MiDispatchFault
NTSTATUS __stdcall MiDispatchFault(
UINT64 FaultStatus,
VOID *VirtualAddress,
_MMPTE *PointerProtoPte,
UINT64 RecheckAccess,
_MMSUPPORT_INSTANCE *Vm,
UINT8 VmIrql,
VOID *TrapInformation,
_MMVAD *Vad,
CHAR PreviousMode,
_MMINPAGE_SUPPORT **InPageSupport){
__m128i v10;
__int128 v12;
__int128 v13;
__m128i v14;
__int128 v15;
__int128 v16;
__int128 v17;
__int128 v18;
_MMSUPPORT_INSTANCE *v19;
unsigned __int64 v20;
NTSTATUS v21;
unsigned __int64 v22;
unsigned __int64 v23;
_MMSUPPORT_INSTANCE *v24;
unsigned __int64 v25;
unsigned __int64 v26;
_MMPTE v27;
int v28;
unsigned __int64 v29;
__int16 v30;
bool v31;
NTSTATUS(__stdcall *v32)();
NTSTATUS v33;
int v34;
char v35;
char MinimumWorkingSetSize;
_KGATE *ExitOutswapGate;
__int64 v39;
__int64 v40;
NTSTATUS v41;
NTSTATUS v42;
NTSTATUS v43;
unsigned __int64 v44;
unsigned __int64 v45;
int v46;
__int64 v47;
unsigned __int64 v48;
NTSTATUS v49;
int v50;
UINT64 v51;
int v52;
VOID *v53;
_MMPTE *PageLockHeld;
UINT8 v55[8];
INT8 ReadBlock[8];
_MMSUPPORT_INSTANCE PointerPte;
*(_QWORD *)VirtualAddress = 0i64;
v10 = *(__m128i *)FaultStatus;
v12 = *(_OWORD *)(FaultStatus + 32);
v13 = *(_OWORD *)(FaultStatus + 80);
v14 = *(__m128i *)(FaultStatus + 48);
v15 = *(_OWORD *)(FaultStatus + 16);
PointerPte.VmWorkingSetList = (_MMWSL_INSTANCE *)VirtualAddress;
*(_OWORD *)&PointerPte.AgeDistribution[3] = v12;
v16 = *(_OWORD *)(FaultStatus + 64);
*(_QWORD *)&PointerPte.NextPageColor = 0i64;
*(_OWORD *)&PointerPte.MinimumWorkingSetSize = v13;
v17 = *(_OWORD *)(FaultStatus + 112);
*(_OWORD *)&PointerPte.AgeDistribution[7] = v16;
v18 = *(_OWORD *)(FaultStatus + 96);
*(_OWORD *)&PointerPte.WorkingSetPrivateSize = v17;
*(__m128i *)&PointerPte.WorkingSetExpansionLinks.Blink = v10;
*(_OWORD *)&PointerPte.WorkingSetLeafPrivateSize = v18;
*(_QWORD *)&v18 = *(_QWORD *)(FaultStatus + 128);
*(__m128i *)&PointerPte.AgeDistribution[5] = v14;
PointerPte.AgeDistribution[0] = _mm_srli_si128(v10, 8).m128i_u64[0];
v19 = (_MMSUPPORT_INSTANCE *)(PointerPte.AgeDistribution[0] & 2);
PointerPte.PeakWorkingSetSize = v18;
PointerPte.TrimmedPageCount = _mm_srli_si128(v14, 8).m128i_u64[0];
v20 = (unsigned __int64)MmGetPteBase() + (((unsigned __int64)v10.m128i_i64[0] >> 9) & 0x7FFFFFFFF8i64);
*(_OWORD *)&PointerPte.AgeDistribution[1] = v15;
v21 = 0;
if( (v15 & 1) == 0
|| (*(_QWORD *)ReadBlock = v15 & 0xFFFFFFFFFFFFFFFEui64, *(_BYTE *)(v15 & 0xFFFFFFFFFFFFFFFEui64) != 5) )
