MiTranslatePageForCopy
INT64 __fastcall MiTranslatePageForCopy(
VOID *VirtualAddress,
_MMSUPPORT_INSTANCE **VmOut,
UINT64 *PageFrameIndexOut,
_MMPFN **LockedProtoPfnOut,
UINT8 *WsIrqlOut,
UINT64 *FillPattern){
UINT64 *v6;
unsigned __int64 v10;
_MMPFN *PfnDb;
int SystemRegionType;
INT64 v13;
INT64 SessionVm;
INT64 v15;
__int128 v16;
__int64 v17;
_MMPTE *v18;
INT64 v19;
unsigned __int64 v20;
__int64 v21;
char *v22;
_MMSUPPORT_INSTANCE *v23;
UINT64 v25;
__int64 v26;
unsigned __int64 v27;
__int16 v28;
__int64 v29;
__int64 v30;
char *v31;
INT64 v32;
char v33;
_MMPTE *v34;
__int64 v35;
_MMPFN *v36;
_MMSUPPORT_INSTANCE *v37;
_MMPFN *v38;
char v39;
__int64 v40;
_MMPFN *v41;
__int64 v42;
unsigned __int64 v43;
INT64 v44;
_MMPFN *v45;
_MMPFN *v46;
INT64 v47;
UINT64 v48;
_MMPFN *v49;
char v50;
int PagingFileOffset;
UINT64 v52;
char PageIrql[8];
UINT64 v54;
UINT8 WsIrql[4];
UINT64 SpinCount;
char ProtectCode[12];
INT64 v58;
_MMPFN **v59;
UINT8 *v60;
_MMVAD *VadOut;
INT64 result[3];
ULONG_PTR BugCheckParameter2[4];
__int128 v64;
_MMSUPPORT_INSTANCE *v65;
v6 = PageFrameIndexOut;
VadOut = 0i64;
v58 = 0i64;
*(_DWORD *)ProtectCode = 0;
*(_QWORD *)&ProtectCode[4] = PageFrameIndexOut;
v60 = WsIrqlOut;
v59 = LockedProtoPfnOut;
memset((INT64)result, 0i64);
memset((INT64)VmOut, 0i64);
v10 = -1i64;
*v6 = -1i64;
*LockedProtoPfnOut = 0i64;
*(_QWORD *)WsIrqlOut = 0i64;
MiInitializePageFaultPacket(0i64, (UINT64)VirtualAddress, 0, 0i64, (INT64)result);
if( (unsigned __int64)(((__int64)VirtualAddress >> 47) + 1) > 1
|| VirtualAddress >= MmGetPteBase() && VirtualAddress <= MmGetPteLimit() )
{
return 3221225711i64;
}
PfnDb = MmGetPfnDb();
if( VirtualAddress >= PfnDb && VirtualAddress < (char *)PfnDb + 0x30000000000i64 )
return 3221225711i64;
if( (unsigned __int64)VirtualAddress >= 0xFFFF800000000000ui64 && MiVaIsUltra((UINT64)VirtualAddress) )
return 3221225711i64;
if( (unsigned __int64)VirtualAddress >= qword_140C4F878 && (unsigned __int64)VirtualAddress <= qword_140C4E0A8 )
{
v32 = *((_QWORD *)KeGetCurrentThread() + 23) + 1664i64;
*(_QWORD *)&v64 = v32;
v33 = MiLockWorkingSetShared(v32);
v18 = (_MMPTE *)BugCheckParameter2[0];
BYTE12(v64) = v33;
v34 = MiLockLowestValidPageTable(v32, (INT64 *)BugCheckParameter2[0], (INT64 **)&v58);
v65 = (_MMSUPPORT_INSTANCE *)v34;
if( v34 != (_MMPTE *)((char *)MmGetPdeBase() + (((unsigned __int64)VirtualAddress >> 18) & 0x3FFFFFF8)) )
