MiAddPhysicalPagesToCrashDump
UINT8 *__fastcall MiAddPhysicalPagesToCrashDump(void (__fastcall **a1)(_QWORD, __int64, __int64, __int64)){
UINT8 *result;
int v2;
unsigned __int64 v4;
__int64 v5;
char *v6;
__int64 PagesRemainingInResidentPage;
unsigned __int64 v8;
bool v9;
char v10;
INT64 v11;
INT64 v12;
result = MmPhysicalMemoryBlock;
v2 = 0;
if( *(_DWORD *)MmPhysicalMemoryBlock )
{
while( 1 )
{
v4 = 0i64;
v5 = *(_QWORD *)&result[16 * v2 + 16];
if( *(_QWORD *)&result[16 * v2 + 24] )
break;
LABEL_17:
if( (unsigned int)++v2 >= *(_DWORD *)result )
return result;
}
while( 1 )
{
v6 = (char *)MmGetPfnDb() + 48 * v5;
PagesRemainingInResidentPage = 1i64;
v8 = *((_QWORD *)v6 + 5);
if( (v8 & 0x1000000000i64) != 0 )
break;
if( (v6[34] & 0xC0) == 64 )
{
v10 = v6[34] & 7;
if( v10 == 6 )
{
if( ((v8 >> 60) & 7) == 1
|| (*((_QWORD *)v6 + 3) & 0x3FFFFFFFFFFFFFFFi64) != 0 && (v8 & 0xFFFFFFFFFi64) == 0xFFFFFFFFDi64 )
{
goto LABEL_16;
}
LABEL_15:
(*a1)(a1, v5, PagesRemainingInResidentPage, 2i64);
goto LABEL_16;
}
if( (unsigned __int8)(v10 - 2) <= 1u )
{
v9 = (*((_DWORD *)v6 + 4) & 0x400i64) == 0;
LABEL_14:
if( v9 )
goto LABEL_15;
}
}
LABEL_16:
result = MmPhysicalMemoryBlock;
v4 += PagesRemainingInResidentPage;
v5 += PagesRemainingInResidentPage;
if( v4 >= *(_QWORD *)&MmPhysicalMemoryBlock[16 * v2 + 24] )
goto LABEL_17;
}
LODWORD(v11) = 0;
LODWORD(v12) = 0;
PagesRemainingInResidentPage = MiGetPagesRemainingInResidentPage((INT64)v6, &v11, &v12);
if( (_DWORD)v11 != 6 )
goto LABEL_16;
v9 = (_DWORD)v12 == 1;
goto LABEL_14;
}
return result;
}Referenced by:
MmGetDumpRange