MiLockCode
__int64 __fastcall MiLockCode(__int64 a1, unsigned __int64 a2, unsigned __int64 a3, int a4){
unsigned __int64 v5;
__int64 v7;
char v8;
int v9;
int SystemRegionType;
int v11;
CHAR *AnyMultiplexedVm;
char *v13;
UINT8 v14;
_MMPFN *PfnDb;
_MMPTE *PxeUserLimit;
_MMPTE *Pml4eBase;
ULONG_PTR v18;
unsigned __int64 v19;
NTSTATUS v20;
ULONG_PTR v21;
__int64 v22;
ULONG_PTR v23;
UNICODE_STRING *v24;
int v25;
int v26;
unsigned __int64 v27;
char *v28;
char v29;
char v30;
UINT64 v31;
INT64 v32;
unsigned __int64 v33;
char WsleContents;
UNICODE_STRING *v35;
WCHAR *v36;
char *v37;
int v38;
_MMPTE *v39;
UINT64 v40;
unsigned __int64 v41;
INT64 v42;
INT64 v43;
char v44;
ULONG_PTR BugCheckParameter4;
INT64 v47;
INT64 a7;
INT64 a8;
UINT64 v50;
INT64 a10;
INT64 *a11;
UINT64 SpinCount;
ULONG_PTR v54;
__int64 v55;
unsigned __int64 v56;
__int64 v57;
INT64 a1a;
__int64 v59;
MMPTE *PointerPte;
int v61;
__int16 v62;
__int16 v63;
__int64 v64;
__int64 v65;
__int64 v66;
__int128 v67;
__int128 v68;
__int128 v69;
__int128 v70;
__int128 v71;
__int128 v72;
__int128 v73;
__int128 v74;
__int128 v75;
__int64 v76;
HIDWORD(a7) = a4;
v56 = a3;
v63 = 0;
v76 = 0i64;
v5 = a2;
PointerPte = (MMPTE *)a2;
v57 = a1;
v67 = 0i64;
v68 = 0i64;
v69 = 0i64;
v70 = 0i64;
v71 = 0i64;
v72 = 0i64;
v73 = 0i64;
v74 = 0i64;
v75 = 0i64;
v59 = (_QWORD)MmGetPteBase() << 25;
v7 = (__int64)((a2 << 25) - v59) >> 16;
if( (unsigned int)MI_IS_PHYSICAL_ADDRESS((PVOID)v7) )
return 0i64;
v8 = 1;
v9 = 0;
LOBYTE(a7) = 1;
HIDWORD(a10) = 0;
SystemRegionType = MiGetSystemRegionType(v7);
if( SystemRegionType == 1 )
{
v55 = *(_QWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 1368i64);
v9 = 2;
a11 = (INT64 *)MiGetSessionVm();
HIDWORD(a10) = 2;
AnyMultiplexedVm = (CHAR *)a11;
}
else
{
v55 = 0i64;
if( SystemRegionType == 6 )
{
AnyMultiplexedVm = MiGetAnyMultiplexedVm(2i64);
a11 = (INT64 *)AnyMultiplexedVm;
}
else
{
AnyMultiplexedVm = (CHAR *)&::a11;
a11 = &::a11;
}
}
LOBYTE(v11) = 0;
LODWORD(a10) = v11;
if( a1 && v9 == 2 && (*(_DWORD *)(a1 + 104) & 0x8000000) == 0 )
LODWORD(a10) = (dword_140CFA174 & 1) != 0;
MiPrefetchDriverPages((MMPTE *)v5, (MMPTE *)a3);
a8 = -1i64;
v64 = 20i64;
v13 = 0i64;
v61 = v9;
v62 = 0;
v65 = 0i64;
v66 = 0i64;
v50 = 0i64;
v14 = MiLockWorkingSetShared((INT64)AnyMultiplexedVm);
