MiCompleteProtoPteFault
NTSTATUS __stdcall MiCompleteProtoPteFault(
_MMSUPPORT_INSTANCE *Vm,
UINT8 VmIrql,
VOID *FaultingAddress,
_MMPTE ProtoPteContents,
UINT64 StoreInstruction,
UINT64 DemandZeroFill,
VOID *TrapInformation){
unsigned int v7;
UINT64 v8;
__int64 v9;
_MMPFN *v10;
union {unsigned __int64 Long;volatile unsigned __int64 VolatileLong;_MMPTE_HARDWARE Hard;_MMPTE_PROTOTYPE Proto;_MMPTE_SOFTWARE Soft;_MMPTE_TIMESTAMP TimeStamp;_MMPTE_TRANSITION Trans;_MMPTE_SUBSECTION Subsect;_MMPTE_LIST List;} *p_u;
__int64 bf_0;
__int64 v13;
__int64 v14;
_CONTROL_AREA *v15;
_EX_FAST_REF *p_FilePointer;
signed __int64 Object;
signed __int64 v18;
_FILE_OBJECT *v19;
unsigned int v20;
signed __int64 v21;
signed __int64 v22;
void *v23;
unsigned __int64 v24;
unsigned __int64 v25;
_EPROCESS *Process;
_MM_SESSION_SPACE *Session;
unsigned int v28;
unsigned __int64 v29;
__int64 v30;
unsigned __int64 v31;
__int64 v32;
_ETHREAD *CurrentThread;
_EPROCESS *v34;
unsigned int v35;
signed __int64 v36;
signed __int64 v37;
__int64 v38;
unsigned int v39;
UINT8 v40;
unsigned __int64 v41;
signed __int64 v42;
signed __int64 v43;
signed __int64 v44;
signed __int64 v45;
unsigned __int64 v46;
_ETHREAD *v47;
void *FsContext;
int StreamSequenceNumber;
unsigned __int64 v50;
_BOOL8 v51;
int LogEntry;
unsigned __int64 *v53;
_QWORD *v54;
__int64 v55;
signed __int32 v56;
char v57;
signed __int32 v58;
VOID **v59;
unsigned __int64 v60;
VOID ***v61;
signed __int32 v62;
unsigned __int64 *v63;
unsigned __int64 v64;
signed __int64 Value;
signed __int64 v66;
_MMPFN *v67;
unsigned __int64 v68;
unsigned __int64 v69;
int v70;
unsigned __int64 v71;
VOID *v72;
_MMPTE *PteLimit;
UINT64 PteBase;
int v75;
UINT64 v76;
char v77;
char PagePrivilege;
unsigned int v79;
char v80;
unsigned __int64 v81;
unsigned __int64 v82;
NTSTATUS v83;
int v84;
INT64 v85;
_EPROCESS *v86;
void **MmHotPatchContext;
bool v88;
union {unsigned __int64 Long;volatile unsigned __int64 VolatileLong;_MMPTE_HARDWARE Hard;_MMPTE_PROTOTYPE Proto;_MMPTE_SOFTWARE Soft;_MMPTE_TIMESTAMP TimeStamp;_MMPTE_TRANSITION Trans;_MMPTE_SUBSECTION Subsect;_MMPTE_LIST List;} v89;
UINT8 v90;
char v91;
unsigned __int64 v92;
_MMPTE v93;
__int64 v94;
int v95;
int v96;
VOID *v97;
UINT64 Diff;
unsigned int v99;
_CONTROL_AREA *v100;
_EPROCESS *v101;
_MMVAD *Address;
_MMVAD *v103;
union {unsigned int LongFlags;_MMVAD_FLAGS VadFlags;_MM_PRIVATE_VAD_FLAGS PrivateVadFlags;_MM_GRAPHICS_VAD_FLAGS GraphicsVadFlags;_MM_SHARED_VAD_FLAGS SharedVadFlags;volatile unsigned int VolatileVadLong;} v104;
INT64 v105;
unsigned __int64 v106;
_MMPFN *v107;
unsigned int v109;
_BYTE *v110;
_UNICODE_STRING *v111;
_MMWSL_INSTANCE *VmWorkingSetList;
int v113;
__int16 v114;
wchar_t *v115;
int v116;
char v117;
