新版本的CbsCoreInitialize 函数可读性更强
这是 10.0.14393.0 版本。
//----- (10087380)-------------------------------------------------------- int __stdcall CbsCoreInitialize(
structIMalloc *a1,
int a2,
int a3,
int a4,
int a5,
int a6,
int a7,
_DWORD *a8) { phModule =0; v8 =0; v56 =0; v57 =0; v58 =a1; v59 =a8; v60 =0; memset(Dst,0, 0x208u); memset(v64,0, 0x208u); SystemTime.wYear = 0; *(_DWORD *)&SystemTime.wMonth= 0; *(_DWORD *)&SystemTime.wDay= 0; *(_DWORD *)&SystemTime.wMinute= 0; SystemTime.wMilliseconds = 0; if (!a1 ) { v48 ="Invalid Malloc pointer passed in."; LABEL_76: v10 =0x80004003; CBSWdsLog(0x4000000, 0x80004003,1, v48); goto LABEL_77; } if (!a2 ) { v48 ="Invalid TiLockProcess function passed in."; goto LABEL_76; } if (!a3 ) { v48 ="Invalid TiUnlockProcess function passedin."; goto LABEL_76; } if (!a4 ) { v48 ="Invalid InstanceCreated callback passedin."; goto LABEL_76; } if (!a5 ) { v48 ="Invalid InstanceDestroyed callback passedin."; goto LABEL_76; } if (!a7 ) { v48 ="Invalid RequireShutdownProcessing callbackpassed in."; goto LABEL_76; } if (!v59 ) { v48 ="Invalid ClassFactory pointer passed in."; goto LABEL_76; } v9 =SetPrivilegesById(v44, v46, v47); v10 =v9; if (v9 < 0) { CBSWdsLog(0x4000000, v9, 1, "Failed to enable backup and restore privileges for theprocess hosting CBS core."); if (v10 < 0) { CBSWdsLog(0x4000000, v10, 1, "Failed to acquire backup and restore privileges."); goto LABEL_68; } } if (!CbsRegQueryDWORDValue( L"Software\\Microsoft\\Tracing", HKEY_LOCAL_MACHINE, (HKEY)1, L"CbsCheckRefCount", (unsigned__int32)&v57, v50, v53)) { CBSWdsLog( 0x4000000, 0, 0, "CbsCheckRefCountflag is set, CBS object addref/release information will be saved to log"); vbTraceInterfaceRefCount = 1; } if (!GetModuleFileNameW(vhInstance, Dst, 0x104u)) { v33 =GetLastError(); v10 =v33; v34 =v33 < 0; if (v33 > 0) { v10 =(unsigned __int16)v33 | 0x80070000; v34 =v10 < 0; } if (!v34 ) v10 =0x80004005; CBSWdsLog(0x4000000, v10, 1, "Failed to get Core DLL's path."); LABEL_68: if (v10 >= 0) goto LABEL_69; goto LABEL_77; } v11 =FileFromPath(Dst); if (v11 ) { v10 =StringCchCopyNW((size_t)Dst, (size_t *)(v11 - Dst), v51,v54); if (v10 < 0) { CBSWdsLog(0x4000000, v10, 1, "Failed to copy core DLL path into servicing stackdirectory string: %S", Dst); goto LABEL_68; } CBS_EnterCriticalSection(&vCoreInitializeLock); v60 =1; if (GetModuleHandleExW(0,L"wdscore.dll", &phModule)) WdsPostLoad(phModule); else WdsLoad(v64); GetSystemTime(&SystemTime); CBSWdsLog( 0x4000000, 0, 0, "UniversalTime is: d-d-d d:d:d.d", SystemTime.wYear, SystemTime.wMonth, SystemTime.wDay, SystemTime.wHour, SystemTime.wMinute, SystemTime.wSecond, SystemTime.wMilliseconds); v12 =CbsTransactionInitialize(); if (v12 == 1) { CBSWdsLog(0x4000000, 0, 0, "Kernel transactionsare disabled, continuing without transaction support."); v12 =0; } if (v12 < 0) CBSWdsLog(0x4000000, v12, 1, "Failed to load and initialize KTM, continuing withouttransaction support."); v57 =0; OnlineConfigGetProperty(L"DisablePSRL",&v57); if (v57 ) SetCbsCoreMode((char *)4); v13 =OpenEventW(0x100000u, 0, L"Global\\SC_BOOT_SERVICING_DONE"); v14 =v13; if (v13 ) { v35 =WaitForSingleObject(v13, 0); CloseHandle(v14); if (v35 == 258) SetCbsCoreMode((char *)2); v8 =0; } else { v15 =GetLastError(); if (v15 != 2) CBSWdsLog(0x4000000, 0, 0, "Open