четверг, 16 апреля 2020 г.

KiTpExcludedRoutines

As you can guess from name this is array of functions for which you can`t set kernel tracepoint. Curious that this lists differs in x64 and arm64
x64
memmove
memset
memcmp
_alloca_probe
_guard_dispatch_icall
_guard_dispatch_icall_nop
__security_check_cookie
ReadNoFence8
ReadNoFence8
memcpy_s
KiDispatchException
PsGetCurrentProcess
KeGetCurrentThread
PsGetCurrentProcessByThread
KeGetCurrentThread
KeGetCurrentPrcb
KeGetPcr
KeGetCurrentProcessorIndex
KeQueryCurrentStackInformationEx
RtlGetExtendedContextLength
RtlpGetLegacyContextLength
RtlGetExtendedContextLength2
RtlpGetEntireXStateAreaLength
RtlInitializeExtendedContext
RtlInitializeExtendedContext2
RtlLocateExtendedFeature
RtlLocateExtendedFeature2
RtlpValidateContextFlags
RtlCaptureContext
RtlRestoreContext
RtlpGetStackLimits
RtlpGetStackLimitsEx
ExtEnvZeroMemory
KeContextFromKframes
KeContextToKframes
KiGetTrapFrameMode
SANITIZE_VA
KeGetCurrentIrql
ObGetCurrentIrql
KeAreAllApcsDisabled
KeAreInterruptsEnabled
KeThawExecution
KeFreezeExecution
KiSendThawExecution
KeStallExecutionProcessor
KiTpHandleTrap
KiTpCompletion
KeInvalidAccessAllowed
KiIsTraceMemoryAccess
KiBugCheckDebugBreak
DbgBreakPoint
DbgBreakPointWithStatus
RtlCaptureStackBackTrace
RtlpSearchFunctionTable
RtlWalkFrameChain
RtlpWalkFrameChain
RtlVirtualUnwind
RtlpVirtualUnwind
RtlpxVirtualUnwind
RtlLookupFunctionEntry
RtlpLookupFunctionEntryForStackWalks
RtlpIsFrameInBounds
RtlpLogExceptionHandler
RtlpLogExceptionDisposition
RtlpExecuteHandlerForException
HalpTimerClockIpiRoutine
HalpHvCounterQueryCounter
HalpTimerClockInterrupt
PsGetProcessImageFileName
IoThreadToProcess
PsGetCurrentThreadId
PsGetProcessId
PsGetProcessInheritedFromUniqueProcessId
PsGetBaseTrapFrame
PspGetBaseTrapFrame
PsIsSystemThread
KeIsAttachedProcess
KiGetTrapFrameRegister
KiFreezeTargetExecution
KiCheckStall
EtwpLogKernelEvent
EtwpReserveTraceBuffer
PpmIdleUpdateConcurrency
KdPollBreakIn
KeAccumulateTicks
KiBeginThreadAccountingPeriod
KiEndThreadAccountingPeriod
KiAbThreadRemoveBoosts
KeAbPostRelease
KiGetNextTimerExpirationDueTime
KiCheckForTimerExpiration
KiQuantumEnd
HvcallInitInputControl
HvlpAcquireHypercallPage
HvcallInitiateHypercall
HvlpReleaseHypercallPage
HvlpGetRegister64
HvlpSetRegister64
HvlpGetRegister128
HvlGetReferenceTimeUsingTscPage
RtlUnsignedMultiplyHigh
KeZeroPages
KeZeroSinglePage
SymCryptWipeAsm
KeQueryPerformanceCounter
PoIdle
KiIdleLoop
PfpLogPageAccess
HalpGetPteAddress
KiBeginCounterAccumulation
KiEndDebugAccumulation
KiAccumulateProcessorCycleStats
MiAgePte
MiAgePteWorker
MiWalkPageTables
MiAgeWorkingSet
MiAgeWorkingSetTail
MiWalkPageTablesRecursively
MiTrimOrAgeWorkingSet
MiProcessWorkingSets
MiWorkingSetManager
MiComputePxeWalkAction
MiFastLockLeafPageTable
MiLockNestedPageAtDpcInline
MiIsPfn
MiIdentifyPfnWrapper
MiIdentifyPfn
MiGetPfnPageSizeIndex
MiGetBaseResidentPage
MI_PFN_IS_PROTO
MI_READ_PTE_LOCK_FREE
MiDeleteVa
MiSetVaAgeList
MiGetNextPageTablePte
MiLockPageTableInternal
MiUnlockPageTableInternal
MiLogPageAccess
MiClearPteAccessed
MiGetSystemRegionIndex
MiGetSystemRegionType
MmIsSessionAddress
KeIdleSpecCtrl
KiGeneralProtectionFault
KeCopyLastBranchInformation
KiExceptionDispatch
KiExceptionDispatchOnExceptionStack
KxExceptionDispatchOnExceptionStack
KiInterruptDispatchNoLockNoEtw
KiInterruptSubDispatchNoLockNoEtw
KiInterruptSubDispatch
KiBreakpointTrap
KiBreakpointTrapShadow
KiDoubleFaultAbort
KxContextToKframes
KzRaiseIrql
KzLowerIrql
SANITIZE_EFLAGS
SANITIZE_DRADDR
KiGetAllocatedXSaveArea
KiCopyXStateArea
RtlXSave
KiUmsExceptionEntry
RtlpConvertFunctionEntry
RtlCaptureContext2
KiNmiInterruptStart
KxNmiInterrupt
KiProcessNMI
KiCheckForFreezeExecution
HalPerformEndOfInterrupt
HvlEndSystemInterrupt
HalpTscQueryCounterOrdered
KiDpcInterruptBypass
HvlWriteApicCommandRegister
HvlPerformEndOfInterrupt
KeRestoreSupervisorState
KiIpiInterruptSubDispatch
KiIpiInterrupt
KiRaiseAssertion
MiPteInShadowRange
VfIsVerifierEnabled
HalpApicRequestInterrupt
HvlWriteApicCommandRegister
KeShouldYieldProcessor


