MiSetSystemCodeProtection
__int64 __fastcall MiSetSystemCodeProtection(__int64 a1, unsigned __int64 a2, unsigned __int64 a3, unsigned int a4){
unsigned int v7;
__int64 v8;
unsigned int v9;
int v10;
char *v11;
INT64 SessionVm;
int v13;
unsigned __int64 v14;
INT64 v16;
UINT64 v17;
_SUBSECTION *v18;
UINT64 v19;
_SUBSECTION *v20;
INT64 v21;
char *v22;
UNICODE_STRING *v23;
UINT8 v24;
PWCHAR v25;
int v26;
ULONG_PTR v27;
INT64 v28;
UINT64 v29;
INT64 ValidPte;
BOOL v31;
_MMPFN *v32;
INT64 v33;
unsigned __int64 v34;
__int64 v35;
unsigned __int64 v36;
unsigned __int64 v37;
unsigned __int64 v38;
BOOL v39;
char v40;
INT64 v41;
BOOL v42;
INT64 v43;
unsigned __int64 a2a;
INT64 v45;
INT64 v46;
INT64 a1a;
_SUBSECTION *i;
char *v49;
UINT64 SpinCount;
__int64 v51;
UINT64 PteOffset;
unsigned __int64 v53;
INT64 v54;
_CONTROL_AREA *ControlArea;
unsigned __int64 v56;
int result;
__int16 result_4;
int v59;
__int64 v60;
__int64 v61;
v56 = a3;
v51 = a1;
PteOffset = 0i64;
memset((INT64)&result, 0i64);
v7 = 1;
if( a4 == 24 || (a4 & 0x10) == 0 )
{
LODWORD(v46) = 0;
}
else
{
a4 &= ~0x10u;
LODWORD(v46) = 1;
}
v8 = (__int64)((a2 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16;
if( !(unsigned int)MI_IS_PHYSICAL_ADDRESS((PVOID)v8) )
{
v9 = a4;
v10 = 2;
if( a4 == 256 )
{
v11 = 0i64;
ControlArea = MiSectionControlArea(*(_SECTION **)(v51 + 112));
v53 = 0i64;
}
else
{
v53 = a3;
ControlArea = 0i64;
v9 = a4 & 0xFFFFFFFE;
v14 = a3;
if( (a4 & 5) != 5 )
v9 = a4;
v11 = 0i64;
if( (int)MiMakeDriverPagesPrivate(v51, a2, v14, (v9 >> 1) & 2) < 0 )
return 0i64;
}
if( (unsigned int)MiGetSystemRegionType(v8) == 1 )
SessionVm = MiGetSessionVm();
else
SessionVm = (INT64)MiGetAnyMultiplexedVm(1i64);
v45 = SessionVm;
v60 = 0i64;
if( v13 != 1 )
v10 = 0;
v59 = 20;
result_4 = 0;
result = v10;
v16 = SessionVm;
v61 = 0i64;
v49 = 0i64;
LOBYTE(v43) = MiLockWorkingSetShared(SessionVm);
if( a2 <= v56 )
{
v17 = 0i64;
v18 = 0i64;
for( i = 0i64; ; v18 = i )
{
if( !v11 )
goto LABEL_22;
if( (a2 & 0xFFF) == 0 )
break;
LABEL_23:
if( a2 > v53 )
{
v19 = v8 - *(_QWORD *)(v51 + 48);
if( v18 )
{
v20 = (_SUBSECTION *)*((_QWORD *)v18 + 2);
i = v20;
PteOffset = 0i64;
}
else
{
MiFlushTbList((__int64)&result);
MiUnlockPageTableInternal(v45, (UINT64)v11);
MiUnlockWorkingSetShared(v45, v43);
i = MiOffsetToProtos(ControlArea, v19, &PteOffset);
MiLockWorkingSetShared(v45);
MiLockPageTableInternal(v45, (UINT64)v11, 0i64);
v17 = PteOffset;
v20 = i;
}
v9 = (*((unsigned __int16 *)v20 + 16) >> 1) & 0x1F;
v53 = a2
+ 8 * (*((unsigned int *)v20 + 11) - (unsigned __int64)(*((_DWORD *)v20 + 13) & 0x3FFFFFFF) - v17 - 1);
if( (v9 & 5) == 5 )
v9 &= ~1u;
}
v21 = MI_READ_PTE_LOCK_FREE(a2);
a1a = v21;
if( (v21 & 1) != 0 )
{
a2a = ((unsigned __int64)MI_READ_PTE_LOCK_FREE((INT64)&a1a) >> 12) & 0xFFFFFFFFFi64;
v22 = (char *)MmGetPfnDb() + 48 * a2a;
LOBYTE(v26) = MI_PFN_IS_PROTO((UNICODE_STRING *)v22, v23, v24, v25);
v17 = 0i64;
if( v26 )
goto LABEL_77;
if( (MiGetPagePrivilege(v27, 0, 0i64) & 0x40) != 0 )
{
if( (a4 & 6) != 0 )
