KiSystemCall64
VOID __fastcall KiSystemCall64(INT64 a1, UINT64 a2, INT64 P4Home, INT64 P5, CHAR a5){
unsigned __int64 v5;
unsigned __int64 v6;
__int64 v7;
unsigned __int64 v8;
unsigned __int64 v9;
unsigned __int64 v10;
__int64 v11;
_M128A v12;
_M128A v13;
_M128A v14;
_M128A v15;
_M128A v16;
_M128A v17;
_KTRAP_FRAME *__shifted(_KTRAP_FRAME,0x80) TrapFrame;
unsigned __int8 v19;
char v20;
_ETHREAD *CurrentThread;
bool v22;
char v23;
INT64 Rdx;
bool v25;
UINT64 v26;
ULONG64 v27;
__int64 v28;
unsigned __int64 Rax;
__int64 Rcx;
__int64 v31;
unsigned __int64 P1Home_low;
__int128 *v33;
__int128 *v34;
__int64 v35;
__int64 v36;
__int64(__fastcall *v37)(_QWORD, _QWORD, _QWORD, _QWORD);
INT64 v38;
INT64 v39;
__int64(__fastcall *v40)(_QWORD, _QWORD, _QWORD, _QWORD);
_ETHREAD *v42;
_ETHREAD *v43;
_KTHREAD *v44;
unsigned __int64 v45;
unsigned __int8 v46;
unsigned __int8 v47;
void *Rip;
_ETHREAD *v51;
_KTHREAD *v52;
unsigned __int8 v53;
__int64 v56;
ULONG v57;
ULONG_PTR v58;
ULONG_PTR CurrentIrql;
UINT64 v60;
__int64 v61;
INT64 v62;
INT64 v63;
INT64 v64;
__int64(__fastcall *v65)(_QWORD, _QWORD, _QWORD, _QWORD);
_BYTE v66[32];
char v67[48];
void *v68;
__int16 v69;
__int32 v70;
void *v71;
__int16 v72;
__int64 v73;
INT64 v74;
__int64 v75;
__int64 v76;
__int64 v77;
__int64 v78;
__swapgs();
__writegsqword(0x10u, (unsigned __int64)&v68);
v78 = 43i64;
v77 = *((_QWORD *)KeGetPcr() + 2);
v76 = v11;
v75 = 51i64;
v74 = a1;
v73 = v7;
TrapFrame = KeGetTrapFrame();
ADJ(TrapFrame)->Rbx = v6;
ADJ(TrapFrame)->Rdi = v8;
ADJ(TrapFrame)->Rsi = v9;
if( (_BYTE)KeSmapEnabled && (ADJ(TrapFrame)->SegCs & 1) != 0 )
__stac();
ADJ(TrapFrame)->Rax = v5;
ADJ(TrapFrame)->Rcx = v10;
ADJ(TrapFrame)->Rdx = a2;
__writegsqword(0x270u, *(_QWORD *)(*((_QWORD *)KeGetCurrentThread() + 68) + 2528i64));
__writegsbyte(0x851u, *((_BYTE *)KeGetPcr() + 2128));
__writegsbyte(0x852u, *((_BYTE *)KeGetPcr() + 632));
v19 = *((_BYTE *)KeGetPcr() + 635);
if( *((_BYTE *)KeGetPcr() + 634) != v19 )
{
__writegsbyte(0x27Au, v19);
__writemsr(0x48u, v19);
}
v20 = *((_BYTE *)KeGetPcr() + 632);
if( (v20 & 8) != 0 )
{
__writemsr(0x49u, 1ui64);
v20 = *((_BYTE *)KeGetPcr() + 632);
}
if( (v20 & 2) != 0 )
__flush_rsb();
_mm_lfence();
__writegsbyte(0x853u, 0);
ADJ(TrapFrame)->ExceptionActive = 2;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
_m_prefetchw((char *)CurrentThread + 144);
ADJ(TrapFrame)->MxCsr = _mm_getcsr();
_mm_setcsr(*((_DWORD *)KeGetPcr() + 96));
v22 = *((_BYTE *)CurrentThread + 3) == 0;
LOWORD(ADJ(TrapFrame)->Dr7) = 0;
if( v22 )
{
LABEL_27:
Rax = ADJ(TrapFrame)->Rax;
Rcx = ADJ(TrapFrame)->Rcx;
