EtwpUpdateFilterData
NTSTATUS __stdcall EtwpUpdateFilterData(
_ETW_GUID_ENTRY *GuidEntry,
UINT64 Index,
_ETW_ENABLE_NOTIFICATION_PACKET *EnablePacket,
UINT8 Remove,
_ETW_FILTER_INFO *FilterInfo){
unsigned int v5;
_ETW_FILTER_HEADER *FilterData;
__int64 v9;
__int32 v10;
void *v11;
void *v12;
void *v13;
void *v14;
void *v15;
void *v16;
VOID **PoolWithTag;
__int64 v19;
__int32 v20;
__int64 v21;
__int32 v22;
__int64 v23;
unsigned int v24;
int v25;
char *v26;
void *v27;
char v28;
void *v29;
void *v30;
void *v31;
void *v32;
void *v33;
void *v34;
void *v35;
void *v36;
void *v37;
PVOID v38;
PVOID v39;
NTSTATUS updated;
PVOID v41;
PVOID v42;
int v43;
PVOID v44;
void *v45;
PVOID v46;
PVOID P;
int v48;
char *v49;
int v50;
unsigned int v51;
unsigned int v52;
char v54;
v52 = Index;
v5 = Index;
updated = 0;
v54 = 0;
P = 0i64;
v44 = 0i64;
v42 = 0i64;
v41 = 0i64;
v46 = 0i64;
v45 = 0i64;
if( !EnablePacket || !EnablePacket->FilterCount )
Remove = 1;
FilterData = GuidEntry->FilterData;
if( !Remove )
{
if( !FilterData )
{
PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x340ui64, 1182233669i64);
FilterData = (_ETW_FILTER_HEADER *)PoolWithTag;
if( !PoolWithTag )
return -1073741801;
memset(PoolWithTag, 0i64, 0x340u);
v5 = v52;
GuidEntry->FilterData = FilterData;
}
v19 = v5;
v20 = 0;
v21 = 0i64;
v43 = 0;
v22 = _InterlockedExchange(&FilterData[v19].FilterFlags, 0);
v48 = v22;
if( !EnablePacket->FilterCount )
goto LABEL_62;
while( 1 )
{
v23 = 2 * v21;
v24 = *(_DWORD *)&EnablePacket[1].gap0[8 * v23 + 12];
v25 = *(_DWORD *)&EnablePacket[1].gap0[8 * v23 + 8];
v26 = &EnablePacket->gap0[*(_QWORD *)&EnablePacket[1].gap0[8 * v23]];
v50 = v25;
v51 = v24;
v49 = v26;
if( v24 > 0x80000200 )
break;
if( v24 == -2147483136 )
{
LODWORD(v29) = EtwpUpdateEventFilter(
(INT64 *)&GuidEntry->FilterData[v19].EventIdFilter,
(INT64 *)FilterInfo + 4,
0);
v44 = v29;
v20 |= 0x80000200;
goto LABEL_59;
}
if( v24 != 0x80000000 )
{
if( v24 == -2147483644 )
{
EtwpUpdatePidFilterData((__int64)&GuidEntry->FilterData[v19], (__int64)&v49, 0);
v20 |= 0x80000004;
}
else if( v24 == -2147483640 )
{
EtwpUpdateStringFilterData((VOID **)&GuidEntry->FilterData[v19].ExeFilter, (VOID **)FilterInfo, 0);
v20 |= 0x80000008;
}
else if( v24 == -2147483632 )
{
EtwpUpdateStringFilterData((VOID **)&GuidEntry->FilterData[v19].PkgIdFilter, (VOID **)FilterInfo + 1, 0);
v20 |= 0x80000010;
}
else
{
if( v24 != -2147483616 )
{
if( v24 == -2147483392 )
{
LODWORD(v27) = EtwpUpdateEventFilter(
(INT64 *)&GuidEntry->FilterData[v19].PayloadFilter,
(INT64 *)FilterInfo + 9,
0);
v45 = v27;
v20 |= 0x80000100;
}
goto LABEL_59;
}
EtwpUpdateStringFilterData((VOID **)&GuidEntry->FilterData[v19].PkgAppIdFilter, (VOID **)FilterInfo + 2, 0);
v20 |= 0x80000020;
}
LABEL_43:
LOBYTE(v5) = v52;
goto LABEL_59;
}
