MiWsleFree
INT64 MiWsleFree(INT64 a1, UINT64 a2, CHAR a3, ...){
_MMPTE *PteBase;
unsigned __int64 v4;
UINT64 v8;
UNICODE_STRING *v9;
UINT8 v10;
WCHAR *v11;
char *v12;
_MMPTE *PteLimit;
char v14;
int v15;
WCHAR *v16;
UNICODE_STRING *v17;
UINT8 v18;
int v19;
unsigned __int64 v20;
unsigned __int64 v21;
int v22;
volatile signed __int32 *v23;
_MMPFN *PfnDb;
int v25;
__int64 v26;
int v27;
UINT64 ValidPte;
struct _KPRCB *CurrentPrcb;
UINT64 v30;
__int64 v31;
unsigned __int64 UltraMapping;
_MMPTE *v33;
unsigned __int64 v34;
_MMPTE *v35;
_QWORD *v36;
_QWORD *v37;
char v38;
UINT64 v39;
INT64 v40;
UINT64 v41;
__int64 v42;
char *v43;
__int64 v44;
UINT64 ContainingPageTable;
char v46;
UINT64 v47;
__int64 v48;
char v49;
char *v50;
char v51;
UINT64 SpinCount;
UINT64 v54;
INT64 a7;
UINT64 v56;
INT64 v57;
INT64 v58;
INT64 v59;
INT64 v60;
int v62;
unsigned __int16 v64;
unsigned __int64 v65;
va_list va1;
va_list va;
va_start(va1, a3);
va_start(va, a3);
v65 = va_arg(va1, _QWORD);
PteBase = MmGetPteBase();
v4 = v65;
v8 = (UINT64)PteBase + ((a2 >> 9) & 0x7FFFFFFFF8i64);
v12 = (char *)MmGetPfnDb() + 48 * (((unsigned __int64)MI_READ_PTE_LOCK_FREE((INT64)va) >> 12) & 0xFFFFFFFFFi64);
PteLimit = MmGetPteLimit();
if( a2 < (unsigned __int64)PteBase || a2 > (unsigned __int64)PteLimit )
v14 = HIBYTE(v4) & 0xF | (16 * ((v4 >> 60) & 7));
else
v14 = ((unsigned __int8)*v12 >> 1) & 7;
LOBYTE(v15) = MI_PFN_IS_PROTO((UNICODE_STRING *)v12, v9, v10, v11);
v62 = v15;
if( (a3 & 4) != 0 )
goto LABEL_15;
if( v15 )
{
if( (*((_QWORD *)v12 + 5) & 0x1000000000i64) == 0 && *((__int64 *)v12 + 1) > 0
|| (*((_DWORD *)v12 + 4) & 0x400i64) != 0 )
{
goto LABEL_15;
}
}
else
{
if( (*(_BYTE *)(a1 + 184) & 7u) >= 2 )
goto LABEL_15;
if( (MiGetPagePrivilege((ULONG_PTR)v12, 0, 0i64) & 0xFFFFFFFD) != 0 )
goto LABEL_15;
LOBYTE(v19) = MI_PFN_IS_PROTO((UNICODE_STRING *)v12, v17, v18, v16);
if( !v19 )
{
v20 = (unsigned __int64)MmGetPteBase();
v21 = (__int64)((v8 << 25) - (v20 << 25)) >> 16;
if( v21 >= v20 && v21 <= (unsigned __int64)MmGetPteLimit() )
goto LABEL_15;
}
}
if( *((_WORD *)v12 + 16) != 1 || (v12[34] & 0xC0) != 64 || (v22 = 1, (v12[35] & 0x40) != 0) )
LABEL_15:
v22 = 0;
v23 = (volatile signed __int32 *)(v12 + 24);
LODWORD(SpinCount) = 0;
while( _interlockedbittestandset64(v23, 0x3Fui64) )
{
do
KeYieldProcessorEx(&SpinCount);
while( *(__int64 *)v23 < 0 );
}
if( v22 )
{
if( (*(_QWORD *)v23 & 0x3FFFFFFFFFFFFFFFi64) != 1 || *((_WORD *)v12 + 16) != 1 )
goto LABEL_46;
PfnDb = MmGetPfnDb();
v25 = 4;
v26 = (v12 - (char *)PfnDb) / 48;
v27 = *((unsigned __int8 *)PfnDb + 48 * v26 + 34) >> 6;
if( !v27 || v27 == 3 )
{
v25 = 12;
}
else if( v27 == 2 )
{
v25 = 28;
}
ValidPte = MiMakeValidPte(0i64, v26, v25 | 0xA0000000);
CurrentPrcb = KeGetCurrentPrcb();
v30 = ValidPte;
v31 = *((_QWORD *)CurrentPrcb + 4095);
if( v31 )
{
UltraMapping = MiGetUltraMapping((unsigned __int64 *)(v31 + 12448), 3u, 1i64, 0);
v33 = MmGetPteBase();
v34 = UltraMapping;
v35 = (_MMPTE *)((char *)v33 + ((UltraMapping >> 9) & 0x7FFFFFFFF8i64));
*(_QWORD *)(v31 + 12344) = v35;
if( UltraMapping )
{
LABEL_36:
if( v35 >= MmGetPml4eBase()
&& v35 <= MmGetPxeUserLimit()
&& (*(_DWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 2172i64) & 0x1000) != 0