__int16 v118;
_UNICODE_STRING *v119;
_MMPFN *v120;
int v121;
char v122;
__int64 v123;
char v124;
INT64 *v125;
NTSTATUS v126;
_MMSUPPORT_INSTANCE *VirtualFaultInfo;
UINT8 v128;
_UNICODE_STRING *IgnoreCase;
INT64 v130;
PWCHAR UpcaseTable;
unsigned __int64 v132;
_CONTROL_AREA *OutControlArea;
UINT64 rcx0;
UINT64 ImagePteIndex;
unsigned __int64 v136;
UINT64 SpinCount;
_EX_FAST_REF *v138;
_FILE_OBJECT *FileObject;
unsigned __int64 v140;
__int64 v141;
unsigned __int64 *v142;
__int64 v143;
union {unsigned __int64 Long;volatile unsigned __int64 VolatileLong;_MMPTE_HARDWARE Hard;_MMPTE_PROTOTYPE Proto;_MMPTE_SOFTWARE Soft;_MMPTE_TIMESTAMP TimeStamp;_MMPTE_TRANSITION Trans;_MMPTE_SUBSECTION Subsect;_MMPTE_LIST List;} *v144;
UINT64 v145;
_MMSUPPORT_INSTANCE *Vma;
_MI_PARTITION *Partition;
__int64 v148;
__int128 v149;
__int64 v150;
VOID *v152;
int Long;
Long = ProtoPteContents.u.Long;
v152 = FaultingAddress;
Vma = (_MMSUPPORT_INSTANCE *)Vm->AgeDistribution[2];
v7 = 0;
rcx0 = *(_QWORD *)&Vm->NextPageColor;
v145 = 0i64;
v130 = 0i64;
LODWORD(ImagePteIndex) = 0;
v8 = (UINT64)MmGetPteBase() + ((rcx0 >> 9) & 0x7FFFFFFFF8i64);
UpcaseTable = (PWCHAR)v8;
v9 = (VmIrql >> 12) & 0xFFFFFFFFFi64;
v143 = v9;
v10 = &MmGetPfnDb()[v9];
p_u = &v10->OriginalPte.u;
IgnoreCase = (_UNICODE_STRING *)v10;
v144 = &v10->OriginalPte.u;
bf_0 = v10->OriginalPte.u.Hard.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0;
Partition = *(_MI_PARTITION **)(*(&stru_140C4DB30 + 267) + 8 * (((unsigned __int64)v10->u4._bf_0 >> 39) & 0x3FF));
v148 = bf_0;
v136 = bf_0;
if( (bf_0 & 0x400) == 0 )
{
v141 = 0i64;
OutControlArea = 0i64;
goto LABEL_102;
}
v13 = bf_0;
if( *(&stru_140C4DB30 + 42) && (bf_0 & 0x10) == 0 )
v13 = bf_0 & ~*(&stru_140C4DB30 + 42);
v14 = v13 >> 16;
v141 = v14;
v15 = *(_CONTROL_AREA **)v14;
OutControlArea = *(_CONTROL_AREA **)v14;
if( PfSnNumActiveTraces )
{
p_FilePointer = &v15->FilePointer;
v138 = &v15->FilePointer;
_m_prefetchw(&v15->FilePointer);
Object = (signed __int64)v15->FilePointer.Object;
if( (Object & 0xF) != 0 )
{
do
{
v18 = _InterlockedCompareExchange64((volatile signed __int64 *)p_FilePointer, Object - 1, Object);
if( Object == v18 )
break;
Object = v18;
}
while( (v18 & 0xF) != 0 );
}
v19 = (_FILE_OBJECT *)(Object & 0xFFFFFFFFFFFFFFF0ui64);
v20 = Object & 0xF;
FileObject = v19;
if( v20 <= 1 )
{
if( !v20 )
{
LABEL_20:
v24 = (unsigned __int8)ExAcquireSpinLockShared((INT64 *)&OutControlArea->ControlAreaLock);
FileObject = (_FILE_OBJECT *)ObFastReferenceObjectLocked(p_FilePointer);
ExReleaseSpinLockSharedFromDpcLevel(&OutControlArea->ControlAreaLock);
__writecr8(v24);
v14 = v141;
LABEL_21:
v25 = v10->PteLong | 0x8000000000000000ui64;
if( (rcx0 < 0xFFFF800000000000ui64 || MiGetSystemRegionType(rcx0) == 1)