{
if( (v15 & 1) == 0
|| (*(_QWORD *)ReadBlock = v15 & 0xFFFFFFFFFFFFFFFEui64, *(_BYTE *)(v15 & 0xFFFFFFFFFFFFFFFEui64) != 2)
&& ((v15 & 1) == 0
|| (*(_QWORD *)ReadBlock = v15 & 0xFFFFFFFFFFFFFFFEui64, *(_BYTE *)(v15 & 0xFFFFFFFFFFFFFFFEui64) != 1)) )
{
*(_QWORD *)ReadBlock = 0i64;
}
}
v22 = 0i64;
LODWORD(v23) = MiComputeMaximumFaultCluster((UINT64 *)&PointerPte.WorkingSetExpansionLinks.Blink, 0i64);
v25 = v23;
if( v23 > 1 )
BYTE5(PointerPte.AgeDistribution[7]) |= 4u;
BYTE5(PointerPte.AgeDistribution[7]) &= ~2u;
if( !v23 )
goto LABEL_34;
v26 = PointerPte.AgeDistribution[1];
while( 1 )
{
if( (PointerPte.AgeDistribution[7] & 0x80000000000i64) != 0 )
{
if( (*(_BYTE *)(PointerPte.TrimmedPageCount + 187) & 8) != 0
|| (*(_BYTE *)(PointerPte.TrimmedPageCount + 184) & 0x40) != 0
&& (unsigned __int64)(*(_QWORD *)(PointerPte.TrimmedPageCount + 120) + 1i64) >= *(_QWORD *)(PointerPte.TrimmedPageCount
+ 152) )
{
goto LABEL_34;
}
LOBYTE(v46) = MiWorkingSetIsContended(PointerPte.TrimmedPageCount);
if( v46
|| (PointerPte.AgeDistribution[7] & 0x10000000000i64) != 0
|| (unsigned int)MiPageTableLockIsContended(v47, (UINT64)MmGetPteBase() + ((v20 >> 9) & 0x7FFFFFFFF8i64))
|| (unsigned int)KeShouldYieldProcessor() )
{
goto LABEL_34;
}
v26 = PointerPte.AgeDistribution[1];
}
v27.u.Long = *(_QWORD *)v20;
if( !*(_QWORD *)v20 || (v27.u.Long & 1) != 0 )
{
v28 = 0;
goto LABEL_26;
}
*(_DWORD *)v55 = 256;
if( (v27.u.Long & 0x400) != 0 )
{
if( PointerPte.WorkingSetLeafPrivateSize )
goto LABEL_13;
v39 = MiCheckProtoAccess(v20, v55);
v26 = PointerPte.AgeDistribution[1];
if( !v39 )
{
v28 = -1073741819;
goto LABEL_26;
}
LODWORD(v40) = *(_DWORD *)v55;
PointerPte.WorkingSetLeafPrivateSize = v39;
}
else
{
if( (PointerPte.AgeDistribution[7] & 0x80000000000i64) == 0 )
goto LABEL_13;
v40 = (v27.u.Long >> 5) & 0x1F;
}
if( (_DWORD)v40 == 256 )
goto LABEL_13;
if( (v40 & 0xFFFFFFF8) == 16 && (PointerPte.AgeDistribution[7] & 0x80000000000i64) != 0 )
{
v28 = -1073741819;
goto LABEL_26;
}
v41 = MiAccessCheck(
(_MMPTE *)v20,
(INT64)v19,
(PointerPte.MinimumWorkingSetSize & 0x40) != 0,
(unsigned int)v40,
(PVOID)v26,
0);
v26 = PointerPte.AgeDistribution[1];
v28 = v41;
if( !v41 )
{
LABEL_13:
if( (PointerPte.AgeDistribution[1] & 1) != 0 && *(_BYTE *)(v26 & 0xFFFFFFFFFFFFFFFEui64) == 2 )
{
MiAdjustFaultList(&PointerPte.WorkingSetExpansionLinks.Blink);
v26 = PointerPte.AgeDistribution[1];
