MiResolveMappedFileFault
INT64 __fastcall MiResolveMappedFileFault(
VOID *FaultingAddress,
_MMPTE *PoINTerPte,
_MMPFN *LockedProtoPfn,
_MMSUPPORT_INSTANCE *Vm,
VOID *TrapInformation,
_MMINPAGE_SUPPORT **ReadBlock){
INT64 v6;
_MMPFN *PfnDb;
__int64 v10;
unsigned __int64 v11;
__int64 v12;
__int64 v13;
int v14;
UINT64 v15;
bool v16;
UINT64 v17;
unsigned int v18;
__int64 v19;
unsigned int v20;
_MI_PARTITION *v21;
INT64 v22;
__int64 v23;
void *v24;
unsigned __int64 v25;
unsigned int v26;
_QWORD *v27;
PSLIST_ENTRY v28;
UINT64 v29;
__int64 v30;
unsigned __int64 v31;
int v32;
__int64 v33;
int v34;
INT64 v35;
_MI_PARTITION *v36;
UINT64 v37;
signed __int32 v38;
unsigned int v39;
INT64 *v40;
UINT64 SlabPage;
VOID *v42;
_MMPTE *v43;
_MMPFN *v44;
INT64 result;
UINT64 v46;
INT64 a8;
int v48;
int v49;
unsigned int v50;
unsigned int v51;
INT64 v52;
UINT64 v53;
__int64 v54;
unsigned __int64 v55;
char *v56;
INT64 SharedProtos;
INT64 Address;
int v59;
int SessionIdForVa;
char v61;
__int64 v62;
_MMPFN *v63;
int v64;
unsigned int v65;
unsigned int v66;
_MMSUPPORT_INSTANCE *v67;
_MMVAD **SpinCount;
INT64 SpinCountb;
INT64 SpinCounta;
_MMPFN *a6;
INT64 a7;
UINT64 v73;
CHAR a2[4];
INT64 v75;
UINT64 SessionId;
_MI_PARTITION *Partition;
UINT64 v78;
INT64 v79;
UINT64 v80;
INT64 a4;
UINT64 ProtectionMask;
INT64 v83;
INT64 v84;
_MMPFN *TransitionPfn;
INT64 v86;
UINT64 v87;
UINT64 v88;
INT64 a10[2];
INT64 v92;
_MMSUPPORT_INSTANCE *v93;
v93 = Vm;
v92 = (INT64)LockedProtoPfn;
v6 = *((_QWORD *)FaultingAddress + 2);
v78 = *(_QWORD *)FaultingAddress;
v86 = *((_QWORD *)FaultingAddress + 7);
v88 = 0i64;
v87 = 0i64;
LODWORD(v73) = 0;
*(_OWORD *)a10 = 0i64;
a4 = v6;
v10 = MI_READ_PTE_LOCK_FREE((INT64)PoINTerPte);
v83 = v10;
v75 = 0i64;
*(_DWORD *)a2 = 2;
if( (*((_BYTE *)KeGetCurrentThread() + 1304) & 4) != 0 )
{
LOBYTE(PfnDb) = 17;
MiUnlockProtoPoolPage((_MMPFN *)v92, (UINT64)PfnDb);
return 3221225633i64;
}
v11 = v6 & 0xFFFFFFFFFFFFFFFEui64;
if( (v6 & 1) != 0 )
{
if( *(_BYTE *)v11 == 5 )
{
if( (*(_DWORD *)(v11 + 56) & 4) != 0 )
{
LOBYTE(PfnDb) = 17;
MiUnlockProtoPoolPage((_MMPFN *)v92, (UINT64)PfnDb);
return 3221225495i64;
}
v75 = 0i64;
}
else if( (v6 & 1) != 0 )
{
if( *(_BYTE *)v11 == 1 )
{
v16 = (*(_DWORD *)(v11 + 80) & 0x100) == 0;
v75 = v6 & 0xFFFFFFFFFFFFFFFEui64;
if( !v16 )
{
LOBYTE(PfnDb) = 17;
MiUnlockProtoPoolPage((_MMPFN *)v92, (UINT64)PfnDb);
return 0i64;
}
*(_DWORD *)a2 = 0;
}
else if( (v6 & 1) != 0 && *(_BYTE *)v11 == 2 )
{
v75 = v6 & 0xFFFFFFFFFFFFFFFEui64;
}
}
}
if( (v10 & 0x400) != 0 )
{
if( qword_140C4DC80 && (v10 & 0x10) == 0 )
v10 &= ~qword_140C4DC80;
