = &KeBugCheckTriageDumpDataArrayListHead;
if( Reboot )
v24 = *(_QWORD *)(*((_QWORD *)Thread + 23) + 40i64);
else
v24 = __readcr3();
*(_QWORD *)(CrashdmpDumpBlock + 1344) = v24 & 0xFFFFFFFFFFFFF000ui64;
if( *(_QWORD *)(CrashdmpDumpBlock + 1328) || v35 != 1 || !Reboot )
{
IopUpdateMinidumpContext(
BugCheckCode,
(UINT64)v11,
(UINT64)BugCheckParameter2,
(UINT64)BugCheckParameter3,
(UINT64)BugCheckParameter4,
(_CONTEXT *)ContextSave,
(_KTHREAD *)Thread,
TrapFrame);
MmSnapTriageDumpInformation((CONTEXT *)ContextSave, BugCheckParameters);
BitMapHeader.SizeOfBitMap = (unsigned int)IopNumTriageDumpDataBlocks | 0x10000000000i64;
BitMapHeader.Buffer = (unsigned __int64 *)IopTriageDumpDataBlocks;
if( v35 == 1 || (v25 = *(_QWORD *)(CrashdmpDumpBlock + 1360)) == 0 )
{
if( !*(_QWORD *)(CrashdmpDumpBlock + 1328) && !Reboot )
*(_QWORD *)(CrashdmpDumpBlock + 1328) = *(_QWORD *)(CrashdmpDumpBlock + 1360) + 0x2000i64;
}
else
{
*(_QWORD *)(CrashdmpDumpBlock + 1328) = v25 + 12316;
*(_QWORD *)(CrashdmpDumpBlock + 8) = 0i64;
}
LODWORD(v34) = 1;
result = IoFillTriageDumpBuffer(
0x3E000u,
*(unsigned __int64 **)(CrashdmpDumpBlock + 1328),
1,
v41,
0i64,
(__int64)ContextSave,
Thread,
(int)CmNtCSDVersion,
65,
v34,
(__int64)&BitMapHeader,
(unsigned int *)&BitMapHeader,
&v42);
v10 = result;
if( result < 0 )
goto LABEL_66;
v18 = BugCheckParameter2;
v20 = BugCheckParameter3;
a5 = BugCheckParameter4;
}
v26 = *(_DWORD *)(CrashdmpDumpBlock + 1368) & 2;
if( v26 && *(_DWORD *)(CrashdmpDumpBlock + 1336) == 6 && *(_QWORD *)(CrashdmpDumpBlock + 8) )
{
*(_DWORD *)(CrashdmpDumpBlock + 1368) |= 4u;
v10 = IoAddPagesForPartialKernelDump(
BugCheckCode,
(UINT64)v11,
v18,
(INT64)v20,
(UINT64)a5,
(__int64)ContextSave,
(__int64)Thread);
goto LABEL_42;
}
v27 = *(_QWORD **)(CrashdmpDumpBlock + 8);
if( !v27 )
{
LABEL_41:
v8 = v43;
LABEL_42:
if( v10 >= 0 )
v10 = ((__int64(__fastcall *)(__int64, PBOOLEAN))qword_140C509D8)(CrashdmpDumpBlock, Reboot);
if( v10 != -1073741267 )
goto LABEL_52;
if( (*(_DWORD *)(CrashdmpDumpBlock + 1368) & 4) != 0 )
{
IoSaveBugCheckProgress(0x27ui64);
*(_DWORD *)(CrashdmpDumpBlock + 1368) |= 8u;
v10 = IoAddPagesForPartialKernelDump(
BugCheckCode,
(UINT64)v11,
BugCheckParameter2,
(INT64)BugCheckParameter3,
(UINT64)BugCheckParameter4,
(__int64)ContextSave,
(__int64)v8);
if( v10 < 0 )
goto LABEL_52;
v31 = ((__int64(__fastcall *)(__int64, PBOOLEAN))qword_140C509D8)(CrashdmpDumpBlock, Reboot);
v32 = 38i64;
}
else
{
if( !*(_QWORD *)(CrashdmpDumpBlock + 1328) )
goto LABEL_52;
*(_DWORD *)(CrashdmpDumpBlock + 1404) |= 0x400u;