goto LABEL_33;
}
else if( (MiFlags & 0x10000) != 0 && (a4 & 4) != 0 && ((*((_QWORD *)v22 + 5) >> 60) & 7) == 3 )
{
LABEL_33:
v11 = v49;
v7 = 0;
goto LABEL_34;
}
v29 = 0i64;
LODWORD(SpinCount) = 0;
while( _interlockedbittestandset64((volatile signed __int32 *)v22 + 6, 0x3Fui64) )
{
do
KeYieldProcessorEx(&SpinCount);
while( *((__int64 *)v22 + 3) < 0 );
}
*((_QWORD *)v22 + 2) ^= (*((_DWORD *)v22 + 4) ^ (32 * v9)) & 0x3E0;
if( (_DWORD)v46 )
MiMarkPfnVerified((UINT64)v22, 4);
v54 = a1a & 0x42;
if( (a1a & 0x42) != 0 )
v29 = MiCaptureDirtyBitToPfn((INT64)v22);
_InterlockedAnd64((volatile signed __int64 *)v22 + 3, 0x7FFFFFFFFFFFFFFFui64);
if( v29 )
MiReleasePageFileInfo(
*(_QWORD *)(qword_140C4E388 + 8 * ((*((_QWORD *)v22 + 5) >> 39) & 0x3FFi64)),
v29,
1,
v28,
v43,
a2a,
v45,
v46,
a1a,
(INT64)i,
(INT64)v49,
SpinCount);
ValidPte = MiMakeValidPte(a2, a2a, v9);
if( (v9 & 5) == 4 && v54 )
ValidPte |= 0x42ui64;
MiWriteValidPteNewProtection((INT64 *)a2, ValidPte);
if( (MiFlags & 0x100) != 0 || (MiFlags & 0x200) != 0 )
{
v31 = MI_TIGHTER_PERMISSIONS(a1a, ValidPte);
v17 = 0i64;
if( !v31 )
goto LABEL_77;
}
MiInsertTbFlushEntry((INT64)&result, v8, 1i64, 0i64);
LABEL_76:
v17 = 0i64;
goto LABEL_77;
}
if( (v21 & 0x400) != 0 )
goto LABEL_76;
v17 = 0i64;
if( (v21 & 0x800) != 0 )
{
v32 = MiLockTransitionLeafPage((_MMPTE *)a2, 0i64);
v17 = 0i64;
if( !v32 )
goto LABEL_78;
v33 = MI_READ_PTE_LOCK_FREE(a2);
v34 = v33;
if( qword_140C4DC80 )
{
if( (v33 & 0x10) != 0 )
v34 = v33 & 0xFFFFFFFFFFFFFFEFui64;
else
v34 = v33 & ~qword_140C4DC80;
}
v54 = (INT64)MmGetPfnDb() + 48 * ((v34 >> 12) & 0xFFFFFFFFFi64);
v35 = 32i64 * (v9 & 0x1F);
v36 = v35 | v33 & 0xFFFFFFFFFFFFFC1Fui64;
v37 = *(_QWORD *)(v54 + 16) & 0xFFFFFFFFFFFFFC1Fui64;
a1a = v36;
v38 = v36;
*(_QWORD *)(v54 + 16) = v35 | v37;
v39 = MiPteInShadowRange(a2);
v17 = 0i64;
if( v39 && (*(_DWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 2172i64) & 0x1000) != 0 && (v36 & 1) != 0 )
v38 = v36 | 0x8000000000000000ui64;
*(_QWORD *)a2 = v38;
_InterlockedAnd64((volatile signed __int64 *)(v54 + 24), 0x7FFFFFFFFFFFFFFFui64);
}
else if( v21 && a4 != 256 )
{
v40 = v21 ^ (v21 ^ (32 * v9)) & 0xE0;
a1a = v21 ^ ((unsigned __int16)v21 ^ (unsigned __int16)(32 * v9)) & 0x3E0;
v41 = a1a;
v42 = MiPteInShadowRange(a2);
v17 = 0i64;
if( v42 && (*(_DWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 2172i64) & 0x1000) != 0 && (v40 & 1) != 0 )
v41 |= 0x8000000000000000ui64;
*(_QWORD *)a2 = v41;
}
LABEL_77:
a2 += 8i64;
v8 += 4096i64;
LABEL_78:
v11 = v49;
if( a2 > v56 )
goto LABEL_34;
v16 = v45;
}
MiFlushTbList((__int64)&result);
MiUnlockPageTableInternal(v16, (UINT64)v11);
LABEL_22:
v11 = (char *)MmGetPteBase() + ((a2 >> 9) & 0x7FFFFFFFF8i64);
v49 = v11;
MiLockPageTableInternal(v16, (UINT64)v11, 0i64);
v18 = i;
v17 = 0i64;
goto LABEL_23;
}
LABEL_34:
MiFlushTbList((__int64)&result);
if( v11 )
MiUnlockPageTableInternal(v45, (UINT64)v11);
MiUnlockWorkingSetShared(v45, v43);
}
return v7;
}Referenced by:
MiProtectSystemImage
MiSetImageProtection