MiCommitHotPatchTable
INT64 __fastcall MiCommitHotPatchTable(INT64 a1, UINT64 a2, UINT64 a3){
ULONG_PTR v6;
INT64 result;
INT64 v8;
char *v9;
UINT64 v10;
unsigned int v11;
UINT64 v12;
unsigned int v13;
INT64 v14;
UINT64 v15;
UINT8 v16;
_MMPFN *OpaquePointer;
UINT64 v18;
INT64 v19;
UINT8 i;
v6 = *((_QWORD *)KeGetCurrentThread() + 23);
result = MiChargeFullProcessCommitment(v6, a3);
if( (int)result >= 0 )
{
v8 = v6 + 1664;
v19 = v6 + 1664;
v9 = 0i64;
v10 = a3 + (((unsigned __int64)*(unsigned __int8 *)(a1 + 34) << 31) | *(_DWORD *)(a1 + 52) & 0x7FFFFFFF);
v11 = 0;
OpaquePointer = 0i64;
*(_DWORD *)(a1 + 52) ^= (v10 ^ *(_DWORD *)(a1 + 52)) & 0x7FFFFFFF;
*(_BYTE *)(a1 + 34) = v10 >> 31;
v12 = a2;
v13 = (*(_DWORD *)(a1 + 48) >> 12) & 0x3F;
v14 = MiSwizzleInvalidPte(32i64);
v15 = (UINT64)MmGetPteBase() + ((a2 >> 9) & 0x7FFFFFFFF8i64);
v18 = v15 + 8 * (a3 - 1);
v16 = MiLockWorkingSetShared(v8);
for( i = v16; v15 <= v18; v12 += 4096i64 )
{
if( v12 == a2 || (v15 & 0xFFF) == 0 )
{
if( v11 )
{
MiIncreaseUsedPtesCount(OpaquePointer, v11);
v11 = 0;
}
if( v9 )
MiUnlockPageTableInternal(v8, (UINT64)v9);
v9 = (char *)MmGetPteBase() + ((v15 >> 9) & 0x7FFFFFFFF8i64);
MiMakeSystemAddressValid(v15, 0i64, v13, v16, 0);
OpaquePointer = MiGetUsedPtesHandle(v12);
}
*(_QWORD *)v15 = v14;
v8 = v19;
++v11;
v16 = i;
v15 += 8i64;
}
MiIncreaseUsedPtesCount(OpaquePointer, v11);
MiUnlockPageTableInternal(v8, (UINT64)v9);
MiUnlockWorkingSetShared(v8, v16);
return 0i64;
}
return result;
}Referenced by:
MiPrepareToHotPatchImage