EtwpAddRegEntryToGroup
NTSTATUS __stdcall EtwpAddRegEntryToGroup(
_ETW_REG_ENTRY *RegEntry,
_GUID *GroupGuid,
_ETW_ENABLE_NOTIFICATION_PACKET *EnablePacket,
UINT64 OutBufferSize,
UINT64 *ReturnSize){
unsigned int v6;
unsigned __int8 v8;
_ETW_SILODRIVERSTATE *SiloState;
_ETW_GUID_ENTRY *v10;
_ETHREAD *CurrentThread;
_ETHREAD *v12;
int v13;
unsigned int SchematizedFilterSize;
_LIST_ENTRY *p_RegListHead;
_LIST_ENTRY *Flink;
_LIST_ENTRY *p_GroupRegList;
unsigned __int8 v18;
unsigned __int16 *p_LoggerId;
UINT8 *v20;
unsigned __int8 GroupEnableMask;
_ETW_GUID_ENTRY *v22;
unsigned __int8 v23;
__int64 v24;
int v25;
REGHANDLE v26;
_WMI_LOGGER_CONTEXT *v28;
_GUID *v29;
_TOKEN_ACCESS_INFORMATION *v30;
NTSTATUS v31;
_WMI_LOGGER_CONTEXT *v32;
unsigned __int16 Flags;
_ETW_GUID_ENTRY *HostEntry;
void(__fastcall *Callback)(GUID *, __int64, _QWORD, unsigned __int64, unsigned __int64, __int128 *, _EPROCESS *);
VOID **v36;
__int128 *v37;
unsigned __int8 v38;
unsigned __int16 *v39;
unsigned __int8 i;
_WMI_LOGGER_CONTEXT *v41;
_GUID *v42;
_TOKEN_ACCESS_INFORMATION *v43;
NTSTATUS v44;
_EPROCESS *Process;
unsigned __int8 v46;
__int64 v47;
_WMI_LOGGER_CONTEXT *v48;
unsigned __int16 v49;
_EPROCESS *v50;
VOID **PoolWithTag;
unsigned __int8 EnableMask;
_ETW_GUID_ENTRY *GuidEntry;
_GUID *p_Guid;
_ETW_GUID_ENTRY *GroupEntry;
_ETW_GUID_ENTRY *GuidEntryByGuid;
unsigned int NumberOfBytes;
_ETW_SILODRIVERSTATE *v58;
_TRACE_ENABLE_INFO EnableInfo;
__int128 v61;
_KAPC_STATE ApcState;
_KAPC_STATE v63;
_EVENT_DATA_DESCRIPTOR UserData;
_GUID *v65;
__int64 v66;
v6 = OutBufferSize;
v8 = 0;
SiloState = RegEntry->GuidEntry->SiloState;
v58 = SiloState;
GuidEntryByGuid = EtwpFindGuidEntryByGuid(SiloState, GroupGuid, EtwGroupGuidType);
v10 = GuidEntryByGuid;
if( !GuidEntryByGuid )
{
GuidEntryByGuid = EtwpAddGuidEntry(SiloState, GroupGuid, EtwGroupGuidType);
v10 = GuidEntryByGuid;
if( !GuidEntryByGuid )
return -1073741801;
}
*(_DWORD *)ReturnSize = 120;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
ExAcquirePushLockExclusiveEx(&v10->Lock, 0i64);
v10->LockOwner = (_ETHREAD *)KeGetCurrentThread();
v12 = (_ETHREAD *)KeGetCurrentThread();
--v12->Tcb.KernelApcDisable;
ExAcquirePushLockExclusiveEx(&RegEntry->GuidEntry->Lock, 0i64);
RegEntry->GuidEntry->LockOwner = (_ETHREAD *)KeGetCurrentThread();
if( RegEntry->GroupEntry )
goto LABEL_22;
v13 = EtwpAccessCheck(v10->SecurityDescriptor, 0x1000ui64, 0i64);
if( v13 >= 0 )
{
SchematizedFilterSize = EtwpGetSchematizedFilterSize(RegEntry->GuidEntry, RegEntry->EnableMask);
NumberOfBytes = SchematizedFilterSize;
if( SchematizedFilterSize )
*(_DWORD *)ReturnSize += SchematizedFilterSize + 16;
if( (RegEntry->Flags & 2) != 0 && *(_DWORD *)ReturnSize > v6 )
{
v13 = -1073741789;
goto LABEL_23;
}
EtwpReferenceGuidEntry(v10);
p_RegListHead = &v10->RegListHead;
RegEntry->GroupEntry = v10;
Flink = v10->RegListHead.Flink;
p_GroupRegList = &RegEntry->GroupRegList;
if( Flink->Blink != &v10->RegListHead )
__fastfail(3u);
p_GroupRegList->Flink = Flink;
RegEntry->GroupRegList.Blink = p_RegListHead;
