MiResolveProtoPteFault
NTSTATUS __stdcall MiResolveProtoPteFault(
UINT64 StoreInstruction,
VOID *FaultingAddress,
_MMPTE *PointerPte,
_MMSUPPORT_INSTANCE *Vm,
UINT8 VmIrql,
_MMPTE *PointerProtoPte,
VOID *TrapInformation,
INT8 PreviousMode,
_MMINPAGE_SUPPORT **ReadBlock){
_MMPTE *PteBase;
UINT64 v12;
UINT64 *v13;
UINT64 v14;
UINT64 v15;
__int64 v16;
unsigned __int64 v17;
_MIPFNBLINK *p_u2;
UINT64 v19;
_MMPFN *v20;
_LIST_ENTRY **p_Blink;
unsigned __int64 v22;
struct {unsigned __int16 ReferenceCount;} *v23;
wchar_t *Buffer;
struct {unsigned __int16 ReferenceCount;} *p_u3;
unsigned __int16 ReferenceCount;
struct {unsigned __int16 ReferenceCount;} *v27;
__int64 v28;
bool v29;
int v30;
__int64 v31;
unsigned __int64 v32;
__int64 v33;
_MMPTE *v34;
unsigned __int64 v35;
_MI_PARTITION *v36;
struct _KPRCB *CurrentPrcb;
signed __int32 CachedResidentAvailable;
signed __int32 v39;
struct {unsigned __int16 ReferenceCount;} *v40;
_MMPTE *v41;
struct {unsigned __int16 ReferenceCount;} *v42;
char v43;
_MIPFNBLINK *v44;
int v45;
_MIPFNBLINK *v46;
_MMPTE *v47;
_MMPTE v48;
unsigned __int64 Long;
_MMPFN *v50;
_MMPTE *v51;
_UNICODE_STRING *Pml4eBase;
unsigned __int64 v53;
UINT8 v54;
wchar_t *PxeUserLimit;
unsigned int PfnPriority;
unsigned int v57;
unsigned __int64 v58;
NTSTATUS result;
int v60;
union {unsigned __int64 Long;volatile unsigned __int64 VolatileLong;_MMPTE_HARDWARE Hard;_MMPTE_PROTOTYPE Proto;_MMPTE_SOFTWARE Soft;_MMPTE_TIMESTAMP TimeStamp;_MMPTE_TRANSITION Trans;_MMPTE_SUBSECTION Subsect;_MMPTE_LIST List;} v61;
__int64 bf_0;
__int64 v63;
__int64 v64;
__int64 v65;
int v66;
_MIPFNBLINK *v67;
unsigned __int16 v68;
_MMVAD *Address;
char v70;
__int64 v71;
union {unsigned int LongFlags;_MMVAD_FLAGS VadFlags;_MM_PRIVATE_VAD_FLAGS PrivateVadFlags;_MM_GRAPHICS_VAD_FLAGS GraphicsVadFlags;_MM_SHARED_VAD_FLAGS SharedVadFlags;volatile unsigned int VolatileVadLong;} v72;
_UNICODE_STRING *v73;
bool v74;
unsigned __int16 v75;
int v76;
__int64 v77;
__int64 v78;
unsigned __int64 v79;
int v80;
_MMPTE *v81;
_UNICODE_STRING *v82;
char *v83;
char v84;
int v85;
unsigned __int64 v86;
unsigned __int64 v87;
__int64 v88;
unsigned __int64 v89;
_MI_PARTITION *v90;
__int64 v91;
signed __int32 v92;
__int64 v93;
unsigned __int64 PteShadow;
unsigned __int64 v95;
_BYTE *v96;
__int64 v97;
VOID *v98;
unsigned int v99;
NTSTATUS v100;
unsigned __int64 v101;
_QWORD *v102;
int v103;
__int16 v104;
__int64 v105;
_MIPFNBLINK *v106;
