67 DPRINT(
"Creating Profile Object Type\n");
73 RtlZeroMemory(&ObjectTypeInitializer,
sizeof(ObjectTypeInitializer));
75 ObjectTypeInitializer.
Length =
sizeof(ObjectTypeInitializer);
113 if ((!BucketSize) && (RangeBase < (
PVOID)(0x10000)))
127 while (BucketSize >>= 1) Log2++;
128 BucketSize += Log2 + 1;
132 if ((BucketSize > 31) || (BucketSize < 2))
134 DPRINT1(
"Bucket size invalid\n");
139 if ((RangeSize >> (BucketSize - 2)) >
BufferSize)
141 DPRINT1(
"Bucket size too small\n");
146 if (((
ULONG_PTR)RangeBase + RangeSize) < RangeSize)
197 DPRINT1(
"NtCreateProfile: Caller requires the SeSystemProfilePrivilege privilege!\n");
258 *ProfileHandle = hProfile;
287 if (PerformanceFrequency)
307 if (PerformanceFrequency) *PerformanceFrequency = PerfFrequency;
327 PVOID TempLockedBufferAddress;
469 ULONG ReturnInterval;
#define STATUS_PRIVILEGE_NOT_HELD
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
#define NT_SUCCESS(StatCode)
#define ExAllocatePoolWithTag(hernya, size, tag)
#define KeWaitForSingleObject(pEvt, foo, a, b, c)
#define ExGetPreviousMode
VOID NTAPI ProbeForWrite(IN PVOID Address, IN SIZE_T Length, IN ULONG Alignment)
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
LARGE_INTEGER NTAPI KeQueryPerformanceCounter(IN PLARGE_INTEGER PerformanceFreq)
LONG NTAPI ExSystemExceptionFilter(VOID)
#define PROCESS_QUERY_INFORMATION
enum _KPROFILE_SOURCE KPROFILE_SOURCE
#define EXCEPTION_EXECUTE_HANDLER
PVOID NTAPI MmMapLockedPages(IN PMDL Mdl, IN KPROCESSOR_MODE AccessMode)
VOID NTAPI MmProbeAndLockPages(IN PMDL Mdl, IN KPROCESSOR_MODE AccessMode, IN LOCK_OPERATION Operation)
VOID NTAPI MmUnlockPages(IN PMDL Mdl)
VOID NTAPI MmUnmapLockedPages(IN PVOID BaseAddress, IN PMDL Mdl)
#define ExFreePoolWithTag(_P, _T)
#define InitializeObjectAttributes(p, n, a, r, s)
_In_ UINT _In_ UINT _In_ PNDIS_PACKET Source
#define PROFILE_ALL_ACCESS
struct _KPROFILE KPROFILE
NTSYSAPI VOID NTAPI RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString)
#define STANDARD_RIGHTS_READ
#define STANDARD_RIGHTS_WRITE
#define STANDARD_RIGHTS_EXECUTE
POBJECT_TYPE ExProfileObjectType
NTSTATUS NTAPI NtQueryIntervalProfile(IN KPROFILE_SOURCE ProfileSource, OUT PULONG Interval)
NTSTATUS NTAPI NtStopProfile(IN HANDLE ProfileHandle)
NTSTATUS NTAPI NtCreateProfile(OUT PHANDLE ProfileHandle, IN HANDLE Process OPTIONAL, IN PVOID RangeBase, IN SIZE_T RangeSize, IN ULONG BucketSize, IN PVOID Buffer, IN ULONG BufferSize, IN KPROFILE_SOURCE ProfileSource, IN KAFFINITY Affinity)
BOOLEAN NTAPI ExpInitializeProfileImplementation(VOID)
NTSTATUS NTAPI NtStartProfile(IN HANDLE ProfileHandle)
VOID NTAPI ExpDeleteProfile(PVOID ObjectBody)
