MiPerformImageHotPatch
INT64 MiPerformImageHotPatch(INT64 rcx0, INT64 rdx0, ...){
INT64 v2;
UINT64 *v3;
_QWORD *v4;
_DWORD *v5;
INT64 Process;
int v7;
INT64 v8;
unsigned __int64 v9;
__int64 v10;
const VOID *v11;
UINT64 v12;
size_t v13;
UINT64 *Pool;
CHAR *HotPatchBase;
_DWORD *v16;
_MMVAD_SHORT *v17;
_ETHREAD *CurrentThread;
_MMVAD_SHORT *v19;
_EX_PUSH_LOCK *v20;
INT8 v22;
INT64 v23;
INT64 v24;
INT64 v25;
INT64 ullMultiplicand;
INT64 v27;
INT64 v28;
INT64 v29;
INT64 v30;
INT64 v31;
INT64 v32;
INT64 v33;
INT64 v34;
int v35;
_DWORD v36[3];
PADAPTER_OBJECT DmaAdapter[3];
VOID *Handle;
__int64 v39;
INT8 v40[16];
INT64 v41[18];
INT64 v42[18];
VOID *Base[17];
INT64 a2;
__int64 v47;
_MMVAD_SHORT *Vad;
_UNICODE_STRING *v49;
__int64 v50;
__int64 v51;
__int64 v52;
_QWORD *v53;
va_list va1;
va_list a2a;
va_start(va1, rdx0);
va_start(a2a, rdx0);
a2 = va_arg(va1, _QWORD);
v47 = va_arg(va1, _QWORD);
Vad = va_arg(va1, _MMVAD_SHORT *);
v49 = va_arg(va1, _UNICODE_STRING *);
v50 = va_arg(va1, _QWORD);
v51 = va_arg(va1, _QWORD);
v52 = va_arg(va1, _QWORD);
v53 = va_arg(va1, _QWORD *);
v2 = rdx0;
memset(Base, 0i64, 0x50u);
v39 = 0i64;
v35 = 0;
memset(v42, 0i64, sizeof(v42));
memset(v41, 0i64, sizeof(v41));
Handle = 0i64;
DmaAdapter[0] = 0i64;
v34 = 0i64;
v33 = 0i64;
v3 = 0i64;
v4 = 0i64;
MiInitializeImageHotPatchContext((INT64)v42, 0i64);
MiInitializeImageHotPatchContext((INT64)v41, 0i64);
v5 = v53;
*v53 = 0i64;
Process = (INT64)KeGetCurrentThread()->ApcState.Process;
v32 = Process;
DmaAdapter[1] = (PADAPTER_OBJECT)Process;
if( !*(_QWORD *)(Process + 1360) && (*(_DWORD *)(Process + 1124) & 0x4000000) != 0 )
{
v7 = -1073741637;
goto LABEL_36;
}
if( !v49->Length )
{
v8 = 0i64;
LABEL_23:
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v19 = Vad;
MiLockVad(CurrentThread, Vad);
if( MiVadDeleted(v19) )
{
MiUnlockVad(CurrentThread, v19);
v7 = -1073741800;
}
else
{
MiInitializeImageHotPatchContext((INT64)v42, (INT64)v19);
MiBeginHoldingDirtyFaults(rcx0, (__int64)&v42[11]);
LODWORD(v42[17]) |= 2u;
v7 = MiPrepareToHotPatchImage((INT64)v42, v3, v2);
MiUnlockVad(CurrentThread, v19);
if( v7 >= 0 )
{
MiSetProcessPebHotPatchState(v32);
if( !v49->Length
|| (v36[0] = 0,
LODWORD(v28) = 2,
LODWORD(v27) = HIDWORD(v41[4]),
v7 = RtlApplyHotPatch(
v42[9],
v42[1],
0i64,
0i64,
0i64,
v22,
v23,
v41[9],
v41[1],
v41[10],
v27,
(INT64)v36,
(INT64)v3,
v8,
v28,
0i64,
0i64,
0i64,
v29,
v30,
v31),
v7 >= 0) )
{
v7 = MiApplyImageHotPatch((__int64)v42, (__int64)v41, rdx0, (INT64)v3, v8);
LODWORD(a2) = v7;
if( v7 >= 0 )
{
if( v4 )
{
v4[1] = v34;
v34 = 0i64;
v4[2] = v33;
v33 = 0i64;
--CurrentThread->Tcb.SpecialApcDisable;
v20 = (_EX_PUSH_LOCK *)(rcx0 + 16);
ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)(rcx0 + 16), 0i64);
*v4 = *(_QWORD *)(rdx0 + 56);
*(_QWORD *)(rdx0 + 56) = v4;
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)(rcx0 + 16), 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(v20);
KeAbPostRelease(v20);
KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
v4 = 0i64;
}
v7 = 0;
}
}
}
}
Process = v32;
goto LABEL_36;
}
v7 = MiOpenHotPatchFile(v49, 0, v52, &Handle, (_SECTION **)DmaAdapter, Base, 0i64, v5);
if( v7 < 0 )
goto LABEL_36;
v9 = (unsigned __int64)LODWORD(Base[2]) << 12;
if( v9 > 0xFFFFFFFF )
{
LABEL_8:
v7 = -1073741701;
goto LABEL_36;
}
LODWORD(v10) = RtlFindHotPatchInformation(Base[0]);
v11 = (const VOID *)v10;
v39 = v10;
if( !v10 )
{
v7 = -1073741701;
LODWORD(a2) = -1073741701;
goto LABEL_36;
}
v12 = *(unsigned int *)(v10 + 4);
v35 = v12;
v13 = v12;
Pool = (UINT64 *)MiAllocatePool(64i64, v12, 0x4E495048ui64);
v3 = Pool;
*(_QWORD *)&v36[1] = Pool;
if( !Pool )
{
LABEL_12:
v7 = -1073741670;
goto LABEL_36;
}
memmove(Pool, v11, v13);
HotPatchBase = RtlFindHotPatchBase(v3);
if( !RtlValidateHotPatchBase(v16, (__int64)HotPatchBase, v47, v9) )
goto LABEL_8;
v8 = (INT64)v3 + *((unsigned int *)HotPatchBase + 6);
if( *((_DWORD *)HotPatchBase + 3) != (_DWORD)v50 || *((_DWORD *)HotPatchBase + 2) != (_DWORD)v51 )
{
v7 = -1073741735;
goto LABEL_36;
}
if( *(_DWORD *)(rdx0 + 88) && *v53 == *(_QWORD *)(rdx0 + 80) )
{
v7 = 255;
goto LABEL_36;
}
*(_QWORD *)v40 = 0i64;
LODWORD(v27) = 1;
LODWORD(ullMultiplicand) = 0;
LODWORD(v25) = 16;
LODWORD(v24) = 0;
v7 = MiMapViewOfSectionExCommon(
DmaAdapter[0],
Process,
1ui64,
&v34,
0i64,
(INT64)v40,
v24,
v25,
0i64,
ullMultiplicand,
v27,
(INT64)&v33,
0);
if( v7 >= 0 )
{
v4 = MiAllocatePool(256i64, 0x18ui64, 0x45505048ui64);
if( v4 )
{
v17 = MiObtainReferencedSecureVad((PVOID)(Process ^ v33 ^ *(&stru_140C4DB30 + 12)), (INT64 *)a2a);
MiInitializeImageHotPatchContext((INT64)v41, (INT64)v17);
MiBeginHoldingDirtyFaults(rcx0, (__int64)&v41[11]);
LODWORD(v41[17]) |= 2u;
v7 = MiPrepareToHotPatchImage((INT64)v41, v3, 0i64);
MiUnlockAndDereferenceVad(v17);
if( v7 < 0 )
goto LABEL_36;
v2 = rdx0;
goto LABEL_23;
}
goto LABEL_12;
}
LABEL_36:
if( Handle )
ZwClose((_HANDLE)Handle);
if( Base[0] )
MiUnmapImageInSystemSpace((_MI_SYSTEM_SPACE_IMAGE *)Base);
if( DmaAdapter[0] )
HalPutDmaAdapter(DmaAdapter[0]);
if( v33 )
MmUnsecureVirtualMemory((VOID *)v33);
if( v34 )
MiUnmapViewOfSection((_EPROCESS *)Process, (VOID *)v34, 0i64);
if( v3 )
ExFreePoolWithTag(v3, 0);
if( v4 )
ExFreePoolWithTag(v4, 0);
MiReleaseHotPatchResources((INT64)v42);
MiReleaseHotPatchResources((INT64)v41);
return(unsigned int)v7;
}Referenced by:
MiHotPatchImage