EtwTraceEvent
__int64 __fastcall EtwTraceEvent(_KSPIN_LOCK *a1, unsigned __int16 *a2, size_t a3, int a4, char RequestorMode){
__int64 v5;
unsigned int v7;
_ETW_SILODRIVERSTATE *EtwSiloState;
unsigned int ReserveTraceBufferStatus;
_WMI_LOGGER_CONTEXT *v10;
_WMI_LOGGER_CONTEXT *v11;
unsigned int LoggerMode;
_ETW_SILODRIVERSTATE *v13;
int v14;
size_t v15;
char *v16;
size_t v17;
unsigned __int64 v18;
unsigned __int64 v19;
int i;
unsigned int v21;
char *v22;
char *v23;
int j;
char *v25;
__int64 v26;
__int64 v27;
char *v28;
_OWORD *v29;
_ETHREAD *CurrentThread;
UINT64 v32;
_ETW_LOGGER_HANDLE LoggerHandle;
char v34;
UINT64 RequiredSize;
_ETW_SILODRIVERSTATE *SiloState;
int v37;
int v38;
int v39;
int v40;
int v41;
size_t Size;
UINT64 LoggerId;
VOID *v44;
_ETW_SILODRIVERSTATE *v45;
_LARGE_INTEGER TimeStamp;
_WMI_LOGGER_CONTEXT *v47;
char *v48;
_ETW_BUFFER_HANDLE BufferHandle[4];
__int64 v50;
VOID *Src;
int v52[62];
v5 = a3;
Size = a3;
v34 = RequestorMode;
*(_OWORD *)BufferHandle = 0i64;
v50 = 0i64;
v38 = 0;
LoggerHandle.DereferenceAndLeave = 0;
v37 = 0;
RequiredSize = 0i64;
TimeStamp.QuadPart = 0i64;
v7 = (unsigned __int16)a1;
LODWORD(LoggerId) = (unsigned __int16)a1;
if( RequestorMode )
EtwSiloState = PsGetCurrentServerSiloGlobals(a1)->EtwSiloState;
else
EtwSiloState = (_ETW_SILODRIVERSTATE *)EtwpHostSiloState;
v45 = EtwSiloState;
SiloState = EtwSiloState;
if( v7 < EtwSiloState->MaxLoggers )
{
v10 = EtwpOpenLogger(v7, EtwSiloState, RequestorMode, &LoggerHandle);
v11 = v10;
v47 = v10;
if( v10 )
{
LoggerMode = v10->LoggerMode;
if( (LoggerMode & 0x80u) == 0 )
{
if( RequestorMode || (LoggerMode & 0x1000000) == 0 )
{
if( RequestorMode )
{
if( ((unsigned __int8)a2 & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( (unsigned __int64)a2 + v5 > 0x7FFFFFFF0000i64 || (unsigned __int16 *)((char *)a2 + v5) < a2 )
MEMORY[0x7FFFFFFF0000] = 0;
}
LODWORD(RequiredSize) = *a2;
if( (unsigned int)RequiredSize < (unsigned int)v5 )
{
ReserveTraceBufferStatus = -1073741811;
HIDWORD(RequiredSize) = -1073741811;
v13 = SiloState;
goto LABEL_72;
}
v38 = *((_DWORD *)a2 + 11);
v14 = v38;
v41 = v38;
v15 = RequiredSize;
if( (v38 & 0x100000) != 0 )
{
v39 = 0;
v16 = (char *)a2 + v5;
v17 = RequiredSize - v5;
if( (unsigned int)(RequiredSize - v5) > 0x100 )
{
ReserveTraceBufferStatus = -1073741684;
HIDWORD(RequiredSize) = -1073741684;
v13 = SiloState;
goto LABEL_72;
}
if( v17 )
{
if( RequestorMode )
{
if( ((unsigned __int8)v16 & 3) != 0 )
ExRaiseDatatypeMisalignment();
v18 = (unsigned __int64)&v16[v17];