&& (Process = KeGetCurrentThread()->ApcState.Process, (Session = Process->Session) != 0i64)
&& (Process->Flags3 & 0x1000) == 0 )
{
v28 = *((_DWORD *)Session + 2);
}
else
{
v28 = -1;
}
v29 = *(_QWORD *)(v14 + 8);
if( (*(_DWORD *)(*(_QWORD *)v14 + 56i64) & 0x20) != 0 )
{
if( v25 < v29 || v25 >= v29 + 8i64 * *(unsigned int *)(v14 + 44) )
{
if( (*(_BYTE *)(v14 + 34) & 2) != 0 )
v30 = (v25 << 9)
- ((__int64)MiGetSharedProtos(*(_CONTROL_AREA **)v14, v28, (_SUBSECTION *)v14)[3].Children[0] << 9);
else
v30 = (v25 << 9) - ((__int64)MiGetSubsectionDriverProtos((_SUBSECTION *)v14)->SubsectionBase << 9);
}
else
{
v30 = (v25 << 9) - (v29 << 9);
}
v31 = ((unsigned __int64)*(unsigned int *)(v14 + 36) << 9) + (v30 & 0xFFFFFFFFFFFFF000ui64);
}
else
{
if( v29 )
v32 = (__int64)(v25 - v29) >> 3 << 12;
else
v32 = 0i64;
v31 = ((*(unsigned int *)(v14 + 36) | ((unsigned __int64)(*(_WORD *)(v14 + 32) & 0xFFC0) << 26)) << 12) + v32;
}
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v132 = v31;
v34 = CurrentThread->Tcb.ApcState.Process;
v35 = OutControlArea->u.LongFlags & 0x20;
_m_prefetchw(&v34->PrefetchTrace);
v36 = (signed __int64)v34->PrefetchTrace.Object;
if( (v36 & 0xF) != 0 )
{
do
{
v37 = _InterlockedCompareExchange64((volatile signed __int64 *)&v34->PrefetchTrace, v36 - 1, v36);
if( v36 == v37 )
break;
v36 = v37;
}
while( (v37 & 0xF) != 0 );
}
v38 = v36 & 0xFFFFFFFFFFFFFFF0ui64;
if( (v36 & 0xFFFFFFFFFFFFFFF0ui64) == 0 )
goto LABEL_97;
v39 = v36 & 0xF;
if( v39 <= 1 )
{
if( v39 )
{
if( ExAcquireRundownProtectionEx((INT64 *)(v38 + 360), 15i64) )
{
_m_prefetchw(&v34->PrefetchTrace);
v42 = (signed __int64)v34->PrefetchTrace.Object;
while( (v42 & 0xF) == 0 )
{
if( v38 != (v42 & 0xFFFFFFFFFFFFFFF0ui64) )
break;
v43 = v42;
v42 = _InterlockedCompareExchange64((volatile signed __int64 *)&v34->PrefetchTrace, v42 + 15, v42);
if( v43 == v42 )
goto LABEL_60;
}
v149 = 0i64;
v150 = 0i64;
_m_prefetchw((const void *)(v38 + 360));
v44 = *(_QWORD *)(v38 + 360);
if( (v44 & 1) != 0 )
{
LABEL_57:
v46 = v44 & 0xFFFFFFFFFFFFFFFEui64;
if( _InterlockedExchangeAdd64((volatile signed __int64 *)v46, 0xFFFFFFFFFFFFFFF1ui64) == 15
&& !_interlockedbittestandreset((volatile signed __int32 *)(v46 + 32), 0) )
{
KeSetEvent((PRKEVENT)(v46 + 8), 0, 0);
}
}
else
{
while( 1 )
{
v45 = v44;
v44 = _InterlockedCompareExchange64((volatile signed __int64 *)(v38 + 360), v44 - 30, v44);
if( v45 == v44 )
break;
if( (v44 & 1) != 0 )
goto LABEL_57;
}
}
}
}
else
{
v40 = 1;
v41 = (unsigned __int8)KeAcquireSpinLockRaiseToDpc(&qword_140C50190);
v38 = v34->PrefetchTrace.Value & 0xFFFFFFFFFFFFFFF0ui64;
if( v38 )
v40 = ExAcquireRundownProtection((_EX_RUNDOWN_REF *)(v38 + 360));
KxReleaseSpinLock(&qword_140C50190);