}
if( (v27.u.Long & 0x400) != 0 )
{
v42 = MiResolveProtoPteFault(
(UINT64)&PointerPte.WorkingSetExpansionLinks.Blink,
v19,
(_MMPTE *)&PointerPte,
v24,
(UINT8)v53,
PageLockHeld,
*(VOID **)v55,
ReadBlock[0],
*(_MMINPAGE_SUPPORT ***)&PointerPte.NextPageColor);
v26 = PointerPte.AgeDistribution[1];
v28 = v42;
goto LABEL_26;
}
if( (v27.u.Long & 0x800) != 0 )
{
v43 = MiResolveTransitionFault(
&PointerPte.WorkingSetExpansionLinks.Blink,
(_MMPTE *)v20,
0i64,
v19,
&PointerPte,
(UINT64)PageLockHeld,
v55[0],
ReadBlock[0],
*(_MMINPAGE_SUPPORT ***)&PointerPte.NextPageColor);
v26 = PointerPte.AgeDistribution[1];
v28 = v43;
goto LABEL_26;
}
if( (v27.u.Long & 4) != 0 )
{
if( (PointerPte.AgeDistribution[7] & 0x80000000000i64) != 0 )
{
if( *(_QWORD *)ReadBlock )
{
MiAdvanceFaultList(*(_MI_FAULT_VA_LIST **)ReadBlock);
v26 = PointerPte.AgeDistribution[1];
}
v28 = -1073740748;
}
else
{
v49 = MiResolvePageFileFault(
&PointerPte.WorkingSetExpansionLinks.Blink,
(_MMPTE *)v20,
0i64,
&PointerPte,
v53,
(_MMINPAGE_SUPPORT **)PageLockHeld);
v26 = PointerPte.AgeDistribution[1];
v28 = v49;
}
goto LABEL_26;
}
v28 = 0;
v29 = v26 & 1;
if( (v26 & 1) != 0
&& *(_BYTE *)(v26 & 0xFFFFFFFFFFFFFFFEui64) == 1
&& (*(_DWORD *)((v26 & 0xFFFFFFFFFFFFFFFEui64) + 80) & 0x4000) == 0 )
{
goto LABEL_26;
}
if( (v26 & 1) == 0 )
goto LABEL_19;
if( *(_BYTE *)(v26 & 0xFFFFFFFFFFFFFFFEui64) != 1 )
{
if( (v26 & 1) == 0 )
goto LABEL_19;
if( *(_BYTE *)(v26 & 0xFFFFFFFFFFFFFFFEui64) == 3 )
goto LABEL_89;
if( (v26 & 1) == 0 )
{
LABEL_19:
if( !v26 )
goto LABEL_25;
v30 = *(_WORD *)(v26 + 368);
v31 = 0;
if( v30 == 16 )
{
if( (*(_DWORD *)(v26 + 376) & 0x200) == 0 )
{
LOBYTE(v50) = KiRspInIstStack(3ui64, *(_QWORD *)(v26 + 384));
if( v50 )
goto LABEL_25;
LOBYTE(v52) = KiRspInIstStack(2ui64, v51);
if( v52 )
goto LABEL_25;
}
v32 = ExpInterlockedPopEntrySListFault;
v44 = *(_QWORD *)(v26 + 360);
v31 = KiDynamicTraceEnabled && v44 >= ControlPc && v44 < qword_140CFBBE0 && KeGetCurrentIrql() == 15;
}
else
{
if( v30 != 51 )
goto LABEL_25;
v32 = (NTSTATUS(__stdcall *)())KeUserPopEntrySListFault;
}
if( *(NTSTATUS(__stdcall **)())(v26 + 360) != v32 && !v31 )
goto LABEL_25;
goto LABEL_89;
}
if( *(_BYTE *)(v26 & 0xFFFFFFFFFFFFFFFEui64) != 6 )
{
if( (v26 & 1) != 0 )
goto LABEL_25;
goto LABEL_19;
}
}
LABEL_89:
if( v29 && *(_BYTE *)(v26 & 0xFFFFFFFFFFFFFFFEui64) == 6
|| PointerPte.WorkingSetExpansionLinks.Blink < (_LIST_ENTRY *)0xFFFF800000000000i64
