MiResolveDemandZeroFault
__int64 __fastcall MiResolveDemandZeroFault(
void *VirtualAddress,
_MMPTE *PointerPte,
_MMPFN *ProtoPfn,
_MMSUPPORT_INSTANCE *Vm,
void *TrapInformation,
unsigned __int64 StoreInstruction,
unsigned int VmIrql){
__int64 v7;
unsigned __int64 v8;
_MMPTE *v9;
int v11;
char v12;
char v13;
unsigned __int64 v14;
__int64 v15;
__int64 v16;
_MMPTE *v17;
INT64 v18;
__int64 v19;
_MMVAD *v20;
_MMPTE *PteBase;
_ETHREAD *CurrentThread;
__int64 v23;
__int64 v24;
_MMPTE *v25;
__int64 v26;
unsigned __int64 v27;
_MMPFN *v28;
__int64 v29;
__int64 v30;
char v32;
char v33;
unsigned int v34;
UINT64 v35;
int v36;
_MMPFN *v37;
int v38;
INT64 v39;
unsigned __int64 *v40;
_MMPTE *v41;
__int64 v42;
unsigned __int64 v43;
__int64 v44;
int v45;
RTL_BALANCED_NODE *Address;
unsigned int v47;
_RTL_BALANCED_NODE *v48;
_MMPTE *v49;
unsigned __int64 v50;
_MMVAD *v51;
unsigned __int64 v52;
_MMPTE *v53;
INT64 v54;
INT64 v55;
INT64 v56;
_MMPTE *v57;
_MMVAD *VadOut;
INT64 v59;
unsigned __int64 v60;
UINT64 SpinCount[2];
INT64 a1;
INT64 v63;
_MMPTE *v64;
_MMPTE *v65;
int v66;
int v67;
__int64 v68;
int v69;
int v70;
__int64 v71;
_MMVAD *v72;
__int64 v73;
UINT64 ProtectCode;
_MMPFN *Pfn1;
_MMSUPPORT_INSTANCE *v76;
v76 = Vm;
Pfn1 = ProtoPfn;
v7 = *((_QWORD *)VirtualAddress + 7);
v8 = 0i64;
a1 = 0i64;
v9 = PointerPte;
v68 = 0i64;
v70 = 0;
v11 = 0;
v12 = *(_BYTE *)(v7 + 184);
v73 = 0i64;
v13 = v12 & 7;
if( !v13 )
{
v11 = 64;
LODWORD(a1) = 64;
}
v14 = *((_QWORD *)VirtualAddress + 2) & 0xFFFFFFFFFFFFFFFEui64;
v15 = *((_QWORD *)VirtualAddress + 2) & 1i64;
if( v15 )
{
switch( *(_BYTE *)v14 )
{
case 2:
v11 |= 1u;
break;
case 1:
v11 |= 2u;
break;
case 5:
v11 |= 8u;
break;
default:
goto LABEL_55;
}
LODWORD(a1) = v11;
LABEL_55:
if( *(_BYTE *)v14 == 4 )
goto LABEL_56;
}
if( (v11 & 0xB) == 0 )
{
v16 = 0i64;
goto LABEL_6;
}
LABEL_56:
v16 = v14;
if( v15 && *(_BYTE *)v14 == 4 )
v73 = *(_QWORD *)(v14 + 40);
if( (v11 & 2) != 0 && (*(_DWORD *)(v14 + 80) & 0x4000) != 0 )
{
v11 |= 4u;
LODWORD(a1) = v11;
}
if( (v11 & 8) != 0 && *(_QWORD *)(*(_QWORD *)(v14 + 8) + 8i64) > 0x1000ui64 )
{
v11 |= 0x10u;
LODWORD(a1) = v11;
}
LABEL_6:
v71 = v16;
if( (v11 & 2) != 0 && (v11 & 4) == 0 )
{
if( ProtoPfn )
{
LOBYTE(PointerPte) = 17;
MiUnlockProtoPoolPage(ProtoPfn, (UINT64)PointerPte);
}
return 0i64;
}
