MiCreatePrototypePtes
__int64 __fastcall MiCreatePrototypePtes(ULONG_PTR BugCheckParameter2, __int16 a2, unsigned int a3, unsigned int a4){
__int64 v5;
void *v9;
void *v10;
int v11;
UINT64 CommittedPages;
INT64 v13;
unsigned __int64 v14;
int v15;
char v16;
INT64 *v17;
KIRQL v18;
int v19;
unsigned __int64 v20;
CHAR v21;
int v22;
int v23;
unsigned int v24;
INT64 v25;
__int64 v27;
_ETHREAD *v28;
ULONG_PTR v29;
char v30;
int v31;
__int64 v32;
unsigned __int64 v33;
__int64 v34;
CHAR v35;
INT64 v36;
int v37;
int v38;
int FileExtents;
NTSTATUS SubsectionCharges;
BOOL v41;
bool v42;
INT64 v43;
__int64 v44;
_ETHREAD *v45;
unsigned int SessionId;
int v47;
__int64 v48;
unsigned __int64 v49;
__int64 v50;
int v51;
unsigned int v52[3];
int v53;
__int64 v54;
UINT64 a3a;
_ETHREAD *CurrentThread;
PVOID P;
BOOL a2a;
int v59;
char v60;
v5 = *(_QWORD *)BugCheckParameter2;
v59 = 0;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v54 = v5;
LODWORD(v9) = MiAllocatePool((struct _SLIST_ENTRY *)0x112);
P = v9;
v10 = v9;
if( !v9 )
return 3221225626i64;
v11 = *(_DWORD *)(v5 + 56) & 0x40000000;
MiInitializePrototypePtes((ULONG_PTR)v9, a4, (unsigned __int16 *)BugCheckParameter2, v11 == 0);
a2a = *(_QWORD *)(v5 + 64) != 0i64;
if( v11 )
{
v37 = 5;
v38 = a2 & 0x400;
if( !v38 || (v37 = 69, (unsigned int)MiChargeLargeProtoSubsection(BugCheckParameter2, 1i64)) )
{
FileExtents = MiAllocateFileExtents(BugCheckParameter2, 0, (ULONG_PTR)v10, a3, v37);
if( FileExtents < 0 )
{
ExFreePoolWithTag(v10, 0);
if( v38 )
MiChargeLargeProtoSubsection(BugCheckParameter2, 0i64);
}
return(unsigned int)FileExtents;
}
return 3221225626i64;
}
if( *(_QWORD *)(v5 + 64) )
{
CommittedPages = a3;
v13 = v5;
}
else
{
v13 = v5;
CommittedPages = MiGetCommittedPages((_QWORD *)v5);
}
LOWORD(v14) = -1;
if( (a2 & 4) != 0 )
{
v15 = 1;
v51 = 1;
goto LABEL_7;
}
v15 = MiControlAreaRequiresCharge(v13);
v51 = v15;
if( v15 )
{
LABEL_7:
v16 = a2 & 0x80;
while( 1 )
{
if( v15 == 2 )
{
if( CommittedPages )
{
SubsectionCharges = MiGetSubsectionCharges(BugCheckParameter2);
v14 = -1i64;
v24 = SubsectionCharges;
if( SubsectionCharges < 0 )
{
CommittedPages = 0i64;
goto LABEL_22;
}
}
}
else
{
CommittedPages = 0i64;
}
if( !a2a )
{
v59 = 1;
*((_WORD *)CurrentThread + 243) += v14;
ExAcquirePushLockExclusiveEx(*(_QWORD *)v13 + 40i64, 0i64);
}
v17 = (INT64 *)(v13 + 72);
v18 = ExAcquireSpinLockExclusive((PEX_SPIN_LOCK)(v13 + 72));
v19 = v51;
v20 = v18;
if( v51 != 2 )
break;
v41 = a2a;
v42 = a2a ? CommittedPages == *(_DWORD *)(BugCheckParameter2 + 44)
- (*(_DWORD *)(BugCheckParameter2 + 52) & 0x3FFFFFFF) : CommittedPages == MiGetCommittedPages((_QWORD *)v13);