BYTE1(a7) = v14;
do
{
PfnDb = MmGetPfnDb();
PxeUserLimit = MmGetPxeUserLimit();
Pml4eBase = MmGetPml4eBase();
if( !v13 )
goto LABEL_15;
if( (v5 & 0xFFF) == 0 )
{
MiFlushTbList((__int64)&v61);
MiUnlockPageTableInternal((INT64)AnyMultiplexedVm, (UINT64)v13);
LABEL_15:
v13 = (char *)MmGetPteBase() + ((v5 >> 9) & 0x7FFFFFFFF8i64);
v50 = (UINT64)v13;
MiLockPageTableInternal((INT64)AnyMultiplexedVm, (UINT64)v13, 0i64);
PxeUserLimit = MmGetPxeUserLimit();
Pml4eBase = MmGetPml4eBase();
PfnDb = MmGetPfnDb();
}
v18 = *(_QWORD *)v5;
if( v5 >= (unsigned __int64)Pml4eBase && v5 <= (unsigned __int64)PxeUserLimit )
Pml4eBase = MmGetPml4eBase();
v54 = *(_QWORD *)v5;
v19 = (__int64)((v5 << 25) - v59) >> 16;
if( (v18 & 1) == 0 )
{
MiFlushTbList((__int64)&v61);
MiUnlockPageTableInternal((INT64)AnyMultiplexedVm, (UINT64)v13);
MiUnlockWorkingSetShared((INT64)AnyMultiplexedVm, v14);
v20 = MmAccessFault(0i64, (PVOID)v19, 0, 0i64);
if( v20 < 0 )
KeBugCheckEx(0x1Au, 0x3000ui64, v19, v18, v20);
v13 = 0i64;
v50 = 0i64;
MiLockWorkingSetShared((INT64)AnyMultiplexedVm);
goto LABEL_95;
}
if( &v54 < (ULONG_PTR *)Pml4eBase || &v54 > (ULONG_PTR *)PxeUserLimit )
v21 = v18;
else
v21 = v18;
v22 = (v21 >> 12) & 0xFFFFFFFFFi64;
v23 = (ULONG_PTR)PfnDb + 48 * v22;
v24 = *(UNICODE_STRING **)(v23 + 40);
if( ((unsigned __int64)v24 & 0x1000000000i64) == 0 && *(__int64 *)(v23 + 8) > 0 )
{
MiFlushTbList((__int64)&v61);
v25 = MiCopyOnWrite(v19, (UINT64 *)v5, -1i64, 0i64);
if( v25 >= 0 )
{
v14 = BYTE1(a7);
}
else
{
MiUnlockPageTableInternal((INT64)AnyMultiplexedVm, (UINT64)v13);
v14 = BYTE1(a7);
MiUnlockWorkingSetShared((INT64)AnyMultiplexedVm, BYTE1(a7));
MiCopyOnWriteCheckConditions((INT64)AnyMultiplexedVm, (unsigned int)v25);
v13 = 0i64;
v50 = 0i64;
MiLockWorkingSetShared((INT64)AnyMultiplexedVm);
}
LABEL_94:
v8 = a7;
LABEL_95:
v42 = a8;
continue;
}
LOBYTE(v26) = MI_PFN_IS_PROTO((UNICODE_STRING *)PfnDb + 3 * v22, v24, (UINT8)PfnDb, (PWCHAR)0xFFFFFFFFFi64);
if( v26 && (!v55 || (_BYTE)a10 == 1) )
{
v29 = BYTE4(a7);
if( (a7 & 0x100000000i64) != 0 )
{
MiFlushTbList((__int64)&v61);
MiUnlockPageTableInternal((INT64)AnyMultiplexedVm, (UINT64)v13);
v14 = BYTE1(a7);
MiUnlockWorkingSetShared((INT64)AnyMultiplexedVm, BYTE1(a7));
v30 = 0;
LABEL_35:
MiMakeDriverPagesPrivate(v57, v5, v56, v30);
