MiZeroFault
NTSTATUS __stdcall MiZeroFault(INT64 FaultStatus, BYTE *VirtualAddress, PVOID TrapInformation, MMPTE **WsIrql){
NTSTATUS v4;
INT64 v5;
_SUBSECTION *v6;
int v7;
__int64 v8;
bool v9;
__int64 v10;
unsigned __int64 v11;
ULONG_PTR v12;
_MMPTE *PteBase;
_MMPTE *PteLimit;
INT64 v15;
unsigned __int64 v16;
__int64 v17;
ULONG_PTR v18;
unsigned __int64 v19;
int v20;
_MMPTE *ProtoPteAddress;
unsigned int v22;
_QWORD *v23;
__int64 v24;
int v26;
char v27;
INT64 ***LockedVadEvent;
__int64 v29;
_SUBSECTION *ContainingSubsection[2];
UINT64 v31;
INT64 v32[2];
__int128 v33;
__int128 v34;
__int64 v35;
unsigned __int64 v36;
INT64 v37;
__int64 v38;
v4 = 0;
v32[0] = 0i64;
v33 = 0i64;
v5 = FaultStatus;
v34 = 0i64;
v6 = (_SUBSECTION *)*((_QWORD *)KeGetCurrentThread() + 23);
v7 = 0;
v8 = *(_QWORD *)(FaultStatus + 56);
v35 = 0i64;
v37 = 0i64;
*VirtualAddress = 1;
v9 = (*(_BYTE *)(v8 + 184) & 7) == 0;
ContainingSubsection[1] = v6;
LODWORD(v32[0]) = 0;
v38 = 0i64;
if( v9 )
{
v7 = 64;
LODWORD(v32[0]) = 64;
}
v10 = *(_QWORD *)(FaultStatus + 16);
v11 = v10 & 0xFFFFFFFFFFFFFFFEui64;
if( (v10 & 1) != 0 )
{
v27 = *(_BYTE *)v11;
if( *(_BYTE *)v11 == 2 )
{
v7 |= 1u;
}
else if( v27 == 1 )
{
v7 |= 2u;
}
else
{
if( v27 != 5 )
{
LABEL_67:
if( v27 == 4 )
goto LABEL_68;
goto LABEL_4;
}
v7 |= 8u;
}
LODWORD(v32[0]) = v7;
goto LABEL_67;
}
LABEL_4:
if( (v7 & 0xB) == 0 )
{
v11 = 0i64;
goto LABEL_6;
}
LABEL_68:
if( (v10 & 1) != 0 && *(_BYTE *)v11 == 4 )
v38 = *(_QWORD *)(v11 + 40);
if( (v7 & 2) != 0 && (*(_DWORD *)(v11 + 80) & 0x4000) != 0 )
{
v7 |= 4u;
LODWORD(v32[0]) = v7;
}
if( (v7 & 8) != 0 && *(_QWORD *)(*(_QWORD *)(v11 + 8) + 8i64) > 0x1000ui64 )
{
v7 |= 0x10u;
LODWORD(v32[0]) = v7;
}
LABEL_6:
v12 = *(_QWORD *)v5;
v36 = v11;
v32[1] = v5;
PteBase = MmGetPteBase();
PteLimit = MmGetPteLimit();
v31 = (UINT64)PteBase + ((v12 >> 9) & 0x7FFFFFFFF8i64);
if( v12 >= 0xFFFF800000000000ui64 )
{
if( (v7 & 2) != 0 )
return 0;
if( v12 >= (unsigned __int64)PteBase && v12 <= (unsigned __int64)PteLimit && v10 )
KeBugCheckEx(0x50u, v12, *(_QWORD *)(v5 + 8), (ULONG_PTR)PteBase + ((v12 >> 9) & 0x7FFFFFFFF8i64), 6ui64);
}
v15 = 0i64;
if( v12 > 0x7FFFFFFEFFFFi64 )
{
if( v12 >= (unsigned __int64)PteBase && v12 <= (unsigned __int64)PteLimit )
{
v22 = 4;
ProtoPteAddress = 0i64;
goto LABEL_29;
}
LABEL_38:
MiCheckFatalAccessViolation((PVOID)v12);
if( (v7 & 2) != 0 && v15 )
MiPrefetchJumpVad(v11, v15, v12);
return -1073741819;
}
if( (*(_DWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 2172i64) & 1) != 0 )
goto LABEL_11;
v16 = v12 & 0xFFFFFFFFFFFFF000ui64;
if( (v12 & 0xFFFFFFFFFFFFF000ui64) == 2147352576 )
{
ProtoPteAddress = (_MMPTE *)ProtoPte;
v22 = 1;
LOBYTE(v7) = v32[0];
goto LABEL_29;
}
if( v16 != qword_140C4DB88 || !v16 )
{
LABEL_11:
v17 = *((_QWORD *)KeGetCurrentThread() + 23);
v15 = *(_QWORD *)(v17 + 2016);
if( v15 )
{
v18 = v12 >> 12;
if( v12 >> 12 >= (*(unsigned int *)(v15 + 24) | ((unsigned __int64)*(unsigned __int8 *)(v15 + 32) << 32))
&& v18 <= (*(unsigned int *)(v15 + 28) | ((unsigned __int64)*(unsigned __int8 *)(v15 + 33) << 32)) )
{
LABEL_14:
ContainingSubsection[0] = 0i64;
if( (*(_DWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 2172i64) & 1) == 0 )
{