if( v42 )
break;
LODWORD(a3a) = CommittedPages;
if( v41 )
CommittedPages = *(_DWORD *)(BugCheckParameter2 + 44) - (*(_DWORD *)(BugCheckParameter2 + 52) & 0x3FFFFFFFu);
else
CommittedPages = MiGetCommittedPages((_QWORD *)v13);
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)(v13 + 72));
__writecr8(v20);
v43 = a2a;
if( !a2a )
{
v44 = *(_QWORD *)v13 + 40i64;
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v44, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)v44);
v52[0] = 0;
v45 = (_ETHREAD *)KeGetCurrentThread();
if( (unsigned int)MiGetSystemRegionType(v44) == 1 )
SessionId = MmGetSessionIdEx(*((_QWORD *)v45 + 23));
else
SessionId = -1;
--*((_WORD *)v45 + 243);
v60 = ++*((_BYTE *)v45 + 794);
v47 = (*((char *)v45 + 792) | *((char *)v45 + 870)) ^ 0x3F;
while( 1 )
{
v42 = !_BitScanReverse((unsigned int *)&v48, v47);
v52[1] = v48;
if( v42 )
goto LABEL_84;
v49 = *((_QWORD *)v45 + 100) + 96 * v48;
v47 &= ~(1 << v48);
if( (*(_BYTE *)(v49 + 26) & 1) != 0
&& (*(_DWORD *)(v49 + 32) & 1) == 0
&& (*(_QWORD *)(v49 + 32) & 0x7FFFFFFFFFFFFFFCi64) == (v44 & 0x7FFFFFFFFFFFFFFCi64)
&& *(_DWORD *)(v49 + 40) == SessionId )
{
*(_BYTE *)(v49 + 26) &= ~1u;
if( *(_QWORD *)(v49 + 32) )
break;
}
}
if( !v49 )
{
LABEL_84:
if( (*((_DWORD *)v45 + 30) & 0x10000) == 0 )
KeBugCheckEx(0x162u, (ULONG_PTR)v45, v44, SessionId, 0i64);
goto LABEL_96;
}
*(_BYTE *)(v49 + 32) |= 2u;
if( *(__int64 *)(v49 + 32) < 0 )
KiAbEntryRemoveFromTree(v49);
v52[0] = 0;
v52[0] = *(_DWORD *)(v49 + 88) & 0x1FFFF;
*(_DWORD *)(v49 + 88) &= 0xFFFE0000;
*(_BYTE *)(v49 + 25) &= ~1u;
*(_QWORD *)(v49 + 32) = 0i64;
v50 = (__int64)(v49 - *((_QWORD *)v45 + 100)) / 96;
if( v60 == 1 )
*((_BYTE *)v45 + 792) |= 1 << v50;
else
_InterlockedOr8((volatile signed __int8 *)v45 + 870, 1 << v50);
LABEL_96:
--*((_BYTE *)v45 + 794);
KiAbThreadRemoveBoosts((ULONG_PTR)v45, v44, v52);
v42 = (*((_WORD *)v45 + 243))++ == 0xFFFF;
if( v42 && *((_ETHREAD **)v45 + 19) != (_ETHREAD *)((char *)v45 + 152) )
KiCheckForKernelApcDelivery();
KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
v13 = v54;
v43 = 0i64;
v59 = 0;
}
LOWORD(v14) = -1;
v15 = 2;
if( (_DWORD)a3a )
{
MiReturnCrossPartitionSectionCharges(
*(volatile INT64 **)(qword_140C4E388 + 8i64 * (*(_WORD *)(v13 + 60) & 0x3FF)),
v43,
(unsigned int)a3a);
v15 = 2;
LOWORD(v14) = -1;
}
}
v21 = v16 | 0x20;
if( v19 == 2 )
v21 = v16 | 0x28;
v22 = MiIncrementSubsectionViewCount((INT64 *)BugCheckParameter2, v21);
v23 = v22;
if( v22 == 1 )
{
ExReleaseSpinLockExclusiveFromDpcLevel(v17);
v14 = -1i64;
v24 = -1073741670;
}
else
{
if( v22 == 3 )
CommittedPages = 0i64;
if( a2a )
*(_WORD *)(BugCheckParameter2 + 32) |= 1u;
