SwapContext
VOID __stdcall SwapContext(){
unsigned __int8 v0;
INT64 v1;
INT64 v2;
INT64 v3;
__int64 v4;
INT64 v5;
unsigned __int64 v6;
unsigned __int64 v7;
UINT64 v8;
unsigned __int64 v9;
_DWORD *v10;
unsigned __int64 BpbTrappedBpbState;
unsigned __int64 v12;
ULONG64 v13;
unsigned __int64 v14;
unsigned __int64 v17;
unsigned __int8 BpbTrappedRetpolineExitSpecCtrl;
__int64 v19;
unsigned __int64 v20;
unsigned __int64 v21;
__int64 v22;
unsigned __int64 v23;
unsigned int *v24;
unsigned __int64 v25;
unsigned int v26;
__int64 v27;
unsigned int v28;
__int64 v29;
unsigned int v30;
__int64 v31;
int v32;
__int64 v33;
unsigned __int8 v34;
_m_prefetchw((const void *)(v3 + 113));
v34 = v0;
if( *(_BYTE *)(v3 + 113) )
{
v32 = 0;
do
{
++v32;
_mm_pause();
}
while( *(_BYTE *)(v3 + 113) );
}
*(_BYTE *)(v3 + 113) = 1;
_disable();
v6 = __rdtsc();
v7 = (((unsigned __int64)HIDWORD(v6) << 32) | (unsigned int)v6) - *(_QWORD *)(v1 + 32448);
*(_QWORD *)(v1 + 32568) += v7;
*(_QWORD *)(v1 + 32448) += v7;
v8 = v7;
if( *(_BYTE *)(v1 + 6) )
{
*(_BYTE *)(v1 + 6) = 0;
if( *(_QWORD *)(v1 + 24) != v3 )
HalRequestSoftwareInterrupt(2ui64);
}
if( (*(_BYTE *)(v3 + 2) & 0x36) != 0 )
{
KiBeginThreadAccountingPeriod((_KPRCB *)v1, (_KTHREAD *)v3, v8);
}
else
{
--*(_BYTE *)(v1 + 32);
_enable();
}
++*(_DWORD *)(v1 + 11580);
v9 = (unsigned __int64)KeFeatureBits;
if( KiCacheIsoBitmap && ((unsigned __int64)KeFeatureBits & 0x100000000000i64) != 0 )
KiCheckAndApplyCacheIsolation(v1, v3);
if( *(_QWORD *)(v1 + 24) != v3 && (unsigned __int8)*(_DWORD *)(v3 + 512) != *(_BYTE *)(v1 + 236) )
KeCheckAndApplyBamQos(v1, v3, v4, v5);
v10 = *(_DWORD **)(v2 + 96);
BpbTrappedBpbState = *(_QWORD *)(v2 + 592) & 0xFFFFFFFFFFFFFFFDui64;
v12 = *(_DWORD *)(v2 + 592) & 0xFFFFFFFD;
if( BpbTrappedBpbState )
{
BpbTrappedBpbState >>= 32;
if( (v9 & 0x4000000000i64) != 0 )
{
_xsaves(v10);
}
else if( (v9 & 0x8000) != 0 )
{
_xsaveopt(v10, v12);
}
else if( (v9 & 0x800000) != 0 )
{
_xsave(v10, v12);
}
else
{
_fxsave(v10);
}
}
v10[6] = _mm_getcsr();
if( (v12 & 0x100) != 0 && (_DWORD)KiIptMsrMask )
KiSaveThreadIptState(v2);
*(_QWORD *)(v2 + 88) = &v33;
if( *(char *)(v2 + 3) < 0 )
{
v13 = __readmsr(0xC0000102);
BpbTrappedBpbState = (unsigned __int64)HIDWORD(v13) << 32;
if( v13 >= MmUserProbeAddress )