Rdx = ADJ(TrapFrame)->Rdx;
_enable();
*((_QWORD *)CurrentThread + 17) = Rcx;
*((_DWORD *)CurrentThread + 32) = Rax;
*((_QWORD *)CurrentThread + 18) = v66;
v31 = ((unsigned int)Rax >> 7) & 0x20;
P1Home_low = Rax & 0xFFF;
do
{
v33 = &KeServiceDescriptorTable;
v34 = &KeServiceDescriptorTableShadow;
if( (*((_DWORD *)CurrentThread + 30) & 0x80) != 0 )
{
if( (*((_DWORD *)CurrentThread + 30) & 0x200000) != 0 )
v34 = KeServiceDescriptorTableFilter;
v33 = v34;
}
if( (unsigned int)P1Home_low < *(_DWORD *)((char *)v33 + v31 + 16) )
{
v35 = *(_QWORD *)((char *)v33 + v31);
v36 = *(int *)(v35 + 4 * P1Home_low);
v37 = (__int64(__fastcall *)(_QWORD, _QWORD, _QWORD, _QWORD))((v36 >> 4) + v35);
if( (_DWORD)v31 == 32 && *(_DWORD *)(*((_QWORD *)CurrentThread + 30) + 5952i64) )
{
ADJ(TrapFrame)->Rax = v36;
ADJ(TrapFrame)->Rcx = Rcx;
ADJ(TrapFrame)->Rdx = Rdx;
v38 = P4Home;
v39 = P5;
v40 = v37;
PsInvokeWin32Callout(7i64, 0i64, 0i64, 0i64);
v36 = ADJ(TrapFrame)->Rax;
Rcx = ADJ(TrapFrame)->Rcx;
Rdx = ADJ(TrapFrame)->Rdx;
P4Home = v38;
P5 = v39;
v37 = v40;
}
if( v36 & 0xF )
__asm { jmp r11 }
if( (KiDynamicTraceMask & 1) != 0 )
{
v61 = Rcx;
v62 = Rdx;
v63 = P4Home;
v64 = P5;
v65 = v37;
ADJ(TrapFrame)->Rax = KiTrackSystemCallEntry(v37, (INT64)&v61, 4i64, (INT64)v67);
v60 = v65(v61, v62, v63, v64);
v26 = KiTrackSystemCallExit(ADJ(TrapFrame)->Rax, v60);
}
else
{
v26 = v37(Rcx, Rdx, P4Home, P5);
}
__incgsdword(0x2EB8u);
goto KiSystemServiceExit;
}
if( (_DWORD)v31 != 32 )
goto LABEL_95;
LODWORD(ADJ(TrapFrame)->P1Home) = P1Home_low;
ADJ(TrapFrame)->P2Home = Rcx;
ADJ(TrapFrame)->P3Home = Rdx;
ADJ(TrapFrame)->P4Home = P4Home;
ADJ(TrapFrame)->P5 = P5;
v22 = (unsigned int)KiConvertToGuiThread() == 0;
P1Home_low = LODWORD(ADJ(TrapFrame)->P1Home);
Rcx = ADJ(TrapFrame)->P2Home;
Rdx = ADJ(TrapFrame)->P3Home;
P4Home = ADJ(TrapFrame)->P4Home;
P5 = ADJ(TrapFrame)->P5;
*((_QWORD *)CurrentThread + 18) = v66;
}
while( v22 );
v56 = *((unsigned int *)&xmmword_140CFBA60 + 4);
if( (unsigned int)P1Home_low >= (unsigned int)v56
|| (v26 = (unsigned int)*(char *)(xmmword_140CFBA60 + 4 * v56 + P1Home_low), (int)v26 > 0) )
{
LABEL_95:
v26 = 3221225500i64;
goto KiSystemServiceExit;
}
goto KiSystemServiceExit;
}
v22 = (*((_BYTE *)CurrentThread + 3) & 3) == 0;
ADJ(TrapFrame)->R8 = P4Home;
ADJ(TrapFrame)->R9 = P5;
if( !v22 )
KiSaveDebugRegisterState();
if( (*((_BYTE *)CurrentThread + 3) & 0x24) == 0 )
goto LABEL_22;
ADJ(TrapFrame)->R11 = v10;
ADJ(TrapFrame)->R10 = v10;
ADJ(TrapFrame)->Xmm0 = v12;
ADJ(TrapFrame)->Xmm1 = v13;
ADJ(TrapFrame)->Xmm2 = v14;
ADJ(TrapFrame)->Xmm3 = v15;
