MmCreatePeb
NTSTATUS __stdcall MmCreatePeb(
_EPROCESS *TargetProcess,
_INITIAL_PEB *InitialPeb,
PEB **Base,
_GROUP_AFFINITY *GroupAffinity){
unsigned int v7;
PVOID v8;
int v9;
void *SectionBaseAddress;
__int16 v11;
__int64 v12;
__int64 v13;
__int16 v14;
__int64 v15;
__int64 v16;
int v17;
int v18;
int v19;
unsigned __int64 v20;
__int64 v21;
bool v22;
_GROUP_AFFINITY *v23;
char *v24;
int v26;
char v27;
char v28;
__int64 v29;
__int64 v30;
_LARGE_INTEGER *SectionOffset;
UINT64 AllocationType;
UINT64 Win32Protect;
UINT16 v34;
_LARGE_INTEGER v36;
UINT64 CapturedViewSize;
__int64 v38;
VOID *CapturedBase;
VOID *v40;
VOID *Basea;
_OWORD v42[10];
UINT64 Size;
__int64 v44;
void *v45;
PEB **v46;
_KAPC_STATE ApcState;
v46 = Base;
Basea = 0i64;
v38 = 0i64;
memset(&ApcState, 0, sizeof(ApcState));
memset(v42, 0i64, sizeof(v42));
CapturedBase = 0i64;
v36.QuadPart = 0i64;
CapturedViewSize = 0i64;
*GroupAffinity = 0i64;
KeQueryGroupMaskProcess(TargetProcess);
_BitScanForward(&v7, v7);
v34 = v7;
GroupAffinity->Group = v7;
KiStackAttachProcess(v8, 0i64, &ApcState);
if( InitNlsSectionPointer )
{
LODWORD(Win32Protect) = 2;
LODWORD(AllocationType) = 5242880;
v9 = MmMapViewOfSection(
InitNlsSectionPointer,
TargetProcess,
&CapturedBase,
0i64,
0i64,
&v36,
&CapturedViewSize,
ViewShare,
AllocationType,
Win32Protect);
if( v9 < 0 )
goto LABEL_30;
}
v40 = 0i64;
v36.QuadPart = 0i64;
CapturedViewSize = 0i64;
LODWORD(Win32Protect) = 2;
LODWORD(AllocationType) = 5242880;
v9 = MmMapViewOfSection(
ExLeapSecondDataSectionPointer,
TargetProcess,
&v40,
0i64,
0i64,
&v36,
&CapturedViewSize,
ViewShare,
AllocationType,
Win32Protect);
if( v9 < 0 || (v9 = MiCreatePebOrTeb(0i64, 0i64, &Basea), v9 < 0) )
{
LABEL_30:
KiUnstackDetachProcess(&ApcState, 0i64);
return v9;
}
else
{
SectionBaseAddress = TargetProcess->SectionBaseAddress;
v45 = SectionBaseAddress;
*(_QWORD *)((char *)v42 + 12) = 10i64;
WORD4(v42[1]) = NtBuildNumber;
DWORD1(v42[1]) = 2;
v11 = CmNtCSDVersion;
WORD5(v42[1]) = CmNtCSDVersion;
*(_QWORD *)&v42[2] = qword_140CFA1B8;
*((_QWORD *)&v42[2] + 1) = qword_140CFA1B0;
*(_QWORD *)&v42[3] = __PAIR64__(NtGlobalFlag, KeNumberProcessors_0);
DWORD2(v42[3]) = NtGlobalFlag2;
*(_QWORD *)&v42[4] = *(&stru_140C4DB30 + 6);
*((_QWORD *)&v42[4] + 1) = (unsigned int)dword_140CFA198;
*(_QWORD *)&v42[5] = qword_140CFA1A8;
*((_QWORD *)&v42[5] + 1) = qword_140CFA1A0;
LOBYTE(v42[6]) = *(_BYTE *)InitialPeb;
BYTE1(v42[6]) = *((_BYTE *)InitialPeb + 3);
*((_QWORD *)&v42[6] + 1) = *((_QWORD *)InitialPeb + 1);
*(_QWORD *)&v42[7] = SectionBaseAddress;
if( CapturedBase )
{
*((_QWORD *)&v42[8] + 1) = (char *)CapturedBase + (unsigned int)InitUnicodeCaseTableDataOffset;
if( InitUnicodeCaseTableDataOffset )
{
*((_QWORD *)&v42[7] + 1) = (char *)CapturedBase + (unsigned int)InitAnsiCodePageDataOffset;
*(_QWORD *)&v42[8] = (char *)CapturedBase + (unsigned int)InitOemCodePageDataOffset;
}
else
{
*((_QWORD *)&v42[7] + 1) = 0i64;
*(_QWORD *)&v42[8] = 0i64;
}
}
else
{
*((_QWORD *)&v42[7] + 1) = 0i64;
v42[8] = 0i64;
}