if( (v11 & 8) != 0 && (*(_DWORD *)(v16 + 56) & 8) != 0 )
{
if( ProtoPfn )
{
LOBYTE(PointerPte) = 17;
MiUnlockProtoPoolPage(ProtoPfn, (UINT64)PointerPte);
}
return 3221225495i64;
}
v17 = *(_MMPTE **)VirtualAddress;
v18 = *((_QWORD *)KeGetCurrentThread() + 23);
v19 = *((_QWORD *)VirtualAddress + 1) >> 57;
v20 = 0i64;
v59 = v18;
v56 = (INT64)v17;
VadOut = 0i64;
PteBase = MmGetPteBase();
if( (_DWORD)v19 )
goto LABEL_19;
if( !v15 )
{
v14 = 0i64;
goto LABEL_11;
}
if( *(_BYTE *)v14 == 4 )
{
LODWORD(v19) = *(unsigned __int16 *)(*((_QWORD *)*(&KiProcessorBlock
+ *(unsigned int *)(*(_QWORD *)(v14 + 40) + 588i64))
+ 24)
+ 146i64)
+ 1;
LABEL_67:
if( (_DWORD)v19 )
goto LABEL_19;
goto LABEL_68;
}
if( *(_BYTE *)v14 == 2 )
{
LODWORD(v19) = *(_DWORD *)(v14 + 40);
goto LABEL_67;
}
LABEL_68:
PteBase = MmGetPteBase();
LABEL_11:
if( !v13 )
{
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v23 = *((_QWORD *)CurrentThread + 23);
v24 = *(_QWORD *)(v23 + 1680);
if( v17 >= PteBase && v17 <= MmGetPteLimit() )
{
v20 = VadOut;
LABEL_49:
if( v14 && *((_BYTE *)CurrentThread + 586) == 1 )
LODWORD(v19) = *(unsigned __int16 *)(v23 + 2i64 * *((unsigned __int16 *)CurrentThread + 292) + 772) + 1;
goto LABEL_18;
}
if( v14 || *(_QWORD *)(v24 + 424) || *(_QWORD *)(v24 + 432) || *(_BYTE *)(v24 + 352) == 1 )
{
Address = MiLocateAddress((UINT64)v17);
VadOut = (_MMVAD *)Address;
v20 = (_MMVAD *)Address;
if( !Address
|| (v47 = (unsigned int)Address[2].Children[0], LODWORD(v19) = (v47 >> 12) & 0x3F, !(_DWORD)v19)
&& ((v47 & 0x100000) != 0
|| (v48 = Address[3].Children[0]->Children[0]) == 0i64
|| (LODWORD(v19) = (LODWORD(v48[2].Right) >> 20) & 0x3F, !(_DWORD)v19)) )
{
v17 = (_MMPTE *)v56;
goto LABEL_49;
}
v17 = (_MMPTE *)v56;
}
else
{
v20 = VadOut;
}
LABEL_18:
v18 = v59;
}
LABEL_19:
v69 = v19;
v64 = v17;
v63 = (INT64)VirtualAddress;
if( !v20 )
{
v25 = MmGetPteBase();
if( v9 <= (_MMPTE *)((char *)v25 + 0x3FFFFFFF78i64) && v9 >= v25 )
{
v26 = *(_QWORD *)(qword_140C4E388 + 8i64 * *(unsigned __int16 *)(v18 + 1838));
if( *(_DWORD *)(v26 + 1160) )
{
if( *(_QWORD *)(v26 + 1280) == v18 )
{
v51 = (_MMVAD *)MiLocateAddress((UINT64)v17);
v17 = (_MMPTE *)v56;
v20 = v51;
VadOut = v51;
}
}
}
}
v27 = *(_QWORD *)v9;
v72 = v20;
v28 = Pfn1;
if( !Pfn1 )
{
v29 = *((_QWORD *)VirtualAddress + 2);
v30 = (v27 >> 5) & 0x1F;
