MiMapViewOfDataSection
NTSTATUS __stdcall MiMapViewOfDataSection(
_CONTROL_AREA *ControlArea,
_EPROCESS *Process,
PVOID *CapturedBase,
_LARGE_INTEGER *SectionOffset,
UINT64 *CapturedViewSize,
_SECTION *Section,
_SECTION_INHERIT InheritDisposition,
UINT64 ProtectionMask,
UINT64 CommitSize,
UINT64 ZeroBits,
UINT64 AllocationType,
UINT64 ProbeMode,
UINT8 *CfgTargetsValid,
PVOID *SecureHandle){
int v14;
__int64 v18;
__int64 *v19;
RTL_BALANCED_NODE *v20;
__int64 v21;
unsigned __int64 v22;
int v23;
int v24;
bool v25;
unsigned __int64 v27;
UINT64 v28;
_ETHREAD *CurrentThread;
unsigned __int64 QuadPart;
NTSTATUS inserted;
struct _DMA_ADAPTER *v32;
UINT64 v33;
bool v34;
_SUBSECTION *SubsectionNode;
unsigned __int64 v36;
unsigned __int64 v37;
INT64 *v38;
UINT64 v39;
int v40;
_DWORD *PoolMm;
_SECTION_INHERIT v42;
unsigned int v43;
int v44;
int v45;
int v46;
_BOOL8 v47;
unsigned int v48;
unsigned int v49;
UINT64 v50;
unsigned __int64 v51;
int v52;
UINT64 v53;
unsigned __int64 v54;
__int64 v55;
__int64 v56;
UINT64 v57;
unsigned __int64 v58;
__int64 *v59;
__int64 v60;
_SUBSECTION *v61;
ULONG_PTR v62;
__int32 v63;
UINT64 v64;
NTSTATUS v65;
volatile INT64 *v66;
_MI_VAD_EVENT_BLOCK **v67;
__int64 *InternalFlags;
UINT64 *HINTHonored;
PVOID *StartingAddress;
__int64 *BugCheckParameter2;
__int64 v72;
int v73;
PVOID Address;
RTL_BALANCED_NODE *PlaceholderVadToReplace;
unsigned __int64 StartingVpn;
UINT64 StartingVpna;
UINT64 StartingVpnb;
int v79;
unsigned __int64 v80;
unsigned __int64 v81;
UINT64 v82;
UINT64 v83;
__int64 v84;
unsigned __int64 v85;
__int64 v86;
unsigned __int64 v87;
RTL_BALANCED_NODE *v88;
__int64 *v89;
UINT64 v90;
UINT64 EndingVpn;
__int64 a6;
PVOID P;
PVOID Lock;
NTSTATUS a4;
PVOID *v96;
_LARGE_INTEGER *v97;
v97 = SectionOffset;
v96 = CapturedBase;
v14 = *((_DWORD *)Process + 15);
Address = 0i64;
v87 = 0i64;
a6 = 0i64;
v73 = 0;
if( (v14 & 2) != 0 )
return -1073741811;
if( MiAweControlArea((INT64)ControlArea) )
return -1073741811;
v21 = *v19;
v22 = *(_QWORD *)(v18 + 88);
v23 = *(_DWORD *)(v18 + 40);
v88 = v20;
v86 = v21;
if( (v23 & 0x2000) != 0 && *((RTL_BALANCED_NODE **)ControlArea + 8) == v20 )
return -1073741811;
v24 = v23 & 0x40000000;
if( (v23 & 0x20000000) == 0 )
{
if( !v24
|| (v23 & 0x2000) == 0 && (*(RTL_BALANCED_NODE **)(v22 + 2240) != v20 || (*((_DWORD *)Process + 18) & 1) != 0) )
{
goto LABEL_20;
}
return -1073741811;
}
if( v24
|| (v23 & 0x2000) != 0
|| InheritDisposition == 24
|| (InheritDisposition & 0xFFFFFFF8) == 16
|| (InheritDisposition & 5) == 5 )
{
return -1073741811;
}
v25 = *((RTL_BALANCED_NODE **)ControlArea + 8) == v20 ? (*(_WORD *)(v21 + 12) & 0x1000) == 0 : (*((_DWORD *)ControlArea
+ 14) & 0x40000000) == 0;
if( v25 )
return -1073741811;
LABEL_20:
v27 = *((_QWORD *)Process + 2);
