MiOutSwapWorkingSetPte
INT64 __fastcall MiOutSwapWorkingSetPte(INT64 rcx0, UINT64 a2, INT64 a3){
INT64 v3;
INT64 v4;
INT64 v5;
INT64 v6;
INT64 v7;
__int64 v8;
UINT64 v10;
unsigned __int64 v11;
char v12;
_MMPFN *v13;
UNICODE_STRING *v14;
UINT8 v15;
INT64 v16;
unsigned __int64 v17;
_MMPFN *v18;
char v19;
__int64 v20;
__int64 v21;
int v22;
_MMPTE *PteBase;
_QWORD *v24;
char *v25;
char *v26;
__int64 v27;
UINT64 *v28;
unsigned __int8 v29;
char v30;
unsigned __int8 v31;
char v32;
INT64 v33;
__int64 v34;
__int64 v35;
unsigned __int64 v36;
unsigned __int64 v37;
unsigned __int64 v38;
unsigned int v39;
__int64 v40;
unsigned __int64 v41;
INT64 updated;
bool v43;
unsigned __int64 v44;
__int64 v45;
__int64 v46;
_QWORD *v47;
INT64 v48;
unsigned __int64 v49;
INT64 a1;
INT64 a6;
INT64 a7;
INT64 a8;
INT64 a9;
INT64 a10;
INT64 a11;
INT64 v58;
UINT64 SpinCount;
unsigned __int64 v60;
v8 = *(_QWORD *)(rcx0 + 168);
a6 = *(_QWORD *)(v8 + 16);
if( (_DWORD)a3 )
return 0i64;
a11 = v3;
v10 = 0i64;
a10 = v5;
v11 = 0i64;
a9 = v4;
v12 = 0;
a8 = v6;
a7 = v7;
v13 = 0i64;
a1 = *(_QWORD *)(v8 + 24);
while( 1 )
{
v17 = MI_READ_PTE_LOCK_FREE(a2);
v60 = v17;
if( (v17 & 1) != 0 )
break;
if( (v17 & 0x400) != 0 )
goto LABEL_89;
if( (v17 & 0x800) == 0 )
{
if( (v17 & 2) != 0 )
{
v60 = v17 & 0xFFFFFFFFFFFFFFFDui64;
*(_QWORD *)a2 = v17 & 0xFFFFFFFFFFFFFFFDui64;
v11 = v17;
}
goto LABEL_89;
}
v18 = MiLockTransitionLeafPage((_MMPTE *)a2, 0i64);
v13 = v18;
if( v18 )
{
v19 = *((_BYTE *)v18 + 34);
v12 = 1;
if( (v19 & 0x28) == 0 )
{
v20 = *((_QWORD *)v13 + 2);
if( (v20 & 2) != 0 )
{
v11 = *((_QWORD *)v13 + 2);
if( *((_WORD *)v13 + 16) || (v19 & 7) != 3 )
{
*((_QWORD *)v13 + 2) = v20 & 0xFFFFFFFFFFFFFFFDui64;
}
else
{
MiUnlinkPageFromList(v13, 0i64);
*((_QWORD *)v13 + 2) &= ~2ui64;
MiInsertPageInList(v13, 8ui64);
}
}
}
goto LABEL_89;
}
}
v21 = 48 * ((v17 >> 12) & 0xFFFFFFFFFi64);
if( ((*(_QWORD *)((char *)MmGetPfnDb() + v21 + 40) >> 50) & 1) == 0 )
goto LABEL_89;
v13 = (_MMPFN *)((char *)MmGetPfnDb() + v21);
LOBYTE(v22) = MI_PFN_IS_PROTO((UNICODE_STRING *)v13, v14, v15, (PWCHAR)v16);
PteBase = MmGetPteBase();
if( v22 )
{
v24 = *(_QWORD **)(v8 + 8);
if( !v24 )
goto LABEL_89;
}
else
{
if( (*(_QWORD *)((char *)MmGetPfnDb() + v21 + 8) | 0x8000000000000000ui64) != a2 )
goto LABEL_89;
v12 = 1;
LODWORD(SpinCount) = 0;
v25 = (char *)MmGetPfnDb() + 24;
if( _interlockedbittestandset64((volatile signed __int32 *)&v25[v21], 0x3Fui64) )
{
do
{
do
KeYieldProcessorEx(&SpinCount);
while( *(__int64 *)&v25[v21] < 0 );
}
while( _interlockedbittestandset64((volatile signed __int32 *)&v25[v21], 0x3Fui64) );
PteBase = MmGetPteBase();
}
v16 = (INT64)MmGetPfnDb() + 34;
if( (*(_BYTE *)(v21 + v16) & 8) != 0 )
goto LABEL_89;
v26 = (char *)MmGetPfnDb() + 16;
v27 = *(_QWORD *)&v26[v21];
v28 = (UINT64 *)&v26[v21];
if( (v27 & 2) != 0 )
{
v11 = *(_QWORD *)&v26[v21];
*v28 = v27 & 0xFFFFFFFFFFFFFFFDui64;
}
if( !*(_DWORD *)(v8 + 144)
&& (*(_WORD *)((char *)MmGetPfnDb() + v21 + 32) != 1
|| (*(_BYTE *)(a6 + 184) & 7) == 0
&& (HIBYTE(*(_QWORD *)((char *)PteBase
+ ((((__int64)((a2 << 25) - ((_QWORD)PteBase << 25)) >> 16) & 0xFFFFFFFFF000ui64) >> 9))) & 0xF) == 8) )
{
