MiSystemFault
INT64 __fastcall MiSystemFault(INT64 a1){
__int64 v2;
int v3;
ULONG_PTR v4;
UINT64 v5;
unsigned __int64 PteBase;
_MMPTE *PteLimit;
char v8;
_ETHREAD *CurrentThread;
int v10;
ULONG_PTR v11;
__int64 v12;
__int64 v13;
_BYTE *v14;
__int16 v15;
bool v16;
INT64(*v17)(void);
unsigned __int64 v18;
char v19;
INT64 v20;
INT64 *SessionVm;
int v22;
int v23;
__int64 v24;
volatile signed __int64 *v25;
volatile unsigned __int64 v26;
__int64 v28;
VOID *v29;
__int64 v30;
_BYTE *v31;
INT64 v32;
__int64 v33;
_BYTE *v34;
__int64 v35;
__int64 v36;
unsigned int v37;
__int64 v38;
KIRQL v39;
__int64 v40;
unsigned __int64 v41;
int v42;
UINT64 v43;
unsigned __int64 v44;
ULONG_PTR v45;
_MMPTE *v46;
_BYTE *v47;
_BYTE *v48;
_BYTE *v49;
void *BugCheckParameter4;
unsigned __int64 v51;
UINT64 VmIrql;
_MMVAD *VadOut;
_DWORD result[6];
__int128 v55;
__int64 v56;
v2 = 0i64;
VadOut = 0i64;
LODWORD(VmIrql) = 0;
memset((INT64)result, 0i64);
v3 = *(_DWORD *)(a1 + 80);
if( (v3 & 0x40) != 0 )
return 3221225477i64;
if( (v3 & 0x20) != 0 )
KeBugCheckEx(0x50u, *(_QWORD *)a1, *(_QWORD *)(a1 + 8), *(_QWORD *)(a1 + 16), 0xEui64);
v4 = *(_QWORD *)a1;
v5 = *(_QWORD *)a1;
PteBase = (unsigned __int64)MmGetPteBase();
PteLimit = MmGetPteLimit();
if( *(_QWORD *)a1 >= PteBase )
{
do
{
if( v5 > (unsigned __int64)PteLimit )
break;
v5 = (__int64)((v5 << 25) - (PteBase << 25)) >> 16;
}
while( v5 >= PteBase );
}
if( v4 >= PteBase && v4 <= (unsigned __int64)PteLimit && v5 >= qword_140C4F878 && v5 <= qword_140C4E0A8 )
*(_QWORD *)(a1 + 8) |= 2ui64;
v8 = 0;
if( (*(_QWORD *)(a1 + 8) & 0x100000000000000i64) != 0 )
{
if( v4 < PteBase
|| v4 > (unsigned __int64)PteLimit
|| v5 > 0x7FFFFFFEFFFFi64 && (v5 < qword_140C4F878 || v5 > qword_140C4E0A8) )
{
return 3489660934i64;
}
return 192i64;
}
if( v5 < 0xFFFF800000000000ui64 || v5 >= qword_140C4E0A0 && v5 < qword_140C4E0A0 + MiHyperSpaceSize() )
return 192i64;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v10 = *((_DWORD *)CurrentThread + 325);
if( (v10 & 0x400) != 0
|| (v10 & 0x100) != 0
&& (unsigned int)MiTransientPageListWriter((unsigned __int64)CurrentThread, *(_QWORD *)a1) == 1 )
{
return 3221225477i64;
}
v11 = *(_QWORD *)a1;
if( dword_140C4E284 )
{
v39 = ExAcquireSpinLockShared(&dword_140C4E280);
v40 = qword_140C4E288;
v41 = v39;
if( qword_140C4E288 )
{
do
{
if( (unsigned __int64)CurrentThread > *(_QWORD *)(v40 + 24) )
{
v40 = *(_QWORD *)(v40 + 8);
}
else
{