if( v27 >= 0x200000 && ((v27 - 1) & *((_QWORD *)Process + 4)) != 0
|| (v23 & 0x2000) != 0 && SectionOffset->QuadPart >= 0x10000000000ui64 )
{
return -1073741793;
}
v28 = (UINT64)v20;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
PlaceholderVadToReplace = v20;
v84 = *(_QWORD *)(v22 + 1680) + 48i64;
P = v20;
v79 = (int)v20;
v72 = (__int64)CurrentThread;
MiCheckPurgeAndUpMapCount((__int64)ControlArea);
QuadPart = SectionOffset->QuadPart;
v80 = QuadPart >> 12;
v82 = (QuadPart + *((_QWORD *)Process + 3)) >> 12;
StartingVpn = MiGetControlAreaPtes((__int64)ControlArea);
if( QuadPart >> 12 >= StartingVpn )
{
inserted = -1073741793;
LABEL_27:
MiDereferenceControlArea((__int64)ControlArea);
if( v28 )
{
if( *(__int64 *)(v28 + 120) < 0 )
MiDereferenceExtendInfo((_MMVAD *)v28, ControlArea);
v32 = *(struct _DMA_ADAPTER **)(v28 + 128);
if( v32 )
HalPutDmaAdapter(v32);
MiFreePlaceholderStorage(v28);
ExFreePoolWithTag((PVOID)v28, 0);
}
if( P )
ExFreePoolWithTag(P, 0);
return inserted;
}
v33 = ProtectionMask;
v34 = 0;
if( *((_QWORD *)ControlArea + 8) == v28 )
{
v87 = v80;
BugCheckParameter2 = (__int64 *)MiLocatePagefileSubsection((unsigned int *)ControlArea + 32, &v87);
SubsectionNode = (_SUBSECTION *)BugCheckParameter2;
if( !v33 && InheritDisposition == 24 )
v34 = (*((_DWORD *)ControlArea + 14) & 0x1000) != 0;
}
else
{
SubsectionNode = MiLocateSubsectionNode(ControlArea, v97->QuadPart, 0i64);
BugCheckParameter2 = (__int64 *)SubsectionNode;
}
v36 = *((unsigned int *)SubsectionNode + 9) | ((unsigned __int64)(*((_WORD *)SubsectionNode + 16) & 0xFFC0) << 26);
v81 = v80 - v36;
v37 = v82 - v36;
if( v34 )
v37 = 1i64;
v83 = v37;
a4 = MiAddViewsForSection((ULONG_PTR)SubsectionNode, v37, 8);
inserted = a4;
if( a4 < 0 )
goto LABEL_27;
v38 = BugCheckParameter2;
v89 = (__int64 *)(BugCheckParameter2[1] + 8 * v81);
if( *((_QWORD *)ControlArea + 8) == v28 && v33 && MiGetCommittedPages(ControlArea) < StartingVpn )
{
v39 = v28;
LOBYTE(v39) = (v33 & 0xFFF) != 0;
v88 = (RTL_BALANCED_NODE *)((v33 >> 12) + v39);
}
v90 = v28;
StartingVpna = CapturedViewSize[3] << 12;
LOWORD(v40) = MmGetCurrentProcessorColor();
PoolMm = ExAllocatePoolMm(64i64, 0x88ui64, 0x20646156ui64, v40 | 0x80000000);
v28 = (UINT64)PoolMm;
if( !PoolMm )
{
inserted = -1073741670;
goto LABEL_121;
}
v42 = InheritDisposition;
v43 = PoolMm[16] & 0xFBFFFFFF;
*((_QWORD *)PoolMm + 2) = -2i64;
*((_QWORD *)PoolMm + 10) = v89;
v44 = 0;
v25 = (_DWORD)Section == 1;
*(_QWORD *)(v28 + 72) = BugCheckParameter2;
if( v25 )
v44 = 0x4000000;
v45 = v44 | v43;
v46 = (*(_DWORD *)(v28 + 48) ^ (v42 << 7)) & 0xF80;
*(_DWORD *)(v28 + 64) = v45;
*(_DWORD *)(v28 + 48) ^= v46;
*(_DWORD *)(v28 + 48) ^= (*(_DWORD *)(v28 + 48) ^ (*((_DWORD *)Process + 13) << 12)) & 0x3F000;
if( *((_DWORD *)Process + 13) )