{
LODWORD(v17) = MI_READ_PTE_LOCK_FREE(v58) != 0 ? -1073741608 : -1073741819;
goto LABEL_26;
}
goto LABEL_21;
}
SystemRegionType = MiGetSystemRegionType((UINT64)VirtualAddress);
switch( SystemRegionType )
{
case 8:
v13 = 0i64;
break;
case 1:
SessionVm = MiGetSessionVm();
if( !SessionVm )
return 3221225477i64;
goto LABEL_18;
case 6:
v13 = 2i64;
break;
case 9:
v13 = 3i64;
break;
default:
v13 = 1i64;
if( SystemRegionType != 12 && SystemRegionType != 3 )
v13 = 5i64;
break;
}
SessionVm = (INT64)MiGetAnyMultiplexedVm(v13);
LABEL_18:
*((_DWORD *)VmOut + 1) |= 4u;
if( !(unsigned int)MiSynchronizeSystemVa(SessionVm, (UINT64)VirtualAddress, v15, 0i64, (INT64)VmOut) )
return 3221225632i64;
v16 = *(_OWORD *)(VmOut + 3);
v17 = *((int *)VmOut + 4);
v65 = VmOut[5];
v64 = v16;
if( !(_DWORD)v17 )
{
v18 = (_MMPTE *)BugCheckParameter2[0];
LABEL_21:
PageIrql[0] = 17;
LODWORD(v17) = 0;
v19 = MI_READ_PTE_LOCK_FREE((INT64)v18);
v54 = v19;
v20 = v19;
if( (v19 & 1) != 0 )
{
LABEL_22:
MiPteInShadowRange((UINT64)&v54);
v10 = (v20 >> 12) & 0xFFFFFFFFFi64;
v21 = 48 * v10;
if( ((*((_QWORD *)MmGetPfnDb() + 6 * v10 + 5) >> 50) & 1) != 0 )
{
HIDWORD(SpinCount) = 0;
v22 = (char *)MmGetPfnDb() + 24;
while( _interlockedbittestandset64((volatile signed __int32 *)&v22[v21], 0x3Fui64) )
{
do
KeYieldProcessorEx((UINT64 *)((char *)&SpinCount + 4));
while( *(__int64 *)&v22[v21] < 0 );
}
}
else
{
LODWORD(v17) = -1073741503;
}
goto LABEL_25;
}
v35 = v19;
while( (v35 & 0x400) == 0 )
{
if( (v35 & 0x3E0) == 768 || (v35 & 0x3E0) == 0 )
goto LABEL_79;
if( (v35 & 0x800) == 0 )
{
if( (unsigned int)MiGetPagingFileOffset((MMPTE *)&v54) )
goto LABEL_81;
LABEL_69:
LODWORD(v17) = 273;
goto LABEL_25;
}
v36 = MiLockTransitionLeafPage(v18, (UINT8 *)PageIrql);
v38 = v36;
if( v36 )
{
v39 = *((_BYTE *)v36 + 34);
if( (v39 & 0x20) == 0 )
{
v40 = (unsigned __int128)((v38 - MmGetPfnDb()) * (__int128)0x2AAAAAAAAAAAAAABi64) >> 64;
v10 = ((unsigned __int64)v40 >> 63) + (v40 >> 3);
goto LABEL_25;
}
if( (v39 & 8) == 0 )
{
v41 = 0i64;
LABEL_80:
LOBYTE(v37) = PageIrql[0];
*(_DWORD *)WsIrql = 1;
MiWaitForCollidedFaultComplete((_MMPFN *)result, v38, v41, v37, (UINT8)WsIrql, v52, *(UINT **)PageIrql);
}
LABEL_81:
LODWORD(v17) = -1073741608;
LABEL_25:
v6 = *(UINT64 **)&ProtectCode[4];
goto LABEL_26;
}
v19 = MI_READ_PTE_LOCK_FREE((INT64)v18);
v54 = v19;