Flink->Blink = p_GroupRegList;
p_RegListHead->Flink = p_GroupRegList;
if( !v10->ProviderEnableInfo.IsEnabled )
{
HostEntry = v10->HostEntry;
if( !HostEntry || !HostEntry->ProviderEnableInfo.IsEnabled )
{
*(_DWORD *)ReturnSize = 0;
LABEL_22:
v13 = 0;
goto LABEL_23;
}
}
v18 = 0;
p_LoggerId = &v10->EnableInfo[0].LoggerId;
do
{
if( *(_DWORD *)(p_LoggerId - 3) )
{
v28 = EtwpAcquireLoggerContextByLoggerId(SiloState, *p_LoggerId, 0);
if( EtwpIsGuidAllowed(v28, &RegEntry->GuidEntry->Guid, v29) )
{
ExAcquirePushLockSharedEx(&v28->LoggerLock, 0i64);
if( v28->TokenAccessInformation )
v31 = EtwpAccessCheckFromState(&RegEntry->GuidEntry->Guid, v30);
else
v31 = -1073741790;
if( _InterlockedCompareExchange64(&v28->LoggerLock._bf_0, 0i64, 17i64) != 17 )
ExfReleasePushLockShared(&v28->LoggerLock);
KeAbPostRelease(&v28->LoggerLock);
if( v31 >= 0 )
v8 += 1 << v18;
EtwpReleaseLoggerContext(v28, 0);
SiloState = v58;
}
else
{
EtwpReleaseLoggerContext(v28, 0);
}
}
++v18;
p_LoggerId += 16;
}
while( v18 < 8u );
EtwpApplyScopeFilters(RegEntry, 0, 2u, 0i64);
v10 = GuidEntryByGuid;
GroupEnableMask = v8;
RegEntry->GroupEnableMask = v8;
v22 = GuidEntryByGuid->HostEntry;
if( v22 )
{
v38 = 0;
v39 = &v22->EnableInfo[0].LoggerId;
for( i = 0; i < 8u; ++i )
{
if( *(_DWORD *)(v39 - 3) )
{
v41 = EtwpAcquireLoggerContextByLoggerId((_ETW_SILODRIVERSTATE *)EtwpHostSiloState, *v39, 0);
if( EtwpIsGuidAllowed(v41, &RegEntry->GuidEntry->Guid, v42) )
{
ExAcquirePushLockSharedEx(&v41->LoggerLock, 0i64);
if( v41->TokenAccessInformation )
v44 = EtwpAccessCheckFromState(&RegEntry->GuidEntry->Guid, v43);
else
v44 = -1073741790;
if( _InterlockedCompareExchange64(&v41->LoggerLock._bf_0, 0i64, 17i64) != 17 )
ExfReleasePushLockShared(&v41->LoggerLock);
KeAbPostRelease(&v41->LoggerLock);
if( v44 >= 0 )
v38 += 1 << i;
}
EtwpReleaseLoggerContext(v41, 0);
}
v39 += 16;
}
LOBYTE(v20) = 1;
EtwpApplyScopeFilters(RegEntry, 0, 2u, v20);
v10 = GuidEntryByGuid;
SiloState = v58;
RegEntry->HostGroupEnableMask = v38;
GroupEnableMask = RegEntry->GroupEnableMask;
}
if( GroupEnableMask )
{
v23 = 0;
v24 = 0i64;
do
{
if( ((unsigned __int8)(1 << v23) & RegEntry->GroupEnableMask) != 0 )
{
v32 = EtwpAcquireLoggerContextByLoggerId(SiloState, RegEntry->GroupEntry->EnableInfo[v24].LoggerId, 0);
Flags = RegEntry->Flags;
if( (Flags & 0x20) != 0 || (v32->Flags & 0x2000000) != 0 )
{
if( (Flags & 1) != 0 )
{
EtwpProviderArrivalCallback(v32, 0, RegEntry);
}
else if( ExAcquireRundownProtection(&RegEntry->Process->RundownProtect) )
{
Process = RegEntry->Process;
memset(&ApcState, 0, sizeof(ApcState));
KiStackAttachProcess(Process, 0i64, &ApcState);
EtwpProviderArrivalCallback(v32, 1, RegEntry);
KiUnstackDetachProcess(&ApcState, 0i64);
ExReleaseRundownProtection(&RegEntry->Process->RundownProtect);
}
}
EtwpReleaseLoggerContext(v32, 0);
}
++v23;
++v24;
}
while( v23 < 8u );
v10 = GuidEntryByGuid;
if( !RegEntry->HostGroupEnableMask )
goto LABEL_19;
}
else if( !RegEntry->HostGroupEnableMask )
{
v13 = 0;
*(_DWORD *)ReturnSize = 0;