*(_BYTE *)(*(_QWORD *)(v22 + 1680) + 352i64) = 1;
if( *((_QWORD *)ControlArea + 8) && (*((_DWORD *)Process + 10) & 0x20002000) == 0 )
*(_DWORD *)(v28 + 64) |= 0x2000000u;
*(_QWORD *)(v28 + 40) = 0i64;
Lock = (PVOID)(v28 + 40);
*(_DWORD *)(v28 + 64) = (v97->QuadPart >> 16) & 0xFFFFFF | *(_DWORD *)(v28 + 64) & 0xFF000000;
if( (*((_DWORD *)Process + 15) & 0x4000000) != 0 )
{
a4 = MiCreatePlaceholderStorage(v28);
inserted = a4;
if( a4 < 0 )
goto LABEL_121;
v38 = BugCheckParameter2;
}
*(_QWORD *)(v28 + 128) = MiReferenceFileObjectForMap((INT64)CapturedViewSize);
v47 = (unsigned int)Feature_Servicing_SetVadPageSize__private_IsEnabled() != 0;
if( (*((_DWORD *)Process + 10) & 0x20000000) != 0 )
{
if( v47 )
{
if( !*((_QWORD *)ControlArea + 8) )
{
*(_DWORD *)(v28 + 48) = *(_DWORD *)(v28 + 48) & 0xFFF3FFFF | 0x80000;
goto LABEL_71;
}
v48 = MiIncrementLargeSubsections(v38, v83);
if( v48 <= 1 )
{
v49 = *(_DWORD *)(v28 + 48) | 0xC0000;
if( v48 == 1 )
v49 = *(_DWORD *)(v28 + 48) & 0xFFF3FFFF | 0x80000;
*(_DWORD *)(v28 + 48) = v49;
LABEL_70:
v73 = 1;
goto LABEL_71;
}
}
else
{
if( !*((_QWORD *)ControlArea + 8) )
goto LABEL_71;
if( (unsigned int)MiIncrementLargeSubsections(v38, v83) <= 1 )
goto LABEL_70;
}
inserted = -1073741280;
goto LABEL_121;
}
LABEL_71:
LOCK_ADDRESS_SPACE((__int64)CurrentThread, v22);
if( (*(_DWORD *)(v22 + 1124) & 0x20) != 0 )
{
inserted = -1073741558;
goto LABEL_116;
}
if( (*((_DWORD *)Process + 18) & 1) != 0 )
{
v50 = (UINT64)*v96;
}
else
{
if( !StartingVpna )
{
LODWORD(StartingAddress) = 0;
LODWORD(HINTHonored) = v42;
a4 = MiSelectUserAddress(
*((unsigned int *)Process + 10),
*(_QWORD *)Process,
*((_QWORD *)Process + 1),
*((_QWORD *)Process + 3),
*((_QWORD *)Process + 2),
0i64,
HINTHonored,
StartingAddress);
inserted = a4;
if( a4 < 0 )
goto LABEL_116;
v50 = 0i64;
v51 = *((_QWORD *)Process + 3) - 1i64;
goto LABEL_85;
}
v50 = StartingVpna + v97->QuadPart;
}
Address = (PVOID)v50;
v85 = v50 + *((_QWORD *)Process + 3) - 1i64;
if( (*((_DWORD *)Process + 15) & 0x4000000) != 0 )
{
PlaceholderVadToReplace = MiFindPlaceholderVadToReplace(
v50,
v50 + *((_QWORD *)Process + 3) - 1i64,
*((unsigned __int8 *)Process + 104),
&a4);
if( !PlaceholderVadToReplace )
{
inserted = a4;
CurrentThread = (_ETHREAD *)v72;
goto LABEL_116;
}
v51 = v85;
}
else
{
v67 = (_MI_VAD_EVENT_BLOCK **)*((_QWORD *)Process + 1);
MiIsVaRangeAvailable((_EPROCESS *)v22, (VOID *)v50, *((_QWORD *)Process + 3), *(VOID **)Process);
if( !v52 )
{
CurrentThread = (_ETHREAD *)v72;
inserted = -1073741800;
goto LABEL_116;
}
}
LABEL_85:
v53 = v50 >> 12;
v54 = v51 >> 12;
*(_BYTE *)(v28 + 32) = v50 >> 44;
*(_BYTE *)(v28 + 33) = v51 >> 44;
*(_DWORD *)(v28 + 24) = v50 >> 12;
*(_DWORD *)(v28 + 28) = v51 >> 12;
v25 = (*((_DWORD *)Process + 10) & 0x2000) == 0;