unsigned __int64 v107;
VOID *v108;
unsigned __int64 v109;
int v110;
char v111;
int v112;
unsigned int v113;
__int64 v114;
_MMPTE *v115;
int v116;
unsigned __int64 v117;
VOID *v118;
int v119;
unsigned __int64 v120;
VOID *StoreInstructiona;
_MMINPAGE_SUPPORT **v122;
_UNICODE_STRING *antNameA;
UINT64 v124;
UINT64 v125;
__int64 v126;
INT64 v127;
UINT64 v128;
struct {unsigned __int16 ReferenceCount;} *v129;
unsigned __int64 v130;
VOID *VirtualAddress;
UINT64 SpinCount;
UINT64 v133;
unsigned __int64 *v134;
_MMPTE *v135;
_LIST_ENTRY **v136;
__int64 v137;
unsigned __int64 v138;
struct {unsigned __int16 ReferenceCount;} *v139;
PteBase = MmGetPteBase();
v127 = 0i64;
PointerPte->u.Long = 0i64;
v137 = *(_QWORD *)(StoreInstruction + 56);
VirtualAddress = *(VOID **)StoreInstruction;
v134 = (unsigned __int64 *)((char *)&PteBase->u.Long + (((unsigned __int64)VirtualAddress >> 9) & 0x7FFFFFFFF8i64));
v12 = *(_QWORD *)(StoreInstruction + 16);
v124 = v12;
v126 = v12 & 1;
if( (v12 & 1) == 0 || (v130 = v12 & 0xFFFFFFFFFFFFFFFEui64, *(_BYTE *)(v12 & 0xFFFFFFFFFFFFFFFEui64) != 1) )
v130 = 0i64;
v128 = *(_QWORD *)(StoreInstruction + 96);
v13 = (unsigned __int64 *)((char *)&PteBase->u.Long + ((v128 >> 9) & 0x7FFFFFFFF8i64));
v125 = *v13;
v14 = v125 & 1;
do
{
if( !v14 )
return -1073741802;
v15 = v125;
if( (v125 & 0x200) != 0 )
return -1073741802;
MiPteInShadowRange((UINT64)&v125);
v16 = (v15 >> 12) & 0xFFFFFFFFFi64;
v17 = 48 * v16;
v138 = 48 * v16;
}
while( (MmGetPfnDb()[v16].u4._bf_0 & 0x4000000000000i64) == 0 );
LODWORD(SpinCount) = 0;
antNameA = (_UNICODE_STRING *)&MmGetPfnDb()[v17 / 0x30];
p_u2 = &MmGetPfnDb()->u2;
while( _interlockedbittestandset64((volatile signed __int32 *)&p_u2[v17 / 8], 0x3Fui64) )
{
do
KeYieldProcessorEx(&SpinCount);
while( p_u2[v17 / 8]._bf_0 < 0 );
}
v19 = *v13;
v125 = v19;
if( (v19 & 1) == 0 || (v19 & 0x200) != 0 || v16 != ((v19 >> 12) & 0xFFFFFFFFFi64) )
{
_InterlockedAnd64(&p_u2[v17 / 8].Lock, 0x7FFFFFFFFFFFFFFFui64);
return -1073741802;
}
v20 = (_MMPFN *)antNameA;
p_Blink = &MmGetPfnDb()->ListEntry.Blink;
v22 = 1i64;
v23 = &MmGetPfnDb()->u3 + 1;
Buffer = antNameA[2].Buffer;
p_u3 = &MmGetPfnDb()->u3;
if( ((unsigned __int64)Buffer & 0x1000000000i64) != 0 || ((unsigned __int64)Buffer & 0x2000000000000i64) != 0 )
goto LABEL_39;
ReferenceCount = p_u3[v17 / 2].ReferenceCount;
v27 = &p_u3[v17 / 2];
v28 = p_u2[v17 / 8]._bf_0 & 0x3FFFFFFFFFFFFFFFi64;
if( ReferenceCount )
{
if( ReferenceCount != 1 )