goto LABEL_23;
}
v46 = 0;
v47 = 0i64;
do
{
if( ((unsigned __int8)(1 << v46) & RegEntry->HostGroupEnableMask) != 0 )
{
v48 = EtwpAcquireLoggerContextByLoggerId(
(_ETW_SILODRIVERSTATE *)EtwpHostSiloState,
RegEntry->GroupEntry->HostEntry->EnableInfo[v47].LoggerId,
0);
v49 = RegEntry->Flags;
if( (v49 & 0x20) != 0 || (v48->Flags & 0x2000000) != 0 )
{
if( (v49 & 1) != 0 )
{
EtwpProviderArrivalCallback(v48, 0, RegEntry);
}
else if( ExAcquireRundownProtection(&RegEntry->Process->RundownProtect) )
{
v50 = RegEntry->Process;
memset(&v63, 0, sizeof(v63));
KiStackAttachProcess(v50, 0i64, &v63);
EtwpProviderArrivalCallback(v48, 1, RegEntry);
KiUnstackDetachProcess(&v63, 0i64);
ExReleaseRundownProtection(&RegEntry->Process->RundownProtect);
}
}
EtwpReleaseLoggerContext(v48, 0);
}
++v46;
++v47;
}
while( v46 < 8u );
v10 = GuidEntryByGuid;
LABEL_19:
if( (RegEntry->Flags & 1) != 0 )
{
Callback = (void(__fastcall *)(GUID *, __int64, _QWORD, unsigned __int64, unsigned __int64, __int128 *, _EPROCESS *))RegEntry->Callback;
if( Callback )
{
v36 = 0i64;
v61 = 0i64;
memset(&EnableInfo, 0, sizeof(EnableInfo));
EtwpComputeRegEntryEnableInfo(RegEntry, &EnableInfo);
if( NumberOfBytes )
{
PoolWithTag = ExAllocatePoolWithTag(1ui64, NumberOfBytes, 1182233669i64);
v36 = PoolWithTag;
if( PoolWithTag )
{
EnableMask = RegEntry->EnableMask;
v37 = &v61;
GuidEntry = RegEntry->GuidEntry;
*(_QWORD *)&v61 = PoolWithTag;
*((_QWORD *)&v61 + 1) = NumberOfBytes | 0x8000000000000000ui64;
EtwpCopySchematizedFilters(PoolWithTag, (__int64)GuidEntry, EnableMask);
}
else
{
v37 = 0i64;
}
}
else
{
v37 = 0i64;
}
Callback(
&NullGuid,
1i64,
EnableInfo.Level,
EnableInfo.MatchAnyKeyword,
EnableInfo.MatchAllKeyword,
v37,
RegEntry->Process);
if( v36 )
ExFreePoolWithTag(v36, 0);
}
}
else
{
EtwpComputeRegEntryEnableInfo(RegEntry, &EnablePacket->EnableInfo);
*(_DWORD *)ReturnSize = 120;
v25 = EtwpGetSchematizedFilterSize(RegEntry->GuidEntry, RegEntry->EnableMask);
if( v25 )
{
*(_DWORD *)ReturnSize = v25 + 136;
*(_DWORD *)&EnablePacket[1].gap0[12] = 0x80000000;
*(_DWORD *)&EnablePacket[1].gap0[8] = v25;
*(_QWORD *)EnablePacket[1].gap0 = 136i64;
EtwpCopySchematizedFilters(&EnablePacket[1].gap0[16], (__int64)RegEntry->GuidEntry, RegEntry->EnableMask);
EnablePacket->FilterCount = 1;
}
else
{
EnablePacket->FilterCount = 0;
}
}
goto LABEL_22;
}
LABEL_23:
RegEntry->GuidEntry->LockOwner = 0i64;
ExReleasePushLockEx((ULONG_PTR)&RegEntry->GuidEntry->Lock, 0);
KeLeaveCriticalRegion();
v10->LockOwner = 0i64;
ExReleasePushLockEx((_DWORD)v10 + 408, 0);
KeLeaveCriticalRegion();
EtwpUnreferenceGuidEntry(v10);
if( v13 >= 0 )
{
v26 = *(&ExBootDevicesRemovedEvent + 241);
if( EtwEventEnabled(*(&ExBootDevicesRemovedEvent + 241), &ETW_EVENT_GROUP_JOIN) )
{
p_Guid = &RegEntry->GuidEntry->Guid;
*(_QWORD *)&UserData.Size = 16i64;
UserData.Ptr = (unsigned __int64)p_Guid;
GroupEntry = RegEntry->GroupEntry;
v66 = 16i64;
v65 = &GroupEntry->Guid;
EtwWrite(v26, &ETW_EVENT_GROUP_JOIN, 0, 2u, &UserData);
}
}
return v13;
}Referenced by:
EtwpSetProviderTraitsCommon