MmProtectPool
INT64 __fastcall MmProtectPool(UINT64 VirtualAddress, INT64 a2, UINT64 a3){
unsigned int v3;
unsigned int ProtectionMask;
unsigned int v7;
void *v8;
int v9;
unsigned __int64 v10;
int v11;
int v12;
INT64 AnyMultiplexedVm;
int v14;
char *v15;
__int64 v16;
UINT8 i;
INT64 v18;
signed __int64 v19;
char v20;
INT64 v21;
_MMPFN *v22;
unsigned __int64 v23;
UINT64 v24;
INT64 TransitionPte;
int v26;
INT64 v27;
signed __int64 v28;
signed __int64 v29;
INT64 v30;
unsigned __int64 v31;
UINT64 v32;
_MMPTE *PteBase;
unsigned __int64 v34;
INT64 v35;
__int64 v36;
unsigned __int64 v37;
UNICODE_STRING *v38;
UINT8 v39;
PWCHAR v40;
int v41;
INT64 v42;
int v43;
unsigned int v44;
int v45;
_MMPFN *v46;
INT64 v47;
unsigned __int64 v48;
unsigned __int64 v49;
signed __int64 v50;
unsigned int v51;
signed __int64 v52;
int v53;
unsigned __int64 v54;
__int64 v55;
_MMPFN *v56;
INT64 ValidPte;
unsigned __int64 v58;
char *v59;
UINT8 v60;
PWCHAR v61;
int v62;
INT64 v63;
int v64;
INT64 v65;
INT64 v66;
INT64 v67;
UINT64 v68;
INT64 v69;
__int64 v70;
INT64 v72;
INT64 a1;
INT64 v74;
UINT64 SpinCount;
unsigned __int64 v76;
char *v77;
INT64 v78;
INT64 v79;
int result;
__int16 result_4;
int v82;
__int64 v83;
__int64 v84;
int v85;
__int16 v86;
int v87;
int v88;
__int64 v89;
__int64 v90;
v3 = a3;
BYTE1(v72) = 0;
memset((INT64)&result, 0i64);
memset((INT64)&v85, 0i64);
if( (v3 & 0x10) != 0 && (MiFlags & 0x10000) != 0 )
v3 &= ~0x10u;
ProtectionMask = MiMakeProtectionMask(v3);
HIDWORD(v74) = ProtectionMask;
v7 = ProtectionMask;
if( ProtectionMask >= 8 && ProtectionMask != 24 || (ProtectionMask & 5) == 5 )
return 0i64;
LODWORD(v74) = 0;
v8 = (void *)(VirtualAddress + a2 - 1);
v76 = (unsigned __int64)v8;
v9 = 0;
v10 = (unsigned __int64)MmGetPteBase() + ((VirtualAddress >> 9) & 0x7FFFFFFFF8i64);
MiGetSystemRegionType(VirtualAddress);
AnyMultiplexedVm = (INT64)MiGetAnyMultiplexedVm(2i64);
if( v11 == 6 )
goto LABEL_13;
if( v11 != 5 )
{
if( v11 != 1 )
return 0i64;
v9 = v12;
AnyMultiplexedVm = MiGetSessionVm();
LABEL_13:
v14 = v74;
goto LABEL_14;
}
if( (unsigned int)MiFindLargeMapping((PVOID)VirtualAddress, v8) )
return 0i64;
v14 = 1;
LODWORD(v74) = 1;
AnyMultiplexedVm = (INT64)MiGetAnyMultiplexedVm(5i64);
LABEL_14:
v15 = 0i64;
v77 = 0i64;
result = v9;
v82 = 20;
result_4 = 0;
v83 = 0i64;
v84 = 0i64;
v16 = *(unsigned __int16 *)(AnyMultiplexedVm + 174);
v76 = (unsigned __int64)MmGetPteBase() + ((v76 >> 9) & 0x7FFFFFFFF8i64);
v78 = *(_QWORD *)(qword_140C4E388 + 8 * v16);
LOBYTE(v72) = MiLockWorkingSetShared(AnyMultiplexedVm);
for( i = v72; v10 <= v76; v14 = v74 )
{
if( v15 )
{
if( (v10 & 0xFFF) != 0 )
goto LABEL_19;
