MiDeleteEnclavePages
void __fastcall MiDeleteEnclavePages(__int64 a1, __int64 a2){
int v2;
_QWORD *v4;
INT64 v5;
NTSTATUS v6;
void *v7;
_ETHREAD *CurrentThread;
_QWORD *v9;
__int64 v10;
_QWORD *v11;
v2 = *(_DWORD *)(a2 + 64);
if( (v2 & 1) == 0 || *(_QWORD *)(a2 + 120) )
{
if( (v2 & 4) != 0 )
{
_InterlockedAdd((volatile signed __int32 *)(*(_QWORD *)(a1 + 1680) + 296i64), 0xFFFFFFFF);
v2 = *(_DWORD *)(a2 + 64);
}
if( (v2 & 1) != 0 )
{
if( (v2 & 8) == 0 )
MiTerminateHardwareEnclave(a1, a2);
v5 = *(_QWORD *)(a2 + 80);
if( (MI_READ_PTE_LOCK_FREE(v5) & 1) != 0 )
{
v6 = KeRemoveEnclavePage((PVOID)(((v5 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16));
if( v6 < 0 )
KeBugCheckEx(0x1Au, 0x18011544ui64, *(_QWORD *)(a2 + 80), v6, 0i64);
MiDeleteEnclavePage(*(_QWORD *)(a2 + 80), 0i64);
v5 = *(_QWORD *)(a2 + 80);
}
MiReleasePtes((INT64)&qword_140C4EC80, v5, 1ui64);
v7 = *(void **)(a2 + 88);
if( v7 )
ExFreePoolWithTag(v7, 0);
MiReturnReservedEnclavePages(a2, -1i64);
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 243);
ExAcquirePushLockExclusiveEx((UINT64)&qword_140C4EBF8, 0i64);
v9 = (_QWORD *)(a2 + 120);
v10 = *v9;
if( *(_QWORD **)(*v9 + 8i64) != v9 || (v11 = (_QWORD *)v9[1], (_QWORD *)*v11 != v9) )
__fastfail(3u);
*v11 = v10;
*(_QWORD *)(v10 + 8) = v11;
*v9 = 0i64;
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&qword_140C4EBF8, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)&qword_140C4EBF8);
KeAbPostRelease(&qword_140C4EBF8);
KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
}
else
{
v4 = *(_QWORD **)(a2 + 72);
if( v4 )
PsDeleteVsmEnclave(a1, v4);
}
}
}Referenced by:
MiDeleteAllHardwareEnclaves
MiDeleteVad