__writecr8(v41);
if( !v40 )
{
LABEL_96:
p_FilePointer = v138;
LABEL_97:
_m_prefetchw(p_FilePointer);
Value = p_FilePointer->Value;
if( ((unsigned __int64)FileObject ^ p_FilePointer->Value) >= 0xF )
{
LABEL_100:
ObDereferenceObjectDeferDelete((UINT64)FileObject);
}
else
{
while( 1 )
{
v66 = Value;
Value = _InterlockedCompareExchange64((volatile signed __int64 *)p_FilePointer, Value + 1, Value);
if( v66 == Value )
break;
if( ((unsigned __int64)FileObject ^ Value) >= 0xF )
goto LABEL_100;
}
}
p_u = v144;
v8 = (UINT64)UpcaseTable;
v10 = (_MMPFN *)IgnoreCase;
v9 = v143;
goto LABEL_102;
}
}
}
LABEL_60:
if( v38 )
{
if( (CurrentThread->$84F33738BEE95ACDF5C5BF1C8FDC7C8C::_bf_0 & 0x40) == 0 )
{
if( (CurrentThread->Tcb.Process->Flags & 0x100000) == 0
&& (CurrentThread->CrossThreadFlags & 0xE00) >= 0x400
|| CurrentThread == (_ETHREAD *)KeGetCurrentThread() && CurrentThread->IoBoostCount )
{
v47 = *(_ETHREAD **)(v38 + 432);
if( !v47 || v47 == CurrentThread && *(void **)(v38 + 440) == CurrentThread->Cid.UniqueThread )
{
FsContext = FileObject->FsContext;
PfSnGetFileInformation((PFSN_TRACE_HEADER *)v38, FileObject);
if( (*(_BYTE *)(v38 + 484) & 1) == 0 && *(_BYTE *)(*(_QWORD *)(v38 + 352) + 1850i64) == 2 )
_InterlockedOr16((volatile signed __int16 *)(v38 + 484), 1u);
if( v132 < 0x20000000000i64 )
{
StreamSequenceNumber = PfKernelGlobals.StreamSequenceNumber;
v50 = v132 >> 9;
v132 >>= 9;
v142 = 0i64;
v51 = v35 != 0;
if( PfKernelGlobals.StreamSequenceNumber != *(_DWORD *)(v38 + 404) )
{
LogEntry = PfSnTraceGetLogEntry(v38, 1u, &v142);
v50 = v132;
if( LogEntry >= 0 )
{
v53 = v142;
*v142 = *v142 & 0xFFFFFFFFFFFFFFF8ui64 | 2;
*((_DWORD *)v53 + 2) = StreamSequenceNumber;
*(_DWORD *)(v38 + 404) = StreamSequenceNumber;
*(_QWORD *)(v38 + 408) = v38 + 416;
}
}
if( v35 || (v54 = *(_QWORD **)(v38 + 408), *v54 >> 3 != v50) || (void *)v54[1] != FsContext )
{
if( _InterlockedIncrement((volatile signed __int32 *)(v38 + 344)) <= *(_DWORD *)(v38 + 340) )
{
v55 = *(_QWORD *)(v38 + 96);
v56 = _InterlockedExchangeAdd((volatile signed __int32 *)(v55 + 16), 1u);
v57 = (v56 + 1 < 0) ^ __OFADD__(1, v56) | (v56 == -1);
v58 = v56 + 1;
if( v57 )
{
LABEL_90:
_InterlockedExchangeAdd((volatile signed __int32 *)(v38 + 344), 0xFFFFFFFF);
}
else
{
while( v58 > *(_DWORD *)(v55 + 20) )
{
_InterlockedExchangeAdd((volatile signed __int32 *)(v55 + 16), 0xFFFFFFFF);
v59 = PfSnTraceBufferAllocate();
if( v59 )
{
v60 = (unsigned __int8)KeAcquireSpinLockRaiseToDpc((UINT64 *)(v38 + 128));
if( *(_QWORD *)(v38 + 96) == v55 )
{
v61 = *(VOID ****)(v38 + 112);
if( *v61 != (VOID **)(v38 + 104) )
__fastfail(3u);
v59[1] = v61;
*v59 = (VOID *)(v38 + 104);
*v61 = v59;
*(_QWORD *)(v38 + 112) = v59;
++*(_DWORD *)(v38 + 120);
*(_QWORD *)(v38 + 96) = v59;