{
if( ReferenceCount != 2 || !v28 )
goto LABEL_39;
LABEL_22:
if( (v23[v17 / 2].ReferenceCount & 8) == 0 )
goto LABEL_39;
goto LABEL_23;
}
if( !v28 )
goto LABEL_22;
}
LABEL_23:
v29 = 0;
LOBYTE(v30) = MI_PFN_IS_PROTO(antNameA, (_UNICODE_STRING *)p_Blink, (UINT8)Buffer, &p_u3->ReferenceCount);
if( v30 && (*(_DWORD *)(&MmGetPfnDb()[v17 / 0x30].3 + 1) & 0x400i64) != 0 )
{
v29 = 1;
}
else
{
v34 = MmGetPteBase();
v35 = *(_QWORD *)(v17 + v31) | 0x8000000000000000ui64;
if( v35 <= (unsigned __int64)&v34[0x7FFFFFFEFi64] && v35 >= (unsigned __int64)v34 )
v29 = (*(_BYTE *)(v17 + v33) & 0x20) != 0;
}
v36 = *(_MI_PARTITION **)(*(&stru_140C4DB30 + 267) + 8 * ((v32 >> 39) & 0x3FF));
if( v29 )
{
v129 = v27;
if( !MiChargeCommit(v36, 1ui64, 4ui64) )
goto LABEL_40;
}
if( v36 == &Irp )
{
CurrentPrcb = KeGetCurrentPrcb();
CachedResidentAvailable = CurrentPrcb->CachedResidentAvailable;
while( CachedResidentAvailable )
{
if( CachedResidentAvailable == -1 )
break;
v39 = CachedResidentAvailable;
CachedResidentAvailable = _InterlockedCompareExchange(
(volatile signed __int32 *)&CurrentPrcb->CachedResidentAvailable,
CachedResidentAvailable - 1,
CachedResidentAvailable);
if( v39 == CachedResidentAvailable )
goto LABEL_39;
}
}
if( MiChargePartitionResidentAvailable(v36, 1ui64, 0xFFFFFFFFui64) == MiChargeFailed )
{
v129 = v27;
if( v29 )
{
MiReturnCommit(v36, 1ui64);
v129 = v27;
}
goto LABEL_40;
}
LABEL_39:
v40 = &MmGetPfnDb()->u3;
++v40[v17 / 2].ReferenceCount;
v129 = &v40[v17 / 2];
v20 = (_MMPFN *)antNameA;
LABEL_40:
v136 = &MmGetPfnDb()[v17 / 0x30].ListEntry.Blink;
v41 = (_MMPTE *)((unsigned __int64)*v136 | 0x8000000000000000ui64);
v135 = v41;
v42 = &v23[v17 / 2];
v43 = v42->ReferenceCount;
v139 = v42;
if( (v43 & 0x20) != 0 )
{
v44 = &MmGetPfnDb()->u2;
do
{
_InterlockedAnd64(&v44[v17 / 8].Lock, 0x7FFFFFFFFFFFFFFFui64);
v45 = 0;
while( (v42->ReferenceCount & 0x20) != 0 )
{
++v45;
_mm_pause();
}
MiLockPageInline(v20);
v43 = v42->ReferenceCount;
}
while( (v42->ReferenceCount & 0x20) != 0 );
v41 = v135;
v22 = 1i64;
}
LOBYTE(v42->ReferenceCount) = v43 | 0x20;
v46 = &MmGetPfnDb()->u2;
if( (v46[v17 / 8]._bf_0 & 0x4000000000000000i64) == 0 && (v41->u.Long & 0x20) == 0 )
MiWriteValidPteVolatile(v41, 1ui64);
_InterlockedAnd64(&v46[v17 / 8].Lock, 0x7FFFFFFFFFFFFFFFui64);
v47 = (_MMPTE *)v128;
while( 1 )
{
while( 1 )
{
v48.u.Long = v47->u.Long;
if( (v47->u.Long & 1) == 0 )
break;
Long = v47->u.Long;
LABEL_60:
if( (MmGetPfnDb()[(Long >> 12) & 0xFFFFFFFFFi64].u4._bf_0 & 0x4000000000000i64) != 0 )
{
v50 = &MmGetPfnDb()[(Long >> 12) & 0xFFFFFFFFFi64];
HIDWORD(SpinCount) = 0;
while( _interlockedbittestandset64((volatile signed __int32 *)&v50->u2, 0x3Fui64) )
{
do
KeYieldProcessorEx((UINT64 *)((char *)&SpinCount + 4));
while( v50->u2._bf_0 < 0 );
}
if( v47->u.Long == v48.u.Long )
goto LABEL_67;
_InterlockedAnd64(&v50->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
}
}
if( (v48.u.Long & 0x400) != 0 || (v48.u.Long & 0x800) == 0 )
break;
if( !v48.u.Long || !*(&stru_140C4DB30 + 42) || (v48.u.Long & *(&stru_140C4DB30 + 42)) != 0 )
{
Long = v47->u.Long;
if( *(&stru_140C4DB30 + 42) && (v48.u.Long & 0x10) == 0 )
Long = v48.u.Long & ~*(&stru_140C4DB30 + 42);
goto LABEL_60;
}
}
v50 = 0i64;
LABEL_67:
v51 = v47;
Pml4eBase = (_UNICODE_STRING *)MmGetPml4eBase();
v53 = v47->u.Long;
v54 = v53;
PxeUserLimit = (wchar_t *)MmGetPxeUserLimit();
if( v51 >= (_MMPTE *)Pml4eBase && v51 <= (_MMPTE *)PxeUserLimit )
Pml4eBase = (_UNICODE_STRING *)MmGetPml4eBase();
v127 = v53;
if( (v53 & 1) == 0 )
{
if( !v53 )
{
LABEL_150:
MiUnlockProtoPoolPage((ULONG_PTR)antNameA, 0x11u);
return -1073741819;
}
LOBYTE(v93) = 0;
PteShadow = *v134;
if( (*v134 & 0x400) != 0 )
{
v95 = *v134;
if( *(&stru_140C4DB30 + 42) && (PteShadow & 0x10) == 0 )
v95 = PteShadow & ~*(&stru_140C4DB30 + 42);
if( HIDWORD(v95) == 0xFFFFFFFF )
{
v96 = (_BYTE *)StoreInstruction;
v93 = (PteShadow >> 5) & 0x1F;
if( ((PteShadow >> 5) & 0x18) == 16 && (*(_BYTE *)(StoreInstruction + 69) & 8) != 0 )
goto LABEL_267;
v97 = v126;
v98 = FaultingAddress;
LABEL_188:
v104 = v53;
if( *(&stru_140C4DB30 + 42) && (v53 & 0x10) == 0 )
v104 = v53 & ~*(&stru_140C4DB30 + 168);
if( (v104 & 0x400) == 0
&& (v104 & 0x800) == 0
&& (v104 & 4) == 0
&& (v93 & 5) == 5
&& (v98 || (((unsigned __int8)MI_READ_PTE_LOCK_FREE((INT64)&v127) >> 5) & 5) != 4)
&& ((*(_BYTE *)(v137 + 184) & 7) != 0 || !KeGetCurrentThread()->ApcState.Process->CloneRoot.Root)
&& ((MiFlags & 0x10000) == 0 || (unsigned __int64)VirtualAddress < 0xFFFF800000000000ui64 || (v93 & 2) == 0) )
{
v105 = v138;
HIDWORD(v133) = 0;
v106 = &MmGetPfnDb()->u2;
if( _interlockedbittestandset64((volatile signed __int32 *)&v106[v138 / 8], 0x3Fui64) )
{
do
{
do
KeYieldProcessorEx((UINT64 *)((char *)&v133 + 4));
while( *(__int64 *)((char *)&v106->_bf_0 + v105) < 0 );
}
while( _interlockedbittestandset64((volatile signed __int32 *)((char *)v106 + v105), 0x3Fui64) );
