PopAllocateHiberContext
NTSTATUS __stdcall PopAllocateHiberContext(){
__int64 v0;
_POP_HIBER_CONTEXT *v1;
_DUMP_STACK_CONTEXT **v2;
_DUMP_STACK_CONTEXT **p_DumpStack;
int DumpStack;
_DUMP_STACK_CONTEXT *v5;
char v6;
unsigned __int8 v7;
__int16 v8;
unsigned __int8 v9;
_MDL *BootLoaderLogMdl;
__int16 v11;
unsigned __int64 v12;
__int16 v13;
_MDL *FirmwareRuntimeInformationMdl;
INT64 v15;
INT64 v16;
INT64 v17;
int v18;
INT64 v19;
VOID *v20;
const WCHAR *v21;
unsigned __int64 v22;
unsigned int v23;
unsigned __int64 ResumeContextPages;
VOID *Pages;
char *v26;
VOID **CommonBuffer;
_MDL *UnHibernatedMdl;
int v29;
INT64 v30;
POP_SLEEP_CHECKPOINT v32;
POP_SLEEP_CHECKPOINT v33;
__int64 v34;
__int16 v35;
unsigned __int64 v36;
__int64 **v37;
__int64 *i;
int v39;
VOID **v40;
__int64 v41;
INT64 Tag;
UINT64 Taga;
UINT64 Tagb;
UINT64 Tagc;
INT64 v46;
INT64 v47;
INT64 savedregs;
INT64 savedregs_8;
INT64 savedregs_16;
INT64 savedregs_24;
INT64 savedregs_32;
INT64 savedregs_40;
INT64 savedregs_48;
CHAR savedregs_56;
VOID *ResumeObjectHandleOut;
INT64 v57;
_LARGE_INTEGER BitlockerPA;
v57 = 0i64;
BitlockerPA.QuadPart = 0i64;
if( EffectiveState != PowerSystemHibernate )
return 0;
ResumeObjectHandleOut = 0i64;
LODWORD(v0) = MmGetHighestPhysicalPage(0i64);
v1 = (_POP_HIBER_CONTEXT *)MemoryMap;
HiberContext = MemoryMap;
*(&stru_140C23628 + 702) = *(&stru_140C23628 + 704) + ((((unsigned __int64)(v0 + 32) >> 3) + 4092) >> 12);
memset(MemoryMap, 0i64, 0x1C8u);
MmLockPreChargedPagedPool((UINT64)PagedPoolVa);
dword_140C50440 = 0;
v1->BootPhaseMap = (_RTL_BITMAP)xmmword_140C234B0;
v1->MemoryImage = (PO_MEMORY_IMAGE *)qword_140C234A0;
v1->IoInfo.DumpMdl = (_MDL *)qword_140C234F0;
v1->BootLoaderLogMdl = (_MDL *)qword_140C234D0;
v1->FirmwareRuntimeInformationMdl = (_MDL *)qword_140C23500;
v1->FirmwareRuntimeInformationVa = (void *)qword_140C234F8;
v1->32 = ($415EA2EC7BC5C02D848E21B435E4F7C5)xmmword_140C234C0;
v1->ClonedRanges.Blink = &v1->ClonedRanges;
v1->ClonedRanges.Flink = &v1->ClonedRanges;
if( !FileObject )
{
DumpStack = -1073741809;
v32 = PopSleepCheckpointAllocatingHiberContextNoFileObject;
LABEL_46:
PopCheckpointSystemSleep(v32);
goto LABEL_43;
}
p_DumpStack = &v1->DumpStack;
DumpStack = IoGetDumpStack(v2, (UINT64)&v1->DumpStack);
if( DumpStack < 0 )
{
v33 = PopSleepCheckpointAllocatingHiberContextGetDumpStackFailed;
goto LABEL_48;
}
v5 = *p_DumpStack;
v6 = 0;
if( (Flags & 0x80000000) != 0i64 && SleepReason == PolicyDeviceBattery )
v6 = 2;
v7 = v6 | 1;
v8 = __readcr4();
v9 = v6 | 9;
if( (v8 & 0x1000) == 0 )
v9 = v7;
BootLoaderLogMdl = v1->BootLoaderLogMdl;
v1->HiberFlags = v9;
v11 = qword_140C234A8;
v12 = qword_140C234A8 & 0xFFFFFFFFFFFFF000ui64;
v13 = qword_140C234A8;
BootLoaderLogMdl->Next = 0i64;
