MiIssueHardFault
INT64 __fastcall MiIssueHardFault(INT64 a1, UINT64 rdx0){
__int64 v2;
INT64 v4;
void *v6;
unsigned int v7;
unsigned int SessionIdForVa;
_FILE_OBJECT *v9;
MMPTE *v10;
__int64 v11;
__int64 v12;
__int64 v13;
INT64 v14;
_MMPFN *PfnDb;
__int64 v16;
int v17;
INT64 v18;
INT64 v19;
INT64 v20;
__int64 v21;
__int64 v22;
unsigned __int64 v23;
int v24;
UINT64 *v25;
unsigned __int64 v26;
UINT64 *v27;
char *v29;
UINT64 v30;
int v31;
UINT8 v32;
WCHAR *v33;
int v34;
UNICODE_STRING *v35;
int v36;
unsigned int v37;
CHAR v38;
INT64 v39;
INT64 *v40;
unsigned int v41;
INT64 TransitionPteValid;
_BYTE *v43;
__int64 v44;
int v45;
_MI_STORE_INPAGE_COMPLETE_FLAGS *v46;
INT64 v47;
__int64 v48;
__int64 v49;
INT64 v50[2];
char v51[8];
MMPTE *a2;
INT64 v53;
INT64 v54;
UNICODE_STRING *v55;
__int64 *v56;
UINT64 *v57;
__int64 v58;
v2 = *(_QWORD *)(rdx0 + 208);
v4 = *(_QWORD *)(rdx0 + 152);
v57 = (UINT64 *)a1;
v6 = *(void **)a1;
v7 = 0;
*(_QWORD *)(rdx0 + 224) = v6;
v51[0] = 0;
v54 = 0i64;
v55 = (UNICODE_STRING *)v2;
SessionIdForVa = MiGetSessionIdForVa(v6);
v9 = MiReferenceInPageFile(rdx0, SessionIdForVa);
v56 = (__int64 *)(a1 + 56);
v10 = (MMPTE *)MiReleaseFaultState(a1 + 56, 1u, v51);
v11 = *(_QWORD *)(a1 + 16);
a2 = v10;
if( v9 )
{
v12 = (__int64)v55;
*(_QWORD *)(rdx0 + 200) = v9;
v7 = (*(_DWORD *)(v12 + 56) >> 5) & 1;
}
else
{
*(_QWORD *)(rdx0 + 200) = *(_QWORD *)(*(_QWORD *)(rdx0 + 200) + 56i64);
}
v13 = *(_QWORD *)(a1 + 16);
if( (v13 & 1) == 0 || *(_BYTE *)(v13 & 0xFFFFFFFFFFFFFFFEui64) != 1 )
++*(_BYTE *)(v4 + 1310);
if( (*(_BYTE *)(*(_QWORD *)(a1 + 56) + 184i64) & 7) != 0 )
--*(_WORD *)(v4 + 486);
else
--*(_WORD *)(v4 + 484);
__writecr8((unsigned __int8)v51[0]);
v14 = *(unsigned int *)(rdx0 + 312);
PfnDb = MmGetPfnDb();
if( (*(_DWORD *)(rdx0 + 192) & 0x20000) != 0 )
{
v16 = (*(_DWORD *)(rdx0 + 312) >> 12) + (unsigned int)((*(_DWORD *)(rdx0 + 312) & 0xFFF) != 0);
MiZeroPhysicalPage(
*(_QWORD *)(rdx0 + 8 * v16 + 312),
3ui64,
(_MI_PFN_CACHE_ATTRIBUTE)(*((unsigned __int8 *)PfnDb + 48 * *(_QWORD *)(rdx0 + 8 * v16 + 312) + 34) >> 6));
v14 = *(unsigned int *)(rdx0 + 312);
}
*(_DWORD *)(rdx0 + 184) = v14;
v53 = 0i64;
if( *(_DWORD *)(rdx0 + 36) )
{
v7 = 2;
LABEL_24:
v21 = a1 + 56;
goto LABEL_25;
}
v17 = *(_DWORD *)(rdx0 + 192);
if( (v17 & 0x200008) == 2097160 && (v17 & 0x100) == 0 )
goto LABEL_24;
if( (dword_140CEBED4 & 1) != 0 && (v17 & 0x100) == 0 && (v17 & 8) == 0 )
{
v18 = *(_QWORD *)(rdx0 + 96);
v19 = *(_QWORD *)(rdx0 + 224);
v47 = *(_QWORD *)(rdx0 + 200);
v53 = (INT64)v50;
PfHardFaultRecord((INT64)v50, v18, v14, v19, v47, v4);
}
v20 = *(_QWORD *)(a1 + 56);
v21 = a1 + 56;
if( (*(_BYTE *)(v20 + 187) & 0x60) == 96 && !MiGetSharedVm(v20)[4] )
KiStackAttachProcess(PsInitialSystemProcess, 0i64, (_KAPC_STATE *)(rdx0 + 104));
v7 |= 2u;
MiIssueHardFaultIo(rdx0, v7 & 1, *(_QWORD *)(a1 + 16));
LABEL_25:
v22 = *(_QWORD *)(a1 + 16);
if( (v22 & 1) == 0 || (v23 = v22 & 0xFFFFFFFFFFFFFFFEui64, *(_BYTE *)v23 != 1) )
{
v29 = *(char **)(rdx0 + 248);