}
LOBYTE(v139->ReferenceCount) &= ~0x20u;
MiRemoveLockedPageChargeAndDecRef((_MMPFN *)antNameA);
_InterlockedAnd64((volatile signed __int64 *)((char *)&v106->Lock + v105), 0x7FFFFFFFFFFFFFFFui64);
if( v130 )
{
if( !v97 )
return 0;
v107 = v124 & 0xFFFFFFFFFFFFFFFEui64;
if( *(_BYTE *)(v124 & 0xFFFFFFFFFFFFFFFEui64) != 1 || (*(_DWORD *)(v107 + 80) & 0x4000) == 0 )
return 0;
v108 = (VOID *)v124;
}
else
{
v108 = (VOID *)v124;
v107 = v124 & 0xFFFFFFFFFFFFFFFEui64;
}
if( v97 )
{
if( *(_BYTE *)v107 != 1 && *(_BYTE *)v107 != 3 && *(_BYTE *)v107 != 6 )
goto LABEL_221;
}
else if( KeInvalidAccessAllowed(v108) != 1 )
{
goto LABEL_221;
}
if( (!v97 || *(_BYTE *)v107 != 6) && (unsigned __int64)VirtualAddress >= 0xFFFF800000000000ui64 )
return -1073741819;
LABEL_221:
if( (PteShadow & 0x400) == 0 )
goto LABEL_226;
v109 = PteShadow;
if( *(&stru_140C4DB30 + 42) && (PteShadow & 0x10) == 0 )
v109 = PteShadow & ~*(&stru_140C4DB30 + 42);
if( HIDWORD(v109) != 0xFFFFFFFF )
{
LABEL_226:
PteShadow = v53;
LOBYTE(v110) = MiPteInShadowRange((UINT64)&v127);
if( v110 )
PteShadow = MiReadPteShadow((__int64)&v127, v53);
}
v111 = PteShadow >> 5;
v112 = v111 & 0x18;
v113 = v111 & 2 | 4;
if( v112 == 8 )
{
v113 |= 8u;
}
else if( v112 == 24 )
{
v113 |= 0x18u;
}
v114 = MiSwizzleInvalidPte(32i64 * v113);
v115 = (_MMPTE *)v134;
if( v134 >= (unsigned __int64 *)MmGetPml4eBase()
&& v134 <= (unsigned __int64 *)MmGetPxeUserLimit()
&& (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0
&& (v114 & 1) != 0 )
{
v114 |= 0x8000000000000000ui64;
}
*v134 = v114;
return MiResolveDemandZeroFault(
v96,
v115,
0i64,
(_MMSUPPORT_INSTANCE *)FaultingAddress,
StoreInstructiona,
(UINT64)v122,
(UINT8)antNameA);
}
if( (v53 & 0x400) != 0 )
{
if( (v96[69] & 8) == 0 )
return MiResolveMappedFileFault(
v96,
v51,
(_MMPFN *)antNameA,
(_MMSUPPORT_INSTANCE *)PointerPte,
StoreInstructiona,
v122);
goto LABEL_267;
}
if( (v53 & 0x800) != 0 )
return MiResolveTransitionFault(
v96,
v51,
antNameA,
(_MMSUPPORT_INSTANCE *)FaultingAddress,
PointerPte,
(UINT64)v122,
(UINT8)antNameA,
v124,
(_MMINPAGE_SUPPORT **)v125);
LOBYTE(v116) = MiPteInShadowRange((UINT64)&v127);
if( v116 )
v54 = MiReadPteShadow((__int64)&v127, v53);
if( (v54 & 4) == 0 )
{
if( v130 )
{
if( !v97
|| (v117 = v124 & 0xFFFFFFFFFFFFFFFEui64, *(_BYTE *)(v124 & 0xFFFFFFFFFFFFFFFEui64) != 1)
|| (*(_DWORD *)(v117 + 80) & 0x4000) == 0 )
{
MiUnlockProtoPoolPage((ULONG_PTR)antNameA, 0x11u);
