MiDeleteSubsectionPages
UINT64 __stdcall MiDeleteSubsectionPages(_SUBSECTION *Subsection, UINT64 *DanglingPageCount){
__int64 v2;
_SUBSECTION *v3;
UINT64 *v4;
__int64 v5;
__int64 v6;
UINT64 v7;
void *v8;
_MMPFN *v9;
INT64 v10;
unsigned __int64 v11;
__int64 v12;
char *v13;
__int64 v14;
UINT8 *PfnDb;
CHAR *v16;
INT64 v17;
INT64 v18;
unsigned __int64 v19;
unsigned __int64 v20;
INT64 v21;
UINT64 v22;
int v23;
UINT64 v24;
INT64 v25;
INT64 v26;
unsigned __int64 v27;
PVOID v28;
INT64 a5;
__int128 a6;
CHAR *v32;
UINT64 v33;
INT64 a10;
volatile INT64 *a1;
INT64 a12;
PVOID P;
UINT64 *v39;
UINT8 PageIrql;
UINT64 SpinCount;
v39 = DanglingPageCount;
v2 = *(_QWORD *)Subsection;
v3 = Subsection;
v4 = DanglingPageCount;
*((_QWORD *)&a6 + 1) = 0i64;
LOBYTE(DanglingPageCount) = 17;
v5 = *(_WORD *)(v2 + 60) & 0x3FF;
PageIrql = 17;
a1 = *(volatile INT64 **)(qword_140C4E388 + 8 * v5);
v6 = *(_QWORD *)(v2 + 64);
v7 = 0i64;
*(_QWORD *)((char *)&a6 + 4) = v6 != 0;
v8 = (void *)*((_QWORD *)Subsection + 1);
v9 = 0i64;
v10 = 0i64;
a12 = v6 & 0xFFFFFFFFFFFFFFF0ui64;
a5 = 0i64;
LODWORD(a6) = *(_DWORD *)(v2 + 56);
P = v8;
if( !v8 )
goto LABEL_66;
v11 = (unsigned __int64)v8;
a10 = (INT64)v8 + 8 * *((unsigned int *)v3 + 11);
if( (unsigned __int64)v8 >= a10 )
goto LABEL_66;
v12 = 0xFFFFFFFFFi64;
v13 = (char *)MmGetPfnDb() + 40;
v14 = 0x4000000000000i64;
PfnDb = (UINT8 *)MmGetPfnDb();
v16 = 0i64;
do
{
v17 = v10;
if( (v11 & 0xFFF) != 0 )
{
if( (_BYTE)DanglingPageCount != 17 )
goto LABEL_17;
}
else if( (_BYTE)DanglingPageCount != 17 )
{
MiUnlockProtoPoolPage(v9, (UINT64)DanglingPageCount);
}
while( 1 )
{
if( (*(_DWORD *)(v2 + 56) & 0x20) == 0 )
{
v18 = MI_READ_PTE_LOCK_FREE((INT64)MmGetPteBase() + ((v11 >> 9) & 0x7FFFFFFFF8i64));
*((_QWORD *)&a6 + 1) = v18;
if( (v18 & 1) == 0 && (v18 & 0x400) != 0 && (v18 & 2) != 0 )
{
LOBYTE(DanglingPageCount) = 17;
v9 = 0i64;
PageIrql = 17;
v11 = (v11 & 0xFFFFFFFFFFFFF000ui64) + 4096;
goto LABEL_61;
}
}
v9 = MiLockProtoPoolPage((_MMPTE *)v11, &PageIrql);
if( v9 )
break;
MmAccessFault(2ui64, (PVOID)v11, 0, 0i64);
}
PfnDb = (UINT8 *)MmGetPfnDb();
v12 = 0xFFFFFFFFFi64;
v13 = (char *)(PfnDb + 40);
v14 = 0x4000000000000i64;
while( 1 )
{
LABEL_17:
while( 1 )
{
v19 = *(_QWORD *)v11;
if( (*(_QWORD *)v11 & 1) == 0 )
break;
v20 = *(_QWORD *)v11;
LABEL_25:
if( (v14 & *(_QWORD *)&v13[48 * (v12 & (v20 >> 12))]) != 0 )
{
v21 = (INT64)&PfnDb[48 * (v12 & (v20 >> 12))];
LODWORD(SpinCount) = 0;
if( _interlockedbittestandset64((volatile signed __int32 *)(v21 + 24), 0x3Fui64) )
{
do
{
do
KeYieldProcessorEx(&SpinCount);
while( *(__int64 *)(v21 + 24) < 0 );
}
while( _interlockedbittestandset64((volatile signed __int32 *)(v21 + 24), 0x3Fui64) );
PfnDb = (UINT8 *)MmGetPfnDb();
v12 = 0xFFFFFFFFFi64;
v13 = (char *)(PfnDb + 40);
v14 = 0x4000000000000i64;