if( (unsigned __int64)CurrentThread >= *(_QWORD *)(v40 + 24) )
break;
v40 = *(_QWORD *)v40;
}
}
while( v40 );
if( v40 && *(_MMPTE **)(v40 + 40) != (_MMPTE *)((char *)MmGetPteBase() + ((v11 >> 9) & 0x7FFFFFFFF8i64)) )
v40 = 0i64;
}
ExReleaseSpinLockSharedFromDpcLevel(&dword_140C4E280);
__writecr8(v41);
if( v40 )
return 3221225477i64;
}
v12 = *(_QWORD *)(a1 + 16);
v13 = v12 & 1;
v14 = (_BYTE *)(v12 & 0xFFFFFFFFFFFFFFFEui64);
if( (v12 & 1) != 0 )
{
if( *v14 != 1 && *v14 != 3 && *v14 != 6 )
goto LABEL_20;
goto LABEL_76;
}
if( !v12 )
goto LABEL_20;
v15 = *(_WORD *)(v12 + 368);
v16 = 0;
if( v15 != 16 )
{
if( v15 == 51 )
{
v17 = (INT64(*)(void))KeUserPopEntrySListFault;
v18 = *(_QWORD *)(v12 + 360);
goto LABEL_18;
}
LABEL_20:
v19 = 0;
goto LABEL_21;
}
if( (*(_DWORD *)(v12 + 376) & 0x200) == 0
&& (KiRspInIstStack(3ui64, *(_QWORD *)(v12 + 384)) || KiRspInIstStack(2ui64, v43)) )
{
goto LABEL_20;
}
v17 = ExpInterlockedPopEntrySListFault;
v18 = *(_QWORD *)(v12 + 360);
v16 = KiDynamicTraceEnabled && v18 >= *(_QWORD *)ControlPc && v18 < qword_140CFBBE0 && KeGetCurrentIrql() == 15;
LABEL_18:
if( (INT64(*)(void))v18 != v17 && !v16 )
goto LABEL_20;
LABEL_76:
v19 = 1;
LABEL_21:
result[1] = 1;
v20 = *((unsigned __int8 *)&antNameB + ((v5 >> 39) & 0x1FF) - 256);
if( (*(_DWORD *)(a1 + 80) & 8) != 0 )
{
if( (_DWORD)v20 == 6 )
goto LABEL_28;
return 3221225477i64;
}
if( (!v13 || *(_BYTE *)(v12 & 0xFFFFFFFFFFFFFFFEui64) != 1) && !v19 )
result[1] = 3;
if( (_DWORD)v20 == 8 )
{
SessionVm = &qword_140C52700;
}
else if( (_DWORD)v20 == 1 )
{
SessionVm = (INT64 *)MiGetSessionVm();
if( !SessionVm )
goto LABEL_142;
v8 = 1;
}
else
{
if( (_DWORD)v20 == 6 )
{
LABEL_28:
SessionVm = &qword_140C4EFC0;
goto LABEL_29;
}
if( (_DWORD)v20 == 12 )
{
SessionVm = &a11;
}
else
{
if( (_DWORD)v20 == 14 )
{
v31 = (_BYTE *)(v12 & 0xFFFFFFFFFFFFFFFEui64);
if( !v13 || *v31 != 1 && *v31 != 4 )
{
LABEL_142:
if( (result[1] & 2) != 0 && !MiGenerateAccessViolation((UINT64 *)a1) )
KeBugCheckEx(0x50u, *(_QWORD *)a1, *(_QWORD *)(a1 + 8), *(_QWORD *)(a1 + 16), 2ui64);
return 3221225477i64;
}
v32 = 4i64;
}
else
{
if( (_DWORD)v20 != 9 )
goto LABEL_142;
v32 = 3i64;
}
SessionVm = (INT64 *)MiGetAnyMultiplexedVm(v32);
}
}
LABEL_29:
if( !(unsigned int)MiSynchronizeSystemVa((INT64)SessionVm, *(_QWORD *)a1, v20, 0i64, (INT64)result) )
goto LABEL_142;
v22 = result[1] & 2;
if( (result[1] & 2) == 0
&& (*(_DWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 2172i64) & 0x1000) != 0