&& (v30 & 1) != 0 )
{
v30 |= 0x8000000000000000ui64;
}
*(_QWORD *)v35 = v30;
v36 = (_QWORD *)v34;
v37 = (_QWORD *)(v34 + 4088);
do
{
if( *v36 | *v37 )
break;
++v36;
--v37;
}
while( v36 <= v37 );
MiUnmapPageInHyperSpaceWorker((PVOID)v34, 0x11u, 0x80000000ui64);
if( v36 > v37 )
{
MiRewriteTrimPteAsDemandZero(a1, v12);
goto LABEL_47;
}
LABEL_46:
v22 = 0;
goto LABEL_47;
}
}
else
{
v33 = MmGetPteBase();
}
v34 = (*((_QWORD *)CurrentPrcb + 4160) & 0xFFFFFFFFFFFFF000ui64)
+ ((*((_QWORD *)CurrentPrcb + 4160) & 0xFFFi64) << 12);
v35 = (_MMPTE *)((char *)v33 + ((v34 >> 9) & 0x7FFFFFFFF8i64));
goto LABEL_36;
}
LABEL_47:
v38 = v65;
v39 = 0i64;
a7 = 0i64;
if( v22 || (v65 & 4) != 0 )
{
ContainingPageTable = MiGetContainingPageTable(v8);
v46 = v12[34];
v47 = ContainingPageTable;
*((_QWORD *)v12 + 5) &= v48;
v12[34] = v46 & 0xC7;
v49 = v12[35];
*(_QWORD *)v23 &= 0xC000000000000000ui64;
v12[35] = v49 & 0xDF;
*((_WORD *)v12 + 16) = 0;
v39 = MiCapturePageFileInfoInline((UINT64 *)v12 + 2, 0i64, 0i64);
if( v39 )
v40 = *(_QWORD *)(qword_140C4E388 + 8 * ((*((_QWORD *)v12 + 5) >> 39) & 0x3FFi64));
else
v40 = a7;
MiInsertPageInFreeOrZeroedList((v12 - (char *)MmGetPfnDb()) / 48, (unsigned int)((v38 & 4) != 0) + 1);
_InterlockedAnd64((volatile signed __int64 *)v23, 0x7FFFFFFFFFFFFFFFui64);
v50 = (char *)MmGetPfnDb() + 48 * v47;
LODWORD(v54) = 0;
v23 = (volatile signed __int32 *)(v50 + 24);
while( _interlockedbittestandset64(v23, 0x3Fui64) )
{
do
KeYieldProcessorEx(&v54);
while( *(__int64 *)v23 < 0 );
}
MiDecrementShareCount((UINT64)v50);
}
else
{
if( (v65 & 0x42) != 0 )
{
v39 = MiCaptureDirtyBitToPfn((INT64)v12);
if( v39 )
v40 = *(_QWORD *)(qword_140C4E388 + 8 * ((*((_QWORD *)v12 + 5) >> 39) & 0x3FFi64));
else
v40 = 0i64;
}
else
{
v40 = 0i64;
}
if( v62 )
{
v56 = *(_QWORD *)((char *)MmGetPteBase() + ((v8 >> 9) & 0x7FFFFFFFF8i64));
v41 = (v56 >> 12) & 0xFFFFFFFFFi64;
}
else
{
v41 = -1i64;
}
if( (a3 & 1) != 0
&& (*(_QWORD *)v23 & 0x3FFFFFFFFFFFFFFFi64) == 1
&& *((_WORD *)v12 + 16) == 1
&& (v12[34] & 0x10) == 0
&& (unsigned int)MiGetPfnPriority((INT64)v12) == 5 )
{
v12[35] = v12[35] & 0xF8 | 4;
}
if( (v12[34] & 7) != 6 )
MiBadShareCount((_MMPFN *)v12);
v42 = (*(_QWORD *)v23 & 0x3FFFFFFFFFFFFFFFi64) - 1;
*(_QWORD *)v23 ^= (*(_QWORD *)v23 ^ v42) & 0x3FFFFFFFFFFFFFFFi64;
if( !v42 )
MiPfnShareCountIsZero((UINT64)v12, 0i64);
if( v41 != -1i64 )
{
_InterlockedAnd64((volatile signed __int64 *)v23, 0x7FFFFFFFFFFFFFFFui64);
v43 = (char *)MmGetPfnDb() + 48 * v41;
HIDWORD(SpinCount) = 0;
v23 = (volatile signed __int32 *)(v43 + 24);
while( _interlockedbittestandset64(v23, 0x3Fui64) )
{
do
KeYieldProcessorEx((UINT64 *)((char *)&SpinCount + 4));
while( *(__int64 *)v23 < 0 );
}
if( (v43[34] & 7) != 6 )
MiBadShareCount((_MMPFN *)v43);
v44 = (*(_QWORD *)v23 & 0x3FFFFFFFFFFFFFFFi64) - 1;
*(_QWORD *)v23 ^= (*(_QWORD *)v23 ^ v44) & 0x3FFFFFFFFFFFFFFFi64;
if( !v44 )
MiPfnShareCountIsZero((UINT64)v43, 0i64);
}
}
_InterlockedAnd64((volatile signed __int64 *)v23, 0x7FFFFFFFFFFFFFFFui64);
if( v39 )
MiReleasePageFileInfo(v40, v39, 1, (INT64)v16, SpinCount, v54, a7, v56, v57, v58, v59, v60);
v51 = 1;
LOBYTE(v64) = v14;
if( !v62 )
v51 = 3;
HIBYTE(v64) = v51;
return v64;
}Referenced by:
MiFreeWsleList