|| ((v27.u.Long >> 5) & 0x18) != 16 )
{
LABEL_25:
v33 = MiResolveDemandZeroFault(
&PointerPte.WorkingSetExpansionLinks.Blink,
(_MMPTE *)v20,
0i64,
v19,
v53,
(UINT64)PageLockHeld,
v55[0]);
v26 = PointerPte.AgeDistribution[1];
v28 = v33;
goto LABEL_26;
}
v28 = -1073741819;
}
LABEL_26:
v34 = v28;
if( (PointerPte.AgeDistribution[7] & 0x80000000000i64) != 0 )
v34 = v21;
if( v28 < 0 )
break;
PointerPte.WorkingSetExpansionLinks.Blink += 256;
v35 = BYTE5(PointerPte.AgeDistribution[7]) | 8;
v20 += 8i64;
BYTE5(PointerPte.AgeDistribution[7]) = v35;
++v22;
PointerPte.AgeDistribution[2] = v20;
if( (v35 & 2) != 0 )
{
v21 = v34;
BYTE5(PointerPte.AgeDistribution[7]) = v35 & 0xFD;
if( v22 == v25 )
goto LABEL_34;
LODWORD(v48) = MiComputeMaximumFaultCluster((UINT64 *)&PointerPte.WorkingSetExpansionLinks.Blink, v25 - v22);
v25 = v48;
if( v48 == 1 && (PointerPte.AgeDistribution[7] & 0x40000000000i64) != 0 )
BYTE5(PointerPte.AgeDistribution[7]) &= ~4u;
v26 = PointerPte.AgeDistribution[1];
v22 = 0i64;
}
PointerPte.WorkingSetLeafPrivateSize = 0i64;
if( (v26 & 1) == 0 || *(_BYTE *)(v26 & 0xFFFFFFFFFFFFFFFEui64) != 2 )
{
v19 = 0i64;
PointerPte.AgeDistribution[0] &= ~2ui64;
}
if( (v26 & 1) != 0 )
{
v45 = v26 & 0xFFFFFFFFFFFFFFFEui64;
if( *(_BYTE *)(v26 & 0xFFFFFFFFFFFFFFFEui64) == 5 )
{
v26 &= ~1ui64;
PointerPte.AgeDistribution[1] = v45;
}
}
v21 = v34;
if( v22 >= v25 )
goto LABEL_34;
}
v21 = v34;
if( v28 != -1073741802 )
{
LABEL_34:
MinimumWorkingSetSize = PointerPte.MinimumWorkingSetSize;
goto LABEL_35;
}
MinimumWorkingSetSize = PointerPte.MinimumWorkingSetSize;
if( (PointerPte.MinimumWorkingSetSize & 0x100) != 0 )
*(_DWORD *)(FaultStatus + 80) |= 0x100u;
LABEL_35:
ExitOutswapGate = PointerPte.ExitOutswapGate;
*(_OWORD *)(FaultStatus + 112) = *(_OWORD *)&PointerPte.WorkingSetPrivateSize;
*(_QWORD *)(FaultStatus + 128) = PointerPte.PeakWorkingSetSize;
*(_QWORD *)(FaultStatus + 104) = PointerPte.WorkingSetSize;
*(_OWORD *)(FaultStatus + 56) = *(_OWORD *)&PointerPte.AgeDistribution[6];
*(_QWORD *)(FaultStatus + 72) = ExitOutswapGate;
if( MinimumWorkingSetSize < 0 )
*(_DWORD *)(FaultStatus + 80) ^= ((unsigned __int8)MinimumWorkingSetSize ^ (unsigned __int8)*(_DWORD *)(FaultStatus + 80)) & 0x80;
if( v21 == -1073532109 )
PointerPte.VmWorkingSetList->NextPteToTrim = *(_MMPTE **)&PointerPte.NextPageColor;
return v21;
}Referenced by:
MiInPagePageTable
MmAccessFault