v13 = 0i64;
v50 = 0i64;
MiLockWorkingSetShared((INT64)AnyMultiplexedVm);
goto LABEL_94;
}
}
else
{
v29 = BYTE4(a7);
}
if( (v18 & 0x800) == 0 && (v18 & 0x200) != 0 )
{
MiFlushTbList((__int64)&v61);
MiUnlockPageTableInternal((INT64)AnyMultiplexedVm, (UINT64)v13);
v14 = BYTE1(a7);
MiUnlockWorkingSetShared((INT64)AnyMultiplexedVm, BYTE1(a7));
v30 = 1;
goto LABEL_35;
}
v31 = 0i64;
v32 = *(_QWORD *)(qword_140C4E388 + 8 * ((v27 >> 39) & 0x3FF));
a1a = v32;
v33 = *(_QWORD *)((char *)MmGetPteBase() + ((v19 >> 9) & 0x7FFFFFFFF8i64));
WsleContents = HIBYTE(v33) & 0xF | (16 * ((v33 >> 60) & 7));
if( a8 != -1 )
{
v28 = (char *)MmGetPfnDb() + 48 * a8;
if( v32 == *(_QWORD *)(qword_140C4E388 + 8 * ((*((_QWORD *)v28 + 5) >> 39) & 0x3FFi64)) )
goto LABEL_45;
MiReleaseFreshPage((_MMPFN *)v28);
v29 = BYTE4(a7);
a8 = -1i64;
}
if( (v29 & 2) != 0 )
{
if( (WsleContents & 0xF) == 9 )
goto LABEL_45;
}
else if( *(_WORD *)(v23 + 32) != 1 )
{
goto LABEL_45;
}
v28 = (char *)(HighestPfn & 0x1FF);
if( ((unsigned __int16)v22 & 0x1FFu) >= (unsigned __int64)v28 || MiIsPfnFromSlabAllocation(v23) )
{
LABEL_45:
LODWORD(SpinCount) = 0;
if( _interlockedbittestandset64((volatile signed __int32 *)(v23 + 24), 0x3Fui64) )
{
do
{
do
KeYieldProcessorEx(&SpinCount);
while( *(__int64 *)(v23 + 24) < 0 );
}
while( _interlockedbittestandset64((volatile signed __int32 *)(v23 + 24), 0x3Fui64) );
v29 = BYTE4(a7);
}
if( a8 != -1 && (v29 & 2) != 0 )
{
WsleContents = MiGetWsleContents((INT64)v28, v19);
if( (WsleContents & 0xF) != 9
&& !MiIsPfnFileOnly(v23)
&& !MiIsPfnFromSlabAllocation(v23)
&& ((unsigned __int16)v22 & 0x1FFu) < (unsigned __int64)((unsigned __int16)v36 & 0x1FF) )
{
v37 = (char *)MmGetPfnDb() + 48 * (_QWORD)v36;
_InterlockedAnd64((volatile signed __int64 *)(v23 + 24), 0x7FFFFFFFFFFFFFFFui64);
LOBYTE(v38) = MI_PFN_IS_PROTO((UNICODE_STRING *)v23, v35, *(_BYTE *)(v23 + 8), v36);
if( v38 && (*(_DWORD *)(v23 + 16) & 0x400i64) != 0 )
{
v41 = (unsigned __int64)MiLockProtoPoolPage(v39, 0i64);
if( v41 )
goto LABEL_64;
}
else
{
v41 = 1i64;
LABEL_64:
if( (unsigned int)MiTradeActivePage(v23, (__int64)v37, v19, 0, 2u, v47) == 1 )
{
*(_QWORD *)(v23 + 16) = ZeroPte;
MiSetOriginalPtePfnFromFreeList((UINT64 *)(v23 + 16));
MiReleaseFreshPage((_MMPFN *)v23);
v23 = (ULONG_PTR)v37;
a8 = -1i64;