if( !*(_QWORD *)(BugCheckParameter2 + 8) )
{
*(_QWORD *)(BugCheckParameter2 + 8) = P;
MiUpdateSystemProtoPtesTree((RTL_BALANCED_NODE *)(BugCheckParameter2 + (a2a ? 112i64 : 56i64)), 1i64);
ExReleaseSpinLockExclusiveFromDpcLevel(v17);
v14 = -1i64;
__writecr8(v20);
P = 0i64;
v24 = 0;
goto LABEL_22;
}
v35 = v21 | 0x10;
if( v51 != 2 )
v35 = v21;
v36 = MiDecrementSubsectionViewCount((INT64 *)BugCheckParameter2, v35);
ExReleaseSpinLockExclusiveFromDpcLevel(v17);
v14 = -1i64;
v24 = -1073741302;
if( v23 == 3 )
CommittedPages = v36;
}
__writecr8(v20);
goto LABEL_22;
}
CommittedPages = 0i64;
v24 = -1073740277;
LABEL_22:
v25 = a2a;
if( !a2a && v59 == 1 )
{
v27 = *(_QWORD *)v54 + 40i64;
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v27, v14) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)v27);
v53 = 0;
v28 = (_ETHREAD *)KeGetCurrentThread();
if( (unsigned int)MiGetSystemRegionType(v27) == 1 )
v29 = (unsigned int)MmGetSessionIdEx(*((_QWORD *)v28 + 23));
else
v29 = 0xFFFFFFFFi64;
--*((_WORD *)v28 + 243);
v30 = ++*((_BYTE *)v28 + 794);
v31 = (*((char *)v28 + 792) | *((char *)v28 + 870)) ^ 0x3F;
while( 1 )
{
v42 = !_BitScanReverse((unsigned int *)&v32, v31);
v52[2] = v32;
if( v42 )
break;
v33 = *((_QWORD *)v28 + 100) + 96 * v32;
v31 &= ~(1 << v32);
if( (*(_BYTE *)(v33 + 26) & 1) != 0
&& (*(_DWORD *)(v33 + 32) & 1) == 0
&& (*(_QWORD *)(v33 + 32) & 0x7FFFFFFFFFFFFFFCi64) == (v27 & 0x7FFFFFFFFFFFFFFCi64)
&& *(_DWORD *)(v33 + 40) == (_DWORD)v29 )
{
*(_BYTE *)(v33 + 26) &= ~1u;
if( *(_QWORD *)(v33 + 32) )
{
if( v33 )
{
*(_BYTE *)(v33 + 32) |= 2u;
if( *(__int64 *)(v33 + 32) < 0 )
KiAbEntryRemoveFromTree(v33);
v53 = *(_DWORD *)(v33 + 88) & 0x1FFFF;
*(_DWORD *)(v33 + 88) &= 0xFFFE0000;
*(_BYTE *)(v33 + 25) &= ~1u;
*(_QWORD *)(v33 + 32) = 0i64;
v34 = (__int64)(v33 - *((_QWORD *)v28 + 100)) / 96;
if( v30 == 1 )
*((_BYTE *)v28 + 792) |= 1 << v34;
else
_InterlockedOr8((volatile signed __int8 *)v28 + 870, 1 << v34);
goto LABEL_47;
}
break;
}
}
}
if( (*((_DWORD *)v28 + 30) & 0x10000) == 0 )
KeBugCheckEx(0x162u, (ULONG_PTR)v28, v27, v29, 0i64);
LABEL_47:
--*((_BYTE *)v28 + 794);
KiAbThreadRemoveBoosts((ULONG_PTR)v28, v27, (unsigned int *)&v53);
v42 = (*((_WORD *)v28 + 243))++ == 0xFFFF;
if( v42 && *((_ETHREAD **)v28 + 19) != (_ETHREAD *)((char *)v28 + 152) )
KiCheckForKernelApcDelivery();
KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
v25 = 0i64;
}
if( CommittedPages )
MiReturnCrossPartitionSectionCharges(
*(volatile INT64 **)(qword_140C4E388 + 8i64 * (*(_WORD *)(v54 + 60) & 0x3FF)),
v25,
CommittedPages);
if( P )
ExFreePoolWithTag(P, 0);
return v24;
}Referenced by:
MiAddViewsForSection