ADJ(TrapFrame)->Xmm4 = v16;
ADJ(TrapFrame)->Xmm5 = v17;
_enable();
v23 = PsAltSystemCallDispatch();
v25 = v23 < 1;
if( v23 == 1 )
{
LABEL_22:
if( *((char *)CurrentThread + 3) >= 0 )
goto LABEL_24;
v27 = __readmsr(0xC0000102);
if( v27 >= MmUserProbeAddress )
v27 = MmUserProbeAddress;
if( *((_QWORD *)CurrentThread + 30) == v27 )
{
LABEL_24:
if( (*((_BYTE *)CurrentThread + 3) & 0x40) != 0 )
*((_DWORD *)CurrentThread + 29) |= 0x10000u;
}
else
{
v28 = *((_QWORD *)CurrentThread + 62);
*((_DWORD *)CurrentThread + 29) |= 0x100u;
--*((_WORD *)CurrentThread + 243);
*(_QWORD *)(v28 + 128) = v27;
_enable();
KiUmsCallEntry();
}
P4Home = ADJ(TrapFrame)->R8;
P5 = ADJ(TrapFrame)->R9;
goto LABEL_27;
}
v26 = ADJ(TrapFrame)->Rax;
if( !v25 )
{
KiExceptionDispatch(3221225500i64, 0i64, (VOID *)ADJ(TrapFrame)->Rip, P5, v67[0]);
__debugbreak();
}
if( (*((_BYTE *)CurrentThread + 3) & 4) != 0 )
{
v42 = (_ETHREAD *)KeGetCurrentThread();
if( !(*((_DWORD *)v42 + 121) | (unsigned __int8)(*((_BYTE *)v42 + 586) | KeGetCurrentIrql())) )
{
_disable();
ADJ(TrapFrame)->Rax = v26;
while( (*((_BYTE *)KeGetCurrentThread() + 194) & 3) != 0 )
{
__writecr8(1ui64);
_enable();
KiInitiateUserApc((_KTRAP_FRAME *)1);
__writecr8(0i64);
_disable();
}
if( (*((_BYTE *)KeGetPcr() + 638) & 2) != 0 )
KiUpdateStibpPairing(0i64);
v51 = (_ETHREAD *)KeGetCurrentThread();
if( (*(_DWORD *)v51 & 0x8000000) != 0 )
KiRestoreSetContextState((INT64)v51, Rdx, P4Home, P5, v67[0]);
v52 = (_ETHREAD *)KeGetCurrentThread();
if( (*((_BYTE *)v52 + 2) & 1) != 0 )
KiCopyCounters((_KTHREAD *)v52);
if( LOWORD(ADJ(TrapFrame)->Dr7) )
KiRestoreDebugRegisterState();
__writegsbyte(0x853u, 0);
v53 = *((_BYTE *)KeGetPcr() + 637);
if( *((_BYTE *)KeGetPcr() + 634) != v53 )
{
__writegsbyte(0x27Au, v53);
__writemsr(0x48u, v53);
}
v47 = _bittestandreset16(MK_FP(__GS__, 632i64), 2u);
if( v47 )
__writemsr(0x49u, 1ui64);
v47 = _bittestandreset16(MK_FP(__GS__, 632i64), 5u);
if( v47 )
__flush_rsb();
_mm_setcsr(ADJ(TrapFrame)->MxCsr);
if( (KiKvaShadow & 1) == 0 )
{
__swapgs();
__iretq(v68, v69, v70, v71, v72);
}
KiKernelExit(ADJ(TrapFrame)->Rcx, ADJ(TrapFrame)->Rdx, ADJ(TrapFrame)->R8, ADJ(TrapFrame)->R9, a5);
return;
}
LABEL_96:
v57 = 74;
v58 = 0i64;
CurrentIrql = KeGetCurrentIrql();
if( !(_DWORD)CurrentIrql )
{
v57 = 1;
CurrentIrql = *((unsigned __int8 *)v42 + 586);
v58 = *((unsigned int *)v42 + 121);
}
KiBugCheckDispatch(v57, ADJ(TrapFrame)->Rip, CurrentIrql, v58);
}
KiSystemServiceExit:
v42 = (_ETHREAD *)KeGetCurrentThread();
if( (ADJ(TrapFrame)->SegCs & 1) == 0 )
{
*((_QWORD *)v42 + 18) = ADJ(TrapFrame)->TrapFrame;