v13 = MmUserProbeAddress;
*(_QWORD *)(*(_QWORD *)(v2 + 496) + 128i64) = v13;
}
if( *(_QWORD *)(*(_QWORD *)(v2 + 544) + 1408i64) )
{
v14 = __readmsr(0xC0000100);
BpbTrappedBpbState = HIDWORD(v14);
*(_QWORD *)(v2 + 1512) = v14;
}
if( _bittestandreset(MK_FP(__GS__, 2131i64), 0) )
*(_BYTE *)(v2 + 127) |= 2u;
if( _bittestandreset((signed __int32 *)(v3 + 127), 1u) )
__writegsbyte(0x853u, KeGetPcr()->Prcb.BpbRetpolineState | 1);
v17 = *(_QWORD *)(v3 + 544);
LOBYTE(v17) = (*(_BYTE *)(v1 + 254) | v17) & 0xC2;
if( v17 == *(_QWORD *)(v2 + 544) )
{
LODWORD(v17) = KeGetPcr()->Prcb.BpbRetpolineState;
LOWORD(v17) = v17 & 3;
if( (_WORD)v17 == 1 )
{
_disable();
BpbTrappedRetpolineExitSpecCtrl = KeGetPcr()->Prcb.BpbTrappedRetpolineExitSpecCtrl;
if( KeGetPcr()->Prcb.BpbCurrentSpecCtrl != BpbTrappedRetpolineExitSpecCtrl )
{
__writegsbyte(0x27Au, BpbTrappedRetpolineExitSpecCtrl);
v17 = 72i64;
HIDWORD(BpbTrappedBpbState) = 0;
__writemsr(0x48u, BpbTrappedRetpolineExitSpecCtrl);
}
LODWORD(BpbTrappedBpbState) = KeGetPcr()->Prcb.BpbTrappedBpbState;
if( (BpbTrappedBpbState & 0x10) != 0 )
{
v17 = 73i64;
__writemsr(0x49u, 1ui64);
BpbTrappedBpbState = KeGetPcr()->Prcb.BpbTrappedBpbState;
LODWORD(BpbTrappedBpbState) = (unsigned __int8)BpbTrappedBpbState;
}
if( (BpbTrappedBpbState & 0x40) != 0 )
__flush_rsb();
_mm_lfence();
__writegsbyte(0x853u, KeGetPcr()->Prcb.BpbRetpolineState | 2);
_enable();
}
}
else
{
LOBYTE(v17) = v17 & 0xC0;
KiUpdateSpeculationControl((_KPROCESS *)v17);
}
v19 = *(_QWORD *)(v3 + 184);
if( v19 != *(_QWORD *)(v2 + 184) )
{
_interlockedbittestandset64(
(volatile signed __int32 *)(v19 + 8i64 * *(unsigned __int8 *)(v1 + 208) + 376),
*(unsigned __int8 *)(v1 + 209));
v20 = *(_QWORD *)(v19 + 40);
if( (KiKvaShadow & 1) != 0 )
{
_disable();
if( (v20 & 2) != 0 )
{
v20 |= 0x8000000000000000ui64;
*(_DWORD *)(v1 + 36504) |= 1u;
}
*(_QWORD *)(v1 + 36480) = v20;
v20 &= ~0x8000000000000000ui64;
*(_DWORD *)(v1 + 36504) &= ~2u;
if( _bittest((const signed __int32 *)(v19 + 912), 0) )
*(_DWORD *)(v1 + 36504) ^= 3u;
_enable();
}
__writecr3(v20);
if( (KiKvaShadow & 1) != 0 && (v20 & 2) == 0 )
{
v21 = __readcr4();
v21 ^= 0x80ui64;
__writecr4(v21);
__writecr4(v21 ^ 0x80);
}
v17 = *(unsigned __int8 *)(v1 + 209);
BpbTrappedBpbState = *(_QWORD *)(v2 + 184);