v30 = *(_QWORD *)(rdx0 + 232);
if( (*((_QWORD *)v29 + 5) & 0x1000000000i64) == 0 && *((__int64 *)v29 + 1) > 0 )
v29 = 0i64;
MiWaitForInPageComplete(a1, rdx0, &v53);
v31 = MiFinishHardFault((_MMINPAGE_SUPPORT *)a1, a2, (_MMSUPPORT_INSTANCE *)rdx0, (_MMPFN *)&v54, v46);
v34 = v53;
--*(_BYTE *)(v4 + 1310);
LODWORD(a2) = v34;
if( v31 )
return(unsigned int)v31;
if( !v29 )
v29 = (char *)MmGetPfnDb() + 48 * (((unsigned __int64)MI_READ_PTE_LOCK_FREE((INT64)&v54) >> 12) & 0xFFFFFFFFFi64);
v35 = (UNICODE_STRING *)(*(_DWORD *)(a1 + 8) & 2);
v55 = v35;
LOBYTE(v36) = MI_PFN_IS_PROTO((UNICODE_STRING *)v29, v35, v32, v33);
if( v36 )
{
v30 = (UINT64)MmGetPteBase() + ((*(_QWORD *)a1 >> 9) & 0x7FFFFFFFF8i64);
v31 = MiCompleteProtoPteFault(a1, v54, v37, 0, v11);
if( v31 >= 0 )
{
v40 = v56;
LABEL_48:
if( (_DWORD)dword_140C4E568 )
{
if( (_DWORD)a2 != 2 )
{
MiGetEffectivePagePriorityThread((_ETHREAD *)v4, v38, v39);
if( v41 >= dword_140C4E56C )
MiLogPageAccess(*v40, v30 | 1);
}
}
if( !v31 )
return 276;
}
}
else
{
v58 = v11 & 1;
if( (v11 & 1) != 0 && *(_BYTE *)(v11 & 0xFFFFFFFFFFFFFFFEui64) == 4 )
*(_QWORD *)v30 = MI_READ_PTE_LOCK_FREE(v30) & 0xFFFFFFFFFFFFFC1Fui64 | 0x80;
TransitionPteValid = MiMakeTransitionPteValid(v30);
if( (unsigned int)MI_IS_SOFTWARE_PTE_SHADOW_STACK((_QWORD *)v29 + 2) )
TransitionPteValid |= 0x40ui64;
if( v55 )
{
if( MiOkToSetPteDirtyForNotValidFault(TransitionPteValid, *v57) )
{
if( (TransitionPteValid & 0x800) != 0 )
{
TransitionPteValid |= 0x42ui64;
if( (v29[34] & 0x10) == 0 )
{
if( (unsigned int)MiGetPagingFileOffset((MMPTE *)(v29 + 16)) )
MiLockPageAndSetDirty((INT64)v29, 1i64);
}
}
}
}
v43 = (_BYTE *)(v11 & 0xFFFFFFFFFFFFFFFEui64);
if( !v58 )
goto LABEL_71;
if( *v43 == 4 )
{
*(_QWORD *)v30 = TransitionPteValid;
return 276i64;
}
if( *v43 == 5 )
{
v44 = (__int64)v43;
v45 = 0;
}
else
{
LABEL_71:
v45 = 0;
v44 = 0i64;
}
if( v58 && *v43 == 3 )
v45 = 1;
LODWORD(v49) = v45;
v48 = TransitionPteValid;
v40 = v56;
if( (unsigned int)MiAllocateWsle(*v56, v30, v29, 0, v48, v49, v44) )
goto LABEL_48;
MiLockAndDecrementShareCount((UINT64)v29, 0);
return(unsigned int)-1073741801;
}
return(unsigned int)v31;
}
v24 = *(unsigned __int8 *)(*(_QWORD *)v21 + 184i64);
if( (v24 & 7u) >= 2 )
*(_DWORD *)(rdx0 + 192) ^= (*(_DWORD *)(rdx0 + 192) ^ (2 * v24 - 2)) & 6;
if( v7 < 2 )
{
v27 = *(UINT64 **)(v23 + 64);
if( *v27 == v23 + 56 )
{
*(_QWORD *)rdx0 = v23 + 56;
*(_QWORD *)(rdx0 + 8) = v27;
*v27 = rdx0;
*(_QWORD *)(v23 + 64) = rdx0;
*(_QWORD *)(v23 + 72) += *(unsigned int *)(rdx0 + 184);
goto LABEL_35;
}
LABEL_33:
__fastfail(3u);
}
v25 = *(UINT64 **)(v23 + 48);
v26 = v23 + 40;
if( *v25 != v26 )
goto LABEL_33;
*(_QWORD *)rdx0 = v26;
*(_QWORD *)(rdx0 + 8) = v25;
*v25 = rdx0;
*(_QWORD *)(v26 + 8) = rdx0;
LABEL_35:
KeGetCurrentIrql();
__writecr8(1ui64);
if( (*(_BYTE *)(*(_QWORD *)v21 + 184i64) & 7) != 0 )
KiLeaveGuardedRegionUnsafe(v4);
else
KeLeaveCriticalRegionThread(v4);
MiRelockFaultState(v21, a2);
return 0i64;
}Referenced by:
MiInPagePageTable
MmAccessFault