MiGetSystemAddressForImage
UINT64 __fastcall MiGetSystemAddressForImage(_SECTION *SectionPoINTer, UINT64 LoadFlags, UINT *SharePages){
char v4;
_CONTROL_AREA *v6;
unsigned __int64 v7;
unsigned __int64 v8;
void *v9;
int v10;
PVOID *v11;
PVOID *v12;
_SECTION *v13;
int v14;
int v15;
unsigned int v17;
void *v18;
_DWORD *v19;
IMAGE_NT_HEADERS *v20;
int LoaderFlags;
unsigned int NumberOfRvaAndSizes;
unsigned int v23;
int SizeOfHeapReserve;
unsigned int SizeOfHeapReserve_high;
int v26;
int v27;
unsigned int v28;
int v29;
MMPTE *PteAddress;
NTSTATUS v31;
int v32;
int v33;
_CONTROL_AREA *v34;
PVOID BaseAddress[10];
INT64 result;
unsigned int FileAlignment;
unsigned int SectionAlignment;
unsigned int SizeOfImage;
int v40;
unsigned int SizeOfHeaders;
unsigned int AddressOfEntryPoint;
unsigned __int64 SizeOfStackReserve_low;
unsigned __int64 SizeOfStackReserve_high;
unsigned __int16 Magic;
unsigned __int16 Subsystem;
unsigned __int16 MajorSubsystemVersion;
unsigned __int16 MinorSubsystemVersion;
unsigned __int16 MajorOperatingSystemVersion;
unsigned __int16 MinorOperatingSystemVersion;
unsigned __int16 DllCharacteristics;
unsigned int CheckSum;
unsigned int SizeOfCode;
unsigned int VirtualAddress;
unsigned int Size;
_IMAGE_DATA_DIRECTORY v56;
_IMAGE_DATA_DIRECTORY v57;
__int64 v58;
_IMAGE_DATA_DIRECTORY v59;
v4 = LoadFlags;
v33 = LoadFlags;
v27 = 0;
memset((INT64)&result, 0i64);
memset((INT64)BaseAddress, 0i64);
*SharePages = 1;
v6 = MiSectionControlArea(SectionPoINTer);
v34 = v6;
LOBYTE(v7) = MiBytesToMapSystemImage((_FAST_MUTEX *)(unsigned int)(*(_DWORD *)(*(_QWORD *)v6 + 8i64) << 12));
if( !v7 )
return 0i64;
v8 = v7 >> 12;
v32 = v7 >> 12;
v9 = (void *)MiImageSuitableForSystem((__int64)v6, &v27);
if( v9 )
{
v11 = (PVOID *)PsLoadedModuleList;
v12 = &PsLoadedModuleList;
while( v11 != v12 )
{
v13 = (_SECTION *)v11[14];
if( v13 && v6 == MiSectionControlArea(v13) )
{
*SharePages = 0;
v10 = 1;
break;
}
v11 = (PVOID *)*v11;
}
}
if( v9 )
{
if( v10 != 1 && (v4 & 2) == 0 )
{
v14 = v4 & 1;
if( ((v4 & 1) == 0 || (unsigned int)MiGetSystemRegionType((UINT64)v9) == 1)
&& ((v4 & 1) != 0 || (unsigned int)MiGetSystemRegionType((UINT64)v9) != 1) )
{
PteAddress = MiGetPteAddress(v9);
if( MiReservePrivilegedPtes((INT64)v6) >= 0 )
{
v15 = 0;
goto LABEL_17;
}
return 0i64;
}
}
}
v14 = v4 & 1;
LODWORD(PteAddress) = v14;
v29 = v14 + 1;
if( v27 )
{
v17 = (v4 & 1) + 1;
goto LABEL_21;
}
v31 = MiMapImageInSystemSpace((__int64)v6, 3, (__int64)BaseAddress);
if( v31 < 0 )
return 0i64;
v19 = BaseAddress[0];
v20 = RtlImageNtHeader(BaseAddress[0]);
v28 = v19[15] + 48;
if( v20->OptionalHeader.Magic != 523 )
{