goto LABEL_89;
}
v29 = *(_BYTE *)(v21 + v16);
if( (v60 & 0x42) == 0 && (v29 & 0x10) == 0 )
{
if( (*(_DWORD *)v28 & 4) == 0 )
goto LABEL_89;
v12 = 3;
}
if( (v29 & 0x10) == 0 )
{
v30 = *(_BYTE *)(v21 + v16);
if( (*(_DWORD *)v28 & 0x400i64) == 0 && (v29 & 8) == 0 )
{
v10 = MiCapturePageFileInfoInline(v28, 1i64, 0i64);
v16 = (INT64)MmGetPfnDb() + 34;
v30 = *(_BYTE *)(v21 + v16);
}
v31 = v30 | 0x10;
*(_BYTE *)(v21 + v16) = v31;
v29 = v31;
}
v32 = v29 >> 6;
if( v32 != 1 )
{
if( v32 == 2 )
{
v12 |= 4u;
}
else if( !v32 )
{
v12 |= 8u;
}
}
v33 = a1;
if( *(_DWORD *)(v8 + 32) == -1 )
{
v34 = -9i64;
v16 = -2049i64;
v35 = *(_QWORD *)(a1 + 8i64 * *(unsigned int *)(a1 + 1156) + 6944);
if( (*v28 & 0x400) != 0 )
v34 = -2049i64;
v36 = *v28 & v34;
if( (*v28 & 0x400) == 0 )
v36 &= 0xFFFFFFFFFFFFFFF9ui64;
if( v35 )
{
v16 = *(unsigned __int16 *)(v35 + 204);
if( v36 )
{
if( qword_140C4DC80 )
{
if( (v36 & 0x10) != 0 )
LODWORD(v36) = v36 & 0xFFFFFFEF;
else
LODWORD(v36) = ~(_DWORD)qword_140C4DC80 & v36;
}
v37 = v36 | 0xFFFFFFFF00000000ui64;
if( qword_140C4DC80 )
{
if( (v37 & qword_140C4DC80) != 0 )
v37 |= 0x10ui64;
else
v37 |= qword_140C4DC80;
}
}
else
{
v37 = MiSwizzleInvalidPte(0xFFFFFFFF00000000ui64);
}
v36 = (unsigned __int16)(v37 ^ ((_WORD)v16 << 12)) & 0xF000 ^ v37;
}
v60 = v36;
if( v28 >= (UINT64 *)MmGetPml4eBase()
&& v28 <= (UINT64 *)MmGetPxeUserLimit()
&& (*(_DWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 2172i64) & 0x1000) != 0 )
{
v38 = v36 | 0x8000000000000000ui64;
if( (v36 & 1) == 0 )
v38 = v36;
*v28 = v38;
}
else
{
*v28 = v36;
}
}
_InterlockedAnd64((volatile signed __int64 *)((char *)MmGetPfnDb() + v21 + 24), 0x7FFFFFFFFFFFFFFFui64);
v39 = *(_DWORD *)(v8 + 32);
v12 &= ~1u;
v24 = *(_QWORD **)v8;
if( v39 != -1 )
{
v40 = v8 + 16i64 * v39;
if( v39 >= 5 || !*(_DWORD *)(v40 + 48) )
goto LABEL_89;
MiReservePageFileSpaceForPage(v33, a2, 128, (UINT64 *)(v40 + 40));
v41 = *(_QWORD *)(v40 + 40);
if( qword_140C4DC80 && (v41 & 0x10) == 0 )
v41 &= ~qword_140C4DC80;
updated = MiUpdatePageFileHighInPte(*(_QWORD *)(v40 + 40), HIDWORD(v41) + 1);
v43 = (*(_DWORD *)(v40 + 48))-- == 1;
*(_QWORD *)(v40 + 40) = updated;
if( v43 )
++*(_DWORD *)(v8 + 32);
v12 |= 0x10u;
}
PteBase = MmGetPteBase();
}
v44 = v24[2];
if( v44 < v24[1] )
{
v16 = *v24 + 16 * v44;
v45 = (__int64)((a2 << 25) - ((_QWORD)PteBase << 25)) >> 16;
if( !v44 || (v46 = *(_QWORD *)(v16 - 8), v47 = (_QWORD *)(v16 - 8), v46 + *(_QWORD *)(v16 - 16) != v45) )
{
v24[2] = v44 + 1;
v47 = (_QWORD *)(v16 + 8);
*(_QWORD *)v16 = v45;
*(_QWORD *)(v16 + 8) = 0i64;
v46 = 0i64;
}
*v47 = v46 + 4096;
++v24[3];
if( (v12 & 2) != 0 )
++*(_QWORD *)(v8 + 136);
if( (v12 & 4) != 0 )
{
++*(_QWORD *)(v8 + 120);
}
else if( (v12 & 8) != 0 )
{
++*(_QWORD *)(v8 + 128);
}
}
LABEL_89:
if( (v12 & 1) != 0 )
_InterlockedAnd64((volatile signed __int64 *)v13 + 3, 0x7FFFFFFFFFFFFFFFui64);
v48 = a1;
if( v11 )
{
v49 = v11 & 0xFFFFFFFFFFFFFFFBui64;
if( (v11 & 4) == 0 )
v49 = v11;
MiReleasePageFileInfo(a1, v49, 0, v16, a1, a6, a7, a8, a9, a10, a11, v58);
}
if( v10 )
MiReleasePageFileInfo(v48, v10, 0, v16, a1, a6, a7, a8, a9, a10, a11, v58);
return 0i64;
}Referenced by:
No references.