}
}
if( v41 > 1 )
{
LOBYTE(v40) = 17;
MiUnlockProtoPoolPage((_MMPFN *)v41, v40);
}
HIDWORD(SpinCount) = 0;
while( _interlockedbittestandset64((volatile signed __int32 *)(v23 + 24), 0x3Fui64) )
{
do
KeYieldProcessorEx((UINT64 *)((char *)&SpinCount + 4));
while( *(__int64 *)(v23 + 24) < 0 );
}
AnyMultiplexedVm = (CHAR *)a11;
}
}
v43 = HIDWORD(a7);
if( (a7 & 0x200000000i64) != 0 )
{
if( (WsleContents & 0xF) != 9 )
MiRemoveSystemImagePage((INT64)AnyMultiplexedVm, v5, v23);
goto LABEL_81;
}
if( HIDWORD(a10) == 2 )
{
if( (unsigned int)MiAddLockedPageCharge(v23, 0) )
goto LABEL_81;
v8 = 0;
LOBYTE(a7) = 0;
}
else
{
if( (unsigned int)MiAreChargesNeededToLockPage(v23) )
*(_BYTE *)(v23 + 35) |= 0x20u;
++*(_WORD *)(v23 + 32);
LABEL_81:
v8 = a7;
}
if( (*(_DWORD *)(v23 + 16) & 0x400i64) == 0 )
{
v44 = *(_BYTE *)(v23 + 34);
if( (v44 & 0x10) == 0 )
{
if( (v44 & 8) == 0 )
{
v31 = MiCapturePageFileInfoInline((UINT64 *)(v23 + 16), 1i64, 0i64);
v44 = *(_BYTE *)(v23 + 34);
}
*(_BYTE *)(v23 + 34) = v44 | 0x10;
}
}
if( (*(_QWORD *)v5 & 0x800i64) != 0 && (*(_QWORD *)v5 & 0x42) == 0 )
{
MiWriteValidPteVolatile((MMPTE *)v5, 2ui64);
MiInsertTbFlushEntry((INT64)&v61, v19, 1i64, 0i64);
}
_InterlockedAnd64((volatile signed __int64 *)(v23 + 24), 0x7FFFFFFFFFFFFFFFui64);
if( v31 )
MiReleasePageFileInfo(a1a, v31, 1, v43, BugCheckParameter4, v47, a7, a8, v50, a10, (INT64)a11, SpinCount);
v13 = (char *)v50;
v5 += 8i64;
v14 = BYTE1(a7);
goto LABEL_95;
}
MiFlushTbList((__int64)&v61);
MiUnlockPageTableInternal((INT64)AnyMultiplexedVm, v50);
MiUnlockWorkingSetShared((INT64)AnyMultiplexedVm, BYTE1(a7));
v13 = 0i64;
a8 = (INT64)MiAllocateDriverPage();
v50 = 0i64;
v42 = a8;
v8 = a7;
v14 = MiLockWorkingSetShared((INT64)AnyMultiplexedVm);
BYTE1(a7) = v14;
}
while( v5 <= v56 && v8 == 1 );
if( v14 != 17 )
{
MiFlushTbList((__int64)&v61);
if( v13 )
MiUnlockPageTableInternal((INT64)AnyMultiplexedVm, (UINT64)v13);
MiUnlockWorkingSetShared((INT64)AnyMultiplexedVm, v14);
}
if( v42 != -1 )
MiReleaseFreshPage((_MMPFN *)((char *)MmGetPfnDb() + 48 * v42));
if( !v8 )
{
MiUnlockCodePage(PointerPte, (MMPTE *)(v5 - 16));
return 3221225626i64;
}
return 0i64;
}Referenced by:
MiDisablePagingOfDriver
MiHandleDriverNonPagedSections
MiLockImageSection
MmLockPreChargedPagedPool
MmResetDriverPaging