if( TargetProcess->Session )
HIDWORD(v42[3]) = MmGetSessionId(TargetProcess);
else
HIDWORD(v42[3]) = 0;
*(_QWORD *)&v42[9] = v40;
DWORD2(v42[9]) = 0;
LODWORD(SectionOffset) = 0;
wil_details_FeatureReporting_ReportUsageToService(
(wil_details_FeatureReportingCache *)&WheapErrorSourceTable + 116,
0xCCD568ui64,
0i64,
0i64,
(FEATURE_LOGGED_TRAITS *)&Feature_PdttSupport_logged_traits,
(INT64)SectionOffset);
LODWORD(v12) = RtlImageNtHeader((UINT64)SectionBaseAddress);
v13 = v12;
v38 = v12;
v14 = *(_WORD *)(v12 + 22);
v15 = (__int64)RtlImageDirectoryEntryToData(SectionBaseAddress, 1u, 0xAu, &Size);
v16 = v15;
v44 = v15;
if( v15 )
{
if( (v15 & 3) != 0 )
ExRaiseDatatypeMisalignment();
v13 = v38;
v16 = v44;
v11 = WORD5(v42[1]);
}
v17 = *(unsigned __int16 *)(v13 + 92);
LODWORD(v42[0]) = v17;
v18 = *(unsigned __int16 *)(v13 + 72);
DWORD1(v42[0]) = v18;
DWORD2(v42[0]) = *(unsigned __int16 *)(v13 + 74);
v19 = *(_DWORD *)(v13 + 76);
if( v19 )
{
if( v16 )
{
if( *(_WORD *)(v16 + 76) )
v11 = *(_WORD *)(v16 + 76);
WORD5(v42[1]) = v11;
}
HIDWORD(v42[0]) = (unsigned __int8)v19;
LODWORD(v42[1]) = BYTE1(v19);
WORD4(v42[1]) = HIWORD(v19);
DWORD1(v42[1]) = (v19 ^ 0xBFFFFFFF) >> 30;
}
if( v16 )
{
v20 = *(_QWORD *)(v16 + 64);
GroupAffinity->Mask = v20;
LODWORD(v21) = KeQueryGroupAffinity(v34);
v22 = (v20 & v21) == v20;
v23 = GroupAffinity;
if( !v22 )
GroupAffinity->Mask = 0i64;
}
else
{
v23 = GroupAffinity;
}
if( (v14 & 0x4000) != 0 )
{
v27 = _InterlockedExchangeAdd((_DWORD *)&stru_140C4DB30 + 11, 1u) + 1;
do
{
v28 = v27 & 0x3F;
v29 = 1i64 << v28;
v23->Mask = 1i64 << v28;
v27 = v28 + 1;
LODWORD(v30) = KeQueryGroupAffinity(v34);
v22 = (v30 & v29) == 0;
v23 = GroupAffinity;
}
while( v22 );
v13 = v38;
v11 = WORD5(v42[1]);
v18 = DWORD1(v42[0]);
v17 = v42[0];
}
v24 = (char *)Basea;
*((_QWORD *)Basea + 35) = *(_QWORD *)((char *)v42 + 12);
*((_WORD *)v24 + 144) = WORD4(v42[1]);
*((_DWORD *)v24 + 73) = DWORD1(v42[1]);
*((_WORD *)v24 + 145) = v11;
*(_OWORD *)(v24 + 200) = v42[2];
*((_DWORD *)v24 + 46) = KeNumberProcessors_0;
*((_DWORD *)v24 + 47) = NtGlobalFlag;
*((_DWORD *)v24 + 497) = NtGlobalFlag2;
*((_QWORD *)v24 + 24) = *(&stru_140C4DB30 + 6);
*((_QWORD *)v24 + 99) = (unsigned int)dword_140CFA198;
*((_QWORD *)v24 + 27) = qword_140CFA1A8;
*((_QWORD *)v24 + 28) = qword_140CFA1A0;
*((_DWORD *)v24 + 176) = HIDWORD(v42[3]);
*((_DWORD *)v24 + 74) = v17;
*((_DWORD *)v24 + 75) = v18;
*((_DWORD *)v24 + 76) = DWORD2(v42[0]);
*v24 = v42[6];
v24[3] = BYTE1(v42[6]);
*((_QWORD *)v24 + 1) = *((_QWORD *)&v42[6] + 1);
*((_QWORD *)v24 + 2) = v45;
*((_QWORD *)v24 + 20) = *((_QWORD *)&v42[7] + 1);
*(_OWORD *)(v24 + 168) = v42[8];
*((_QWORD *)v24 + 247) = *(_QWORD *)&v42[9];
*((_DWORD *)v24 + 496) = 0;
if( TargetProcess->WoW64Process
&& (v26 = MiInitializeWowPeb((__int64)v42, v13, (INT64)TargetProcess, (__int64)GroupAffinity), v26 < 0) )
{
KiUnstackDetachProcess(&ApcState, 0i64);
return v26;
}
else
{
KiUnstackDetachProcess(&ApcState, 0i64);
*v46 = (PEB *)v24;
return 0;
}
}
}Referenced by:
PspAllocateProcess