MiHandleForkTransitionPte
VOID __fastcall MiHandleForkTransitionPte(){
__int64 v0;
MMPTE *v1;
MMPTE *v2;
UINT64 v3;
_MMPTE *v4;
UINT64 *v5;
INT64 v6;
unsigned int v7;
INT64 v8;
unsigned int v9;
int v10;
__int64 v11;
__int64 v12;
INT64 v13;
__int64 v14;
__int64 v15;
_MMPFN *v16;
unsigned __int64 v17;
INT64 v18;
__int64 v19;
signed __int32 v20;
UINT64 Page;
UINT8 v22;
_MI_PARTITION *v23;
UINT64 v24;
INT64 *v25;
KIRQL v26;
UINT64 v27;
__int64 v28;
int v29;
int v30;
__int64 v31;
_MMPFN *PfnDb;
INT64 v33;
INT64 v34;
unsigned __int64 v35;
char *v36;
INT64 *SharedVm;
INT64 PageIrql;
INT64 v39;
INT64 Color;
int Colora;
INT64 a8;
INT64 a9;
INT64 a9a;
INT64 a10;
INT64 a11;
_MI_PARTITION *Partition;
__int128 v48;
INT64 v49;
INT64 v50;
__int64 v51;
MMPTE *BugCheckParameter1;
MMPTE *PointerNewPte;
UINT64 v54;
_QWORD *v55;
__int64 v56;
UINT64 *v57;
char v58;
UINT8 WsIrql;
_QWORD *v60;
_DWORD *v61;
PointerNewPte = v2;
BugCheckParameter1 = v1;
v51 = v0;
v3 = v54;
v4 = v1;
v5 = (UINT64 *)v2;
a10 = 0i64;
v48 = 0i64;
v6 = MiSwizzleInvalidPte((v54 << 16) | 0x400);
v8 = ZeroPte;
v9 = v7;
v49 = v6;
v10 = v7;
v12 = *(unsigned __int16 *)(v11 + 1838);
v50 = ZeroPte;
HIDWORD(Color) = v7;
LODWORD(a8) = v7;
v13 = *(_QWORD *)(qword_140C4E388 + 8 * v12);
v15 = *(unsigned __int16 *)(v14 + 1838);
a11 = v13;
Partition = *(_MI_PARTITION **)(qword_140C4E388 + 8 * v15);
if( Partition == (_MI_PARTITION *)v13 )
{
while( 1 )
{
LABEL_11:
v16 = MiLockTransitionLeafPage(v4, 0i64);
if( !v16 )
goto LABEL_21;
v17 = MI_READ_PTE_LOCK_FREE((INT64)v4);
v18 = 0i64;
v19 = (v17 >> 5) & 0x1F;
a9 = v19;
if( !*((_WORD *)v16 + 16)
&& (v19 & 0xFFFFFFF8) != 16
&& !(unsigned int)MI_IS_SOFTWARE_PTE_SHADOW_STACK((_QWORD *)v16 + 2) )
{
break;
}
Colora = *((unsigned __int8 *)v16 + 34) >> 6;
a9a = v51 + 1664;
if( *v57 != -1i64 )
{
if( v10 )
{
MiReturnCommit((_MI_PARTITION *)v13, 1ui64);
LODWORD(v18) = 0;
v10 = 0;
}
if( v9 )
{
MiReturnCrossPartitionCloneCharges(v13);
LODWORD(v18) = 0;
}
v9 = v18;
v36 = (char *)MmGetPfnDb() + 48 * *v57;
MiLockNestedPageAtDpcInline((INT64)v36);
MiFinalizePageAttribute((_MMPFN *)v36, (_MI_PFN_CACHE_ATTRIBUTE)Colora, 1ui64);
_InterlockedAnd64((volatile signed __int64 *)v36 + 3, 0x7FFFFFFFFFFFFFFFui64);
if( (*((_BYTE *)v16 + 34) & 0x20) != 0 && (MiFlushTbList(v56), (*((_BYTE *)v16 + 34) & 8) != 0) )
{
_InterlockedAnd64((volatile signed __int64 *)v16 + 3, 0x7FFFFFFFFFFFFFFFui64);
MiUnlockWorkingSetExclusive(a9a, WsIrql);
KeDelayExecutionThread(0, 0, (PLARGE_INTEGER)&MiShortTime);
SharedVm = MiGetSharedVm(a9a);
ExAcquireSpinLockExclusive((PEX_SPIN_LOCK)SharedVm);
*((_DWORD *)SharedVm + 1) = 0;
}
else if( (unsigned int)MiDuplicateCloneLeaf(BugCheckParameter1, PointerNewPte, *v57, WsIrql, 2u) )
{
*v57 = -1i64;
++*v55;
return;
}
LABEL_21:
if( v10 )
MiReturnCommit((_MI_PARTITION *)v13, 1ui64);
if( v9 )
MiReturnCrossPartitionCloneCharges(v13);
return;
}
_InterlockedAnd64((volatile signed __int64 *)v16 + 3, 0x7FFFFFFFFFFFFFFFui64);
MiInitializePageColorBase(v51 + 1664, v18, (INT64)&v48);
v20 = _InterlockedExchangeAdd((volatile signed __int32 *)v48, 1u);