arm64
memmove
memset
memcmp
_alloca_probe
_guard_dispatch_icall
_guard_dispatch_icall_nop
__security_check_cookie
ReadNoFence8
ReadBooleanNoFence
memcpy_s
KiDispatchException
PsGetCurrentProcess
KeGetCurrentThread
PsGetCurrentProcessByThread
KeGetCurrentThread
KeGetCurrentPrcb
KeGetPcr
KeGetCurrentProcessorIndex
KeQueryCurrentStackInformationEx
RtlGetExtendedContextLength
RtlpGetLegacyContextLength
RtlGetExtendedContextLength2
RtlpGetEntireXStateAreaLength
RtlInitializeExtendedContext
RtlInitializeExtendedContext2
RtlLocateExtendedFeature
RtlLocateExtendedFeature2
RtlpValidateContextFlags
RtlCaptureContext
RtlRestoreContext
RtlpGetStackLimits
RtlpGetStackLimitsEx
RtlZeroMemory
KeContextFromKframes
KeContextToKframes
KiGetTrapFrameMode
SANITIZE_VA
KeGetCurrentIrql
KeGetEffectiveIrql
KeAreAllApcsDisabled
KeAreInterruptsEnabled
KeThawExecution
KeFreezeExecution
KiSendThawExecution
KeStallExecutionProcessor
KiTpHandleTrap
KiTpCompletion
KeInvalidAccessAllowed
KiIsTraceMemoryAccess
KiBugCheckDebugBreak
DbgBreakPoint
DbgBreakPointWithStatus
RtlCaptureStackBackTrace
RtlpSearchFunctionTable
RtlWalkFrameChain
RtlpWalkFrameChain
RtlVirtualUnwind
RtlpVirtualUnwind
RtlpxVirtualUnwind
RtlLookupFunctionEntry
RtlpLookupFunctionEntryForStackWalks
RtlpIsFrameInBounds
RtlpLogExceptionHandler
RtlpLogExceptionDisposition
RtlpExecuteHandlerForException
HalpTimerClockIpiRoutine
HalpHvCounterQueryCounter
HalpTimerClockInterrupt
PsGetProcessImageFileName
IoThreadToProcess
PsGetCurrentThreadId
PsGetProcessId
PsGetProcessInheritedFromUniqueProcessId
PsGetBaseTrapFrame
PspGetBaseTrapFrame
PsIsSystemThread
KeIsAttachedProcess
KiGetTrapFrameRegister
KiFreezeTargetExecution
KiCheckStall
EtwpLogKernelEvent
EtwpReserveTraceBuffer
PpmIdleUpdateConcurrency
KdPollBreakIn
KeAccumulateTicks
KiBeginThreadAccountingPeriod
KiEndThreadAccountingPeriod
KiAbThreadRemoveBoosts
KeAbPostRelease
KiGetNextTimerExpirationDueTime
KiCheckForTimerExpiration
KiQuantumEnd
HvcallInitInputControl
HvlpAcquireHypercallPage
HvcallInitiateHypercall
HvlpReleaseHypercallPage
HvlpGetRegister64
HvlpSetRegister64
HvlpGetRegister128
HvlGetReferenceTimeUsingTscPage
RtlUnsignedMultiplyHigh
KeZeroPages
KeZeroSinglePage
SymCryptWipeAsm
KeQueryPerformanceCounter
PoIdle
KiIdleLoop
PfpLogPageAccess
HalpGetPteAddress
KiBeginCounterAccumulation
KiEndDebugAccumulation
KiAccumulateProcessorCycleStats
MiAgePte
MiAgePteWorker
MiWalkPageTables
MiAgeWorkingSet
MiAgeWorkingSetTail
MiWalkPageTablesRecursively
MiTrimOrAgeWorkingSet
MiProcessWorkingSets
MiWorkingSetManager
MiComputePxeWalkAction
MiFastLockLeafPageTable
MiLockNestedPageAtDpcInline
MiIsPfn
MiIdentifyPfnWrapper
MiIdentifyPfn
MiGetPfnPageSizeIndex
MiGetBaseResidentPage
MI_PFN_IS_PROTO
MiGetPfnLink
MiDeleteVa
MiSetVaAgeList
MiGetNextPageTablePte
MiLockPageTableInternal
MiUnlockPageTableInternal
MiLogPageAccess
MiClearPteAccessed
MiGetSystemRegionIndex
MiGetSystemRegionType
MmIsSessionAddress

Комментариев нет:

Отправить комментарий