ObEnableEtwReferenceTrace
VOID __stdcall ObEnableEtwReferenceTrace(){
_ETHREAD *CurrentThread;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 243);
ExAcquirePushLockExclusiveEx((UINT64)&ObpStackTraceLock, 0i64);
ObpTraceFlags |= 4u;
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&ObpStackTraceLock, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)&ObpStackTraceLock);
KeAbPostRelease(&ObpStackTraceLock);
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
}Referenced by:
EtwpEnableKernelTrace