BootLoaderLogMdl->MdlFlags = 0;
BootLoaderLogMdl->StartVa = (void *)v12;
BootLoaderLogMdl->ByteOffset = v11 & 0xFFF;
BootLoaderLogMdl->Size = 8 * ((((unsigned __int64)(v13 & 0xFFF) + 102399) >> 12) + 6);
BootLoaderLogMdl->ByteCount = 98304;
MmBuildMdlForNonPagedPool(v1->BootLoaderLogMdl);
FirmwareRuntimeInformationMdl = v1->FirmwareRuntimeInformationMdl;
if( FirmwareRuntimeInformationMdl )
{
v34 = qword_140C234F8;
v35 = qword_140C234F8;
FirmwareRuntimeInformationMdl->Next = 0i64;
FirmwareRuntimeInformationMdl->MdlFlags = 0;
FirmwareRuntimeInformationMdl->ByteCount = 4096;
FirmwareRuntimeInformationMdl->Size = 8 * (((unsigned __int16)((v35 & 0xFFF) + 0x1FFF) >> 12) + 6);
FirmwareRuntimeInformationMdl->StartVa = (void *)(v34 & 0xFFFFFFFFFFFFF000ui64);
FirmwareRuntimeInformationMdl->ByteOffset = v34 & 0xFFF;
MmBuildMdlForNonPagedPool(v1->FirmwareRuntimeInformationMdl);
}
DumpStack = PopLoadResumeContext((POP_HIBER_CONTEXT *)v1);
if( DumpStack < 0 )
{
v33 = PopSleepCheckpointAllocatingHiberContextLoadResumeContextFailed;
goto LABEL_48;
}
PopBcdOpen(
(INT64)&v57,
v15,
v16,
v17,
Tag,
v46,
v47,
savedregs,
savedregs_8,
savedregs_16,
savedregs_24,
savedregs_32,
savedregs_40,
savedregs_48,
savedregs_56);
DumpStack = v18;
if( v18 < 0 )
{
v33 = PopSleepCheckpointAllocatingHiberContextBcdOpenFailed;
goto LABEL_48;
}
v19 = v57;
DumpStack = PopBcdEstablishResumeObject((VOID *)v57, &ResumeObjectHandleOut);
if( DumpStack < 0 )
{
PopBcdClose((VOID *)v19);
v33 = PopSleepCheckpointAllocatingHiberContextEstablishResumeObjectFailed;
goto LABEL_48;
}
DumpStack = PopBcdSetPendingResume((VOID *)v19, v20, v21, ResumeObjectHandleOut);
BcdCloseObject(ResumeObjectHandleOut);
if( DumpStack < 0 )
{
PopBcdClose((VOID *)v19);
v33 = PopSleepCheckpointAllocatingHiberContextSetPendingResumeFailed;
goto LABEL_48;
}
BcdForciblyUnloadStore((PVOID)v19);
RtlClearAllBits(&v1->DiscardMap);
RtlSetAllBits(&v1->BootPhaseMap);
v1->HardwareConfigurationSignature = PopGetHwConfigurationSignature();
PopHiberInitializeResources(v1);
LODWORD(v19) = 0;
if( PopGetBitlockerKeyLocation(&BitlockerPA) >= 0 )
{
v36 = (unsigned __int64)BitlockerPA.QuadPart >> 12;
v1->BitlockerKeyPFN = (unsigned __int64)BitlockerPA.QuadPart >> 12;
PopDiscardRange(v1, v36, 4ui64);
}
if( !KdPitchDebugger || KdEventLoggingEnabled )
{
LODWORD(Taga) = 543646276;
PoSetHiberRange(v1, 2ui64, &KdTimerDifference, 0i64, Taga);
LODWORD(Tagc) = 543646276;
PoSetHiberRange(v1, 2ui64, &KdDebuggerLock, 0i64, Tagc);
}
MmMarkHiberRange(v1, Va, 0x13000ui64);
((void(__fastcall *)(_POP_HIBER_CONTEXT *))off_140C005A8[0])(v1);
v22 = (4 * (unsigned __int64)*(&stru_140C23628 + 702) + 4095) >> 12;
v23 = v22;
v1->IoPagesCount = v22;
if( v1->ResumeContext )
{
ResumeContextPages = v1->ResumeContextPages;