EtwpUpdateSchematizedFilterData((__int64)&GuidEntry->FilterData[v19], v5, (__int64)&v49, 0);
LOBYTE(v5) = v52;
v28 = 1;
v54 = 1;
LABEL_60:
v21 = (unsigned int)(v43 + 1);
v43 = v21;
if( (unsigned int)v21 >= EnablePacket->FilterCount )
{
v22 = v48;
if( !v28 )
LABEL_62:
EtwpUpdateSchematizedFilterData((__int64)&GuidEntry->FilterData[v19], 0, 0i64, 1);
if( (v22 & 0x80000004) == -2147483644 && (v20 & 0x80000004) != -2147483644 )
EtwpUpdatePidFilterData((__int64)&GuidEntry->FilterData[v19], 0i64, 1);
if( (v22 & 0x80000008) == -2147483640 && (v20 & 0x80000008) != -2147483640 )
EtwpUpdateStringFilterData((VOID **)&GuidEntry->FilterData[v19].ExeFilter, 0i64, 1u);
if( (v22 & 0x80000010) == -2147483632 && (v20 & 0x80000010) != -2147483632 )
EtwpUpdateStringFilterData((VOID **)&GuidEntry->FilterData[v19].PkgIdFilter, 0i64, 1u);
if( (v22 & 0x80000020) == -2147483616 && (v20 & 0x80000020) != -2147483616 )
EtwpUpdateStringFilterData((VOID **)&GuidEntry->FilterData[v19].PkgAppIdFilter, 0i64, 1u);
if( (v22 & 0x80008000) == -2147450880 && (v20 & 0x80008000) != -2147450880 )
EtwpUpdateStringFilterData((VOID **)&GuidEntry->FilterData[v19].ContainerFilter, 0i64, 1u);
if( (v22 & 0x80001000) == -2147479552 && (v20 & 0x80001000) != -2147479552 )
{
LODWORD(v33) = EtwpUpdateEventFilter((INT64 *)&GuidEntry->FilterData[v19].StackWalkIdFilter, 0i64, 1);
P = v33;
}
if( (v22 & 0x80000200) == -2147483136 && (v20 & 0x80000200) != -2147483136 )
{
LODWORD(v34) = EtwpUpdateEventFilter((INT64 *)&GuidEntry->FilterData[v19].EventIdFilter, 0i64, 1);
v44 = v34;
}
if( (v22 & 0x80000400) == -2147482624 && (v20 & 0x80000400) != -2147482624 )
{
LODWORD(v35) = EtwpUpdateEventFilter((INT64 *)&GuidEntry->FilterData[v19].EventNameFilter, 0i64, 1);
v42 = v35;
}
if( (v22 & 0x80002000) == -2147475456 && (v20 & 0x80002000) != -2147475456 )
{
LODWORD(v36) = EtwpUpdateEventFilter((INT64 *)&GuidEntry->FilterData[v19].StackWalkNameFilter, 0i64, 1);
v41 = v36;
}
if( (v22 & 0x80004000) == -2147467264 && (v20 & 0x80004000) != -2147467264 )
updated = EtwpUpdateLevelKwFilter((__int64)&GuidEntry->FilterData[v19], 0i64, 1, &v46);
if( (v22 & 0x80000100) != -2147483392 || (v20 & 0x80000100) == -2147483392 )
{
v16 = v45;
}
else
{
LODWORD(v37) = EtwpUpdateEventFilter((INT64 *)&GuidEntry->FilterData[v19].PayloadFilter, 0i64, 1);
v16 = v37;
}
_InterlockedExchange(&GuidEntry->FilterData[v19].FilterFlags, v20);
LABEL_99:
v38 = P;
v39 = v46;
if( P || v44 || v42 || v41 || v46 || v16 )
{
KeGenericCallDpc((__int64)KeAbCrossThreadDeleteNopDpcRoutine, 0i64);
if( v38 )
ExFreePoolWithTag(v38, 0);
if( v44 )
ExFreePoolWithTag(v44, 0);
if( v42 )
EtwpFreeEventNameFilter(v42);
if( v41 )
EtwpFreeEventNameFilter(v41);
if( v39 )
ExFreePoolWithTag(v39, 0);
if( v16 )
{
if( _InterlockedExchangeAdd((volatile signed __int32 *)v16, 0xFFFFFFFF) == 1 )
ExFreePoolWithTag(v16, 0);
}
}