if( (v29 & 1) != 0 && *(_BYTE *)(v29 & 0xFFFFFFFFFFFFFFFEui64) == 4 || (v27 & 0x400) != 0 )
LODWORD(v30) = 4;
v66 = v30;
v67 = v30;
v65 = 0i64;
return MiResolvePrivateZeroFault((INT64)&a1);
}
v32 = a1;
v33 = 0;
v65 = v9;
v34 = 24;
v60 = 1i64;
v35 = 0i64;
LODWORD(ProtectCode) = 24;
if( (a1 & 0x15) != 0 && (a1 & 0x40) != 0 )
{
v49 = MiCheckVirtualAddress(v17, &ProtectCode, &VadOut);
v34 = ProtectCode;
v35 = (UINT64)v49;
v20 = VadOut;
v28 = Pfn1;
v66 = ProtectCode;
v67 = ProtectCode;
LABEL_79:
if( (v32 & 4) != 0 && v34 >> 3 != 1 && (v34 >> 3 != 3 || (v34 & 7) == 0) )
{
LOBYTE(v35) = 17;
MiUnlockProtoPoolPage(v28, v35);
return 0i64;
}
if( v35 && v20 && v34 != 24 && (v34 & 0xFFFFFFF8) != 16 )
{
MiExpandSharedZeroCluster(
(INT64)&a1,
v35,
(INT64)v28,
(INT64)v17,
v54,
v55,
v56,
(INT64)VadOut,
v59,
v60,
SpinCount[0],
SpinCount[1],
a1,
v63,
(INT64)v64);
v60 = v50;
}
goto LABEL_33;
}
if( v20 )
{
v52 = *((unsigned int *)v20 + 12);
if( (v52 & 0x100000) == 0 && MiVadPageSizes[(v52 >> 18) & 3] == 16 )
{
v33 = 1;
v53 = MiCheckUserVirtualAddress(v17, &ProtectCode, v20, (UINT64)v17);
v34 = ProtectCode;
v35 = (UINT64)v53;
v28 = Pfn1;
}
}
v66 = v34;
v67 = v34;
if( v33 == 1 )
goto LABEL_79;
LABEL_33:
v36 = MiCreateSharedZeroPages((int *)&a1, &v60);
v37 = Pfn1;
v38 = v36;
LODWORD(SpinCount[0]) = 0;
while( _interlockedbittestandset64((volatile signed __int32 *)v37 + 6, 0x3Fui64) )
{
do
KeYieldProcessorEx(SpinCount);
while( *((__int64 *)v37 + 3) < 0 );
}
*((_BYTE *)v37 + 34) &= ~0x20u;
MiRemoveLockedPageChargeAndDecRef(v37);
_InterlockedAnd64((volatile signed __int64 *)v37 + 3, 0x7FFFFFFFFFFFFFFFui64);
if( v38 >= 0 && (a1 & 4) == 0 )
{
v39 = (INT64)v64;
v59 = 0i64;
v40 = (unsigned __int64 *)((char *)v9 - 8 * (unsigned int)((unsigned __int64)(v56 - (_QWORD)v64) >> 12));
v41 = *(_MMPTE **)VirtualAddress;
v57 = *(_MMPTE **)VirtualAddress;
if( (a1 & 8) != 0 )
v59 = v16;
if( v60 )
{
v42 = v59;
do
{
v43 = *v40;
MiPteInShadowRange((UINT64)v40);
v44 = (__int64)v76;
*(_QWORD *)VirtualAddress = v39;
v45 = MiCompleteProtoPteFault((INT64)VirtualAddress, v43, v44, 1, v42);
v39 += 4096i64;
if( !v8 && v45 < 0 )
v38 = v45;
__incgsdword(0x2E9Cu);
++v8;
++v40;
}
while( v8 < v60 );
v41 = v57;
}
*(_QWORD *)VirtualAddress = v41;
}
return(unsigned int)v38;
}Referenced by:
MiDispatchFault
MiResolveProtoPteFault
MiSystemFault