_interlockedbittestandreset64(
(volatile signed __int32 *)(BpbTrappedBpbState + 8i64 * *(unsigned __int8 *)(v1 + 208) + 376),
v17);
}
v22 = *(_QWORD *)(v3 + 40);
if( (KiKvaShadow & 1) != 0 )
*(_QWORD *)(v1 + 36488) = v22;
else
*(_QWORD *)(*(_QWORD *)(v1 - 376) + 4i64) = v22;
*(_QWORD *)(v1 + 40) = v22;
if( v22 >= 0 )
KeBugCheckEx(0x1CEu, (PVOID)v2, (PVOID)v3, 0i64, 0i64);
if( KiCpuTracingFlags )
{
if( (KiCpuTracingFlags & 2) != 0 )
KiClearLastBranchRecordStack();
if( (KiCpuTracingFlags & 4) != 0 )
KiResetProcessorTraceBuffer((_EPROCESS *)v17, (UINT8 *)BpbTrappedBpbState);
}
v23 = *(_QWORD *)(v3 + 592) | KUSER_SHARED_DATA.XState.EnabledSupervisorFeatures & *(_QWORD *)(v2 + 592);
*(_BYTE *)(v2 + 113) = 0;
v24 = *(unsigned int **)(v3 + 96);
v25 = v23 & 0xFFFFFFFFFFFFFFFDui64;
if( v25 )
{
if( (v9 & 0x20000000000i64) != 0 && (v25 & 1) != 0 )
__asm { fninit }
if( (v9 & 0x4000000000i64) != 0 )
{
_xrstors(v24);
}
else if( (v9 & 0x800000) != 0 )
{
_xrstor(v24, (unsigned int)v25);
}
else
{
_fxrstor(v24);
}
}
_mm_setcsr(v24[6]);
if( (v25 & 0x100) != 0 && (_DWORD)KiIptMsrMask )
KiRestoreThreadIptState(v3);
if( !_bittest((const signed __int32 *)(v3 + 116), 0xAu) )
{
v26 = *(_DWORD *)(v3 + 1512);
if( *(_QWORD *)(*(_QWORD *)(v3 + 544) + 1408i64) )
v26 = *(_DWORD *)(v3 + 240) + 0x2000;
v27 = *(_QWORD *)(v1 - 384);
*(_WORD *)(v27 + 82) = v26;
v28 = HIWORD(v26);
*(_BYTE *)(v27 + 84) = v28;
*(_BYTE *)(v27 + 87) = BYTE1(v28);
__writemsr(0xC0000100, *(_QWORD *)(v3 + 1512));
if( (__GS__ & (unsigned __int16)(__ES__ & __DS__)) != 43 )
{
__DS__ = 43;
_disable();
__swapgs();
__swapgs();
_enable();
}
v29 = *(_QWORD *)(v3 + 240);
v30 = *(_DWORD *)(v3 + 244);
*(_QWORD *)(v1 - 336) = v29;
if( (*(_BYTE *)(v3 + 3) & 0x84) != 0 )
{
if( *(char *)(v3 + 3) >= 0 )
{
LODWORD(v29) = *(_DWORD *)(v3 + 1520);
v30 = *(_DWORD *)(v3 + 1524);
}
else
{
v31 = *(_QWORD *)(v3 + 496);
LODWORD(v29) = *(_DWORD *)(v31 + 128);
v30 = *(_DWORD *)(v31 + 132);
}
}
__writemsr(0xC0000102, __PAIR64__(v30, v29));
}
if( (*(_DWORD *)(v1 + 12588) & 0x10001) != 0 )
KeBugCheckEx(0xB8u, (PVOID)v2, (PVOID)v3, 0i64, 0i64);
++*(_DWORD *)(v3 + 340);
if( *(_BYTE *)(v3 + 193) == 1 )
{
if( *(_WORD *)(v3 + 486) | v34 )
HalRequestSoftwareInterrupt(1ui64);
}
}Referenced by:
KiIdleLoop
KiSwapContext
KxDispatchInterrupt