IoUpdateBugCheckProgressEnvVariable();
IopUpdateMinidumpContext(
BugCheckCode,
(UINT64)v11,
(UINT64)BugCheckParameter2,
(UINT64)BugCheckParameter3,
(UINT64)BugCheckParameter4,
(_CONTEXT *)ContextSave,
(_KTHREAD *)v8,
TrapFrame);
MmSnapTriageDumpInformation((CONTEXT *)ContextSave, BugCheckParameters);
BitMapHeader.SizeOfBitMap = (unsigned int)IopNumTriageDumpDataBlocks | 0x10000000000i64;
BitMapHeader.Buffer = (unsigned __int64 *)IopTriageDumpDataBlocks;
LODWORD(v34) = 1;
v10 = IoFillTriageDumpBuffer(
0x3E000u,
*(unsigned __int64 **)(CrashdmpDumpBlock + 1328),
1,
3583,
0i64,
(__int64)ContextSave,
v8,
(int)CmNtCSDVersion,
65,
v34,
(__int64)&BitMapHeader,
(unsigned int *)&BitMapHeader,
&v42);
if( v10 < 0 )
goto LABEL_52;
v31 = ((__int64(__fastcall *)(__int64, PBOOLEAN))qword_140C509D8)(CrashdmpDumpBlock, Reboot);
v32 = 35i64;
}
v10 = v31;
IoSaveBugCheckProgress(v32);
LABEL_52:
result = DumpPolicyAttemptOffline;
if( (DumpPolicyAttemptOffline & 1) != 0 && v10 < 0 || (DumpPolicyAttemptOffline & 2) != 0 && !v35 )
{
IoSaveBugCheckProgress(0x24ui64);
result = ((__int64(__fastcall *)(_QWORD))off_140C008D8[0])(0i64);
if( result >= 0 )
{
if( CrashdmpDumpBlock )
{
*(_DWORD *)(CrashdmpDumpBlock + 1404) |= 0x1000u;
IoUpdateBugCheckProgressEnvVariable();
}
while( 1 )
{
KeStallExecutionProcessor(0xF4240u);
++AttemptOfflineStallCount;
}
}
}
else if( v10 >= 0 )
{
if( v35 != 1 )
{
result = CrashdmpDumpBlock;
if( *(_QWORD *)(CrashdmpDumpBlock + 1360) )
{
IoSetBugCheckProgressAndFlag();
v10 = IopWriteTriageDumpToFirmware(*(_NT_PRODUCT_TYPE **)(CrashdmpDumpBlock + 1360));
result = CrashdmpDumpBlock;
if( CrashdmpDumpBlock )
{
*(_DWORD *)(CrashdmpDumpBlock + 1404) |= 0x10000000u;
result = IoUpdateBugCheckProgressEnvVariable();
}
}
}
v9 = v10 >= 0;
}
goto LABEL_66;
}
v45[5] = 0i64;
v28 = 1;
BitMapHeader.SizeOfBitMap = v27[6];
BitMapHeader.Buffer = v27 + 7;
v45[2] = (UINT64)&BitMapHeader;
v45[0] = (UINT64)IoSetDumpRange;
v45[1] = (UINT64)IoFreeDumpRange;
v45[3] = (UINT64)v27;
v45[4] = 0i64;
v29 = *(_DWORD *)(CrashdmpDumpBlock + 1336);
if( v29 == 6 )
{
v36 = v47 != 0;
}
else
{
if( v29 != 5 || !v26 )
goto LABEL_40;
v36 = 2;
}
v28 = 0;
LABEL_40:
IopDumpCallAddPagesCallbacks(BugCheckCode);
IoSaveBugCheckProgress(0x21ui64);
MmGetDumpRange((UINT64)v45, v28, v36);
IopDumpCallRemovePagesCallbacks(BugCheckCode);
IoSaveBugCheckProgress(0x22ui64);
v30 = RtlNumberOfSetBitsEx(&BitMapHeader);
v11 = v44;
v27[5] = v30;
goto LABEL_41;
}
LABEL_66:
LOBYTE(result) = v9;
return result;
}Referenced by:
KeBugCheck2