2

I'm debugging dns.exe in Windows10 1809 and I'm really confused about one condition that often appeared in this file

WPP_GLOBAL_Control == &WPP_GLOBAL_Control

Actually, I have seen this kind of condition a == &a in many other files. Some values are addresses but some are just int values with only 8 bits. Do they use this form because this value is frequently used in other programs and needs to check before use like critical section or sth

if ( (unsigned __int64)v3 < v4 )
  {
    while ( 1 )
    {
      v6 = *v5++;
      if ( v6 > 0x3Fu )
        break;
      if ( v6 )
      {
        ++v1;
        v5 += v6;
        if ( (unsigned __int64)v5 < v4 )
          continue;
      }
      goto LABEL_6;
    }
    v7 = WPP_GLOBAL_Control;
    if ( WPP_GLOBAL_Control == &WPP_GLOBAL_Control
      || (*((_DWORD *)WPP_GLOBAL_Control + 7) & 0x800) == 0
      || *((_BYTE *)WPP_GLOBAL_Control + 25) < 4u )
    {
      return 0i64;
    }



.data:00007FF7B0829D40 WPP_GLOBAL_Control dq offset WPP_GLOBAL_Control
.data:00007FF7B0829D40                                         ; DATA XREF: Aging_UpdateAgingTime+32↑r
.data:00007FF7B0829D40                                         ; Aging_UpdateAgingTime+39↑o ...
.data:00007FF7B0829D48                 align 10h
.data:00007FF7B0829D50 ; PWSTR g_genericDesiredAttrs
Improve this question
1
  • I've wondered about this myself. I think it's merely a sentinel value that shows whether the initialization was done. If you look for xrefs (x in IDA) to WPP_GLOBAL_Control you should see only two instances of w (write) with everything else being reads. In a driver I am reversing right now I see the writes only in WppInitKm and WppCleanupKm. Probably slightly different for user mode, but in all likelihood similar. Much of the WPP/ETW/tracelogging details can be gleaned from headers and the tools that preprocess your code, if you employ WPP.
    – 0xC0000022L ♦
    Jan 11 at 13:16

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.