return 0;
}
v118 = (VOID *)v124;
}
else
{
v118 = (VOID *)v124;
v117 = v124 & 0xFFFFFFFFFFFFFFFEui64;
}
if( v97 )
{
if( *(_BYTE *)v117 != 1 && *(_BYTE *)v117 != 3 && *(_BYTE *)v117 != 6 )
return MiResolveDemandZeroFault(
v96,
(_MMPTE *)v128,
(_MMPFN *)antNameA,
(_MMSUPPORT_INSTANCE *)FaultingAddress,
StoreInstructiona,
(UINT64)v122,
(UINT8)antNameA);
}
else if( KeInvalidAccessAllowed(v118) != 1 )
{
return MiResolveDemandZeroFault(
v96,
(_MMPTE *)v128,
(_MMPFN *)antNameA,
(_MMSUPPORT_INSTANCE *)FaultingAddress,
StoreInstructiona,
(UINT64)v122,
(UINT8)antNameA);
}
if( (!v97 || *(_BYTE *)v117 != 6) && (unsigned __int64)VirtualAddress >= 0xFFFF800000000000ui64 )
{
LOBYTE(v119) = MiIsPrototypePteVadLookup(PteShadow);
if( !v119 )
{
LODWORD(v120) = MI_READ_PTE_LOCK_FREE((INT64)&v127);
PteShadow = v120;
}
if( ((PteShadow >> 5) & 0x18) == 16 )
goto LABEL_150;
}
return MiResolveDemandZeroFault(
v96,
(_MMPTE *)v128,
(_MMPFN *)antNameA,
(_MMSUPPORT_INSTANCE *)FaultingAddress,
StoreInstructiona,
(UINT64)v122,
(UINT8)antNameA);
}
if( (v96[69] & 8) == 0 )
return MiResolvePageFileFault(
v96,
v51,
(_MMPFN *)antNameA,
(_MMSUPPORT_INSTANCE *)PointerPte,
StoreInstructiona,
v122);
LABEL_267:
MiUnlockProtoPoolPage((ULONG_PTR)antNameA, 0x11u);
return -1073740748;
}
}
if( (PteShadow & 8) != 0 )
{
v98 = FaultingAddress;
}
else
{
v93 = (v53 >> 5) & 0x1F;
v99 = ((v53 >> 5) & 0x1F) >> 3;
if( v99 == 2 && (*(_BYTE *)(StoreInstruction + 69) & 8) != 0 )
goto LABEL_267;
if( (v53 & 1) == 0 )
{
v98 = FaultingAddress;
if( !FaultingAddress )
LOBYTE(v22) = 0;
if( (char)byte_140010E80[(unsigned __int8)v53 >> 5] - (char)v22 < 10 )
{
v100 = -1073741819;
goto LABEL_181;
}
v97 = v126;
if( v99 == 2 && (!v126 || *(_BYTE *)(v124 & 0xFFFFFFFFFFFFFFFEui64) != 1) )
{
if( MiAllowGuardFault(v124) )
{
v101 = v53 & 0xFFFFFFFFFFFFFC1Fui64 | (32 * ((v53 >> 5) & 0xF));
v102 = (_QWORD *)v128;
LOBYTE(v103) = MiPteInShadowRange(v128);
if( v103 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (v101 & 1) != 0 )
v101 |= 0x8000000000000000ui64;
*v102 = v101;
v100 = -2147483647;
}
else
{
v100 = -1073741819;
}
goto LABEL_181;
}
v51 = (_MMPTE *)v128;
LABEL_187:
v96 = (_BYTE *)StoreInstruction;
goto LABEL_188;
}
v98 = FaultingAddress;
if( FaultingAddress && (v53 & 0xA00) == 0 )
{
v100 = -1073741819;
LABEL_181:
if( v50 )
_InterlockedAnd64(&v50->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
MiUnlockProtoPoolPage((ULONG_PTR)antNameA, 0x11u);