MiFlushTbList((__int64)&result);
MiUnlockPageTableInternal(AnyMultiplexedVm, (UINT64)v15);
}
v15 = (char *)MmGetPteBase() + ((v10 >> 9) & 0x7FFFFFFFF8i64);
v77 = v15;
MiLockPageTableInternal(AnyMultiplexedVm, (UINT64)v15, 0i64);
LABEL_19:
v18 = MI_READ_PTE_LOCK_FREE(v10);
v19 = v18;
v20 = *(_BYTE *)(AnyMultiplexedVm + 184) & 7;
a1 = v18;
if( v7 != 24 )
{
if( v20 == 7 )
{
v51 = v7 | 0x80000000;
while( 1 )
{
v52 = v19;
v53 = v19 & 1;
if( v53 )
{
v54 = MI_READ_PTE_LOCK_FREE((INT64)&a1);
}
else
{
v54 = v52;
if( qword_140C4DC80 && (v52 & 0x10) == 0 )
v54 = ~qword_140C4DC80 & v52;
}
v55 = (v54 >> 12) & 0xFFFFFFFFFi64;
v56 = (_MMPFN *)((char *)MmGetPfnDb() + 48 * v55);
ValidPte = MiMakeValidPte(v10, v55, v51);
v50 = ValidPte;
if( !v53 )
{
if( (*((_QWORD *)v56 + 3) & 0x3FFFFFFFFFFFFFFFi64) != 1 )
{
LODWORD(SpinCount) = 0;
while( _interlockedbittestandset64((volatile signed __int32 *)v56 + 6, 0x3Fui64) )
{
do
KeYieldProcessorEx(&SpinCount);
while( *((__int64 *)v56 + 3) < 0 );
}
*((_QWORD *)v56 + 3) = *((_QWORD *)v56 + 3) & 0xC000000000000000ui64 | 1;
_InterlockedAnd64((volatile signed __int64 *)v56 + 3, 0x7FFFFFFFFFFFFFFFui64);
v50 |= 0x200ui64;
}
v7 = HIDWORD(v74);
*((_QWORD *)v56 + 2) ^= (*((_DWORD *)v56 + 4) ^ (32 * HIDWORD(v74))) & 0x3E0;
goto LABEL_98;
}
if( (_DWORD)v74 != 1 )
break;
v56 = MiLockNonPagedPoolPte((_MMPTE *)v10, (UINT8 *)&v72 + 1);
v19 = MI_READ_PTE_LOCK_FREE(v10);
if( v19 == v52 )
{
if( (v52 & 0x200) != 0 )
v50 |= 0x200ui64;
v19 = _InterlockedCompareExchange64((volatile signed __int64 *)v10, v50, v52);
if( v19 == v52 )
goto LABEL_66;
}
_InterlockedAnd64((volatile signed __int64 *)v56 + 3, 0x7FFFFFFFFFFFFFFFui64);
__writecr8(BYTE1(v72));
a1 = v19;
}
BYTE1(v72) = 17;
MiWriteValidPteNewProtection((INT64 *)v10, ValidPte);
LABEL_66:
v7 = HIDWORD(v74);
*((_QWORD *)v56 + 2) ^= (*((_DWORD *)v56 + 4) ^ (32 * HIDWORD(v74))) & 0x3E0;
if( (_DWORD)v74 == 1 )
{
_InterlockedAnd64((volatile signed __int64 *)v56 + 3, 0x7FFFFFFFFFFFFFFFui64);
__writecr8(BYTE1(v72));
}
if( (MiFlags & 0x100) == 0 || MI_TIGHTER_PERMISSIONS(a1, v50) )
{
PteBase = MmGetPteBase();
v34 = v10 << 25;
v35 = 1i64;
goto LABEL_33;
}
goto LABEL_99;
}
if( (v18 & 1) != 0 )
{
v58 = ((unsigned __int64)MI_READ_PTE_LOCK_FREE((INT64)&a1) >> 12) & 0xFFFFFFFFFi64;
v59 = (char *)MmGetPfnDb() + 48 * v58;
LOBYTE(v62) = MI_PFN_IS_PROTO((UNICODE_STRING *)v59, (UNICODE_STRING *)v58, v60, v61);
if( v62 )
{
MiFlushTbList((__int64)&result);
v64 = MiCopyOnWrite((__int64)((v10 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16, (UINT64 *)v10, -1i64, 0i64);
if( v64 < 0 )
{
MiUnlockPageTableInternal(AnyMultiplexedVm, (UINT64)v15);