KxReleaseSpinLock((UINT64 *)(v38 + 128));
__writecr8(v60);
}
else
{
KxReleaseSpinLock((UINT64 *)(v38 + 128));
__writecr8(v60);
ExFreePoolWithTag(v59, 0);
}
v55 = *(_QWORD *)(v38 + 96);
v62 = _InterlockedExchangeAdd((volatile signed __int32 *)(v55 + 16), 1u);
v57 = (v62 + 1 < 0) ^ __OFADD__(1, v62) | (v62 == -1);
v58 = v62 + 1;
if( !v57 )
continue;
}
goto LABEL_90;
}
v63 = (unsigned __int64 *)(v55 + 16i64 * v58 + 8);
v64 = v51 | (8 * v132);
v63[1] = (unsigned __int64)FsContext;
*v63 = v64;
_InterlockedIncrement((volatile signed __int32 *)(v38 + 332));
if( !v51 )
*(_QWORD *)(v38 + 408) = v63;
}
}
else
{
_InterlockedExchangeAdd((volatile signed __int32 *)(v38 + 344), 0xFFFFFFFF);
if( !_InterlockedCompareExchange((volatile signed __int32 *)(v38 + 400), 3, 0) )
ExQueueWorkItem((PWORK_QUEUE_ITEM)(v38 + 368), DelayedWorkQueue);
}
}
}
}
}
else
{
_InterlockedIncrement((volatile signed __int32 *)(v38 + 336));
}
}
ExReleaseRundownProtection((_EX_RUNDOWN_REF *)(v38 + 360));
}
goto LABEL_96;
}
ObReferenceObjectExWithTag(v19, 0xFui64, (UINT64)FaultingAddress);
_m_prefetchw(p_FilePointer);
v21 = p_FilePointer->Value;
while( (v21 & 0xF) == 0 )
{
if( v19 != (_FILE_OBJECT *)(v21 & 0xFFFFFFFFFFFFFFF0ui64) )
break;
v22 = v21;
v21 = _InterlockedCompareExchange64((volatile signed __int64 *)p_FilePointer, v21 + 15, v21);
if( v22 == v21 )
goto LABEL_19;
}
ObpTraceObjectDereferenceIfActive((_OBJECT_HEADER *)&v19[-1].gap80[40], 0xFui64, 0x746C6644ui64);
v23 = (void *)(_InterlockedExchangeAdd64((volatile signed __int64 *)&v19[-1].gap80[40], 0xFFFFFFFFFFFFFFF1ui64)
- 15);
if( (__int64)v23 <= 0 )
{
if( v19[-1].CompletionContext )
KeBugCheckEx(
0x18u,
(PVOID)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ LOBYTE(v19[-1].IrpList.Flink) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)v19 - 48) >> 8)],
v19,
(PVOID)6,
v19[-1].CompletionContext);
if( (__int64)v23 < 0 )
KeBugCheckEx(0x18u, 0i64, v19, (PVOID)5, v23);
ObpDeferObjectDeletion((_OBJECT_HEADER *)&v19[-1].gap80[40]);
}
}
LABEL_19:
if( v19 )
goto LABEL_21;
goto LABEL_20;
}
LABEL_102:
v140 = *(unsigned __int64 *)((char *)&MmGetPteBase()->u.Long + ((v8 >> 9) & 0x7FFFFFFFF8i64));
v67 = &MmGetPfnDb()[(v140 >> 12) & 0xFFFFFFFFFi64];
LODWORD(SpinCount) = 0;
while( _interlockedbittestandset64((volatile signed __int32 *)&v67->u2, 0x3Fui64) )
{
do
KeYieldProcessorEx(&SpinCount);
while( v67->u2._bf_0 < 0 );
}
v67->u2._bf_0 ^= (v67->u2._bf_0 ^ (v67->u2._bf_0 + 1)) & 0x3FFFFFFFFFFFFFFFi64;
_InterlockedAnd64(&v67->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
v68 = *(_QWORD *)v8;
if( (*(_QWORD *)v8 & 0x400i64) == 0 )
goto LABEL_112;
v69 = *(_QWORD *)v8;
if( *(&stru_140C4DB30 + 42) && (v68 & 0x10) == 0 )
v69 = v68 & ~*(&stru_140C4DB30 + 42);