&& !MiIsWorkingSetTrimThread()
&& (unsigned int)MiGetSystemRegionType(v5) == 1
|| (v23 = MiCheckSystemPageTables((UINT64 *)a1), v23 == 2) )
{
MiUnlockSystemVa((INT64)result);
goto LABEL_142;
}
if( v23 == 1 )
{
MiUnlockSystemVa((INT64)result);
return 0i64;
}
v24 = v56;
*(_OWORD *)(a1 + 56) = v55;
*(_QWORD *)(a1 + 72) = v24;
v25 = *(volatile signed __int64 **)(a1 + 24);
v26 = *v25;
if( (*v25 & 1) != 0 )
{
if( (v26 & 0x80u) != 0i64 )
{
v44 = *(_QWORD *)a1;
if( *(_QWORD *)a1 >= (unsigned __int64)MmGetPteBase() && v44 <= (unsigned __int64)MmGetPteLimit() )
{
if( v22 )
KeBugCheckEx(0x50u, v44, *(_QWORD *)(a1 + 8), *(_QWORD *)(a1 + 16), 8ui64);
goto LABEL_102;
}
}
v30 = *(_QWORD *)(a1 + 16);
if( (v30 & 1) != 0 && *(_BYTE *)(v30 & 0xFFFFFFFFFFFFFFFEui64) == 1 )
{
MiUpdatePfnPriorityByPte(*(_MMPTE **)(a1 + 24), *(_DWORD *)((v30 & 0xFFFFFFFFFFFFFFFEui64) + 80) & 7);
MiUnlockSystemVa((INT64)result);
return 0i64;
}
if( (*(_BYTE *)(a1 + 8) & 2) != 0 )
{
if( (v26 & 0x800) == 0 )
{
if( (v26 & 0x200) == 0 && (*(_DWORD *)(a1 + 80) & 8) == 0 )
{
if( !MiGenerateAccessViolation((UINT64 *)a1) )
KeBugCheckEx(0xBEu, *(_QWORD *)a1, v26, *(_QWORD *)(a1 + 16), 0xBui64);
goto LABEL_102;
}
v42 = MiCopyOnWrite(*(_QWORD *)a1, *(UINT64 **)(a1 + 24), -1i64, 0i64);
MiUnlockSystemVa((INT64)result);
if( v42 < 0 )
MiCopyOnWriteCheckConditions((INT64)SessionVm, (unsigned int)v42);
return 0i64;
}
}
else
{
MiCheckSystemNxFault(a1, v26, 2ui64);
v30 = *(_QWORD *)(a1 + 16);
}
MiNoFaultFound(a1, v25, *(_QWORD *)a1, v30, 1u, v26);
LABEL_68:
MiUnlockSystemVa((INT64)result);
return(unsigned int)v2;
}
if( *(_QWORD *)a1 >= (unsigned __int64)MmGetPteBase() && *(_QWORD *)a1 <= (unsigned __int64)MmGetPteLimit() )
{
if( !v19 )
{
v45 = *(_QWORD *)(a1 + 16);
if( (v45 & 1) == 0 || *(_BYTE *)(v45 & 0xFFFFFFFFFFFFFFFEui64) != 1 )
KeBugCheckEx(0x50u, *(_QWORD *)a1, *(_QWORD *)(a1 + 8), v45, 9ui64);
goto LABEL_68;
}
goto LABEL_102;
}
if( (v26 & 0x400) == 0 )
{
if( (*v25 & 0x3E0) == 0 && (*v25 & 0x800) == 0 )
{
if( (*(_DWORD *)(a1 + 80) & 8) == 0 )
{
v48 = (_BYTE *)(*(_QWORD *)(a1 + 16) & 0xFFFFFFFFFFFFFFFEui64);
if( (*(_QWORD *)(a1 + 16) & 1i64) != 0 )
{
if( *v48 == 1 || *v48 == 3 || *v48 == 6 )
goto LABEL_102;
}
else if( KeInvalidAccessAllowed(*(PVOID *)(a1 + 16)) == 1 )
{
goto LABEL_102;
}
if( !MiGenerateAccessViolation((UINT64 *)a1) )
KeBugCheckEx(0x50u, *(_QWORD *)a1, *(_QWORD *)(a1 + 8), *(_QWORD *)(a1 + 16), 0i64);
}
LABEL_102:
LODWORD(v2) = -1073741819;
goto LABEL_68;
}
if( (*v25 & 0x3E0) == 768
|| (*v25 & 0x3E0) == 992
&& ((v33 = *(_QWORD *)(a1 + 16), (v33 & 1) == 0) || *(_BYTE *)(v33 & 0xFFFFFFFFFFFFFFFEui64) != 4) )
{
if( (*(_DWORD *)(a1 + 80) & 8) != 0 )
goto LABEL_99;
v34 = (_BYTE *)(*(_QWORD *)(a1 + 16) & 0xFFFFFFFFFFFFFFFEui64);
if( (*(_QWORD *)(a1 + 16) & 1i64) != 0 )
{
if( *v34 == 1 || *v34 == 3 || *v34 == 6 )
goto LABEL_99;
}
else if( KeInvalidAccessAllowed(*(PVOID *)(a1 + 16)) == 1 )
{
goto LABEL_99;
}
if( !MiGenerateAccessViolation((UINT64 *)a1) )
KeBugCheckEx(0x50u, *(_QWORD *)a1, *(_QWORD *)(a1 + 8), *(_QWORD *)(a1 + 16), 1ui64);
LABEL_99:
if( (v26 & 0x3E0) == 768 )
goto LABEL_102;
v35 = *(_QWORD *)(a1 + 16);
if( (v35 & 1) == 0 || *(_BYTE *)(v35 & 0xFFFFFFFFFFFFFFFEui64) != 1 )
goto LABEL_102;
}
LABEL_39:
if( (*(_BYTE *)(a1 + 8) & 2) == 0 || v2 || v8 || ((v26 >> 5) & 4) != 0 )
{
*(_QWORD *)(a1 + 96) = v2;
return 3221225494i64;
}
if( (*(_DWORD *)(a1 + 80) & 8) != 0 )
goto LABEL_102;
v49 = (_BYTE *)(*(_QWORD *)(a1 + 16) & 0xFFFFFFFFFFFFFFFEui64);
if( (*(_QWORD *)(a1 + 16) & 1i64) != 0 )
{
if( *v49 == 1 || *v49 == 3 || *v49 == 6 )
goto LABEL_102;
goto LABEL_190;
}
if( KeInvalidAccessAllowed(*(PVOID *)(a1 + 16)) != 1 )
{
LABEL_190:
if( !MiGenerateAccessViolation((UINT64 *)a1) )
KeBugCheckEx(0xBEu, *(_QWORD *)a1, v26, *(_QWORD *)(a1 + 16), 0xEui64);
goto LABEL_102;
}
goto LABEL_102;
}
if( (v26 & 2) != 0 )
{
v36 = *(_QWORD *)(a1 + 16);
if( (v36 & 1) == 0 || *(_BYTE *)(v36 & 0xFFFFFFFFFFFFFFFEui64) != 1 )
{
v37 = MiResolveDemandZeroFault((void *)a1, *(_MMPTE **)(a1 + 24), 0i64, 0i64, BugCheckParameter4, v51, VmIrql);
v38 = *(_QWORD *)(a1 + 72);
v55 = *(_OWORD *)(a1 + 56);
v56 = v38;
MiUnlockSystemVa((INT64)result);
return v37;
}
goto LABEL_68;
}
v28 = *v25;
if( qword_140C4DC80 && (v26 & 0x10) == 0 )
v28 = v26 & ~qword_140C4DC80;
v2 = v28 >> 16;
if( !v8 )
goto LABEL_39;
if( !MiIsPrototypePteVadLookup(v26) )
goto LABEL_39;
v46 = MiCheckVirtualAddress(v29, &VmIrql, &VadOut);
v2 = (__int64)v46;
if( v46 )
goto LABEL_39;
v47 = (_BYTE *)(*(_QWORD *)(a1 + 16) & 0xFFFFFFFFFFFFFFFEui64);
if( (*(_QWORD *)(a1 + 16) & 1i64) != 0 )
{
if( *v47 == 1 || *v47 == 3 || *v47 == 6 )
goto LABEL_102;
}
else if( KeInvalidAccessAllowed(*(PVOID *)(a1 + 16)) == 1 )
{
goto LABEL_102;
}
if( MiGenerateAccessViolation((UINT64 *)a1) )
goto LABEL_102;
MiUnlockSystemVa((INT64)result);
return 3489660934i64;
}Referenced by:
MmAccessFault