MiMapProcessExecutable
NTSTATUS __stdcall MiMapProcessExecutable(
_EPROCESS *ProcessToInitialize,
_SECTION *Section,
UINT64 *CreateFlags,
VOID *NoAccessVa){
union {unsigned int LongFlags;_MMSECTION_FLAGS Flags;} v4;
int v8;
__int64 v9;
NTSTATUS v10;
INT64 v11;
NTSTATUS v12;
int v13;
unsigned int v14;
NTSTATUS v15;
int v16;
NTSTATUS result;
INT64 v18;
char v19;
INT64 v20;
INT64 v21;
INT64 v22;
INT64 v23;
INT64 v24;
INT64 v25;
INT64 v26;
UINT64 v27[2];
__int128 v28;
INT64 v29;
INT64 v30;
v4.LongFlags = (unsigned int)Section->u;
*(_OWORD *)v27 = 0i64;
v28 = 0i64;
if( (v4.LongFlags & 0x20) == 0 )
return -1073741751;
if( (*(_DWORD *)CreateFlags & 0x80u) == 0 || (result = MiSessionCreate((UINT64 *)ProcessToInitialize), result >= 0) )
{
LODWORD(v23) = 0;
v8 = *(_DWORD *)CreateFlags;
v30 = 0i64;
v29 = 0i64;
v9 = 4i64;
v24 = 0i64;
LODWORD(v22) = 1;
LODWORD(v21) = 4;
LODWORD(v20) = (v8 & 0x10) << 25;
v25 = 5i64;
v26 = 32i64;
v10 = MmMapViewOfSectionEx(
Section,
(INT64)ProcessToInitialize,
&v29,
(INT64)&v24,
(INT64)&v30,
v20,
v21,
(INT64)&v25,
v22,
v23,
0i64);
v11 = v29;
v12 = v10;
ProcessToInitialize->SectionBaseAddress = (void *)v29;
if( v10 >= 0 )
{
v13 = *(_DWORD *)CreateFlags;
v14 = 0;
if( (*(_DWORD *)CreateFlags & 0x10) != 0 )
{
MiFillPteHierarchy(v11, v27);
do
{
v18 = v27[--v9];
v19 = MI_READ_PTE_LOCK_FREE(v18);
if( (v19 & 1) == 0 )
break;
if( v19 < 0 )
{
v14 = 1;
break;
}
}
while( v9 != 1 );
if( v14 )
v14 &= -((v13 & 0x20) != 0);
else
*(_DWORD *)CreateFlags = v13 & 0xFFFFFFEF;
}
v15 = PsMapSystemDlls(ProcessToInitialize, v14);
if( v15 < 0 )
v12 = v15;
if( v12 >= 0 )
{
v16 = MiCfgInitializeProcess(ProcessToInitialize);
if( v16 < 0 )
return v16;
}
}
return v12;
}
return result;
}Referenced by:
MmInitializeProcessAddressSpace