IopUpdateMinidumpContext
VOID __stdcall IopUpdateMinidumpContext(
UINT64 BugCheckCode,
UINT64 BugCheckParameter1,
UINT64 BugCheckParameter2,
UINT64 BugCheckParameter3,
UINT64 BugCheckParameter4,
_CONTEXT *ContextSave,
_KTRAP_FRAME *TrapFrame){
struct _KPRCB *CurrentPrcb;
char v8;
UINT64 v10;
unsigned int v11;
UINT64 v12;
char *v13;
char *v14;
UINT64 v15;
unsigned int v16;
__int64 v17;
char *IsrStack;
unsigned int v19;
unsigned int v20;
char *v21;
unsigned __int64 *v22;
char *v23;
unsigned __int64 v24;
unsigned int v25;
unsigned int v26;
_KPRCB *Prcb;
_KDPC_DATA *DpcData;
_SINGLE_LIST_ENTRY *i;
_SINGLE_LIST_ENTRY *Next;
void **DpcWatchdogProfile;
unsigned __int64 v32;
unsigned int v33;
_QWORD *j;
__int64 v35;
_OWORD *v36;
__int128 v37;
unsigned int v38;
v38 = BugCheckCode;
CurrentPrcb = KeGetCurrentPrcb();
v8 = 0;
v10 = BugCheckParameter1;
v11 = BugCheckCode;
if( (_DWORD)BugCheckCode != 126 )
{
if( (_DWORD)BugCheckCode == 127 )
{
v12 = (UINT64)ContextSave;
if( BugCheckParameter1 == 8 )
{
ContextSave->_Rbp = *(_QWORD *)(BugCheckParameter2 + 344);
ContextSave->_Rip = *(_QWORD *)(BugCheckParameter2 + 360);
ContextSave->_Rsp = *(_QWORD *)(BugCheckParameter2 + 384);
}
goto LABEL_5;
}
LABEL_8:
v12 = (UINT64)ContextSave;
goto LABEL_9;
}
if( !BugCheckParameter4 )
goto LABEL_8;
v12 = BugCheckParameter4;
LABEL_5:
v8 = 1;
LABEL_9:
v13 = (char *)KeGetPcr()->Prcb.DpcStack + 80;
v14 = *(char **)(v12 + 152);
if( &v13[-(unsigned int)KeKernelStackSize] <= v14 && v14 < v13 )
{
if( (unsigned __int64)(v13 - v14) >= 0x7FFF )
v15 = 0x7FFFi64;
else
v15 = (unsigned int)((_DWORD)v13 - (_DWORD)v14);
IopGetMaxValidMemorySize(*(VOID **)(v12 + 152), v15);
IoAddTriageDumpDataBlock(v14, (_BYTE *)v16);
}
v17 = 2i64;
if( CurrentPrcb->DebuggerSavedIRQL > 2u )
{
IsrStack = (char *)KeGetPcr()->Prcb.IsrStack;
if( IsrStack - 24576 <= v14 && v14 < IsrStack )
{
if( (unsigned __int64)(IsrStack - v14) >= 0x7FFF )
v19 = 0x7FFF;
else
v19 = (_DWORD)IsrStack - (_DWORD)v14;
IopGetMaxValidMemorySize(v14, v19);
IoAddTriageDumpDataBlock(v14, (_BYTE *)v20);
}
}
if( v11 == 307 )
{
if( (KeGetPcr()->Prcb.DpcRequestSummary & 1) != 0 && TrapFrame != (_KTRAP_FRAME *)CurrentPrcb->IdleThread )
{
v21 = (char *)KeGetPcr()->Prcb.DpcStack + 80;
v22 = (unsigned __int64 *)((char *)KeGetPcr()->Prcb.IsrStack - 8);
v23 = &v21[-(unsigned int)KeKernelStackSize];
if( KiIsAddressRangeValid((INT64)v22, 8i64) )
{
v24 = *v22;
if( KiIsAddressRangeValid(v24, 8i64) )
{
if( (unsigned __int64)v23 <= v24 && v24 < (unsigned __int64)v21 )
v23 = (char *)v24;
}
}
if( (unsigned __int64)(v21 - v23) >= 0x7FFF )
v25 = 0x7FFF;
else
v25 = (_DWORD)v21 - (_DWORD)v23;
IopGetMaxValidMemorySize(v23, v25);
IoAddTriageDumpDataBlock(v23, (_BYTE *)v26);
}
Prcb = KeGetPrcb(LODWORD(TrapFrame[1]._Xmm1.High));
DpcData = Prcb->DpcData;
do
{
for( i = DpcData->DpcList.ListHead.Next; i; i = i->Next )
{
IoAddTriageDumpDataBlock(&i[-1], (_BYTE *)0x40);
Next = i[6].Next;
if( Next != (_SINGLE_LIST_ENTRY *)1 )
IoAddTriageDumpDataBlock(Next, (_BYTE *)0x60);
}
++DpcData;
--v17;
}
while( v17 );
DpcWatchdogProfile = Prcb->DpcWatchdogProfile;
if( DpcWatchdogProfile && DpcWatchdogProfile != Prcb->DpcWatchdogProfileCurrentEmptyCapture )
{
v32 = (unsigned int)(8 * dword_140CFA32C);
v33 = LODWORD(Prcb->DpcWatchdogProfileCurrentEmptyCapture) - (_DWORD)DpcWatchdogProfile;
if( v33 <= (unsigned int)v32 )
v32 = v33;
IoAddTriageDumpDataBlock(DpcWatchdogProfile, (_BYTE *)v32);
}
v11 = v38;
v10 = BugCheckParameter1;
}
for( j = (_QWORD *)*(&stru_140C23628 + 181); j != (_QWORD *)((char *)&stru_140C23628 + 1448); j = (_QWORD *)*j )
IoAddTriageDumpDataBlock(j, (_BYTE *)0x420);
IopAddBugcheckTriageDataFromParameters(v11, v10, BugCheckParameter2, BugCheckParameter3, BugCheckParameter4);
if( v8 && qword_140C50960 )
{
*(_DWORD *)(qword_140C50960 + 24i64) |= 0x10000000u;
v35 = 9i64;
v36 = (_OWORD *)(qword_140C50960 + 64i64);
do
{
*v36 = *(_OWORD *)v12;
v36[1] = *(_OWORD *)(v12 + 16);
v36[2] = *(_OWORD *)(v12 + 32);
v36[3] = *(_OWORD *)(v12 + 48);
v36[4] = *(_OWORD *)(v12 + 64);
v36[5] = *(_OWORD *)(v12 + 80);
v36[6] = *(_OWORD *)(v12 + 96);
v36 += 8;
v37 = *(_OWORD *)(v12 + 112);
v12 += 128i64;
*(v36 - 1) = v37;
--v35;
}
while( v35 );
*v36 = *(_OWORD *)v12;
v36[1] = *(_OWORD *)(v12 + 16);
v36[2] = *(_OWORD *)(v12 + 32);
v36[3] = *(_OWORD *)(v12 + 48);
v36[4] = *(_OWORD *)(v12 + 64);
}
}Referenced by:
IoWriteCrashDump
IopAddMiniDumpPagesToPartialKernelDump
IopWriteCapsuleTriageDumpToFirmware