return v100;
}
}
v97 = v126;
goto LABEL_187;
}
if( v130 )
{
PfnPriority = MiGetPfnPriority(v50);
if( v57 > PfnPriority )
*((_BYTE *)&v50->u3 + 3) = v57 | *((_BYTE *)&v50->u3 + 3) & 0xF8;
_InterlockedAnd64(&v50->u2.Lock, v58);
MiUnlockProtoPoolPage((ULONG_PTR)antNameA, 0x11u);
return 0;
}
LOBYTE(v60) = MI_PFN_IS_PROTO((_UNICODE_STRING *)v50, Pml4eBase, 0xFFu, PxeUserLimit);
if( v60 )
{
v61.Long = (unsigned __int64)v50->OriginalPte.u;
if( (v61.Long & 0x400) != 0 && (((unsigned __int64)v50->u4._bf_0 >> 60) & 7) != 3 )
{
bf_0 = v50->OriginalPte.u.Hard.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0;
if( *(&stru_140C4DB30 + 42) && (v61.Long & 0x10) == 0 )
bf_0 = ~*(&stru_140C4DB30 + 42) & v61.Long;
v63 = bf_0 >> 16;
if( (*(_DWORD *)(*(_QWORD *)v63 + 56i64) & 0x20) != 0 )
{
v64 = *(_QWORD *)(*(_QWORD *)(*(_QWORD *)v63 + 96i64) + 40i64);
if( v64 )
{
if( (v64 & 0xFFFFFFFFFFFFFFF8ui64) != 8 && (v64 & 3) != 2 )
{
if( (unsigned __int64)VirtualAddress >= 0xFFFF800000000000ui64 )
{
if( (MiFlags & 0x10000) == 0 || (v61.Long & 0x40) == 0 )
goto LABEL_88;
LABEL_101:
_InterlockedAnd64(&v50->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
MiUnlockProtoPoolPage((ULONG_PTR)antNameA, 0x11u);
return -1073740760;
}
Address = MiLocateAddress(VirtualAddress);
if( !Address )
goto LABEL_101;
v72.LongFlags = (unsigned int)Address->Core.u;
if( (v72.LongFlags & 0x70) != 32 )
goto LABEL_101;
if( (v72.LongFlags & 0xF80) != 128
&& ((Address->u2.LongFlags2 & 0x8000000) == 0 || (v70 & 4) != 0)
&& ((MiFlags & 0x400) == 0 || (*(_BYTE *)(v71 + 34) & 2) == 0) )
{
goto LABEL_101;
}
}
}
}
}
}
LABEL_88:
v65 = 0x3FFFFFFFFFFFFFFFi64;
v50->u2._bf_0 ^= (v50->u2._bf_0 ^ (v50->u2._bf_0 + 1)) & 0x3FFFFFFFFFFFFFFFi64;
_InterlockedAnd64(&v50->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
v66 = 0;
LODWORD(v133) = 0;
v67 = &MmGetPfnDb()->u2;
if( _interlockedbittestandset64((volatile signed __int32 *)&v67[v17 / 8], 0x3Fui64) )
{
do
{
do
KeYieldProcessorEx(&v133);
while( v67[v17 / 8]._bf_0 < 0 );
}
while( _interlockedbittestandset64((volatile signed __int32 *)&v67[v17 / 8], 0x3Fui64) );
v65 = 0x3FFFFFFFFFFFFFFFi64;
}
LOBYTE(v42->ReferenceCount) &= ~0x20u;
v68 = v129->ReferenceCount;
if( !v129->ReferenceCount )
MiBadRefCount((_MMPFN *)antNameA);
v73 = antNameA;
v74 = v68 == 1;
v75 = v68 - 1;
v129->ReferenceCount = v75;
if( v74 )
{
LOBYTE(v76) = MiIsPfnFileOnly((INT64)antNameA);
if( v76 )
goto LABEL_145;
}
