MiSoftFaultMappedView
VOID __fastcall MiSoftFaultMappedView(INT64 rcx0){
int v1;
INT64 v2;
__int64 v3;
__int64 *v4;
__int64 v5;
int v6;
unsigned int v7;
__int64 v8;
INT64 v9;
__int64 v10;
unsigned __int64 v11;
_MMPTE *v12;
_MMPTE *PteBase;
UINT64 v14;
unsigned __int64 v15;
unsigned __int64 v16;
_MMPTE *v17;
INT64 v18;
LONG *v19;
unsigned __int64 i;
unsigned __int64 v21;
unsigned __int64 v22;
__int64 v23;
volatile signed __int64 *v24;
int v25;
INT64 v26;
INT64 v27;
unsigned __int64 v28;
int v29;
unsigned int v30;
char PageIrql[4];
_DWORD v32[3];
INT64 v33;
INT64 a1[2];
UINT64 v35;
_MMPFN *ProtoPagePfn;
INT64 v37;
UINT64 SpinCount;
unsigned __int64 v39;
__int64 v40[16];
v1 = *(_DWORD *)(rcx0 + 48);
v35 = 0i64;
v33 = rcx0;
v2 = rcx0;
*(_OWORD *)a1 = 0i64;
if( (v1 & 0xF80) == 128 || (v1 & 0x100000) == 0 && (v1 & 0x70) == 32 && (v1 & 0x200000) != 0 )
return;
if( MiVadMapsLargeImage(rcx0) )
return;
v4 = *(__int64 **)(v3 + 72);
v5 = *v4;
if( (*(_DWORD *)(*v4 + 56) & 0x4000000) != 0 )
return;
v6 = 0;
v7 = 0;
memset(v32, 0, sizeof(v32));
ProtoPagePfn = 0i64;
v8 = *(_QWORD *)(v5 + 32);
v9 = *((_QWORD *)KeGetCurrentThread() + 23) + 1664i64;
v37 = v9;
if( !v8 )
return;
v10 = *(unsigned int *)(v2 + 24);
v11 = (unsigned __int64)*(unsigned __int8 *)(v2 + 32) << 32;
v12 = *(_MMPTE **)(v2 + 80);
PageIrql[0] = 17;
PteBase = MmGetPteBase();
v14 = (UINT64)PteBase + 8 * ((v10 | v11) & 0xFFFFFFFFFi64);
v15 = (*(unsigned int *)(v2 + 28) | ((unsigned __int64)*(unsigned __int8 *)(v2 + 33) << 32)) & 0xFFFFFFFFFi64;
BYTE5(a1[1]) |= 4u;
v16 = (unsigned __int64)PteBase + 8 * v15;
v39 = v16;
a1[0] = v9;
BYTE4(a1[1]) = MiLockWorkingSetShared(v9);
if( v14 > v16 )
goto LABEL_46;
v17 = v12;
while( 1 )
{
if( (unsigned __int64)v17 > *(_QWORD *)(v2 + 88) || !v8 )
goto LABEL_41;
if( v6
&& (v6 & 8) == 0
&& ((v18 = v37, (*(_BYTE *)(v37 + 184) & 7) == 2) ? (v19 = &dword_140C4F4C0) : (v19 = (LONG *)(v37 + 192)),
(*v19 & 0x40000000) != 0 || KeShouldYieldProcessor()) )
{
v29 = 1;
}
else
{
if( v35 && (v14 & 0xFFF) != 0 )
goto LABEL_20;
v18 = v37;
v29 = 2;
}
if( PageIrql[0] != 17 )
{
MiUnlockProtoPoolPage(ProtoPagePfn, (unsigned __int8)PageIrql[0]);
PageIrql[0] = 17;
}
if( v32[0] )
{
if( !(unsigned int)MiCompleteRestrictedImageFault((INT64)a1, *(INT64 *)&v32[1], v40, v32[0]) )
{
v7 = 0;
LABEL_41:
v27 = *(_QWORD *)&v32[1];
LABEL_42:
if( PageIrql[0] != 17 )
MiUnlockProtoPoolPage(ProtoPagePfn, (unsigned __int8)PageIrql[0]);
if( v7 )
MiCompleteRestrictedImageFault((INT64)a1, v27, v40, v7);
goto LABEL_46;
}
v32[0] = 0;
}
if( v35 )
{
MiUnlockPageTableInternal(v18, v35);
v35 = 0i64;
}
if( v29 == 1 )
MiUnlockFaultWorkingSet((INT64)a1);
v30 = (*(_DWORD *)(v2 + 48) >> 12) & 0x3F;
if( v29 == 1 )
MiLockWorkingSetShared(v37);
MiMakeSystemAddressValid(v14, 0i64, v30, BYTE4(a1[1]), 0);
v7 = v32[0];
v35 = (UINT64)MmGetPteBase() + ((v14 >> 9) & 0x7FFFFFFFF8i64);
LABEL_20:
++v6;
if( !*(_QWORD *)v14 )
break;
LABEL_39:
v12 = (_MMPTE *)((char *)v12 + 8);
v14 += 8i64;
v17 = v12;
LABEL_40:
v7 = v32[0];
if( v14 > v39 )
goto LABEL_41;
}
if( ((unsigned __int16)v12 & 0xFFF) != 0 )
{
if( PageIrql[0] != 17 )
goto LABEL_23;
}
else if( PageIrql[0] != 17 )
{
MiUnlockProtoPoolPage(ProtoPagePfn, (unsigned __int8)PageIrql[0]);
PageIrql[0] = 17;
}
if( v7 )
{
v27 = *(_QWORD *)&v32[1];
if( !(unsigned int)MiCompleteRestrictedImageFault((INT64)a1, *(INT64 *)&v32[1], v40, v7) )
{
v7 = 0;
goto LABEL_42;
}
v32[0] = 0;
}
ProtoPagePfn = MiLockProtoPoolPage(v12, (UINT8 *)PageIrql);
if( !ProtoPagePfn )
{
v28 = 8 * ((unsigned __int64)(4096 - ((unsigned __int16)v12 & 0xFFFu)) >> 3);
v12 = (_MMPTE *)((char *)v12 + v28);
v14 += v28;
v17 = v12;
if( v35 && (_MMPTE *)v35 != (_MMPTE *)((char *)MmGetPteBase() + ((v14 >> 9) & 0x7FFFFFFFF8i64)) )
{
MiUnlockPageTableInternal(v37, v35);
v35 = 0i64;
}
goto LABEL_40;
}
LABEL_23:
if( (*(_BYTE *)v12 & 1) == 0 )
goto LABEL_39;
for( i = 0x7FFFFFFFFFFFFFFFi64; ; _InterlockedAnd64(v24 + 3, i) )
{
while( 1 )
{
v21 = *(_QWORD *)v12;
v22 = *(_QWORD *)v12;
if( (*(_QWORD *)v12 & 1) != 0 )
goto LABEL_26;
if( (*(_QWORD *)v12 & 0xC00i64) != 2048 )
goto LABEL_38;
if( MiInvalidPteConforms(*(_QWORD *)v12) )
{
v22 = v21;
if( qword_140C4DC80 && (v21 & 0x10) == 0 )
v22 = v21 & ~qword_140C4DC80;
LABEL_26:
v23 = 48 * ((v22 >> 12) & 0xFFFFFFFFFi64);
if( (*(_QWORD *)((char *)MmGetPfnDb() + v23 + 40) & 0x4000000000000i64) != 0 )
break;
}
}
v24 = (volatile signed __int64 *)((char *)MmGetPfnDb() + v23);
LODWORD(SpinCount) = 0;
if( _interlockedbittestandset64((volatile signed __int32 *)v24 + 6, 0x3Fui64) )
{
do
{
do
KeYieldProcessorEx(&SpinCount);
while( *((__int64 *)v24 + 3) < 0 );
}
while( _interlockedbittestandset64((volatile signed __int32 *)v24 + 6, 0x3Fui64) );
i = 0x7FFFFFFFFFFFFFFFi64;
}
if( *(_QWORD *)v12 == v21 )
break;
}
if( !v24 )
{
LABEL_38:
v2 = v33;
goto LABEL_39;
}
if( (*(_BYTE *)v12 & 1) == 0 || (--v8, (v24[2] & 0x400) == 0) || (*((_BYTE *)v24 + 35) & 0x40) != 0 )
{
_InterlockedAnd64(v24 + 3, i);
goto LABEL_38;
}
if( !MiImagePageOk((__int64)((v14 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16, (INT64)v24) )
{
_InterlockedAnd64(v24 + 3, 0x7FFFFFFFFFFFFFFFui64);
goto LABEL_38;
}
*((_QWORD *)v24 + 3) ^= (*((_QWORD *)v24 + 3) ^ (*((_QWORD *)v24 + 3) + 1i64)) & 0x3FFFFFFFFFFFFFFFi64;
_InterlockedAnd64(v24 + 3, 0x7FFFFFFFFFFFFFFFui64);
if( v23 / 48 == -1 )
goto LABEL_38;
v25 = v32[0];
v26 = v14;
if( v32[0] )
v26 = *(_QWORD *)&v32[1];
v40[v32[0]] = v23 / 48;
*(_QWORD *)&v32[1] = v26;
v32[0] = v25 + 1;
if( v25 != 15 )
goto LABEL_38;
MiUnlockProtoPoolPage(ProtoPagePfn, (unsigned __int8)PageIrql[0]);
PageIrql[0] = 17;
if( (unsigned int)MiCompleteRestrictedImageFault((INT64)a1, v26, v40, 0x10ui64) )
{
*(_QWORD *)&v32[1] = v26;
v32[0] = 0;
goto LABEL_38;
}
LABEL_46:
if( v35 )
{
MiUnlockPageTableInternal(v37, v35);
v35 = 0i64;
}
MiUnlockFaultWorkingSet((INT64)a1);
}Referenced by:
MiMapViewOfImageSection