NtSetInformationVirtualMemory
NTSTATUS __stdcall NtSetInformationVirtualMemory(
PVOID ProcessHandle,
VIRTUAL_MEMORY_INFORMATION_CLASS VmInformationClass,
UINT64 NumberOfEntries,
MEMORY_RANGE_ENTRY *VirtualAddresses,
PVOID VmInformation,
UINT64 VmInformationLength){
PVOID v9;
char v10;
int v11;
NTSTATUS valid;
__int64 v13;
NTSTATUS result;
_ETHREAD *CurrentThread;
_DWORD *v16;
KPROCESSOR_MODE v17;
UINT64 v18;
char *v19;
char *v20;
UINT8 *v21;
CHAR v22;
INT64 v23;
__int32 v24;
__int32 v25;
char *v26;
PVOID v27;
__int64 v28;
int IoPriorityThread;
int v30;
int v31;
NTSTATUS v32;
UINT64 v33;
INT64 v34;
UINT8 *v35;
UINT8 *v36;
__int32 v37;
__int32 v38;
int v39;
INT64 Tag;
KPROCESSOR_MODE AccessMode;
UINT8 *v42;
unsigned int a4;
unsigned int a4_4;
CHAR a7;
PVOID Object;
INT64 a6;
PVOID P;
int v50;
PADAPTER_OBJECT DmaAdapter;
volatile void *Address[2];
HANDLE v53[2];
INT64 a9;
PVOID v55;
_ETHREAD *Thread;
PVOID v57;
void *Src;
struct _KAPC_STATE ApcState;
char v60[256];
UINT8 dst[256];
Src = VirtualAddresses;
v9 = ProcessHandle;
v57 = ProcessHandle;
Object = 0i64;
memset(&ApcState, 0, sizeof(ApcState));
LODWORD(a6) = 0;
DmaAdapter = 0i64;
v10 = 0;
a7 = 0;
v11 = 0;
v50 = 0;
v42 = (UINT8 *)v60;
valid = 0;
a4 = 0;
if( VmInformationClass < VmPrefetchInformation )
return -1073741584;
if( VmInformationClass > 1 )
{
if( VmInformationClass == 2 )
{
v13 = (unsigned int)VmInformationLength;
if( (_DWORD)VmInformationLength == 40 )
goto LABEL_11;
return -1073741580;
}
if( VmInformationClass > 6 )
return -1073741584;
}
if( !VmInformation )
return -1073741581;
v13 = (unsigned int)VmInformationLength;
if( (_DWORD)VmInformationLength != 4 )
return -1073741580;
if( VmInformationClass == (_DWORD)VmInformationLength )
{
if( !MiUserHotPatchReserveSize )
return -1073741637;
if( NumberOfEntries != 1 )
return -1073741583;
}
LABEL_11:
if( NumberOfEntries - 1 > 0xFFFFFFFFFFFFFFEi64 )
return -1073741583;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
Thread = CurrentThread;
v16 = (_DWORD *)*((_QWORD *)CurrentThread + 23);
P = v16;
if( VmInformationClass == 2 && (v16[628] & 0x100) != 0 )
{
if( (*((_DWORD *)CurrentThread + 324) & 0x40000) == 0 )
v10 = 1;
a7 = v10;
}
*(_OWORD *)Address = 0i64;
*(_OWORD *)v53 = 0i64;
a9 = 0i64;
v17 = *((_BYTE *)CurrentThread + 562);
AccessMode = v17;
if( v17 )
{
v18 = NumberOfEntries;
if( 16 * NumberOfEntries )
{
if( ((unsigned __int8)VirtualAddresses & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( (unsigned __int64)&VirtualAddresses[v18] > 0x7FFFFFFF0000i64 || &VirtualAddresses[v18] < VirtualAddresses )
MEMORY[0x7FFFFFFF0000] = 0;
}
if( VmInformationClass == 2 )
{
if( (_DWORD)v13 )
{
if( ((unsigned __int8)VmInformation & 3) != 0 )
ExRaiseDatatypeMisalignment();
v19 = (char *)VmInformation + v13;
if( (unsigned __int64)v19 > 0x7FFFFFFF0000i64 || v19 < VmInformation )
MEMORY[0x7FFFFFFF0000] = 0;
}
*(_OWORD *)Address = *(_OWORD *)VmInformation;
*(_OWORD *)v53 = *((_OWORD *)VmInformation + 1);
a9 = *((_QWORD *)VmInformation + 4);
a4_4 = _mm_cvtsi128_si32(*(__m128i *)Address);
if( !a4_4 || HIDWORD(Address[0]) )
return -1073741581;
ProbeForWrite((VOID *)Address[1], 4ui64, 4ui64);
if( ((__int64)v53[0] & 3) != 0 )
ExRaiseDatatypeMisalignment();
v20 = (char *)v53[0] + 16 * a4_4;
if( (unsigned __int64)v20 > 0x7FFFFFFF0000i64 || v20 < v53[0] )
MEMORY[0x7FFFFFFF0000] = 0;
v17 = AccessMode;
}
else
{
if( ((unsigned __int8)VmInformation & 3) != 0 )
ExRaiseDatatypeMisalignment();
a4 = *(_DWORD *)VmInformation;
a4_4 = (unsigned int)Address[0];
}
v16 = P;
v9 = ProcessHandle;
goto LABEL_42;
}
if( VmInformationClass != 2 )
{
a4 = *(_DWORD *)VmInformation;
a4_4 = (unsigned int)Address[0];
goto LABEL_42;
}
