MiSwitchToTransition
INT64 __fastcall MiSwitchToTransition(MDL *MemoryDescriptorList, INT64 a2, INT64 a3){
MDL *v4;
CHAR v5;
INT64 v6;
char v7;
unsigned __int64 v8;
unsigned __int8 v9;
__int64 v10;
unsigned int v11;
char *v12;
INT64 v13;
unsigned int v14;
unsigned int v15;
signed __int32 v16;
UINT64 Page;
UINT64 v18;
UINT64 v19;
INT64 v20;
unsigned int v21;
__int64 v22;
char *v23;
UINT8 v24;
CHAR v25;
int v26;
ULONG_PTR v27;
unsigned __int64 v28;
_MMPFN *PfnDb;
ULONG_PTR BugCheckParameter4;
__int64 v31;
unsigned __int16 v32;
INT64 v33;
__int64 v34;
unsigned int v35;
__int64 v36;
unsigned __int8 v37;
__int64 v38;
_ETHREAD *v39;
PSLIST_ENTRY v40;
PSLIST_ENTRY v41;
char v42;
UINT64 v43;
_MMPFN *v44;
UINT64 *v45;
__int64 v46;
_MMPFN *v47;
unsigned int v48;
__int64 v49;
unsigned __int8 v51;
UINT8 v52;
UINT64 BlinkValue;
volatile signed __int64 *BlinkValuea;
unsigned int v55;
int v56;
_MI_PARTITION *Partition;
unsigned int v59;
INT64 v60;
char v61;
INT64 TransitionPte;
UINT64 v63;
UINT64 ContainingPageTable;
PSLIST_ENTRY ReadyInPageBlock;
UINT64 a1;
unsigned __int64 v67;
unsigned __int64 StartVa;
INT64 v69[2];
_ETHREAD *CurrentThread;
unsigned __int64 v71;
__int64 v72;
int result;
__int16 result_4;
int v75;
__int64 v76;
__int64 v77;
v55 = a3;
v4 = MemoryDescriptorList;
*(_OWORD *)v69 = 0i64;
memset((INT64)&result, 0i64);
v63 = 0i64;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v72 = *((_QWORD *)CurrentThread + 23);
MiGetEffectivePagePriorityThread(CurrentThread, v5, v6);
v61 = v7;
ReadyInPageBlock = MiGetReadyInPageBlock(a2);
StartVa = (unsigned __int64)v4->StartVa;
v8 = (unsigned __int64)MmGetPteBase() + ((StartVa >> 9) & 0x7FFFFFFFF8i64);
v60 = v72 + 1664;
v56 = 0;
v9 = 0;
MiInitializePageColorBase(v72 + 1664, 0i64, (INT64)v69);
BlinkValue = 0xFFFFFFFFFi64;
v12 = 0i64;
v13 = 0i64;
Partition = *(_MI_PARTITION **)(qword_140C4E388 + 8i64 * *(unsigned __int16 *)(v10 + 174));
v14 = MiObtainFaultCharges(Partition, v11, 2ui64);
v59 = v14;
v15 = 0;
if( !v14 )
goto LABEL_14;
while( 1 )
{
v16 = _InterlockedExchangeAdd((volatile signed __int32 *)v69[0], 1u);
Page = MiGetPage(Partition, v69[1] & v16 | HIDWORD(v69[1]), 0i64);
v19 = Page;
if( Page != -1i64 )
{
v12 = (char *)MmGetPfnDb() + 48 * Page;
if( (unsigned int)MiPageAttributeBatchChangeNeeded((INT64)v12, v55) == 1 )
{
*((_QWORD *)v12 + 2) = v13;
v13 = (INT64)v12;
}
MiSetPfnBlink((_MMPFN *)v12, BlinkValue, 0i64);
BlinkValue = v19;
++v15;
goto LABEL_8;
}
if( v15 )
break;
MiWaitForFreePage(Partition, v18);
LABEL_8:
if( v15 == v14 )
goto LABEL_11;
}
MiReturnFaultCharges(Partition, v14 - v15, 0i64);
v14 = v15;
v59 = v15;
LABEL_11:
if( v13 )
{
MiSetOriginalPtePfnFromFreeList(&v63);
MiChangePageAttributeBatch(v13, (_BYTE *)v55, v63);
}
v4 = MemoryDescriptorList;
LABEL_14:
v20 = v60;
v21 = 0;
ContainingPageTable = -1i64;
v22 = v14;
v23 = 0i64;
v67 = v8 + 8 * v22;
v24 = MiLockWorkingSetShared(v60);
v52 = v24;
if( v8 >= v67 )
goto LABEL_49;
v71 = (char *)v4 - ((StartVa >> 9) & 0x7FFFFFFFF8i64) - (char *)MmGetPteBase();