Magic = v20->OptionalHeader.Magic;
FileAlignment = v20->OptionalHeader.FileAlignment;
SectionAlignment = v20->OptionalHeader.SectionAlignment;
SizeOfImage = v20->OptionalHeader.SizeOfImage;
SizeOfHeapReserve = v20->OptionalHeader.SizeOfHeapReserve;
v40 = SizeOfHeapReserve;
result = HIDWORD(v20->OptionalHeader.ImageBase);
SizeOfHeaders = v20->OptionalHeader.SizeOfHeaders;
AddressOfEntryPoint = v20->OptionalHeader.AddressOfEntryPoint;
SizeOfStackReserve_low = LODWORD(v20->OptionalHeader.SizeOfStackReserve);
SizeOfStackReserve_high = HIDWORD(v20->OptionalHeader.SizeOfStackReserve);
Subsystem = v20->OptionalHeader.Subsystem;
MajorSubsystemVersion = v20->OptionalHeader.MajorSubsystemVersion;
MinorSubsystemVersion = v20->OptionalHeader.MinorSubsystemVersion;
MajorOperatingSystemVersion = v20->OptionalHeader.MajorOperatingSystemVersion;
MinorOperatingSystemVersion = v20->OptionalHeader.MinorOperatingSystemVersion;
DllCharacteristics = v20->OptionalHeader.DllCharacteristics;
CheckSum = v20->OptionalHeader.CheckSum;
SizeOfCode = v20->OptionalHeader.SizeOfCode;
v59 = 0i64;
SizeOfHeapReserve_high = HIDWORD(v20->OptionalHeader.SizeOfHeapReserve);
if( SizeOfHeapReserve_high > 6 && v20->OptionalHeader.DataDirectory[4].VirtualAddress )
{
v59 = v20->OptionalHeader.DataDirectory[4];
SizeOfHeapReserve_high = HIDWORD(v20->OptionalHeader.SizeOfHeapReserve);
}
if( SizeOfHeapReserve_high > 0xC )
{
VirtualAddress = v20->OptionalHeader.DataDirectory[10].VirtualAddress;
Size = v20->OptionalHeader.DataDirectory[10].Size;
SizeOfHeapReserve_high = HIDWORD(v20->OptionalHeader.SizeOfHeapReserve);
}
if( SizeOfHeapReserve_high <= 0xE )
{
v56 = 0i64;
}
else
{
v56 = v20->OptionalHeader.DataDirectory[12];
if( v20->OptionalHeader.DataDirectory[12].VirtualAddress && v20->OptionalHeader.DataDirectory[12].Size )
v40 = SizeOfHeapReserve | 1;
}
if( HIDWORD(v20->OptionalHeader.SizeOfHeapReserve) <= 5 )
v57 = 0i64;
else
v57 = v20->OptionalHeader.DataDirectory[3];
if( HIDWORD(v20->OptionalHeader.SizeOfHeapReserve) > 0xA )
{
LODWORD(v58) = v20->OptionalHeader.DataDirectory[8].VirtualAddress;
v23 = v20->OptionalHeader.DataDirectory[8].Size;
goto LABEL_62;
}
LABEL_63:
v58 = 0i64;
goto LABEL_64;
}
Magic = 523;
FileAlignment = v20->OptionalHeader.FileAlignment;
SectionAlignment = v20->OptionalHeader.SectionAlignment;
SizeOfImage = v20->OptionalHeader.SizeOfImage;
LoaderFlags = v20->OptionalHeader.LoaderFlags;
v40 = LoaderFlags;
result = v20->OptionalHeader.ImageBase;
SizeOfHeaders = v20->OptionalHeader.SizeOfHeaders;
AddressOfEntryPoint = v20->OptionalHeader.AddressOfEntryPoint;
SizeOfStackReserve_low = v20->OptionalHeader.SizeOfStackReserve;