TransitionPfn = 0i64;
}
else
{
if( qword_140C4DC80 && (v10 & 0x10) == 0 )
v10 &= ~qword_140C4DC80;
PfnDb = MmGetPfnDb();
TransitionPfn = (_MMPFN *)((char *)PfnDb + 48 * (((unsigned __int64)v10 >> 12) & 0xFFFFFFFFFi64));
v10 = *((_QWORD *)TransitionPfn + 2);
if( qword_140C4DC80 && (v10 & 0x10) == 0 )
v10 &= ~qword_140C4DC80;
}
v12 = v10 >> 16;
v13 = *(_QWORD *)v12;
v14 = *(_DWORD *)(*(_QWORD *)v12 + 56i64);
if( (v14 & 0x10) != 0 )
{
LOBYTE(PfnDb) = 17;
MiUnlockProtoPoolPage((_MMPFN *)v92, (UINT64)PfnDb);
return 3221225478i64;
}
v15 = *(_QWORD *)(v12 + 8);
v16 = (*(_BYTE *)(v12 + 34) & 2) == 0;
LODWORD(SessionId) = -1;
v84 = 0i64;
v80 = v15;
if( !v16 && (v14 & 0x4000000) != 0 )
{
SessionIdForVa = MiGetSessionIdForVa((PVOID)v78);
v17 = 0xFFFF800000000000ui64;
LODWORD(SessionId) = SessionIdForVa;
if( v78 >= 0xFFFF800000000000ui64 )
{
if( (v6 & 1) != 0 )
{
v61 = *(_BYTE *)v11;
if( *(_BYTE *)v11 == 1 || v61 == 3 || v61 == 6 )
{
LABEL_106:
v62 = *((_QWORD *)FaultingAddress + 2);
if( (v62 & 1) == 0 || *(_BYTE *)(v62 & 0xFFFFFFFFFFFFFFFEui64) != 6 )
goto LABEL_110;
}
}
else if( KeInvalidAccessAllowed((PVOID)v6) == 1 )
{
goto LABEL_106;
}
}
SharedProtos = (INT64)MiGetSharedProtos(v13, SessionId, v12);
v84 = SharedProtos;
LABEL_109:
v80 = *(_QWORD *)(SharedProtos + 72);
goto LABEL_12;
}
v17 = 0xFFFF800000000000ui64;
if( v78 >= 0xFFFF800000000000ui64 && (v14 & 0x20) != 0 )
{
SharedProtos = MiGetSubsectionDriverProtos((_QWORD *)v12);
if( SharedProtos )
goto LABEL_109;
}
LABEL_12:
if( (unsigned __int64)PoINTerPte >= v80
- 8i64 * (*(_DWORD *)(v12 + 52) & 0x3FFFFFFF)
+ 8i64 * *(unsigned int *)(v12 + 44) )
{
LABEL_110:
LOBYTE(v17) = 17;
MiUnlockProtoPoolPage((_MMPFN *)v92, v17);
return 3221225477i64;
}
v18 = 0;
v19 = *(_WORD *)(v13 + 60) & 0x3FF;
v20 = 0;
HIDWORD(v73) = 0;
v21 = *(_MI_PARTITION **)(qword_140C4E388 + 8 * v19);
Partition = v21;
v25 = v83;
if( MiControlAreaUsingExtents(v13) )
{
if( v23 )
{
v18 = 2;
}
else
{
v18 = 3;
LODWORD(v73) = 1;
}
HIDWORD(v73) = v18;
*(_DWORD *)a2 = 0;
if( v18 > 2 )
goto LABEL_21;
}
else if( MiControlAreaUsingCopyExtents(v22) )
{
v18 = 1;
HIDWORD(v73) = 1;
}
v79 = 0i64;
MiComputeFaultNode((_MMSUPPORT_INSTANCE *)FaultingAddress, (PVOID)v13, (_CONTROL_AREA *)&v79, v24, SpinCount);
v20 = v26;
LODWORD(v73) = 0;
if( v18 - 1 <= 1 )
{
LODWORD(v73) = 1;
}
else
{
v27 = (_QWORD *)v75;
if( v75 )
{
Address = v79;
if( !v79 )
{
Address = (INT64)MiLocateAddress(v78);
v79 = Address;
}
MiComputeFaultCluster((INT64)v21, v27, Address, 0i64);
LODWORD(v73) = v59;
}