*(_OWORD *)Address = *(_OWORD *)VmInformation;
*(_OWORD *)v53 = *((_OWORD *)VmInformation + 1);
a9 = *((_QWORD *)VmInformation + 4);
a4_4 = _mm_cvtsi128_si32(*(__m128i *)Address);
if( !a4_4 || HIDWORD(Address[0]) )
return -1073741581;
LABEL_42:
if( v9 == (PVOID)-1i64 )
{
Object = v16;
}
else
{
result = ObReferenceObjectByHandleWithTag(v9, 8u, (POBJECT_TYPE)PsProcessType, v17, 0x66506D4Du, &Object, 0i64);
valid = result;
if( result < 0 )
return result;
}
v21 = dst;
P = dst;
if( NumberOfEntries > 0x10 )
{
LODWORD(v35) = MiAllocatePool((struct _SLIST_ENTRY *)0x40);
v21 = v35;
P = v35;
if( !v35 )
{
v21 = dst;
valid = -1073741670;
v26 = v60;
goto LABEL_82;
}
}
if( VmInformationClass == 2 )
{
if( a4_4 > 0x10 )
{
LODWORD(v36) = MiAllocatePool((struct _SLIST_ENTRY *)0x40);
v42 = v36;
if( !v36 )
{
v26 = v60;
valid = -1073741670;
goto LABEL_82;
}
}
if( v53[1] )
{
v55 = 0i64;
valid = ObReferenceObjectByHandle(v53[1], 1u, MmSectionObjectType, AccessMode, &v55, 0i64);
DmaAdapter = (PADAPTER_OBJECT)v55;
if( valid < 0 )
goto LABEL_81;
}
}
memmove(v21, (UINT8 *)Src, 16 * NumberOfEntries);
if( VmInformationClass == 2 )
memmove(v42, (UINT8 *)v53[0], 16i64 * a4_4);
if( *((PVOID *)Thread + 23) != Object )
{
if( (unsigned int)(VmInformationClass - 3) <= 1 )
{
valid = -1073741585;
goto LABEL_81;
}
KeStackAttachProcess((PRKPROCESS)Object, &ApcState);
v11 = 1;
}
if( !(unsigned int)MiValidateMemoryRangeEntries((MEMORY_RANGE_ENTRY *)v21, NumberOfEntries, 0i64) )
goto LABEL_104;
if( VmInformationClass == VmPrefetchInformation )
{
if( a4 == (_DWORD)v23 )
{
MiGetEffectivePagePriorityThread(Thread, v22, v23);
IoPriorityThread = PsGetIoPriorityThread(v28);
v31 = 17408;
if( IoPriorityThread > 1 )
v31 = 0x4000;
v32 = MiPrefetchVirtualMemory(NumberOfEntries, (INT64)v21, (CHAR *)Object + 1664, v30 | (unsigned int)v31);
goto LABEL_80;
}
goto LABEL_87;
}
v24 = VmInformationClass - 1;
if( !v24 )
{
if( a4 > 5 )
goto LABEL_87;
v33 = a4;
v34 = 1i64;
goto LABEL_85;
}
v25 = v24 - 1;
if( v25 )
{
v37 = v25 - 1;
if( v37 )
{
v38 = v37 - 1;
if( v38 )
{
v39 = v38 - 1;
if( v39 )
{
if( v39 != 1 )
goto LABEL_81;
if( a4 != (_DWORD)v23 )
{
valid = -1073741811;
goto LABEL_81;
}
v32 = VmPrefetchVirtualAddresses(v21);
goto LABEL_80;
}
if( a4 == 512 )
{
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeLockMemoryPrivilege, AccessMode) )
{
valid = -1073741727;
goto LABEL_81;
}
v32 = MiProcessVaContiguityInformation((UINT64)v21, NumberOfEntries);
goto LABEL_80;
}
LABEL_115:
valid = -1073741637;
goto LABEL_81;
}
if( a4 == 1 )
{
if( *((_QWORD *)v21 + 1) == 4096i64 )
{
v32 = MiSetImageHotPatchAllowed(*(_QWORD *)v21);
goto LABEL_80;
}
LABEL_104:
valid = -1073741582;
goto LABEL_81;
}
LABEL_87:
valid = -1073741581;
goto LABEL_81;
}
if( a4 != (_DWORD)v23 )
goto LABEL_87;
if( (*((_DWORD *)Object + 281) & 0x10) == 0 )
goto LABEL_115;
v33 = 0i64;
v34 = 3i64;
LABEL_85:
v32 = MiProcessVaRangesInfoClass(NumberOfEntries, v21, v34, v33);
LABEL_80:
valid = v32;
LABEL_81:
v26 = (char *)v42;
goto LABEL_82;
}
v26 = (char *)v42;
if( NumberOfEntries == 1 )
{
LODWORD(Tag) = a4_4;
valid = MiCfgMarkValidEntries(
(_EPROCESS *)Object,
*(_QWORD *)v21,
*((_QWORD *)v21 + 1),
v42,
Tag,
(INT64)&a6,
a7,
(INT64)DmaAdapter,
a9);
if( v11 )
KeUnstackDetachProcess(&ApcState);
LOBYTE(v11) = 0;
*(_DWORD *)Address[1] = a6;
v27 = ProcessHandle;
goto LABEL_59;
}
valid = -1073741582;
LABEL_82:
v27 = ProcessHandle;
LABEL_59:
if( (v11 & 1) != 0 )
KeUnstackDetachProcess(&ApcState);
if( DmaAdapter )
HalPutDmaAdapter(DmaAdapter);
if( v27 != (PVOID)-1i64 )
ObfDereferenceObjectWithTag(Object, 0x66506D4Dui64);
if( v21 != dst )
ExFreePoolWithTag(v21, 0);
if( v26 != v60 )
ExFreePoolWithTag(v26, 0);
return valid;
}Referenced by:
No references.