SizeOfStackReserve_high = v20->OptionalHeader.SizeOfStackCommit;
Subsystem = v20->OptionalHeader.Subsystem;
MajorSubsystemVersion = v20->OptionalHeader.MajorSubsystemVersion;
MinorSubsystemVersion = v20->OptionalHeader.MinorSubsystemVersion;
MajorOperatingSystemVersion = v20->OptionalHeader.MajorOperatingSystemVersion;
MinorOperatingSystemVersion = v20->OptionalHeader.MinorOperatingSystemVersion;
DllCharacteristics = v20->OptionalHeader.DllCharacteristics;
CheckSum = v20->OptionalHeader.CheckSum;
SizeOfCode = v20->OptionalHeader.SizeOfCode;
v59 = 0i64;
NumberOfRvaAndSizes = v20->OptionalHeader.NumberOfRvaAndSizes;
if( NumberOfRvaAndSizes > 6 && v20->OptionalHeader.DataDirectory[6].VirtualAddress )
{
v59 = v20->OptionalHeader.DataDirectory[6];
NumberOfRvaAndSizes = v20->OptionalHeader.NumberOfRvaAndSizes;
}
if( NumberOfRvaAndSizes > 0xC )
{
VirtualAddress = v20->OptionalHeader.DataDirectory[12].VirtualAddress;
Size = v20->OptionalHeader.DataDirectory[12].Size;
NumberOfRvaAndSizes = v20->OptionalHeader.NumberOfRvaAndSizes;
}
if( NumberOfRvaAndSizes <= 0xE )
{
v56 = 0i64;
}
else
{
v56 = v20->OptionalHeader.DataDirectory[14];
if( v20->OptionalHeader.DataDirectory[14].VirtualAddress && v20->OptionalHeader.DataDirectory[14].Size )
v40 = LoaderFlags | 1;
}
if( v20->OptionalHeader.NumberOfRvaAndSizes <= 5 )
v57 = 0i64;
else
v57 = v20->OptionalHeader.DataDirectory[5];
if( v20->OptionalHeader.NumberOfRvaAndSizes <= 0xA )
goto LABEL_63;
LODWORD(v58) = v20->OptionalHeader.DataDirectory[10].VirtualAddress;
v23 = v20->OptionalHeader.DataDirectory[10].Size;
LABEL_62:
HIDWORD(v58) = v23;
LABEL_64:
v26 = v31;
MiUnmapImageInSystemSpace((INT64)BaseAddress);
if( v26 < 0 )
return 0i64;
v17 = v29;
if( (int)MiRelocateImage(*(_QWORD *)v6, (__int64)&result, v28, v29, -1i64, 1) < 0 )
return 0i64;
MiImageSuitableForSystem((__int64)v6, &v27);
if( !v27 && (*((_DWORD *)v6 + 14) & 0x40000000) == 0 )
return 0i64;
LABEL_21:
v18 = (void *)MiSelectSystemImageAddress(v17, (unsigned int)v8);
v9 = v18;
if( v18 )
{
PteAddress = MiGetPteAddress(v18);
if( MiReservePrivilegedPtes((INT64)v6) < 0 )
{
LABEL_70:
MiReturnSystemImageAddress(v9, (unsigned int)((_DWORD)v8 << 12));
return 0i64;
}
v15 = 1;
if( !(unsigned int)MiAddPrivateFixupEntryForSystemImage((__int64)v6, (unsigned __int64)v9) )
{
LABEL_69:
MiReleasePrivilegedPtes();
goto LABEL_70;
}
LABEL_17:
if( !v14 || (int)MiSessionInsertImage((unsigned __int64)v9, (__int64)v6) >= 0 )
return(UINT64)v9;
if( v15 == 1 )
MiFreePrivateFixupEntryForSystemImage(v9, 1ui64);
goto LABEL_69;
}
return 0i64;
}Referenced by:
MiApplyHotPatchToLoadedDriver
MmLoadSystemImageEx