v19 = v12 & 0xFFFFFFFFFFFFF000ui64;
if( (v12 & 0xFFFFFFFFFFFFF000ui64) == 2147352576 )
{
ProtoPteAddress = (_MMPTE *)ProtoPte;
v22 = 1;
goto LABEL_28;
}
if( v19 == qword_140C4DB88 && v19 )
{
ProtoPteAddress = (_MMPTE *)qword_140C4DB80;
v22 = 1;
goto LABEL_28;
}
}
if( (*(_DWORD *)(v15 + 48) & 0x70) == 32 && (*(_DWORD *)(v15 + 64) & 0x10000000) != 0 )
{
LockedVadEvent = MiLocateLockedVadEvent(v15, 32i64);
if( LockedVadEvent )
{
if( LockedVadEvent[1] != (INT64 **)KeGetCurrentThread() )
goto LABEL_90;
}
}
v20 = *(_DWORD *)(v15 + 48);
if( (v20 & 4) != 0 )
{
v22 = 24;
ProtoPteAddress = 0i64;
goto LABEL_28;
}
if( (v20 & 0x100000) == 0 )
{
if( (*(_DWORD *)(v15 + 64) & 0x1000000) == 0 || (*(_BYTE *)(v15 + 48) & 0x70) == 80 )
{
ProtoPteAddress = MiGetProtoPteAddress((_MMVAD *)v15, v12 >> 12, 4ui64, ContainingSubsection);
if( ProtoPteAddress )
{
v22 = (*(_DWORD *)(v15 + 48) >> 7) & 0x1F;
if( (*(_DWORD *)(v15 + 48) & 0x70) == 32 && v22 == 7 )
v22 = 256;
}
else
{
v22 = 24;
}
v23 = *(_QWORD **)(v15 + 120);
if( (__int64)v23 < 0
&& v18 - (*(unsigned int *)(v15 + 24) | ((unsigned __int64)*(unsigned __int8 *)(v15 + 32) << 32)) > (unsigned __int64)(*v23 - 1i64) >> 12 )
{
v22 = 24;
}
v5 = FaultStatus;
}
else
{
v22 = 24;
ProtoPteAddress = 0i64;
}
LABEL_28:
LOBYTE(v7) = v32[0];
if( v22 != 24 )
goto LABEL_29;
goto LABEL_38;
}
if( (v26 = *(_DWORD *)(v15 + 48) & 0x70, v26 == 16)
|| v26 == 48
|| (v20 & 0x400000) != 0
|| (v20 & 0xC0000u) >= 0x80000
|| v26 == 32 && (*(_DWORD *)(v15 + 64) & 0x1000000) != 0
|| *(int *)(v15 + 52) >= 0 )
{
LABEL_90:
v22 = 24;
}
else
{
v22 = (*(_DWORD *)(v15 + 48) >> 7) & 0x1F;
}
ProtoPteAddress = 0i64;
goto LABEL_28;
}
v15 = *(_QWORD *)(v17 + 2008);
while( v15 )
{
if( v18 > (*(unsigned int *)(v15 + 28) | ((unsigned __int64)*(unsigned __int8 *)(v15 + 33) << 32)) )
{
v15 = *(_QWORD *)(v15 + 8);
}
else
{
if( v18 >= (*(unsigned int *)(v15 + 24) | ((unsigned __int64)*(unsigned __int8 *)(v15 + 32) << 32)) )
{
*(_QWORD *)(v17 + 2016) = v15;
goto LABEL_14;
}
v15 = *(_QWORD *)v15;
}
}
}
v15 = 0i64;
LOBYTE(v7) = v32[0];
goto LABEL_38;
}
ProtoPteAddress = (_MMPTE *)qword_140C4DB80;
v22 = 1;
LOBYTE(v7) = v32[0];
LABEL_29:
if( (v22 & 0xFFFFFFF8) == 16 )
{
if( (v7 & 2) == 0 )
{
if( (unsigned int)MiAllowGuardFault(*(PVOID *)(v5 + 16)) )
{
MiUpdatePageTableUseCount((PVOID)v12, 1ui64);
v29 = v22 & 0xF;
if( ProtoPteAddress )
v29 |= 0xFFFFFFFFF8000020ui64;
*(_QWORD *)v31 = MiSwizzleInvalidPte(32 * v29);
*VirtualAddress = 2;
return 0;
}
return -1073741819;
}
return 0;
}
v24 = *(_QWORD *)(v5 + 8) >> 57;
*(_QWORD *)&v33 = v12;
*(_QWORD *)&v34 = v22;
LODWORD(v35) = v24;
*((_QWORD *)&v33 + 1) = ProtoPteAddress;
v37 = v15;
if( !ProtoPteAddress )
return MiResolvePrivateZeroFault((INT64)v32);
if( (v7 & 2) == 0 )
{
if( v15 )
{
if( *(__int64 *)(v15 + 120) >= 0 )
{
v4 = MiCheckVadSequential((__int64)v32);
if( v4 == -1073741280 )
{
if( !_InterlockedIncrement((volatile signed __int32 *)(v15 + 36)) )
__fastfail(0xEu);
*(_DWORD *)(FaultStatus + 80) |= 1u;
*(_QWORD *)(FaultStatus + 88) = v15;
}
}
}
}
*VirtualAddress = 0;
*(_DWORD *)TrapInformation = v22;
*WsIrql = ProtoPteAddress;
MiResolveSharedZeroFault((INT64)v32);
return v4;
}Referenced by:
MiUserFault