return updated;
}
}
switch( v24 )
{
case 0x80000400:
LODWORD(v32) = EtwpUpdateEventFilter(
(INT64 *)&GuidEntry->FilterData[v19].EventNameFilter,
(INT64 *)FilterInfo + 6,
0);
v42 = v32;
v20 |= 0x80000400;
break;
case 0x80001000:
LODWORD(v31) = EtwpUpdateEventFilter(
(INT64 *)&GuidEntry->FilterData[v19].StackWalkIdFilter,
(INT64 *)FilterInfo + 5,
0);
P = v31;
v20 |= 0x80001000;
break;
case 0x80002000:
LODWORD(v30) = EtwpUpdateEventFilter(
(INT64 *)&GuidEntry->FilterData[v19].StackWalkNameFilter,
(INT64 *)FilterInfo + 7,
0);
v41 = v30;
v20 |= 0x80002000;
break;
case 0x80004000:
updated = EtwpUpdateLevelKwFilter((__int64)&GuidEntry->FilterData[v19], (__int64)&v49, 0, &v46);
v20 |= 0x80004000;
goto LABEL_43;
case 0x80008000:
EtwpUpdateStringFilterData((VOID **)&GuidEntry->FilterData[v19].ContainerFilter, (VOID **)FilterInfo + 3, 0);
v20 |= 0x80008000;
goto LABEL_43;
}
LABEL_59:
v28 = v54;
goto LABEL_60;
}
if( FilterData )
{
v9 = (unsigned int)Index;
v10 = _InterlockedExchange(&FilterData[v9].FilterFlags, 0);
EtwpUpdateSchematizedFilterData((__int64)&GuidEntry->FilterData[v9], 0, 0i64, Remove);
if( (v10 & 0x80000004) == -2147483644 )
EtwpUpdatePidFilterData((__int64)&GuidEntry->FilterData[v9], 0i64, Remove);
if( (v10 & 0x80000008) == -2147483640 )
EtwpUpdateStringFilterData((VOID **)&GuidEntry->FilterData[v9].ExeFilter, 0i64, Remove);
if( (v10 & 0x80000010) == -2147483632 )
EtwpUpdateStringFilterData((VOID **)&GuidEntry->FilterData[v9].PkgIdFilter, 0i64, Remove);
if( (v10 & 0x80000020) == -2147483616 )
EtwpUpdateStringFilterData((VOID **)&GuidEntry->FilterData[v9].PkgAppIdFilter, 0i64, Remove);
if( (v10 & 0x80008000) == -2147450880 )
EtwpUpdateStringFilterData((VOID **)&GuidEntry->FilterData[v9].ContainerFilter, 0i64, Remove);
if( (v10 & 0x80001000) == -2147479552 )
{
LODWORD(v11) = EtwpUpdateEventFilter((INT64 *)&GuidEntry->FilterData[v9].StackWalkIdFilter, 0i64, Remove);
P = v11;
}
if( (v10 & 0x80000200) == -2147483136 )
{
LODWORD(v12) = EtwpUpdateEventFilter((INT64 *)&GuidEntry->FilterData[v9].EventIdFilter, 0i64, Remove);
v44 = v12;
}
if( (v10 & 0x80000400) == -2147482624 )
{
LODWORD(v13) = EtwpUpdateEventFilter((INT64 *)&GuidEntry->FilterData[v9].EventNameFilter, 0i64, Remove);
v42 = v13;
}
if( (v10 & 0x80002000) == -2147475456 )
{
LODWORD(v14) = EtwpUpdateEventFilter((INT64 *)&GuidEntry->FilterData[v9].StackWalkNameFilter, 0i64, Remove);
v41 = v14;
}
if( (v10 & 0x80004000) == -2147467264 )
updated = EtwpUpdateLevelKwFilter((__int64)&GuidEntry->FilterData[v9], 0i64, Remove, &v46);
if( (v10 & 0x80000100) == -2147483392 )
{
LODWORD(v15) = EtwpUpdateEventFilter((INT64 *)&GuidEntry->FilterData[v9].PayloadFilter, 0i64, Remove);
v16 = v15;
}
else
{
v16 = 0i64;
}
goto LABEL_99;
}
return 0;
}Referenced by:
EtwpClearSessionAndUnreferenceEntry
EtwpUpdateGuidEnableInfo