if( HIDWORD(v69) == 0xFFFFFFFF )
{
v70 = (v68 >> 5) & 0x1F;
}
else
{
LABEL_112:
v71 = (v136 >> 5) & 0x1F;
v7 = 1;
if( (v68 & 8) != 0 )
LODWORD(v71) = 1;
v72 = v152;
v70 = v71;
if( v152 )
{
if( (v71 & 4) == 0 )
v72 = 0i64;
v152 = v72;
}
}
PteLimit = MmGetPteLimit();
PteBase = (UINT64)MmGetPteBase();
if( (MiFlags & 0x10000) != 0
&& rcx0 >= 0xFFFF800000000000ui64
&& (rcx0 < PteBase || rcx0 > (unsigned __int64)PteLimit)
&& (v70 & 2) != 0 )
{
if( (MiFlags & 0x20000) != 0
|| (LOBYTE(v75) = MI_PFN_IS_PROTO((_UNICODE_STRING *)v10, (_UNICODE_STRING *)rcx0, (UINT8)PteLimit, 0i64), !v75)
|| (p_u->Long & 0x400) != 0 )
{
PagePrivilege = MiGetPagePrivilege((ULONG_PTR)v10, 0i64, 0i64);
}
else
{
PagePrivilege = v77;
if( MiIsAddressInDriverView(v76) )
PagePrivilege = 1;
}
PteBase = (UINT64)MmGetPteBase();
if( (PagePrivilege & 1) != 0 )
{
v70 = 3;
v152 = 0i64;
}
else if( (PagePrivilege & 8) != 0 )
{
v70 = 1;
v152 = 0i64;
}
else
{
v70 &= ~2u;
if( !v70 )
v70 = 1;
}
PteLimit = MmGetPteLimit();
}
v79 = v70 & 0xFFFFFFE7;
v80 = *((_BYTE *)&v10->u3 + 2) >> 6;
if( v80 != 1 )
{
if( v80 )
{
if( v80 == 2 )
v79 |= 0x18u;
}
else
{
v79 |= 8u;
}
}
v81 = (v9 << 12) | MmProtectToPteMask[v79] & 0xFFFF000000000E7Fui64 | 0x21;
if( v8 < PteBase || v8 > (unsigned __int64)PteLimit )
{
LABEL_161:
v81 |= 0x100ui64;
goto LABEL_162;
}
v82 = (__int64)((v8 << 25) - (PteBase << 25)) >> 16;
if( v8 >= (unsigned __int64)MmGetPdeBase() && v8 <= (unsigned __int64)MmGetPdeLimit() )
{
if( (_MMPTE *)v8 == MmGetPxeSelfRef() )
v81 |= 0x8000000000000000ui64;
else
v81 &= ~0x8000000000000000ui64;
v83 = MiUserPdeOrAbove(v8);
PteBase = (UINT64)MmGetPteBase();
if( v83 )
v81 |= 4ui64;
}
if( v8 <= PteBase + 0x3FFFFFFF78i64 )
v81 |= 4ui64;
if( v82 < 0xFFFF800000000000ui64 )
{
v84 = *(&stru_140C4DB30 + 537);
goto LABEL_160;
}
if( MiGetSystemRegionType(v82) != 1
&& (v82 < (unsigned __int64)MmGetPteBase() || v82 > (unsigned __int64)MmGetPteLimit()) )
{
if( v82 < *(&stru_140C4DB30 + 937) || (v84 = *(&stru_140C4DB30 + 537), v82 > *(&stru_140C4DB30 + 175)) )
v84 = *(&stru_140C4DB30 + 536);
LABEL_160:
if( !v84 )
goto LABEL_162;
goto LABEL_161;
}
LABEL_162:
v85 = v81 & 0xF0FFFFFFFFFFFFFFui64 | 0xA00000000000000i64;
v130 = v85;
if( v152 )
{
if( *(_QWORD *)&Vm->NextPageColor <= 0x7FFFFFFEFFFFui64 )
{
v86 = KeGetCurrentThread()->ApcState.Process;
if( v85 >= 0 && (v86->Flags & 0x10) != 0
|| (MmHotPatchContext = (void **)v86->MmHotPatchContext) != 0i64
&& MmHotPatchContext[3] != MmHotPatchContext + 3 )
{
v85 = v130;
v152 = 0i64;
goto LABEL_185;
}
v85 = v130;
}
if( (v70 & 5) != 5 )
{
v85 |= 0x42ui64;
v88 = (*(_BYTE *)(&v10->u3 + 1) & 0x10) == 0;
v130 = v85;
if( v88 && (*(_DWORD *)(&v10->3 + 1) & 0x400i64) == 0 && MiGetPagingFileOffset(&v10->OriginalPte) )