GENERIC_MAPPING ExpProfileMapping
NTSTATUS NTAPI NtQueryPerformanceCounter(OUT PLARGE_INTEGER PerformanceCounter, OUT PLARGE_INTEGER PerformanceFrequency OPTIONAL)
NTSTATUS NTAPI NtSetIntervalProfile(IN ULONG Interval, IN KPROFILE_SOURCE Source)
VOID NTAPI KeSetIntervalProfile(ULONG Interval, KPROFILE_SOURCE ProfileSource)
BOOLEAN NTAPI KeStopProfile(struct _KPROFILE *Profile)
ULONG NTAPI KeQueryIntervalProfile(KPROFILE_SOURCE ProfileSource)
VOID NTAPI KeInitializeProfile(struct _KPROFILE *Profile, struct _KPROCESS *Process, PVOID ImageBase, SIZE_T ImageSize, ULONG BucketSize, KPROFILE_SOURCE ProfileSource, KAFFINITY Affinity)
BOOLEAN NTAPI KeStartProfile(struct _KPROFILE *Profile, PVOID Buffer)
const LUID SeSystemProfilePrivilege
VOID NTAPI KeInitializeMutex(IN PKMUTEX Mutex, IN ULONG Level)
LONG NTAPI KeReleaseMutex(IN PKMUTEX Mutex, IN BOOLEAN Wait)
POBJECT_TYPE PsProcessType
BOOLEAN NTAPI SeSinglePrivilegeCheck(_In_ LUID PrivilegeValue, _In_ KPROCESSOR_MODE PreviousMode)
Checks if a single privilege is present in the context of the calling thread.
#define STATUS_PROFILING_NOT_STOPPED
#define STATUS_INVALID_PARAMETER_7
#define STATUS_PROFILING_NOT_STARTED
NTSTATUS NTAPI ObInsertObject(IN PVOID Object, IN PACCESS_STATE AccessState OPTIONAL, IN ACCESS_MASK DesiredAccess, IN ULONG ObjectPointerBias, OUT PVOID *NewObject OPTIONAL, OUT PHANDLE Handle)
NTSTATUS NTAPI ObCreateObject(IN KPROCESSOR_MODE ProbeMode OPTIONAL, IN POBJECT_TYPE Type, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN KPROCESSOR_MODE AccessMode, IN OUT PVOID ParseContext OPTIONAL, IN ULONG ObjectSize, IN ULONG PagedPoolCharge OPTIONAL, IN ULONG NonPagedPoolCharge OPTIONAL, OUT PVOID *Object)
NTSTATUS NTAPI ObCreateObjectType(IN PUNICODE_STRING TypeName, IN POBJECT_TYPE_INITIALIZER ObjectTypeInitializer, IN PVOID Reserved, OUT POBJECT_TYPE *ObjectType)
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
#define _SEH2_GetExceptionCode()
#define _SEH2_EXCEPT(...)
#define _SEH2_YIELD(__stmt)
#define ProbeForWriteLargeInteger(Ptr)
#define ProbeForWriteHandle(Ptr)
#define ProbeForWriteUlong(Ptr)
#define STATUS_BUFFER_TOO_SMALL
#define STATUS_BUFFER_OVERFLOW
PULONG MinorVersion OPTIONAL
PVOID LockedBufferAddress
KPROFILE_SOURCE ProfileSource
GENERIC_MAPPING GenericMapping
OB_DELETE_METHOD DeleteProcedure
ULONG DefaultNonPagedPoolCharge
#define RtlZeroMemory(Destination, Length)
#define STATUS_INVALID_PARAMETER
#define STATUS_INSUFFICIENT_RESOURCES
_In_ WDFMEMORY _Out_opt_ size_t * BufferSize
_In_ ULONG _In_ ULONG _In_ ULONG _Out_ PKIRQL _Out_ PKAFFINITY Affinity
#define ObDereferenceObject
_In_ KPROCESSOR_MODE PreviousMode