I'm debugging dns.exe in Windows10 1809 and I'm really confused about one condition that often appeared in this file

WPP_GLOBAL_Control == &WPP_GLOBAL_Control

Actually, I have seen this kind of condition a == &a in many other files. Some values are addresses but some are just int values with only 8 bits. Do they use this form because this value is frequently used in other programs and needs to check before use like critical section or sth

if ( (unsigned __int64)v3 < v4 )
    while ( 1 )
      v6 = *v5++;
      if ( v6 > 0x3Fu )
      if ( v6 )
        v5 += v6;
        if ( (unsigned __int64)v5 < v4 )
      goto LABEL_6;
    v7 = WPP_GLOBAL_Control;
    if ( WPP_GLOBAL_Control == &WPP_GLOBAL_Control
      || (*((_DWORD *)WPP_GLOBAL_Control + 7) & 0x800) == 0
      || *((_BYTE *)WPP_GLOBAL_Control + 25) < 4u )
      return 0i64;

.data:00007FF7B0829D40 WPP_GLOBAL_Control dq offset WPP_GLOBAL_Control
.data:00007FF7B0829D40                                         ; DATA XREF: Aging_UpdateAgingTime+32↑r
.data:00007FF7B0829D40                                         ; Aging_UpdateAgingTime+39↑o ...
.data:00007FF7B0829D48                 align 10h
.data:00007FF7B0829D50 ; PWSTR g_genericDesiredAttrs
  • I've wondered about this myself. I think it's merely a sentinel value that shows whether the initialization was done. If you look for xrefs (x in IDA) to WPP_GLOBAL_Control you should see only two instances of w (write) with everything else being reads. In a driver I am reversing right now I see the writes only in WppInitKm and WppCleanupKm. Probably slightly different for user mode, but in all likelihood similar. Much of the WPP/ETW/tracelogging details can be gleaned from headers and the tools that preprocess your code, if you employ WPP.
    – 0xC0000022L
    Jan 11 at 13:16


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.