MiQueryProcessActivePatches
INT64 __fastcall MiQueryProcessActivePatches(
VOID *Handle,
INT64 *a2,
_DWORD *a3,
INT64 a4,
INT64 a5,
KPROCESSOR_MODE AccessMode){
INT64 *v6;
_DWORD *v7;
unsigned int v8;
unsigned __int64 j;
unsigned __int64 k;
__int64 v11;
unsigned int v12;
_ETHREAD *Lock;
_QWORD *v14;
INT64 v15;
unsigned __int64 i;
unsigned __int64 v17;
_QWORD **v18;
_QWORD *v19;
PVOID *v20;
PVOID *v21;
__int64 v22;
NTSTATUS v23;
void *v24;
signed __int64 v25;
unsigned int v26;
bool v27;
_QWORD *ProcessHotPatchContext;
unsigned __int64 v29;
__int64 v30;
unsigned __int64 n;
_QWORD **v32;
unsigned __int64 v33;
_QWORD *v34;
unsigned __int64 v35;
int v36;
INT64 v37;
INT64 v38;
VOID *v39;
INT64 v40;
INT64 v41;
INT64 v42;
_QWORD **v43;
unsigned __int64 v44;
_QWORD *v45;
PVOID *m;
INT64 v47;
INT64 v48;
_DWORD *v49;
_QWORD **v50;
unsigned __int64 v51;
_QWORD *v52;
_ETHREAD *v53;
__int64 v54;
INT64 a8;
_ETHREAD *CurrentThread;
INT64 *v58;
_DWORD *v59;
INT64 a7;
INT64 a6;
INT64 v62;
PADAPTER_OBJECT DmaAdapter;
PVOID Object;
_QWORD *v65;
INT64 v66;
VOID *v67;
_KAPC_STATE ApcState;
v58 = a2;
v67 = Handle;
v6 = a2;
v66 = a4;
v59 = a3;
a8 = 0i64;
v7 = a3;
DmaAdapter = 0i64;
LOBYTE(v8) = 0;
v65 = 0i64;
j = 0i64;
k = 0i64;
v11 = 0i64;
v12 = 0;
memset(&ApcState, 0, sizeof(ApcState));
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
if( !Handle )
{
v8 = 8;
Lock = MmAcquireLoadLock();
v14 = (_QWORD *)MiSecureImageActivePatches;
v15 = 0i64;
CurrentThread = Lock;
while( v14 )
{
k = (unsigned __int64)v14;
v14 = (_QWORD *)*v14;
}
i = k;
while( i )
{
++v12;
v17 = i;
v11 += *(unsigned __int16 *)(i + 48) + 24i64;
v18 = *(_QWORD ***)(i + 8);
if( v18 )
{
v19 = *v18;
for( i = *(_QWORD *)(i + 8); v19; v19 = (_QWORD *)*v19 )
i = (unsigned __int64)v19;
}
else
{
while( 1 )
{
i = *(_QWORD *)(i + 16) & 0xFFFFFFFFFFFFFFFCui64;
if( !i || *(_QWORD *)i == v17 )
break;
v17 = i;
}
}
}
v20 = (PVOID *)PsLoadedModuleList;
v21 = &PsLoadedModuleList;
while( v20 != v21 )
{
if( MiIsActiveSystemHotPatch((INT64)v20) )
{
++v12;
v11 += *(unsigned __int16 *)(v22 + 72) + 24i64;
}
v20 = *(PVOID **)v22;
}
LABEL_40:
v35 = v11 + 40;
if( (unsigned int)a5 >= v35 )
{
v36 = v35;
LODWORD(v37) = MiAllocatePool((struct _SLIST_ENTRY *)0x100);
v25 = 0i64;
v38 = v37;
if( v37 )
{
v39 = v67;
*(_QWORD *)(v37 + 8) = v67;
*(_DWORD *)v37 = 2;
if( v12 )
{
v40 = v37 + 40;
v41 = v37 - v66;
v42 = v37 + 40 + 16i64 * v12;
a6 = v37 + 40;
v62 = v42;
*(_QWORD *)(v37 + 24) = v37 + 40;
*(_QWORD *)(v37 + 32) = v42;
a7 = v42 + 8i64 * v12;
if( v39 )
{
while( j )
{
if( *(_DWORD *)(j + 88) )
{
MiFillActivePatchesQueryBuffer(
v38,
v42,
v40,
v41,
(INT64)&v62,
(INT64)&a6,
(INT64)&a7,
j + 48,
(UNICODE_STRING *)(j + 64));
v25 = 0i64;
}
v50 = *(_QWORD ***)(j + 8);
v51 = j;
if( v50 )
{
v52 = *v50;
for( j = *(_QWORD *)(j + 8); v52; v52 = (_QWORD *)*v52 )
j = (unsigned __int64)v52;
}
else
{
while( 1 )
{
j = *(_QWORD *)(j + 16) & 0xFFFFFFFFFFFFFFFCui64;
if( !j || *(_QWORD *)j == v51 )
break;
v51 = j;
}
}