v77 = (__int64)v73[2].Buffer;
if( (v77 & 0x1000000000i64) == 0 && (v77 & 0x2000000000000i64) == 0 )
{
v78 = v67[v17 / 8]._bf_0;
v79 = v65 & v78;
if( !v75 )
{
v80 = 1;
goto LABEL_115;
}
if( v75 != 1 )
{
if( v75 == 2 && v79 )
{
LABEL_112:
if( (v42->ReferenceCount & 8) != 0 )
goto LABEL_113;
}
goto LABEL_146;
}
if( !v79 )
goto LABEL_112;
LABEL_113:
v80 = 0;
LABEL_115:
v81 = MmGetPteBase();
v82 = (_UNICODE_STRING *)((unsigned __int64)*v136 | 0x8000000000000000ui64);
if( v82 <= (_UNICODE_STRING *)&v81[0x7FFFFFFEFi64] && v82 >= (_UNICODE_STRING *)v81 )
{
v83 = (char *)&MmGetPfnDb()->u3 + 3;
}
else
{
v83 = (char *)&MmGetPfnDb()->u3 + 3;
v84 = v83[v17];
if( (v84 & 0x20) != 0 )
{
v83[v17] = v84 & 0xDF;
goto LABEL_144;
}
}
LOBYTE(v85) = MI_PFN_IS_PROTO(v73, v82, v77, (PWCHAR)v78);
if( v85 && (*(_DWORD *)(&MmGetPfnDb()[v17 / 0x30].3 + 1) & 0x400i64) != 0 )
{
v66 = 1;
}
else if( v86 <= v89 && v86 >= (unsigned __int64)MmGetPteBase() && (v83[v17] & 0x20) != 0 )
{
v66 = 1;
}
else if( v80 == 1 && (v88 & 0x4000000000000000i64) != 0 )
{
v66 = 1;
}
v77 = (v87 >> 39) & 0x3FF;
v90 = *(_MI_PARTITION **)(*(&stru_140C4DB30 + 267) + 8 * v77);
if( v66 == 1 )
{
MiReturnCommit(*(_MI_PARTITION **)(*(&stru_140C4DB30 + 267) + 8 * v77), 1ui64);
v73 = antNameA;
}
if( v90 == &Irp )
{
v77 = (__int64)KeGetCurrentPrcb();
v91 = *(int *)(v77 + 33564);
if( (_DWORD)v91 != -1 )
{
if( (unsigned __int64)(v91 + 1) <= 0x100 )
{
while( 1 )
{
v92 = _InterlockedCompareExchange((volatile signed __int32 *)(v77 + 33564), v91 + 1, v91);
v74 = (_DWORD)v91 == v92;
LODWORD(v91) = v92;
if( v74 )
break;
if( v92 == -1 || (unsigned __int64)(v92 + 1i64) > 0x100 )
goto LABEL_138;
}
LABEL_144:
if( v80 )
LABEL_145:
MiPfnReferenceCountIsZero((_MMPFN *)v73, (__int64)v17 / 48, v77);
goto LABEL_146;
}
LABEL_138:
if( (int)v91 > 192
&& (_DWORD)v91 != -1
&& (_DWORD)v91 == _InterlockedCompareExchange((volatile signed __int32 *)(v77 + 33564), 192, v91) )
{
v22 = (int)v91 - 192 + 1i64;
}
if( !v22 )
goto LABEL_144;
}
}
_InterlockedExchangeAdd64((volatile signed __int64 *)&v90->Vp.ResidentAvailablePages, v22);
goto LABEL_144;
}
LABEL_146:
_InterlockedAnd64(&MmGetPfnDb()[v17 / 0x30].u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
__incgsdword(0x2E98u);
result = MiCompleteProtoPteFault(
(_MMSUPPORT_INSTANCE *)StoreInstruction,
v54,
FaultingAddress,
0i64,
v124,
(UINT64)v122,
antNameA);
if( result >= 0 )
return 272;
return result;
}Referenced by:
MiDispatchFault