ofSC_BOOT_SERVICING_DONE event failed %d\n", v15); } v16 =CbsSqmApiLoad(); if (v16 < 0) CBSWdsLog(0x4000000, v16, 1, "Failed to load sqmapi (reports - possiblyexpected)."); v18 =TraceLoggingRegisterEx(v17); if (v18 < 0) CBSWdsLog(0x4000000, v18, 1, "Failed to initialize TraceInfo ETW API (possiblyexpected)."); v19 =CbsEventingReadApiLoad(); if (v19 < 0) CBSWdsLog(0x4000000, v19, 1, "Failed to load eventing read apis (reports - possiblyexpected)."); v20 =CbsSetupApiLoad(); if (v20 < 0) CBSWdsLog(0x4000000, v20, 1, "Failed to load setupapi (reports - possiblyexpected)."); v21 =CbsCatalogInstallationApiLoad(); if (v21 < 0) CBSWdsLog(0x4000000, v21, 1, "Failed to load catalog installation apis (possiblyexpected)."); AppContainerLoad(); v10 =DetermineServicingStackVersion(Dst, v64); if (v10 < 0) { CBSWdsLog(0x4000000, v10, 1, "Failed to determine servicing stack version."); goto LABEL_68; } if (hFile ) SetCbsCoreMode((char *)1); v22 =InitializeRebootInProgressFlag(); if (v22 < 0) CBSWdsLog(0x4000000, v22, 1, "Failed getting reboot in progress volatile key"); v10 =CoreResourcesLoad(v64); if (v10 < 0) { CBSWdsLog(0x4000000, v10, 1, "Failed to initialize core resources."); goto LABEL_68; } v10 =DpxLoad(v64); if (v10 < 0) { CBSWdsLog(0x4000000, v10, 1, "Failed to load DPX DLL."); goto LABEL_68; } v10 =WcpLoad(v64, v23, v52, v55); if (v10 < 0) { CBSWdsLog(0x4000000, v10, 1, "Failed to load WCP DLL."); goto LABEL_68; } v10 =DrupLoad(v64); if (v10 < 0) { CBSWdsLog(0x4000000, v10, 1, "Failed to load DrUpdate DLL."); goto LABEL_68; } v24 =CfgMgr32Load(); if (v24 < 0) CBSWdsLog(0x4000000, v24, 1, "Failed to load CfgMgr32 DLL."); v25 =SrLoad(); if (v25 < 0) CBSWdsLog(0x4000000, v25, 1, "Failed to load SrClient DLL, continuing withoutrestore point support."); v26 =(int (__stdcall*)(structIMalloc *))vpfnSetIsolationIMalloc; v27 =v58; __guard_check_icall_fptr(vpfnSetIsolationIMalloc); v10 =v26(v27); if (v10 < 0) { CBSWdsLog(0x4000000, v10, 1, "Failed to set IMalloc for CSI."); } else { v10 =SessionManagerInitialize(); if (v10 < 0|| (v10= CapabilityManagerInitialize(), v10 <0) ) { CBSWdsLog(0x4000000, v10, 1, "Failed to initialize session manager."); } else { v10 =PublicObjectMonitorInitialize(); if ( v10 < 0 ) { CBSWdsLog(0x4000000, v10, 1, "Failed toinitialize public object monitor."); } else { v10 =ComponentAnalyzerInitialize(); if ( v10 <0 ) { CBSWdsLog(0x4000000, v10, 1, "Failed toinitialize component analyzer"); } else { v10 = ExecutionEngineInitialize(); if ( v10 >=0 ) { v28 = CreateClassFactory(&v56); v10 = v28; if ( v28 <0 ) { v49 = "Failed tocreate class factory."; v45 = v28; } else { hObject = CreateEventW(0, 1, 1, 0); if ( hObject ) { dword_1019AAB4 = CreateEventW(0, 1, 1, 0); if ( dword_1019AAB4 ) { hEvent = CreateEventW(0, 1, 1, 0); if ( hEvent ) { if ( GetEnvironmentVariableW(L"TRACK_WCP_MEMORY_USAGE", 0, 0) ) { v37 = (CServicingStackMemoryProfiler*)operatornew(0x60u); v38 = v37 ?CServicingStackMemoryProfiler::CServicingStackMemoryProfiler(v37) : 0; vpCbsMemoryProfiler= v38; if ( v38 ) CServicingStackMemoryProfiler::Initialize(); } if ( !IsCbsCoreMode(2) ) CbsCoreInitializePhase2(); if ( !hFile ) { v29 = CbsEventRegister(); if ( v29 <0 ) CBSWdsLog( 0x4000000, v29, 1, "Failed to register with event system. We will continue without events."); v10 = 0; } v30 = v58; v31 = v58->lpVtbl->AddRef; __guard_check_icall_fptr(v58->lpVtbl->AddRef); v31(v30); if ( dword_1019AA78 ) { v39 = dword_1019AA78; v40 =dword_1019AA78->lpVtbl->Release; __guard_check_icall_fptr(dword_1019AA78->lpVtbl->Release); v40(v39); } v8 = 0; dword_1019AA78 = v58; dword_1019AAA4 = a2; dword_1019AAB8 = a3; dword_1019AABC = a4; dword_1019AACC = a5; dword_1019AAB0 = a6; dword_1019AA74 = a7; *v59 =v56; gotoLABEL_68; } v36 = GetLastError(); if ( v36 >0 ) v36 = (unsigned__int16)v36 | 0x80070000; v10 = v36; if ( v36 >=0 ) { v10 = 0x80004005; v36 = 0x80004005; } v49 = "Failedcreating StopIdleProcessing event"; } else { v36 = GetLastError(); if ( v36 >0 ) v36 = (unsigned__int16)v36 | 0x80070000; v10 = v36; if ( v36 >=0 ) { v10 = 0x80004005; v36 = 0x80004005; } v49 = "Failedcreating PauseIdleProcessing event"; } } else { v36 = GetLastError(); if ( v36 >0 ) v36 = (unsigned__int16)v36 | 0x80070000; v10 = v36; if ( v36 >=0 ) { v10 = 0x80004005; v36 = 0x80004005; } v49 = "Failedcreating NoActiveSessions event"; } v45 = v36; } CBSWdsLog(0x4000000, v45, 1,v49); v8 = v56; goto LABEL_68; } CBSWdsLog(0x4000000, v10, 1, "Failed toinitialize execution engine."); } } } } v8 =0; goto LABEL_68; } v10 =0x8000FFFF; CBSWdsLog(0x4000000, 0x8000FFFF,1, "Failed tofind the cbscore.dll in the path: %S", Dst); LABEL_77: if (hLibModule ) { WcpUnload(); hLibModule = 0; } if (dword_1019AAC0 ) { vpfnDpxNewJob = 0; FreeLibrary(dword_1019AAC0); dword_1019AAC0 = 0; } if (dword_1019AA7C ) { vpfnDriverUpdateOpenContext = 0; vpfnDriverUpdateCloseContext = 0; vpfnDriverUpdateStageUpdates = 0; vpfnDriverUpdateUnstageUpdates = 0; vpfnDriverUpdateInstallUpdates = 0; vpfnDriverUpdateUninstallUpdates = 0; vpfnDriverUpdateEnableDeviceInstall = 0; dword_1019AA7C = 0; } if (dword_1019AAA8 ) { vpfnCMP_WaitNoPendingInstallEvents = 0; vpfnCMP_GetServerSideDeviceInstallFlags= 0; FreeLibrary(dword_1019AAA8); dword_1019AAA8 = 0; } if (dword_1019AA6C ) { vpfnSrSetRestorePointW = 0; FreeLibrary(dword_1019AA6C); dword_1019AA6C = 0; } CoreResourcesUnload(); AppContainerUnload(); CbsCatalogInstallationApiUnload(); CbsEventingReadApiUnload(); CbsSqmApiUnload(); EventUnregister(dword_10199678,dword_1019967C); dword_10199678 = 0; dword_1019967C = 0; dword_10199660 = 0; CbsEventingReadApiUnload(); AppContainerUnload(); CbsCatalogInstallationApiUnload(); CbsSetupApiUnload(); CbsEventingReadApiUnload(); CbsSqmApiUnload(); vfTransactionsDisabled = 1; WdsUnload(); LABEL_69: if (v8 ) { v41 =*(_DWORD*)v8; v42 =v8; v43 =*(void(__stdcall **)(int))(*(_DWORD *)v8 + 8); __guard_check_icall_fptr(*(_DWORD *)(v41 + 8)); v43(v42); } if (v60 ) CBS_LeaveCriticalSection(&vCoreInitializeLock); return v10; } // 1000841C: using guessed type wchar_taDisablepsrl[12]; // 10008484: using guessed type wchar_taSoftwareMic_11[27]; // 10199660: using guessed type intdword_10199660; // 10199678: using guessed type intdword_10199678; // 1019967C: using guessed type intdword_1019967C; // 1019A188: using guessed type int vfTransactionsDisabled; // 1019AA7C: using guessed type intdword_1019AA7C; // 1019B0A0: using guessed type intvbTraceInterfaceRefCount; // 1019C3D0: using guessed type _DWORD __stdcallEventUnregister(_DWORD, _DWORD); // 1019C74C: using guessed type int (__thiscall*__guard_check_icall_fptr)(_DWORD);