else if( (v25 & 0x400) != 0 && (*(_DWORD *)(v13 + 56) & 0x20) == 0 && (*(_BYTE *)(v86 + 184) & 7) == 0 )
{
v52 = v79;
v53 = v78;
if( !v79 )
{
v52 = (INT64)MiLocateAddress(v78);
v79 = v52;
}
v54 = *(_QWORD *)(v52 + 120);
if( v54 >= 0 )
{
v55 = *(_QWORD *)(v52 + 120) & 0xFFFi64;
if( v55 >= 0x11 && (v53 & 0xFFFFFFFFFFFFF000ui64) == (((unsigned __int64)v54 >> 12) - 1 + v55) << 12 )
{
v56 = (char *)PoINTerPte + 8;
if( (((_DWORD)PoINTerPte + 8) & 0xFFF) != 0
&& (unsigned __int64)v56 < -8i64 * (*(_DWORD *)(v12 + 52) & 0x3FFFFFFF)
+ v80
+ 8i64 * *(unsigned int *)(v12 + 44)
&& MI_READ_PTE_LOCK_FREE((INT64)v56) == v25 )
{
LODWORD(v73) = (v54 & 0xFFF) - 1;
}
}
}
}
}
LABEL_21:
v28 = MiAllocateInPageSupport((UINT64)PoINTerPte, a2[0], &v73, &v92);
if( !v28 )
{
result = 3221225626i64;
goto LABEL_129;
}
if( MI_READ_PTE_LOCK_FREE((INT64)PoINTerPte) == v25 )
{
v30 = (v25 >> 10) & 1;
if( ((v25 >> 10) & 1) != 0
|| (*((_BYTE *)TransitionPfn + 34) & 0x20) != 0 && (*(_DWORD *)(*(_QWORD *)TransitionPfn + 160i64) & 0x20) == 0 )
{
if( v18 == 3 )
{
v63 = (_MMPFN *)v92;
v43 = PoINTerPte;
goto LABEL_127;
}
if( v75 && *(_BYTE *)v75 == 1 )
MiSetInPagePrefetchPriority(v75, (INT64)v28);
if( v30 )
v31 = MI_READ_PTE_LOCK_FREE((INT64)&v83);
else
v31 = v25;
*(_DWORD *)a2 = (*(unsigned __int16 *)(v12 + 32) >> 1) & 0x1F;
MiSanitizePfnProtection(0i64, *(unsigned int *)a2, (v31 >> 5) & 0x1F);
LODWORD(ProtectionMask) = v32;
MiInitializePageColorBase(v86, v20, (INT64)a10);
v34 = HIDWORD(v73);
v35 = -1i64;
if( (unsigned int)(HIDWORD(v73) - 1) <= 1 )
goto LABEL_33;
if( (*(_DWORD *)(v13 + 56) & 0x40020) == 32 && v30 && !dword_140C4EA00 )
{
if( !v33 )
{
LABEL_33:
v36 = Partition;
goto LABEL_34;
}
v36 = Partition;
if( *(_BYTE *)v33 != 1 || MiGetAvailablePagesBelowPriority(Partition, ((*(_DWORD *)(v33 + 80) >> 3) & 7u) + 1) )
{
LABEL_34:
if( (unsigned int)MiObtainFaultCharges(v36, 1ui64, 1ui64) )
{
v38 = _InterlockedExchangeAdd((volatile signed __int32 *)a10[0], 1u);
v25 = v83;
v39 = HIDWORD(a10[1]) | v38 & a10[1];
if( v30 && (unsigned int)MiUseSlabAllocator((INT64)v36, (_BYTE *)v12, v83, 0i64) )
{
LODWORD(SpinCount) = (_DWORD)v40;
SlabPage = MiGetSlabPage((UINT64)v36, a2[0], 0i64, v40, (INT64)SpinCount);
}
else
{
SlabPage = MiGetPage(v36, v39, 0i64);
}
v35 = SlabPage;
if( SlabPage != -1i64 )
{
v42 = (VOID *)a4;
if( v34 == 1 )
{
MiCopyImageExtentContents(
(_MMINPAGE_SUPPORT *)v28,
(_SUBSECTION *)v12,
PoINTerPte,
a4,
SlabPage,
v92,
v84);
*(_QWORD *)&v93->NextPageColor = v28;
return 3221435187i64;
}
v43 = PoINTerPte;
if( v34 != 2 )
{
v44 = (_MMPFN *)v92;
a6 = (_MMPFN *)v92;
v28[14].Next = (_SLIST_ENTRY *)v78;
