WheapAttemptPhysicalPageOffline
NTSTATUS __stdcall WheapAttemptPhysicalPageOffline(UINT64 Page, UINT8 PlatformDirected, UINT8 Poisoned){
CHAR v3;
UINT64 v4;
UINT8 v5;
INT64 v6;
int v7;
UINT8 v8;
char v9;
NTSTATUS v10;
NTSTATUS v11;
NTSTATUS v12;
CHAR v15;
_LARGE_INTEGER v16;
_LARGE_INTEGER v17;
LARGE_INTEGER StartAddress;
__int128 Src;
__int128 v20;
__int64 v21[2];
char v22;
StartAddress.QuadPart = Page;
v15 = v3;
v4 = PlatformDirected << 12;
v5 = 0;
memset(v21, 0, 9);
v6 = PlatformDirected;
v16.QuadPart = PlatformDirected << 12;
v17.QuadPart = 4096i64;
Src = 0i64;
v20 = 0i64;
if( v3 )
{
v7 = 2;
}
else
{
v7 = 1;
v16.QuadPart = v4 | 1;
}
v8 = -1;
v9 = -1;
v10 = MmMarkPhysicalMemoryAsBad(&v16, &v17);
v11 = v10;
if( v10 >= 0 )
{
v9 = v10 == 0;
if( WheapClearPoisonSupported && v22 && WheapClearPoison(&StartAddress) >= 0 )
return v11;
if( !v9 )
WheapCallInUsePageNotificationCallbacks(v6, Poisoned, v15);
if( KeGetCurrentIrql() <= 2u )
{
*(_QWORD *)&Src = 0x1674C6857i64;
*((_QWORD *)&Src + 1) = 41i64;
*(_QWORD *)&v20 = 0x800000064C4E524Bui64;
*((_QWORD *)&v20 + 1) = 0x900000002i64;
LODWORD(v21[0]) = v7;
BYTE4(v21[0]) = v9;
*(_DWORD *)((char *)v21 + 5) = v6;
WheaLogInternalEvent(&Src);
}
}
if( WheapPolicyMemPersistOffline )
{
v12 = WheaPersistBadPageToBcd(v6);
if( v12 >= 0 )
v5 = 1;
else
v11 = v12;
}
if( v9 != -1 )
v8 = v9 == 0;
WheapLogPageOfflineAttemptEvent(v4, v8, v15, v5, Poisoned);
return v11;
}Referenced by:
WheaAttemptClearPoison
WheaAttemptPhysicalPageOffline
WheapAttemptPhysicalPageOfflineWorker