StartingVpnb = v50 >> 12;
EndingVpn = v51 >> 12;
if( !v25 )
{
CurrentThread = (_ETHREAD *)v72;
--*(_WORD *)(v72 + 486);
ExAcquirePushLockExclusiveEx((UINT64)&qword_140C4C6D0, 0i64);
v55 = *(_QWORD *)(v86 + 32);
if( v55 )
{
++*(_DWORD *)(v55 + 8);
}
else
{
LODWORD(v56) = MiAllocatePool((struct _SLIST_ENTRY *)0x40);
v55 = v56;
if( !v56 )
{
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&qword_140C4C6D0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)&qword_140C4C6D0);
KeAbPostRelease(&qword_140C4C6D0);
KiLeaveGuardedRegionUnsafe(v72);
inserted = -1073741670;
goto LABEL_114;
}
*(_DWORD *)(v56 + 8) = 1;
*(_QWORD *)v56 = _InterlockedCompareExchange64((volatile signed __int64 *)(v86 + 24), -1i64, -1i64);
*(_QWORD *)(v86 + 32) = v56;
}
v57 = CapturedViewSize[6];
if( *(_QWORD *)v55 < v57 )
*(_QWORD *)v55 = v57;
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&qword_140C4C6D0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)&qword_140C4C6D0);
KeAbPostRelease(&qword_140C4C6D0);
KiLeaveGuardedRegionUnsafe(v72);
v53 = StartingVpnb;
v54 = EndingVpn;
v50 = (UINT64)Address;
*(_QWORD *)(v28 + 120) = v55;
}
if( (InheritDisposition & 5) == 5 )
{
v58 = (*(unsigned int *)(v28 + 28) | ((unsigned __int64)*(unsigned __int8 *)(v28 + 33) << 32))
- (*(unsigned int *)(v28 + 24) | ((unsigned __int64)*(unsigned __int8 *)(v28 + 32) << 32))
+ 1;
*(_DWORD *)(v28 + 52) ^= ((*(_DWORD *)(v28 + 28) - *(_DWORD *)(v28 + 24) + 1) ^ *(_DWORD *)(v28 + 52)) & 0x7FFFFFFF;
*(_BYTE *)(v28 + 34) = v58 >> 31;
}
v59 = BugCheckParameter2;
*(_QWORD *)(v28 + 88) = MiComputeContiguousSubsectionPte((__int64)BugCheckParameter2, v54 + v81 - v53);
if( (*((_DWORD *)Process + 10) & 0x400000) != 0 || (CapturedViewSize[7] & 0x4000) != 0 )
{
P = MiAddSecureEntry(v28, v50, v60, 0x80000000, 0);
if( !P )
{
inserted = -1073741670;
LABEL_113:
CurrentThread = (_ETHREAD *)v72;
LABEL_114:
if( PlaceholderVadToReplace )
MiUnlockVad((__int64)CurrentThread, (__int64)PlaceholderVadToReplace);
LABEL_116:
UNLOCK_ADDRESS_SPACE((__int64)CurrentThread, v22);
if( v79 == 1 )
MiRemoveSharedCommitNode(ControlArea, v22, 0i64);
if( v73 )
{
v61 = MiLocateSubsectionNode(ControlArea, *((_QWORD *)Process + 4) + v97->QuadPart - 1, 0i64);
v62 = (ULONG_PTR)BugCheckParameter2;
MiDecrementLargeSubsections(BugCheckParameter2, (__int64)v61);
LABEL_122:
MiRemoveViewsFromSectionWithPfn(v62, v83, 8u);
goto LABEL_27;
}
LABEL_121:
v62 = (ULONG_PTR)BugCheckParameter2;
goto LABEL_122;
}
}
if( (*((_DWORD *)Process + 10) & 0x20000000) != 0 )
{
*(_DWORD *)(v28 + 48) = *(_DWORD *)(v28 + 48) & 0xFFFFFF8F | 0x50;
v50 = (UINT64)Address;
*(_DWORD *)(v28 + 64) |= 0x1000000u;
}
if( !*((_QWORD *)ControlArea + 8) )
{
inserted = MiInsertSharedCommitNode(ControlArea, v22, 0);