*((_BYTE *)v42 + 562) = ADJ(TrapFrame)->PreviousMode;
_disable();
_enable();
return;
}
if( *((_DWORD *)v42 + 121) | (unsigned __int8)(*((_BYTE *)v42 + 586) | KeGetCurrentIrql()) )
goto LABEL_96;
_disable();
while( (*((_BYTE *)KeGetCurrentThread() + 194) & 3) != 0 )
{
ADJ(TrapFrame)->Rax = v26;
ADJ(TrapFrame)->Rcx = 0i64;
ADJ(TrapFrame)->Rdx = 0i64;
ADJ(TrapFrame)->R8 = 0i64;
ADJ(TrapFrame)->R9 = 0i64;
ADJ(TrapFrame)->R10 = 0i64;
ADJ(TrapFrame)->R11 = 0i64;
ADJ(TrapFrame)->Xmm0 = 0i64;
ADJ(TrapFrame)->Xmm1 = 0i64;
ADJ(TrapFrame)->Xmm2 = 0i64;
ADJ(TrapFrame)->Xmm3 = 0i64;
ADJ(TrapFrame)->Xmm4 = 0i64;
ADJ(TrapFrame)->Xmm5 = 0i64;
__writecr8(1ui64);
_enable();
KiInitiateUserApc((_KTRAP_FRAME *)1);
_disable();
__writecr8(0i64);
v26 = ADJ(TrapFrame)->Rax;
}
if( (*((_BYTE *)KeGetPcr() + 638) & 2) != 0 )
{
ADJ(TrapFrame)->Rax = v26;
KiUpdateStibpPairing(0i64);
v26 = ADJ(TrapFrame)->Rax;
}
v43 = (_ETHREAD *)KeGetCurrentThread();
if( (*(_DWORD *)v43 & 0x8000000) != 0 )
{
ADJ(TrapFrame)->Rax = v26;
ADJ(TrapFrame)->Rcx = 0i64;
ADJ(TrapFrame)->Rdx = 0i64;
ADJ(TrapFrame)->R8 = 0i64;
ADJ(TrapFrame)->R9 = 0i64;
ADJ(TrapFrame)->R10 = 0i64;
ADJ(TrapFrame)->R11 = 0i64;
ADJ(TrapFrame)->Xmm0 = 0i64;
ADJ(TrapFrame)->Xmm1 = 0i64;
ADJ(TrapFrame)->Xmm2 = 0i64;
ADJ(TrapFrame)->Xmm3 = 0i64;
ADJ(TrapFrame)->Xmm4 = 0i64;
ADJ(TrapFrame)->Xmm5 = 0i64;
KiRestoreSetContextState((INT64)v43, Rdx, P4Home, P5, v67[0]);
}
v44 = (_ETHREAD *)KeGetCurrentThread();
if( (*(_DWORD *)v44 & 0x40010000) != 0 )
{
ADJ(TrapFrame)->Rax = v26;
if( (*((_BYTE *)v44 + 2) & 1) != 0 )
{
KiCopyCounters((_KTHREAD *)v44);
v44 = (_ETHREAD *)KeGetCurrentThread();
}
if( (*((_BYTE *)v44 + 3) & 0x40) != 0 )
KiUmsExit(0);
v26 = ADJ(TrapFrame)->Rax;
}
_mm_setcsr(ADJ(TrapFrame)->MxCsr);
if( LOWORD(ADJ(TrapFrame)->Dr7) )
{
ADJ(TrapFrame)->Rax = v26;
KiRestoreDebugRegisterState();
v45 = *(_QWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 984i64);
if( v45 && ADJ(TrapFrame)->SegCs == 51 )
ADJ(TrapFrame)->Rip = v45;
v26 = ADJ(TrapFrame)->Rax;
}
ADJ(TrapFrame)->Rax = v26;
__writegsbyte(0x853u, 0);
v46 = *((_BYTE *)KeGetPcr() + 637);
if( *((_BYTE *)KeGetPcr() + 634) != v46 )
{
__writegsbyte(0x27Au, v46);
__writemsr(0x48u, v46);
}
v47 = _bittestandreset16(MK_FP(__GS__, 632i64), 2u);
if( v47 )
__writemsr(0x49u, 1ui64);
v47 = _bittestandreset16(MK_FP(__GS__, 632i64), 5u);
if( v47 )
__flush_rsb();
Rip = (void *)ADJ(TrapFrame)->Rip;
if( (KiKvaShadow & 1) == 0 )
{
__swapgs();
__sysretq(Rip, *(_QWORD *)&ADJ(TrapFrame)->EFlags);
}
KiKernelSysretExit(Rip);
}Referenced by:
No references.