{
v89.Long = 0i64;
v90 = MiLockPageInline(v10);
v91 = *((_BYTE *)&v10->u3 + 2);
v92 = v90;
if( (v91 & 0x10) == 0 && (*(_DWORD *)(&v10->3 + 1) & 0x400i64) == 0 )
{
if( (v91 & 8) == 0 )
{
v93.u.Long = MiCapturePageFileInfoInline(&v10->OriginalPte, 1ui64, 0i64).u.Long;
v91 = *((_BYTE *)&v10->u3 + 2);
v89.Long = v93.u.Long;
}
*((_BYTE *)&v10->u3 + 2) = v91 | 0x10;
}
_InterlockedAnd64(&v10->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
if( v89.Long )
MiReleasePageFileInfo(Partition, (_MMPTE)v89.Long, 1ui64);
__writecr8(v92);
v85 = v130;
}
if( (v148 & 0x400) != 0 && (Vma->Flags._bf_0 & 7) != 2 )
MiCheckAndUpdateIoAttribution(v10);
}
}
LABEL_185:
v94 = 0i64;
v95 = 0;
v96 = 0;
if( Long || (v10->u4._bf_0 & 0x1000000000i64) == 0 && (__int64)v10->ListEntry.Blink > 0 )
goto LABEL_216;
v97 = (VOID *)rcx0;
if( rcx0 < 0xFFFF800000000000ui64 )
{
if( v141 )
{
if( (OutControlArea->u.LongFlags & 0x20) == 0 )
{
LABEL_216:
v107 = (_MMPFN *)IgnoreCase;
goto LABEL_217;
}
}
else
{
v101 = KeGetCurrentThread()->ApcState.Process;
if( v101->CloneRoot.Root && MiLocateCloneAddress(v101, (VOID *)(v10->PteLong | 0x8000000000000000ui64)) )
goto LABEL_215;
}
if( *(_QWORD *)&KeGetCurrentThread()->ApcState.Process->Vm.Instance.VmWorkingSetList[9].LastAccessClearingRemainder != v94 )
{
Address = MiLocateAddress(v97);
v103 = Address;
if( Address )
{
v104.LongFlags = (unsigned int)Address->Core.u;
if( (v104.LongFlags & 0x70) == 32 && (v104.LongFlags & 0x100000) == 0 && (v104.LongFlags & 0x200000) != 0 )
{
v100 = v103->Subsection->ControlArea;
v99 = (rcx0 >> 12)
+ (((__int64)v103->FirstPrototypePte - *(_QWORD *)v100[1].gap8) >> 3)
- v103->Core.StartingVpn;
if( _bittest((const signed __int32 *)v103[1].Core.VadNode.ParentValue, v99) )
{
Diff = (UINT64)v103[1].Core.NextVad;
v85 = v130;
goto LABEL_204;
}
}
}
}
LABEL_215:
v85 = v130;
goto LABEL_216;
}
if( OutControlArea && (OutControlArea->u.LongFlags & 0x20) == 0 )
goto LABEL_216;
LODWORD(Diff) = MiSystemImageHasPrivateFixups((VOID *)rcx0, &OutControlArea, &ImagePteIndex);
v99 = ImagePteIndex;
LODWORD(v94) = 0;
LODWORD(v100) = (_DWORD)OutControlArea;
LABEL_204:
if( !Diff )
goto LABEL_216;
v96 = MiPrivateFixup((_CONTROL_AREA *)Vm, (ULONG_PTR)v100, (_MMPFN *)v99, v10, Diff, VirtualFaultInfo, v128);
MiLockAndDecrementShareCount(v10, 0i64);
if( v96 == 297 || v96 == -1073741670 )
{
MiLockAndDecrementShareCount(v67, 0i64);
if( v96 == 297 )
return -1073740748;
return v96;
}
if( v96 < 0 )
return v96;
LODWORD(v105) = MiMakeTransitionPteValid((_XSTATE_CONFIGURATION *)UpcaseTable);
v130 = v105;
v85 = v105;
LODWORD(v106) = MI_READ_PTE_LOCK_FREE((INT64)&v130);
v107 = &MmGetPfnDb()[(v106 >> 12) & 0xFFFFFFFFFi64];
v7 = 2;
IgnoreCase = (_UNICODE_STRING *)v107;