if( inserted < 0 )
goto LABEL_113;
v59 = BugCheckParameter2;
v79 = 1;
}
if( v88 && !(unsigned int)MiChargeSegmentCommit(v59, v89, (__int64)v88) )
{
inserted = -1073741523;
goto LABEL_113;
}
a4 = MiInsertVadCharges(v28, v22);
inserted = a4;
if( a4 < 0 )
goto LABEL_113;
if( !*((_QWORD *)ControlArea + 8) && *((int *)ControlArea + 14) < 0 )
{
*(_DWORD *)(v28 + 48) = *(_DWORD *)(v28 + 48) & 0xFFF3FFFF | 0x40000;
++*(_QWORD *)(v84 + 384);
}
if( PlaceholderVadToReplace )
{
MiPreparePlaceholderVadReplacement((__int64)PlaceholderVadToReplace, v22, v84);
ExAcquirePushLockExclusiveEx(v28 + 40, 0i64);
}
else
{
MiLockVad(v72, v28);
}
MiGetWsAndInsertVad(v28);
if( !*((_QWORD *)ControlArea + 8) && !*(_QWORD *)(v86 + 56) )
*(_QWORD *)(v86 + 56) = v50;
if( v90 )
MiAdvanceVadHint(StartingVpnb, EndingVpn, v90);
if( ((InheritDisposition - 4) & 0xFFFFFFFD) == 0 && *((_QWORD *)ControlArea + 8) )
{
_InterlockedIncrement((volatile signed __int32 *)ControlArea + 23);
v50 = (UINT64)Address;
}
inserted = 0;
a4 = 0;
v63 = InheritDisposition & 2;
if( ((InheritDisposition & 2) == 0 || !MiIsProcessCfgEnabled()) && !*((_QWORD *)Process + 10) )
{
if( PlaceholderVadToReplace )
{
v66 = (volatile INT64 *)Lock;
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)Lock, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(v66);
KeAbPostRelease((PVOID)v66);
UNLOCK_ADDRESS_SPACE_UNORDERED(v72, v22);
inserted = a4;
MiFinishPlaceholderVadReplacement(PlaceholderVadToReplace);
*v96 = Address;
}
else
{
MiUnlockVad(v72, v28);
UNLOCK_ADDRESS_SPACE(v72, v22);
*v96 = (PVOID)v50;
}
return inserted;
}
UNLOCK_ADDRESS_SPACE_UNORDERED(v72, v22);
MiReferenceVad(v28);
if( v63 )
{
if( MiIsProcessCfgEnabled() )
{
inserted = MiCommitVadCfgBits(v28, 0i64, (UINT8 *)CommitSize);
if( inserted < 0 )
{
LABEL_150:
MiUnmapVad(
(_MMVAD *)v28,
(__int64)PlaceholderVadToReplace,
0i64,
v64,
(__int64)v67,
(__int64)InternalFlags,
(__int64)HINTHonored,
(int)StartingAddress);
if( PlaceholderVadToReplace )
MiFinishPlaceholderVadReplacement(PlaceholderVadToReplace);
return inserted;
}
}
}
if( *((_QWORD *)Process + 10) )
{
v64 = *((unsigned int *)Process + 19);
if( (unsigned int)(v64 - 1) > 1 && (_DWORD)v64 != -2147483647 && (_DWORD)v64 != 4 )
{
v65 = -1073741755;
LABEL_149:
inserted = v65;
goto LABEL_150;
}
InternalFlags = &a6;
LODWORD(v67) = 0;
v65 = MiSecureVad((_MMVAD_SHORT *)v28, (PVOID)v50, *((_QWORD *)Process + 3), v64, v67);
if( v65 < 0 )
goto LABEL_149;
**((_QWORD **)Process + 10) = qword_140C4DB90 ^ a6 ^ v22;
}
if( PlaceholderVadToReplace )
{
MiUnlockAndDereferenceNestedVad((PVOID)v28);
MiFinishPlaceholderVadReplacement(PlaceholderVadToReplace);
}
else
{
MiUnlockAndDereferenceVad((PVOID)v28);
}
*v96 = (PVOID)v50;
return inserted;
}Referenced by:
MiMapViewOfSection