IopAddBugcheckTriageThread
NTSTATUS __stdcall IopAddBugcheckTriageThread(_ETHREAD *TriageThread){
NTSTATUS v1;
int v3;
_BYTE *StackBase;
_BYTE *KernelStack;
unsigned int v6;
VOID *v7;
unsigned int v8;
_LIST_ENTRY *p_IrpList;
_LIST_ENTRY *Flink;
_LIST_ENTRY *v11;
v1 = 0;
v3 = 0;
if( !KiIsAddressRangeValid((INT64)TriageThread, 2200i64) )
return -1073741823;
IoAddTriageDumpDataBlock(TriageThread, (_BYTE *)0x898);
if( (*(&TriageThread->Tcb.MiscFlags + 1) & 0x20000) != 0 )
{
StackBase = TriageThread->Tcb.StackBase;
KernelStack = TriageThread->Tcb.KernelStack;
if( (unsigned __int64)(StackBase - KernelStack) >= 0x3FFF )
v6 = 0x3FFF;
else
v6 = (_DWORD)StackBase - (_DWORD)KernelStack;
v7 = (VOID *)((unsigned __int64)(KernelStack + 7) & 0xFFFFFFFFFFFFFFF8ui64);
IopGetMaxValidMemorySize(v7, v6);
if( v8 )
IoAddTriageDumpDataBlock(v7, (_BYTE *)v8);
}
p_IrpList = &TriageThread->IrpList;
Flink = TriageThread->IrpList.Flink;
v11 = p_IrpList;
while( Flink && Flink != p_IrpList && v3 < 10 )
{
++v3;
if( !KiIsAddressRangeValid((INT64)&Flink[-2], 208i64) || Flink->Blink != v11 )
return -1073741823;
IopAddBugcheckTriageIrp((_IRP *)&Flink[-2], 1u);
v11 = Flink;
Flink = Flink->Flink;
}
return v1;
}Referenced by:
IopAddBugcheckPnpTriageData
IopAddBugcheckPnpWatchdogTriageData
IopAddBugcheckPowerTriageData
IopAddBugcheckTriageDataFromParameters
IopAddBugcheckTriageWorkQueue