MiUnlockWorkingSetShared(AnyMultiplexedVm, v72);
MiCopyOnWriteCheckConditions(AnyMultiplexedVm, (unsigned int)v64);
MiLockWorkingSetShared(AnyMultiplexedVm);
MiLockPageTableInternal(AnyMultiplexedVm, (UINT64)v15, 0i64);
}
v10 -= 8i64;
goto LABEL_99;
}
v65 = v7;
LODWORD(v65) = v7 | 0x80000000;
v66 = v19 & 0xF00000000000000i64 | v19 & 0x7000000000000000i64 | MiMakeValidPte(v10, v63, v65) & 0x80FFFFFFFFFFFFFFui64;
if( _InterlockedCompareExchange64((volatile signed __int64 *)v10, v66, v19) == v19 )
{
if( (MiFlags & 0x100) == 0 || MI_TIGHTER_PERMISSIONS(a1, v66) )
MiInsertTbFlushEntry(
(INT64)&result,
(__int64)((v10 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16,
1i64,
0i64);
v68 = 0i64;
HIDWORD(SpinCount) = 0;
while( _interlockedbittestandset64((volatile signed __int32 *)v59 + 6, 0x3Fui64) )
{
do
KeYieldProcessorEx((UINT64 *)((char *)&SpinCount + 4));
while( *((__int64 *)v59 + 3) < 0 );
}
*((_QWORD *)v59 + 2) ^= (*((_DWORD *)v59 + 4) ^ (32 * v7)) & 0x3E0;
if( (a1 & 0x42) != 0 )
v68 = MiCaptureDirtyBitToPfn((INT64)v59);
_InterlockedAnd64((volatile signed __int64 *)v59 + 3, 0x7FFFFFFFFFFFFFFFui64);
if( v68 )
MiReleasePageFileInfo(v78, v68, 1, v67, v72, a1, v74, SpinCount, v76, (INT64)v77, v78, v79);
goto LABEL_99;
}
}
else if( (v18 & 0x400) != 0 )
{
LABEL_44:
MiFlushTbList((__int64)&result);
MiUnlockPageTableInternal(AnyMultiplexedVm, (UINT64)v15);
MiUnlockWorkingSetShared(AnyMultiplexedVm, i);
MmAccessFault(0i64, (PVOID)((__int64)((v10 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16), 0, 0i64);
MiLockWorkingSetShared(AnyMultiplexedVm);
MiLockPageTableInternal(AnyMultiplexedVm, (UINT64)v15, 0i64);
}
else
{
if( (v18 & 0x800) == 0 )
{
a1 = v18 ^ ((unsigned __int16)v18 ^ (unsigned __int16)(32 * v7)) & 0x3E0;
v50 = a1;
goto LABEL_98;
}
v46 = MiLockTransitionLeafPage((_MMPTE *)v10, 0i64);
if( v46 )
{
v69 = MI_READ_PTE_LOCK_FREE(v10);
v70 = 32i64 * (v7 & 0x1F);
v48 = v70 | *((_QWORD *)v46 + 2) & 0xFFFFFFFFFFFFFC1Fui64;
v49 = v70 | v69 & 0xFFFFFFFFFFFFFC1Fui64;
LABEL_48:
*((_QWORD *)v46 + 2) = v48;
a1 = v49;
*(_QWORD *)v10 = v49;
_InterlockedAnd64((volatile signed __int64 *)v46 + 3, 0x7FFFFFFFFFFFFFFFui64);
LABEL_99:
i = v72;
goto LABEL_100;
}
}
LABEL_42:
v10 -= 8i64;
goto LABEL_100;
}
v21 = v18 & 1;
if( v20 == 7 )
{
if( v14 == 1 )
{
if( v21 )
{
v22 = MiLockNonPagedPoolPte((_MMPTE *)v10, (UINT8 *)&v72 + 1);
v19 = MI_READ_PTE_LOCK_FREE(v10);
a1 = v19;
goto LABEL_26;
}
}
else if( v21 )
{
v22 = (_MMPFN *)((char *)MmGetPfnDb()
+ 48 * (((unsigned __int64)MI_READ_PTE_LOCK_FREE((INT64)&a1) >> 12) & 0xFFFFFFFFFi64));
BYTE1(v72) = MiLockPageInline((INT64)v22);
LABEL_26:
*((_QWORD *)v22 + 2) = *((_QWORD *)v22 + 2) & 0xFFFFFFFFFFFFFC1Fui64 | 0x300;
v23 = MI_READ_PTE_LOCK_FREE((INT64)&a1);
TransitionPte = MiMakeTransitionPte((v23 >> 12) & 0xFFFFFFFFFi64, 0x18ui64, v24);
v27 = (unsigned int)(v26 - 23);
v28 = TransitionPte;
if( (_DWORD)v74 == (_DWORD)v27 )
{
while( 1 )
{
v29 = v19;
v30 = _InterlockedCompareExchange64((volatile signed __int64 *)v10, v28, v19);
v19 = v30;
if( v30 == v29 )
break;
a1 = v30;
v31 = MI_READ_PTE_LOCK_FREE((INT64)&a1);
v28 = MiMakeTransitionPte((v31 >> 12) & 0xFFFFFFFFFi64, 0x18ui64, v32);
}
v7 = HIDWORD(v74);
if( (v29 & 0x200) != 0 )
*((_QWORD *)v22 + 3) = *((_QWORD *)v22 + 3) & 0xC000000000000000ui64 | 0x10000;
}
else
{
*(_QWORD *)v10 = TransitionPte;
}
_InterlockedAnd64((volatile signed __int64 *)v22 + 3, 0x7FFFFFFFFFFFFFFFui64);
PteBase = MmGetPteBase();
v34 = v10 << 25;
v35 = v27;
LABEL_33:
MiInsertTbFlushEntry((INT64)&result, (__int64)(v34 - ((_QWORD)PteBase << 25)) >> 16, v35, 0i64);
goto LABEL_99;
}
}
else
{
if( !v21 )
{
if( (v19 & 0x400) != 0 )
goto LABEL_44;
if( (v19 & 0x800) == 0 )
{
a1 = v19 & 0xFFFFFFFFFFFFFC1Fui64 | 0x300;
v50 = a1;
LABEL_98:
*(_QWORD *)v10 = v50;
goto LABEL_99;
}
v46 = MiLockTransitionLeafPage((_MMPTE *)v10, 0i64);
if( v46 )
{
v47 = MI_READ_PTE_LOCK_FREE(v10);
v48 = *((_QWORD *)v46 + 2) & 0xFFFFFFFFFFFFFC1Fui64 | 0x300;
v49 = v47 & 0xFFFFFFFFFFFFFC1Fui64 | 0x300;
goto LABEL_48;
}
goto LABEL_42;
}
v36 = (__int64)((v10 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16;
v37 = MI_READ_PTE_LOCK_FREE((INT64)&a1);
LOBYTE(v41) = MI_PFN_IS_PROTO((UNICODE_STRING *)MmGetPfnDb() + 3 * ((v37 >> 12) & 0xFFFFFFFFFi64), v38, v39, v40);
if( v41 )
{
MiFlushTbList((__int64)&result);
v43 = MiCopyOnWrite(v36, (UINT64 *)v10, -1i64, 0i64);
v10 -= 8i64;
v44 = v43;
if( v43 < 0 )
{
MiUnlockPageTableInternal(AnyMultiplexedVm, (UINT64)v15);
MiUnlockWorkingSetShared(AnyMultiplexedVm, v72);
MiCopyOnWriteCheckConditions(AnyMultiplexedVm, v44);
MiLockWorkingSetShared(AnyMultiplexedVm);
MiLockPageTableInternal(AnyMultiplexedVm, (UINT64)v15, 0i64);
}
goto LABEL_99;
}
if( (_DWORD)dword_140C4E568 )
MI_WSLE_LOG_ACCESS(AnyMultiplexedVm, v10);
if( (MiGetWsleContents(v42, v36) & 0xF) == 8 )
goto LABEL_99;
v45 = MiTbFlushType(AnyMultiplexedVm);
v88 = 0;
v89 = 0i64;
v90 = 0i64;
v85 = v45;
v86 = 4;
v87 = 20;
MiInsertTbFlushEntry((INT64)&v85, v36, 1i64, 0i64);
i = v72;
if( !MiFreeWsleList(AnyMultiplexedVm, (INT64)&v85, 0) )
goto LABEL_42;
}
LABEL_100:
v15 = v77;
v10 += 8i64;
}
MiFlushTbList((__int64)&result);
if( v15 )
MiUnlockPageTableInternal(AnyMultiplexedVm, (UINT64)v15);
MiUnlockWorkingSetShared(AnyMultiplexedVm, i);
return 1i64;
}Referenced by:
ExProtectPoolEx