MiMapSystemImageWithLargePage
CHAR *__fastcall MiMapSystemImageWithLargePage(INT64 a1, UINT64 a2, const VOID *a3){
UINT64 v3;
_CONTROL_AREA *v5;
char *i;
UINT64 v7;
_MI_PARTITION *v8;
UINT64 v9;
UINT64 v10;
UINT64 v11;
int v13;
void *PageTablesForLargeMap;
UINT64 v15;
void *v16;
UINT64 v17;
IMAGE_NT_HEADERS *v18;
const CHAR *v19;
UINT32 v20;
IMAGE_NT_HEADERS *v21;
unsigned int VirtualAddress;
LONGLONG v23;
int v24;
MMPTE *PteAddress;
INT64 Conflict;
ULONG Conflicta;
ULONG Invalid;
INT64 Invalida;
UINT64 PreferredNode;
INT64 PreferredNodea;
UINT64 PreferredChannel;
UINT64 Flags;
CHAR *AnyMultiplexedVm;
__int64 v35[14];
v3 = (unsigned int)a2;
memset(v35, 0, 48);
if( a1 )
{
v5 = MiSectionControlArea((_SECTION *)a1);
for( i = (char *)v5 + 128; i; i = (char *)*((_QWORD *)i + 2) )
{
if( (i[32] & 0x3E) == 0 )
return 0i64;
}
}
else
{
v5 = 0i64;
}
v7 = v3;
v8 = (_MI_PARTITION *)((v3 + (unsigned int)dword_140C4C98C + 511i64) & 0xFFFFFFFFFFFFFE00ui64);
v9 = MiRoundUpToPowerOf2SizeT((UINT64)v8);
LODWORD(Flags) = 0x100000;
LODWORD(PreferredChannel) = 0x80000000;
LODWORD(PreferredNode) = 0x80000000;
if( (int)MiFindContiguousPages(
(_MI_PARTITION *)&MiSystemPartition,
0x200ui64,
0xFFFFFFFFFui64,
v9,
v9,
MiCached,
PreferredNode,
PreferredChannel,
Flags,
0i64) < 0 )
return 0i64;
if( v9 > (unsigned __int64)v8 )
MiFreeContiguousPages(v8, v9 - (_QWORD)v8, v11);
MiPageToNode(0i64, v10);
PageTablesForLargeMap = (void *)MiGetPageTablesForLargeMap((UINT64)v8, 0xCui64, 1i64, (unsigned int)(v13 + 1));
v16 = PageTablesForLargeMap;
if( !PageTablesForLargeMap )
goto LABEL_13;
MiGetPteAddress(PageTablesForLargeMap);
if( MiReservePrivilegedPtes((INT64)v5) < 0 )
{
MiUnmapLargeDriver(v16, v3);
LABEL_13:
MiFreeContiguousPages(0i64, (UINT64)v8, v15);
return 0i64;
}
AnyMultiplexedVm = MiGetAnyMultiplexedVm(1i64);
LODWORD(PreferredNodea) = 1;
LODWORD(Conflict) = 1;
MiMapWithLargePages((INT64)AnyMultiplexedVm, (UINT64)v16, 0i64, (UINT64)v8, Conflict, 6, PreferredNodea);
v17 = (unsigned int)((_DWORD)v3 << 12);
memmove((UINT8 *)v16, (UINT8 *)a3, v17);
memset((INT64)v16 + v17, 0i64);
if( MiIsRetpolineEnabled() )
memmove((UINT8 *)v16 + v17, (UINT8 *)Base, (unsigned int)(dword_140C4C9C8 << 12));
v18 = RtlImageNtHeader(v16);
v21 = v18;
if( v18->OptionalHeader.NumberOfRvaAndSizes <= 5
|| (VirtualAddress = v18->OptionalHeader.DataDirectory[5].VirtualAddress) != 0
&& ((v23 = VirtualAddress + v21->OptionalHeader.DataDirectory[5].Size, (unsigned int)v23 > (unsigned int)v17)
|| (LdrRelocateImageWithBias(v16, v23, v19, v20, Conflicta, Invalid) & 0x80000000) != 0
|| (MiIsRetpolineEnabled() || MiIsImportOptimizationEnabled())
&& (LODWORD(Invalida) = MiIsRetpolineEnabled(),
v24 = RtlPerformRetpolineRelocationsOnImage(
(CHAR *)v16,
(INT64)v16,
(unsigned int)v17,
(INT64)v16 + v17,
(INT64)Base,
Invalida),
(int)(v24 + 0x80000000) >= 0)
&& v24 != -1073741637) )
{
MiReleasePrivilegedPtes();
MiUnmapLargeDriver(v16, v7);
return 0i64;
}
v21->OptionalHeader.ImageBase = (unsigned __int64)v16;
if( a1 )
{
PteAddress = MiGetPteAddress((PVOID)a3);
MiDeleteSystemPagableVm((__int64)AnyMultiplexedVm, (__int64)v5, (unsigned __int64)PteAddress, v7, 1, v35);
MiChargeSystemImageCommitment(a1);
}
return(CHAR *)v16;
}Referenced by:
MiHandleBootImage
MmLoadSystemImageEx