v35 = v19;
v20 = v19;
if( (v19 & 1) != 0 )
goto LABEL_22;
}
if( (v35 & 2) != 0 )
{
v42 = v35;
if( qword_140C4DC80 && (v35 & 0x10) == 0 )
v42 = v35 & ~qword_140C4DC80;
v43 = v35 & 0xFFFFFFFFFFFFFBFFui64;
if( (v42 & 0xFFFFFFFFFFFF0000ui64) != 0 )
v43 = v35;
*(_QWORD *)v60 = v43 & 0xFFFFFFFFFFFFFFFDui64;
goto LABEL_69;
}
if( qword_140C4DC80 && (v35 & 0x10) == 0 )
v35 &= ~qword_140C4DC80;
v44 = v35 >> 16;
if( !MiIsPrototypePteVadLookup(v19)
|| (v44 = (INT64)MiCheckVirtualAddress(VirtualAddress, (UINT64 *)ProtectCode, &VadOut)) != 0 )
{
v45 = MiLockProtoPoolPage((_MMPTE *)v44, (UINT8 *)PageIrql);
if( !v45 )
goto LABEL_81;
v46 = MiLockLeafPage((_MMPTE *)v44, 0i64);
v47 = MI_READ_PTE_LOCK_FREE(v44);
v54 = v47;
if( (v47 & 1) != 0 )
goto LABEL_82;
if( v47 )
{
if( (v47 & 0x400) != 0 )
{
v49 = v45;
}
else
{
if( (v47 & 0x800) == 0 )
{
PagingFileOffset = MiGetPagingFileOffset((MMPTE *)&v54);
LOBYTE(v48) = PageIrql[0];
v49 = v45;
if( !PagingFileOffset )
{
MiUnlockProtoPoolPage(v45, v48);
goto LABEL_69;
}
LABEL_87:
MiUnlockProtoPoolPage(v49, v48);
goto LABEL_81;
}
v50 = *((_BYTE *)v46 + 34);
if( (v50 & 0x20) == 0 )
{
LABEL_82:
v10 = (v46 - MmGetPfnDb()) / 48;
*v59 = v45;
goto LABEL_25;
}
v49 = v45;
if( (v50 & 8) == 0 )
{
MiObtainProtoReference((INT64)v45, 1);
v41 = v45;
v38 = v46;
goto LABEL_80;
}
}
LOBYTE(v48) = PageIrql[0];
goto LABEL_87;
}
LOBYTE(v48) = PageIrql[0];
MiUnlockProtoPoolPage(v45, v48);
}
LABEL_79:
LODWORD(v17) = -1073741819;
goto LABEL_25;
}
v54 = MI_READ_PTE_LOCK_FREE(BugCheckParameter2[v17]);
v25 = v54;
MiPteInShadowRange((UINT64)&v54);
v26 = 1i64;
v10 = (v25 >> 12) & 0xFFFFFFFFFi64;
v27 = (unsigned __int64)result[0] >> 12;
do
{
v28 = v27;
v27 >>= 9;
v29 = v26 * (v28 & 0x1FF);
v26 <<= 9;
v10 += v29;
LODWORD(v17) = v17 - 1;
}
while( (_DWORD)v17 );
if( v10 <= 0xFFFFFFFFFi64 )
{
v30 = 48 * v10;
if( ((*((_QWORD *)MmGetPfnDb() + 6 * v10 + 5) >> 50) & 1) != 0 )
{
LODWORD(SpinCount) = 0;
v31 = (char *)MmGetPfnDb() + 24;
while( _interlockedbittestandset64((volatile signed __int32 *)&v31[v30], 0x3Fui64) )
{
do
KeYieldProcessorEx(&SpinCount);
while( *(__int64 *)&v31[v30] < 0 );
}
goto LABEL_25;
}
}
LODWORD(v17) = -1073741503;
LABEL_26:
v23 = v65;
*(_OWORD *)(VmOut + 3) = v64;
VmOut[5] = v23;
if( (int)v17 < 0 )
MiUnlockSystemVa((INT64)VmOut);
else
*v6 = v10;
return(unsigned int)v17;
}Referenced by:
MmCopyMemory