mirror of
https://github.com/zer0condition/Demystifying-PatchGuard
synced 2026-08-09 13:17:48 +00:00
88 lines
2.7 KiB
C
88 lines
2.7 KiB
C
void __fastcall IopIrpStackProfilerDpcRoutine(
|
|
struct _KDPC *Dpc,
|
|
__int64 DeferredContext,
|
|
unsigned __int64 SystemArgument1,
|
|
unsigned __int64 SystemArgument2)
|
|
{
|
|
unsigned __int64 v8; // rdi
|
|
unsigned int i; // ebx
|
|
__int64 Prcb; // rax
|
|
__int64 v11; // rdx
|
|
_DWORD *v12; // r8
|
|
int v13; // edx
|
|
__int64 j; // rcx
|
|
unsigned int k; // ebx
|
|
__int64 v16; // rax
|
|
_DWORD v17[84]; // [rsp+0h] [rbp-228h] BYREF
|
|
_DWORD *v18; // [rsp+150h] [rbp-D8h]
|
|
__int64 v19[20]; // [rsp+160h] [rbp-C8h] BYREF
|
|
|
|
v18 = v17;
|
|
memset(&v17[40], 0, 0x5Bui64);
|
|
if ( DeferredContext >> 47 != -1 && DeferredContext >> 47 != 0 )
|
|
{
|
|
v17[12] = 0;
|
|
Dpc->Type = 0;
|
|
Dpc->DeferredContext = (void *)(SystemArgument2 >> 8);
|
|
*(_QWORD *)((char *)&v17[60] + 3) = SystemArgument1;
|
|
*(_QWORD *)((char *)&v17[44] + 3) = __ROL8__(DeferredContext, SystemArgument1);
|
|
*(_QWORD *)((char *)&v17[54] + 3) = __ROR8__(Dpc, SystemArgument1);
|
|
Dpc->SystemArgument1 = (void *)((unsigned __int64)Dpc->SystemArgument1 ^ SystemArgument2);
|
|
Dpc->SystemArgument2 = (void *)((unsigned __int64)Dpc->SystemArgument2 ^ SystemArgument1);
|
|
KiCustomAccessRoutine2(DeferredContext);
|
|
}
|
|
memset(v19, 0, sizeof(v19));
|
|
v8 = 0i64;
|
|
for ( i = 0; i < (unsigned int)KeNumberProcessors_0; ++i )
|
|
{
|
|
Prcb = KeGetPrcb(i);
|
|
if ( Prcb )
|
|
{
|
|
v8 += (unsigned int)(*(_DWORD *)(Prcb + 35856) - *(_DWORD *)(Prcb + 35940));
|
|
v11 = 0i64;
|
|
v12 = (_DWORD *)(Prcb + 35776);
|
|
do
|
|
{
|
|
v19[v11++] += (unsigned int)(*v12 - v12[21]);
|
|
++v12;
|
|
}
|
|
while ( v11 < 20 );
|
|
}
|
|
}
|
|
v13 = 20;
|
|
if ( v8 > (unsigned int)IopIrpStackProfilerSampleSize )
|
|
{
|
|
v13 = 0;
|
|
for ( j = 0i64; j < 20; ++j )
|
|
{
|
|
if ( v19[j] > (unsigned __int64)(unsigned int)IopIrpStackProfilerMinSizeThreshold )
|
|
break;
|
|
++v13;
|
|
}
|
|
}
|
|
if ( v13 != 20 )
|
|
{
|
|
IopProcessIrpStackProfiler(v19);
|
|
IopIrpStackProfilerMinSizeThreshold *= 2;
|
|
if ( (unsigned int)IopIrpStackProfilerMinSizeThreshold > 0x1900 )
|
|
IopIrpStackProfilerMinSizeThreshold = 6400;
|
|
IopIrpStackProfilerSampleSize *= 2;
|
|
if ( (unsigned int)IopIrpStackProfilerSampleSize > 0x7D00 )
|
|
IopIrpStackProfilerSampleSize = 32000;
|
|
for ( k = 0; k < (unsigned int)KeNumberProcessors_0; ++k )
|
|
{
|
|
v16 = KeGetPrcb(k);
|
|
if ( v16 )
|
|
{
|
|
*(_OWORD *)(v16 + 35860) = *(_OWORD *)(v16 + 35776);
|
|
*(_OWORD *)(v16 + 35876) = *(_OWORD *)(v16 + 35792);
|
|
*(_OWORD *)(v16 + 35892) = *(_OWORD *)(v16 + 35808);
|
|
*(_OWORD *)(v16 + 35908) = *(_OWORD *)(v16 + 35824);
|
|
*(_OWORD *)(v16 + 35924) = *(_OWORD *)(v16 + 35840);
|
|
*(_DWORD *)(v16 + 35940) = *(_DWORD *)(v16 + 35856);
|
|
}
|
|
}
|
|
}
|
|
_InterlockedOr(&IopIrpStackProfilerFlags, 4u);
|
|
}
|