}
if( *(_QWORD *)v11 == v19 )
goto LABEL_33;
_InterlockedAnd64((volatile signed __int64 *)(v21 + 24), 0x7FFFFFFFFFFFFFFFui64);
}
}
if( (v19 & 0x400) != 0 || (v19 & 0x800) == 0 )
break;
if( MiInvalidPteConforms(*(_QWORD *)v11) )
{
v20 = v19;
if( qword_140C4DC80 && (v19 & 0x10) == 0 )
v20 = v19 & ~qword_140C4DC80;
goto LABEL_25;
}
}
v21 = 0i64;
LABEL_33:
v22 = *(_QWORD *)v11;
*((_QWORD *)&a6 + 1) = v22;
if( (v22 & 1) != 0 )
{
++v10;
if( *(_WORD *)(v21 + 32) <= 2u )
v10 = v17;
if( (MI_READ_PTE_LOCK_FREE((INT64)&a6 + 8) & 0x1FF000) == 0 )
{
MiSetLeafPfnBuddy((_QWORD *)v21, (UINT64)v16);
v16 = (CHAR *)v21;
}
_InterlockedAnd64((volatile signed __int64 *)(v21 + 24), 0x7FFFFFFFFFFFFFFFui64);
goto LABEL_58;
}
if( (v22 & 0x400) != 0 )
goto LABEL_58;
if( (v22 & 0x800) != 0 )
{
if( qword_140C4DC80 && (v22 & 0x10) == 0 )
LOWORD(v22) = ~(_WORD)qword_140C4DC80 & v22;
v7 = a5;
if( (*(_DWORD *)(v21 + 16) & 0x400i64) != 0
&& (*(_DWORD *)(v2 + 56) & 0x20) == 0
&& (*(_BYTE *)(v21 + 34) & 0x18) != 0 )
{
v7 = ++a5;
}
if( !a12
&& (v22 & 0xF000) == 0
&& (__int64)((a10 - v11) & 0xFFFFFFFFFFFFFFF8ui64) >= 128
&& ((4096 - (v11 & 0xFFF)) & 0xFFFFFFF8) >= 0x80
&& (unsigned int)MiDeleteClusterSection(v21, v11) == 1 )
{
v4 = v39;
v11 += 128i64;
goto LABEL_60;
}
LOBYTE(PfnDb) = 17;
v23 = MiDeleteTransitionPte((_MMPTE *)v11, (_MMPFN *)v21, PfnDb, 1ui64);
v4 = v39;
if( v23 == 3 )
++*v39;
}
else
{
v33 = v22;
v24 = MiCapturePageFileInfoInline(&v33, 0i64, 1i64);
v33 = v24;
if( v24 )
MiReleasePageFileInfo((INT64)a1, v24, 0, v25, a5, a6, *((INT64 *)&a6 + 1), (INT64)v32, v33, a10, (INT64)a1, a12);
LABEL_58:
v4 = v39;
}
v7 = a5;
v11 += 8i64;
LABEL_60:
DanglingPageCount = (UINT64 *)PageIrql;
LABEL_61:
v12 = 0xFFFFFFFFFi64;
PfnDb = (UINT8 *)MmGetPfnDb();
v14 = 0x4000000000000i64;
v13 = (char *)(PfnDb + 40);
}
while( v11 < a10 );
v32 = v16;
v3 = Subsection;
if( (_BYTE)DanglingPageCount != 17 )
{
MiUnlockProtoPoolPage(v9, (UINT64)DanglingPageCount);
PageIrql = 17;
}
if( v32 )
*v4 += MiDeleteSubsectionLargePages((INT64)Subsection, v32, v10);
LABEL_66:
if( (a6 & 0x80u) == 0i64 || (a6 & 0x20) != 0 )
return v7;
v26 = MiDecrementSubsectionViewCount((INT64 *)v3, 0);
v27 = ExAcquireSpinLockExclusive((PEX_SPIN_LOCK)(v2 + 72));
while( *((_DWORD *)v3 + 26) )
{
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)(v2 + 72));
__writecr8(v27);
_mm_pause();
ExAcquireSpinLockExclusive((PEX_SPIN_LOCK)(v2 + 72));
}
v28 = P;
if( P )
{
MiUpdateSystemProtoPtesTree((RTL_BALANCED_NODE *)((char *)v3 + 112), 0i64);
*((_QWORD *)v3 + 1) = 0i64;
}
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)(v2 + 72));
__writecr8(v27);
if( v28 )
ExFreePoolWithTag(v28, 0);
if( v26 )
MiReturnCrossPartitionSectionCharges(a1, DWORD1(a6), v26);
return a5;
}Referenced by:
MiDeleteSegmentPages
MiExtendSection