if( ResumeContextPages > v22 )
{
v1->IoPagesCount = ResumeContextPages;
v23 = ResumeContextPages;
}
}
Pages = PopAllocatePages(v23);
DumpStack = v1->Status;
v1->IoPages = Pages;
if( DumpStack < 0 )
{
v33 = PopSleepCheckpointAllocatingHiberContextAllocateIoPagesPagesFailed;
goto LABEL_48;
}
if( (*p_DumpStack)->UseStorageInfo )
{
v37 = (__int64 **)((char *)(*p_DumpStack)->DumpPointers + 40);
for( i = *v37; i != (__int64 *)v37; i = (__int64 *)*i )
{
v39 = *((_DWORD *)i + 16);
if( v39 )
{
if( (v39 & 0xFFF) != 0 )
{
PopInternalAddToDumpFile(i - 1, 0x70ui64, 0i64);
PopInternalAddToDumpFile(v1, 0x1C8ui64, 0i64);
PopCheckpointSystemSleep(PopSleepCheckpointAllocatingHiberContextAdapterBuffersInvalid1);
KeBugCheckEx(0xA0u, (PVOID)0x102, (PVOID)0xA, v5, v1);
}
v40 = (VOID **)(i + 9);
v41 = 2i64;
do
{
if( *v40 )
{
LODWORD(Taga) = 1718968931;
PoSetHiberRange(v1, 0x8000ui64, *v40, *((unsigned int *)i + 16), Taga);
}
++v40;
--v41;
}
while( v41 );
}
}
}
else
{
v26 = (char *)PopAllocatePages(0x10ui64);
v5->Init.MemoryBlock = v26;
if( !v26 )
{
DumpStack = v1->Status;
v33 = PopSleepCheckpointAllocatingHiberContextAllocateDumpPagesFailed;
goto LABEL_48;
}
LODWORD(Taga) = 1835363652;
PoSetHiberRange(v1, 0x8000ui64, v26 + 0x2000, 0xE000ui64, Taga);
if( (v5->Init.CommonBufferSize & 0xFFF) != 0 )
{
PopInternalAddToDumpFile(v5, 0x108ui64, 0i64);
PopInternalAddToDumpFile(v1, 0x1C8ui64, 0i64);
PopCheckpointSystemSleep(PopSleepCheckpointAllocatingHiberContextAdapterBuffersInvalid2);
KeBugCheckEx(0xA0u, (PVOID)0x102, (PVOID)0xA, v5, v1);
}
CommonBuffer = v5->Init.CommonBuffer;
v19 = 2i64;
do
{
if( *CommonBuffer )
{
LODWORD(Tagb) = 1718968931;
PoSetHiberRange(v1, 0x8000ui64, *CommonBuffer, v5->Init.CommonBufferSize, Tagb);
}
++CommonBuffer;
--v19;
}
while( v19 );
}
UnHibernatedMdl = PopGenerateUnHibernatedMdl((POP_HIBER_CONTEXT *)v1, *(&stru_140C23628 + 702));
v1->LoaderMdl = UnHibernatedMdl;
if( !UnHibernatedMdl )
{
DumpStack = -1073741670;
v32 = PopSleepCheckpointAllocatingHiberContextUnHibernatedMdlFailed;
goto LABEL_46;
}
if( VslVsmEnabled != (_BYTE)v19 )
{
v1->IumEnabled = 1;
DumpStack = VslAllocateSecureHibernateResources(v1);
if( DumpStack >= 0 )
goto LABEL_33;
v33 = PopSleepCheckpointAllocatingHiberContextSecureResourcesFailed;
LABEL_48:
PopCheckpointSystemSleep(v33);
goto LABEL_40;
}
v1->IumEnabled = v19;
LABEL_33:
ZwQuerySystemInformation();
if( v29 >= 0 )
v1->SecureBoot = 0;
if( BgkResumePrepare(v1) >= 0 )
*(&stru_140C23628 + 2672) = 1;
v1->GraphicsProc = v1->ProcessorCount - 1;
if( (HvlpFlags & 2) != 0 )
HvlpAllocatePageListResources(v30, 16i64);
DumpStack = v19;
LABEL_40:
if( DumpStack < 0 )
LABEL_43:
PopFreeHiberContext();
return DumpStack;
}Referenced by:
PopTransitionSystemPowerStateEx