if( rcx0 >= 0xFFFF800000000000ui64 && (*((_BYTE *)&v107->u3 + 3) & 8) != 0 )
v95 = 2;
LODWORD(v94) = 0;
v70 = 0;
LABEL_217:
v109 = v94;
if( (v7 & 1) == 0 )
v109 = v70;
v110 = (_BYTE *)(StoreInstruction & 0xFFFFFFFFFFFFFFFEui64);
if( (StoreInstruction & 1) != 0 )
{
if( *v110 == 5 )
v145 = StoreInstruction & 0xFFFFFFFFFFFFFFFEui64;
if( (StoreInstruction & 1) != 0 && *v110 == 3 )
v95 |= 1u;
}
v111 = (_UNICODE_STRING *)BYTE5(Vm->AgeDistribution[3]);
if( ((unsigned __int8)v111 & 8) != 0 )
{
VmWorkingSetList = Vm->VmWorkingSetList;
if( ((unsigned __int8)VmWorkingSetList & 1) == 0
|| *(_BYTE *)((unsigned __int64)VmWorkingSetList & 0xFFFFFFFFFFFFFFFEui64) != 2 )
{
v85 &= ~0x20ui64;
}
}
if( ((unsigned __int8)v111 & 5) != 4 || ((unsigned __int8)v111 & 2) != 0 )
{
v120 = (_MMPFN *)IgnoreCase;
goto LABEL_245;
}
v113 = WORD1(Vm->AgeDistribution[3]);
v114 = 511;
v115 = UpcaseTable;
if( (_WORD)v113 )
{
if( v113 + LOWORD(Vm->AgeDistribution[3]) == (((unsigned int)UpcaseTable >> 3) & 0x1FF) )
{
LOBYTE(v111) = (unsigned __int8)v111 & 0x10;
LOBYTE(v116) = MI_PFN_IS_PROTO((_UNICODE_STRING *)v107, v111, (UINT8)v107, UpcaseTable);
if( v116 )
{
if( !v117 )
goto LABEL_238;
}
else if( v117 )
{
goto LABEL_238;
}
}
MiEmptyDeferredWorkingSetEntries((INT64)&Vm->AgeDistribution[2]);
v114 = 511;
v115 = UpcaseTable;
}
LABEL_238:
v118 = WORD1(Vm->AgeDistribution[3]);
if( v118 )
{
WORD1(Vm->AgeDistribution[3]) = v118 + 1;
v95 |= 4u;
v120 = (_MMPFN *)IgnoreCase;
}
else
{
v119 = (_UNICODE_STRING *)BYTE5(Vm->AgeDistribution[3]);
WORD1(Vm->AgeDistribution[3]) = 1;
LOWORD(Vm->AgeDistribution[3]) = v114 & ((unsigned int)v115 >> 3);
v120 = (_MMPFN *)IgnoreCase;
LOBYTE(v121) = MI_PFN_IS_PROTO(IgnoreCase, v119, (UINT8)v107, v115);
if( v121 )
v124 = v122 & 0xEF;
else
v124 = v122 | 0x10;
*(_BYTE *)(v123 + 69) = v124;
v95 |= 4u;
}
LABEL_245:
LODWORD(VirtualFaultInfo) = v95;
v125 = (INT64 *)UpcaseTable;
if( !MiAllocateWsle(Vma, (_MMPTE *)UpcaseTable, v120, v109, (_MMPTE)v85, (_MI_FAULT_VA_LIST *)VirtualFaultInfo) )
{
MiLockAndDecrementShareCount(v120, 0i64);
if( v7 < 2 )
MiLockAndDecrementShareCount(v67, 0i64);
return -1073741801;
}
if( !v152 || (v85 & 0x800) != 0 || (v85 & 0x200) == 0 || KeGetCurrentThread()->ApcState.Process->ForkInProgress )
return v96;
if( Vm->AgeDistribution[4] && (Vm->AgeDistribution[3] & 0x10000000000i64) == 0 && WORD1(Vm->AgeDistribution[3]) )
MiEmptyDeferredWorkingSetEntries((INT64)&Vm->AgeDistribution[2]);
v126 = MiCopyOnWrite(rcx0, v125, 0xFFFFFFFFFFFFFFFFui64, 0i64);
v96 = v126;
if( v126 >= 0 )
return v96;
MiSetFaultPacketDirectives((INT64)Vm, (unsigned int)v126);
return -1073740748;
}Referenced by:
MiIssueHardFault
MiResolveDemandZeroFault
MiResolveProtoPteFault
MiResolveTransitionFault