LODWORD(Color) = HIDWORD(v48) | v20 & DWORD2(v48);
Page = MiGetPage(Partition, (unsigned int)Color, 0i64);
*v57 = Page;
if( Page == -1i64 )
{
v22 = WsIrql;
v23 = Partition;
do
{
MiFlushTbList(v56);
MiUnlockWorkingSetExclusive(a9a, v22);
MiWaitForFreePage(v23, v24);
v25 = MiGetSharedVm(a9a);
v26 = ExAcquireSpinLockExclusive((PEX_SPIN_LOCK)v25);
*((_DWORD *)v25 + 1) = 0;
v22 = v26;
MiMakeSystemAddressValid((UINT64)BugCheckParameter1, 0i64, 0i64, v26, 1);
v27 = MiGetPage(v23, (unsigned int)Color, 0i64);
*v57 = v27;
}
while( v27 == -1i64 );
v6 = v49;
v8 = v50;
v13 = a11;
v9 = HIDWORD(Color);
v10 = a8;
WsIrql = v22;
v3 = v54;
}
v4 = BugCheckParameter1;
if( (MI_READ_PTE_LOCK_FREE((INT64)BugCheckParameter1) & 0x401) != 0 )
goto LABEL_21;
}
*(_QWORD *)v3 = v18;
*(_QWORD *)v3 = v17;
MI_MAKE_PROTECT_WRITE_COPY((_MMPTE *)v3);
*(_QWORD *)(v3 + 8) = v9;
*(_QWORD *)(v3 + 24) = 2i64;
if( (v58 & 1) != 0 )
{
*(_QWORD *)(v3 + 16) = 1i64;
if( v10 )
++*v60;
else
++v60[1];
_InterlockedExchangeAdd64((volatile signed __int64 *)(v13 + 7624), 1ui64);
v28 = *(_QWORD *)(v3 + 16);
}
else
{
v28 = 0i64;
}
v29 = a9;
*(_QWORD *)(v3 + 16) = v28 & 0x7FFFFFFFFFFFFFFi64 | ((unsigned __int64)(unsigned int)a9 << 59);
if( (*((_QWORD *)v16 + 2) & 2) != 0 )
{
v8 = *((_QWORD *)v16 + 2);
if( (*((_BYTE *)v16 + 34) & 7) == 3 )
{
MiUnlinkPageFromList(v16, 0i64);
v30 = 1;
}
else
{
v30 = 0;
}
*((_QWORD *)v16 + 2) &= ~2ui64;
if( v30 )
MiInsertPageInList(v16, 8ui64);
}
*((_QWORD *)v16 + 1) = v3;
*((_QWORD *)v16 + 5) |= 0x8000000000000000ui64;
MI_MAKE_PROTECT_WRITE_COPY((_MMPTE *)((char *)v16 + 16));
v31 = *((_QWORD *)v16 + 5);
a11 = v31 & 0xFFFFFFFFFi64;
a10 = MI_READ_PTE_LOCK_FREE((INT64)MmGetPteBase() + ((v3 >> 9) & 0x7FFFFFFFF8i64));
*((_QWORD *)v16 + 5) = v31 ^ (v31 ^ ((unsigned __int64)MI_READ_PTE_LOCK_FREE((INT64)&a10) >> 12)) & 0xFFFFFFFFFi64;
PfnDb = MmGetPfnDb();
v33 = (INT64)PfnDb + 48 * (((unsigned __int64)MI_READ_PTE_LOCK_FREE((INT64)&a10) >> 12) & 0xFFFFFFFFFi64);
MiLockNestedPageAtDpcInline(v33);
*(_QWORD *)(v33 + 24) ^= (*(_QWORD *)(v33 + 24) ^ (*(_QWORD *)(v33 + 24) + 1i64)) & 0x3FFFFFFFFFFFFFFFi64;
_InterlockedAnd64((volatile signed __int64 *)(v33 + 24), 0x7FFFFFFFFFFFFFFFui64);
*(_QWORD *)BugCheckParameter1 = v6;
_InterlockedAnd64((volatile signed __int64 *)v16 + 3, 0x7FFFFFFFFFFFFFFFui64);
if( v8 )
{
v35 = v8 & 0xFFFFFFFFFFFFFFFBui64;
if( (v8 & 4) == 0 )
v35 = v8;
MiReleasePageFileInfo(v13, v35, 1, v34, PageIrql, v39, Color, a8, a9, a10, a11, (INT64)Partition);
}
if( (v58 & 1) != 0 && v29 != 24 )
v6 |= 8ui64;
*(_QWORD *)PointerNewPte = v6;
MiLockAndDecrementShareCount((UINT64)PfnDb + 48 * a11, 0);
_InterlockedExchangeAdd64((volatile signed __int64 *)(v51 + 1272), 0xFFFFFFFFFFFFFFFFui64);
}
else
{
if( (v58 & 1) != 0 )
{
if( !(unsigned int)MiChargeCommit((_MI_PARTITION *)v13, v7 + 1, 0i64) )
{
MiWriteUselessChildPte(v5);
*v61 = 1;
return;
}
v10 = 1;
LODWORD(a8) = 1;
}
if( (unsigned int)MiGetCrossPartitionCloneCharges(v13) )
{
v9 = 1;
HIDWORD(Color) = 1;
goto LABEL_11;
}
MiWriteUselessChildPte(v5);
*v61 = 1;
if( v10 )
MiReturnCommit((_MI_PARTITION *)v13, 1ui64);
}
}Referenced by:
MiBuildForkPte