}
}
else
{
while( k )
{
a8 = *(_QWORD *)(k + 24);
MiFillActivePatchesQueryBuffer(
v38,
v42,
v40,
v41,
(INT64)&v62,
(INT64)&a6,
(INT64)&a7,
(INT64)&a8,
(UNICODE_STRING *)(k + 48));
v43 = *(_QWORD ***)(k + 8);
v25 = 0i64;
v44 = k;
if( v43 )
{
v45 = *v43;
for( k = *(_QWORD *)(k + 8); v45; v45 = (_QWORD *)*v45 )
k = (unsigned __int64)v45;
}
else
{
while( 1 )
{
k = *(_QWORD *)(k + 16) & 0xFFFFFFFFFFFFFFFCui64;
if( !k || *(_QWORD *)k == v44 )
break;
v44 = k;
}
}
}
for( m = (PVOID *)PsLoadedModuleList; m != &PsLoadedModuleList; m = (PVOID *)*m )
{
if( MiIsActiveSystemHotPatch((INT64)m) )
{
v49 = m[35];
LODWORD(a8) = v49[30];
HIDWORD(a8) = v49[39];
MiFillActivePatchesQueryBuffer(
v38,
v47,
v48,
v41,
(INT64)&v62,
(INT64)&a6,
(INT64)&a7,
(INT64)&a8,
(UNICODE_STRING *)(m + 9));
v25 = 0i64;
}
}
}
*(_QWORD *)(v38 + 32) -= v41;
*(_QWORD *)(v38 + 24) -= v41;
}
*v58 = v38;
v26 = v25;
*v59 = v36;
}
else
{
v26 = -1073741670;
}
}
else
{
v25 = 0i64;
if( v35 <= 0xFFFFFFFF )
{
*v6 = v15;
v26 = v15;
*v7 = v35;
}
else
{
v26 = -1073741675;
}
}
goto LABEL_75;
}
Object = 0i64;
v23 = ObReferenceObjectByHandle(Handle, 0x1000u, (POBJECT_TYPE)PsProcessType, AccessMode, &Object, 0i64);
v24 = Object;
v25 = 0i64;
DmaAdapter = (PADAPTER_OBJECT)Object;
v26 = v23;
if( v23 < 0 )
{
v53 = CurrentThread;
goto LABEL_79;
}
v27 = ExAcquireRundownProtection((PEX_RUNDOWN_REF)Object + 139);
v8 = 2 * v27;
if( v27 )
{
KiStackAttachProcess((_KPROCESS *)v24, 0i64, &ApcState);
v8 |= 4u;
ProcessHotPatchContext = MiGetProcessHotPatchContext((INT64)v24, 0i64);
v15 = 0i64;
v65 = ProcessHotPatchContext;
v29 = (unsigned __int64)ProcessHotPatchContext;
if( ProcessHotPatchContext )
{
v8 |= 1u;
--*((_WORD *)CurrentThread + 243);
ExAcquirePushLockSharedEx((UINT64)(ProcessHotPatchContext + 2), 0i64);
v30 = *(_QWORD *)(v29 + 8);
if( (v30 & 1) != 0 )
{
if( v30 != 1 )
j = v30 ^ (v29 | 1);
}
else
{
j = *(_QWORD *)(v29 + 8);
}
v15 = 0i64;
n = j;
while( n )
{
if( *(_DWORD *)(n + 88) )
{
++v12;
v11 += *(unsigned __int16 *)(n + 64) + 24i64;
}
v32 = *(_QWORD ***)(n + 8);
v33 = n;
if( v32 )
{
v34 = *v32;
for( n = *(_QWORD *)(n + 8); v34; v34 = (_QWORD *)*v34 )
n = (unsigned __int64)v34;
}
else
{
while( 1 )
{
n = *(_QWORD *)(n + 16) & 0xFFFFFFFFFFFFFFFCui64;
if( !n || *(_QWORD *)n == v33 )
break;
v33 = n;
}
}
}
}
v6 = v58;
v7 = v59;
goto LABEL_40;
}
v26 = -1073741558;
v25 = 0i64;
LABEL_75:
v53 = CurrentThread;
if( v8 < 8 )
{
v24 = DmaAdapter;
}
else
{
MmReleaseLoadLock(CurrentThread);
v24 = DmaAdapter;
v25 = 0i64;
}
LABEL_79:
if( (v8 & 1) != 0 )
{
v54 = (__int64)v65;
if( _InterlockedCompareExchange64(v65 + 2, v25, 17i64) != 17 )
ExfReleasePushLockShared((INT64 *)(v54 + 16));
KeAbPostRelease((PVOID)(v54 + 16));
KiLeaveGuardedRegionUnsafe((__int64)v53);
}
if( (v8 & 4) != 0 )
KiUnstackDetachProcess(&ApcState, 0i64);
if( (v8 & 2) != 0 )
ExReleaseRundownProtection((PEX_RUNDOWN_REF)v24 + 139);
if( v24 )
HalPutDmaAdapter((PADAPTER_OBJECT)v24);
return v26;
}Referenced by:
NtManageHotPatch