if( (unsigned int)MiCopyDataPageToImagePage(
(_MMINPAGE_SUPPORT *)v28,
(_SUBSECTION *)v12,
PoINTerPte,
v42,
SlabPage,
a6) != 1 )
goto LABEL_42;
LABEL_51:
*(_QWORD *)&v93->NextPageColor = v28;
return 3221435187i64;
}
v63 = (_MMPFN *)v92;
v64 = MiCopyFileOnlyGlobalSubsectionPage(
(INT64)v28,
(INT64 *)v12,
(UINT64)PoINTerPte,
a4,
SlabPage,
v92,
v84);
v65 = v64;
if( v64 >= 0 )
goto LABEL_51;
if( v64 == -1073741739 )
{
v65 = 0;
LABEL_125:
LOBYTE(v29) = 17;
MiUnlockProtoPoolPage(v63, v29);
MiFreeInPageSupportBlock(v28);
return v65;
}
if( v64 != -1073740748 )
{
if( v64 == -1073532109 )
{
v65 = -1073741802;
*((_DWORD *)FaultingAddress + 20) |= 0x100u;
}
goto LABEL_125;
}
LABEL_127:
LOBYTE(v29) = 17;
MiUnlockProtoPoolPage(v63, v29);
v66 = (__int64)v28[12].Next & 0xFFFBFFFF;
*((_DWORD *)&v28[19].Next + 2) = 0;
v28[13].Next = (_SLIST_ENTRY *)v12;
LODWORD(v28[12].Next) = v66 | 1;
v67 = v93;
*((_DWORD *)&v28[11].Next + 2) = 0;
*((_QWORD *)&v28[10].Next + 1) = v25;
*((_QWORD *)&v28[14].Next + 1) = v43;
*(_QWORD *)&v67->NextPageColor = v28;
result = 3221435187i64;
v28[10].Next = 0i64;
v28[16].Next = 0i64;
LODWORD(v28[5].Next) = 0;
return result;
}
MiReturnFaultCharges(v36, 1ui64, 1ui64);
}
v43 = PoINTerPte;
v44 = (_MMPFN *)v92;
LABEL_42:
if( (unsigned int)(HIDWORD(v73) - 1) <= 1 )
goto LABEL_43;
goto LABEL_46;
}
}
else
{
v36 = Partition;
}
v44 = (_MMPFN *)v92;
v43 = PoINTerPte;
LABEL_46:
v46 = v80;
*((_DWORD *)&v28[11].Next + 2) = v73;
v28[13].Next = (_SLIST_ENTRY *)v12;
a8 = v75;
*((_QWORD *)&v28[14].Next + 1) = v43;
v48 = SessionId;
LODWORD(SpinCount) = SessionId;
v28[10].Next = (_SLIST_ENTRY *)v44;
*((_QWORD *)&v28[10].Next + 1) = v25;
v49 = MiPickClusterForMappedFileFault((INT64)v36, (INT64)v28, a8, v46, (UINT64)SpinCount, v35, &v88, &v87);
LODWORD(a7) = ProtectionMask;
LODWORD(SpinCountb) = v49;
MiBuildMdlForMappedFileFault(
(INT64)v28,
v88,
v87,
v36,
SpinCountb,
v35,
a7,
a8,
(INT64)FaultingAddress,
(INT64)a10);
v51 = v50;
if( v50 != v49 )
MiReturnFaultCharges(v36, v49 - v50, 1ui64);
if( v51 )
{
LODWORD(SpinCounta) = v48;
MiFinishMdlForMappedFileFault((_MMINPAGE_SUPPORT *)v28, (VOID *)a4, v51, TransitionPfn, SpinCounta);
*(_QWORD *)&v93->NextPageColor = v28;
return 3221435187i64;
}
LABEL_43:
LOBYTE(v37) = 17;
MiUnlockProtoPoolPage(v44, v37);
MiFreeInPageSupportBlock(v28);
return 3221225495i64;
}
}
LOBYTE(v29) = 17;
MiUnlockProtoPoolPage((_MMPFN *)v92, v29);
MiFreeInPageSupportBlock(v28);
result = 3221226548i64;
LABEL_129:
if( v75 )
*(_BYTE *)(v75 + 1) = ((_DWORD)result == -1073741670) + 1;
return result;
}Referenced by:
MiResolveProtoPteFault