if( v18 > 0x7FFFFFFF0000i64 || v18 < (unsigned __int64)v16 )
MEMORY[0x7FFFFFFF0000] = 0;
}
v19 = v17;
memmove(&Src, v16, v17);
v15 = v5;
LODWORD(RequiredSize) = v5;
v37 = v19 >> 4;
for( i = 0; ; ++i )
{
v39 = i;
if( i >= v37 )
break;
v21 = v52[4 * i];
v15 += v21;
LODWORD(RequiredSize) = v15;
if( v15 < v21 )
{
ReserveTraceBufferStatus = -2147483643;
HIDWORD(RequiredSize) = -2147483643;
v13 = SiloState;
goto LABEL_72;
}
}
v14 = v41;
}
}
LODWORD(v32) = 0;
v22 = (char *)EtwpReserveTraceBuffer(v11, v15, BufferHandle, &TimeStamp, v32);
v23 = v22;
v48 = v22;
if( v22 )
{
if( (v14 & 0x100000) != 0 )
{
v40 = 0;
v44 = &v22[Size];
memmove(v22, a2, Size);
for( j = 0; ; ++j )
{
v40 = j;
if( j >= v37 )
break;
v25 = *(char **)&v52[4 * j - 2];
v26 = (unsigned int)v52[4 * j];
if( v25 && (_DWORD)v26 )
{
if( RequestorMode && ((unsigned __int64)&v25[v26] > 0x7FFFFFFF0000i64 || &v25[v26] < v25) )
MEMORY[0x7FFFFFFF0000] = 0;
v27 = v26;
memmove(v44, v25, v26);
v44 = (char *)v44 + v27;
}
}
v14 = v41;
}
else
{
if( RequestorMode && v15 )
{
if( ((unsigned __int8)a2 & 3) != 0 )
ExRaiseDatatypeMisalignment();
v28 = (char *)a2 + v15;
if( (unsigned __int64)v28 > 0x7FFFFFFF0000i64 || v28 < (char *)a2 )
MEMORY[0x7FFFFFFF0000] = 0;
}
memmove(v22, a2, v15);
}
if( (v14 & 0x80000) != 0 )
{
v29 = (_OWORD *)*((_QWORD *)a2 + 3);
if( RequestorMode && ((unsigned __int8)v29 & 3) != 0 )
ExRaiseDatatypeMisalignment();
*(_OWORD *)(v23 + 24) = *v29;
}
v13 = SiloState;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
*(_DWORD *)v23 = a4 | RequiredSize;
*((_LARGE_INTEGER *)v23 + 2) = TimeStamp;
*((_DWORD *)v23 + 10) = CurrentThread->Tcb.SchedulerApc.SpareLong0;
*((_DWORD *)v23 + 11) = CurrentThread->Tcb.UserTime;
*((_DWORD *)v23 + 2) = CurrentThread->Cid.UniqueThread;
*((_DWORD *)v23 + 3) = CurrentThread->Cid.UniqueProcess;
if( (v11->LoggerMode & 0x80000) != 0
&& (!(_BYTE)KdDebuggerNotPresent && !KdPitchDebugger || KdEventLoggingPresent) )
{
EtwpSendTraceEvent(v11, BufferHandle);
}
if( v11->CallbackContext )
EtwpInvokeEventCallback((INT64)v11, (INT64)BufferHandle, (INT64)(v23 + 24));
EtwpReleaseTraceBuffer(BufferHandle);
ReserveTraceBufferStatus = HIDWORD(RequiredSize);
goto LABEL_72;
}
ReserveTraceBufferStatus = EtwpGetReserveTraceBufferStatus(v11, v15);
}
else
{
ReserveTraceBufferStatus = -1073741637;
}
}
else
{
ReserveTraceBufferStatus = -1073741790;
}
v13 = SiloState;
LABEL_72:
EtwpCloseLogger((unsigned int)LoggerId, v13, LoggerHandle);
return ReserveTraceBufferStatus;
}
}
return(unsigned int)-1073741816;
}Referenced by:
IoWMIWriteEvent
NtTraceEvent