MiComputeImagePteIndex
NTSTATUS __stdcall MiComputeImagePteIndex(_MMPFN *Pfn1, UINT64 SessionId){
union {unsigned __int64 Long;volatile unsigned __int64 VolatileLong;_MMPTE_HARDWARE Hard;_MMPTE_PROTOTYPE Proto;_MMPTE_SOFTWARE Soft;_MMPTE_TIMESTAMP TimeStamp;_MMPTE_TRANSITION Trans;_MMPTE_SUBSECTION Subsect;_MMPTE_LIST List;} v2;
unsigned __int64 v3;
__int64 v4;
__int64 v5;
_CONTROL_AREA *v6;
_MI_PER_SESSION_PROTOS *SubsectionDriverProtos;
_RTL_BALANCED_NODE *SharedProtos;
_RTL_BALANCED_NODE *v9;
_MMPTE *SubsectionBase;
v2.Long = (unsigned __int64)Pfn1->OriginalPte.u;
v3 = Pfn1->PteLong | 0x8000000000000000ui64;
LODWORD(v4) = 0;
if( *(&stru_140C4DB30 + 42) && (v2.Long & 0x10) == 0 )
v2.Long &= ~*(&stru_140C4DB30 + 42);
v5 = v2.Hard._bf_0 >> 16;
v6 = *(_CONTROL_AREA **)v5;
if( (*(_BYTE *)(v5 + 34) & 2) != 0 && (v6->u.LongFlags & 0x4000000) != 0 )
{
SharedProtos = MiGetSharedProtos(*(_CONTROL_AREA **)v5, SessionId, (_SUBSECTION *)v5);
}
else
{
SubsectionDriverProtos = MiGetSubsectionDriverProtos((_SUBSECTION *)v5);
SharedProtos = &SubsectionDriverProtos->SessionProtoNode;
if( SubsectionDriverProtos )
{
SubsectionBase = SubsectionDriverProtos->SubsectionBase;
if( v3 < (unsigned __int64)SubsectionBase || v3 >= (unsigned __int64)&SubsectionBase[*(unsigned int *)(v5 + 44)] )
SharedProtos = 0i64;
}
}
if( SharedProtos )
{
v9 = SharedProtos[3].Children[0];
v4 = (__int64)(*(_QWORD *)(v5 + 8) - *(_QWORD *)v6[1].gap8) >> 3;
}
else
{
v9 = *(_RTL_BALANCED_NODE **)v6[1].gap8;
}
return v4 + ((__int64)(v3 - (_QWORD)v9) >> 3);
}Referenced by:
MiReferenceInPageFile