while( 2 )
{
if( v23 )
{
if( (v8 & 0xFFF) == 0 )
{
MiUnlockPageTableInternal(v20, (UINT64)v23);
goto LABEL_19;
}
}
else
{
LABEL_19:
v23 = (char *)MmGetPteBase() + ((v8 >> 9) & 0x7FFFFFFFF8i64);
MiLockPageTableInternal(v20, (UINT64)v23, 0i64);
ContainingPageTable = MiGetContainingPageTable(v8);
}
MiIsProbeActive((_MMPTE *)v8, 1ui64, 3i64, v25);
if( v26 )
goto LABEL_46;
TransitionPte = MI_READ_PTE_LOCK_FREE(v8);
v27 = TransitionPte;
if( (TransitionPte & 1) == 0 )
KeBugCheckEx(0x1Au, 0x41200ui64, v8, TransitionPte, (ULONG_PTR)MemoryDescriptorList);
v28 = MI_READ_PTE_LOCK_FREE((INT64)&TransitionPte);
PfnDb = MmGetPfnDb();
BugCheckParameter4 = (ULONG_PTR)PfnDb + 48 * ((v28 >> 12) & 0xFFFFFFFFFi64);
if( (*((_QWORD *)PfnDb + 6 * ((v28 >> 12) & 0xFFFFFFFFFi64) + 5) & 0x4000000000000i64) == 0 )
{
LABEL_30:
v33 = (INT64)v12;
BlinkValuea = (volatile signed __int64 *)(v12 + 24);
v34 = *((_QWORD *)v12 + 3) & 0xFFFFFFFFFi64;
if( v34 == 0xFFFFFFFFFi64 )
v12 = 0i64;
else
v12 = (char *)PfnDb + 48 * v34;
a1 = (v33 - (__int64)PfnDb) / 48;
v35 = (v27 & 0x800) != 0 ? 4 : 1;
if( v55 == 2 )
{
v35 |= 0x18u;
}
else if( !v55 )
{
v35 |= 8u;
}
TransitionPte = MiSwizzleInvalidPte(32i64 * v35);
*(_QWORD *)(v33 + 16) = TransitionPte;
if( (v9 & v37) == 0 )
{
v38 = (__int64)ReadyInPageBlock;
v39 = CurrentThread;
LODWORD(ReadyInPageBlock[12].Next) |= 0x20u;
*(_DWORD *)(v38 + 80) = 0;
*(_QWORD *)(v38 + 88) = 0i64;
v9 |= v37;
*(_QWORD *)(v38 + 248) = v33;
*(_QWORD *)(v38 + 152) = v39;
}
*(_QWORD *)(v33 + 40) ^= v36 & (ContainingPageTable ^ *(_QWORD *)(v33 + 40));
v51 = MiLockPageInline(v33);
v40 = ReadyInPageBlock;
*(_BYTE *)(v33 + 34) |= 0x20u;
if( v40 )
v41 = v40 + 2;
else
v41 = 0i64;
*(_QWORD *)v33 = v41;
*BlinkValuea &= 0xC000000000000000ui64;
MiAddLockedPageCharge(v33, 1);
v42 = *(_BYTE *)(v33 + 34) & 0xFA;
*(_QWORD *)(v33 + 8) = v8;
*(_BYTE *)(v33 + 34) = v42 | 2;
*(_BYTE *)(v33 + 35) ^= (v61 ^ *(_BYTE *)(v33 + 35)) & 7;
if( ((*(_QWORD *)(v33 + 40) >> 39) & 0x3FF) != 0 )
ExAcquireRundownProtectionCacheAware(*((_QWORD *)Partition + 268), 2ui64);
_InterlockedAnd64(BlinkValuea, 0x7FFFFFFFFFFFFFFFui64);
__writecr8(v51);
MiReturnFaultCharges(Partition, 1ui64, 0i64);
TransitionPte = MiMakeTransitionPte(a1, v35, v43);
*(_QWORD *)v8 = TransitionPte;
++v21;
v20 = v60;
*(_QWORD *)(v71 + v8 + 48) = a1;
v8 += 8i64;
if( v8 >= v67 )
goto LABEL_46;
continue;
}
break;
}
if( (*(_QWORD *)(BugCheckParameter4 + 8) | 0x8000000000000000ui64) == v8 )
KeBugCheckEx(0x1Au, 0x41300ui64, v8, v27, BugCheckParameter4);
v31 = *(_QWORD *)(BugCheckParameter4 + 40);
v32 = 1;
if( (v31 & 0x1000000000i64) != 0 || (v31 & 0xFFFFFFFFFi64) == 0xFFFFFFFFDi64 )
v32 = 2;
if( *(_WORD *)(BugCheckParameter4 + 32) < v32 )
KeBugCheckEx(0x1Au, 0x41301ui64, v8, v27, BugCheckParameter4);
if( *(_WORD *)(BugCheckParameter4 + 32) <= v32 )
{
PfnDb = MmGetPfnDb();
goto LABEL_30;
}
v20 = v60;
v56 = 1;
LABEL_46:
if( v23 )
MiUnlockPageTableInternal(v20, (UINT64)v23);
v24 = v52;
v4 = MemoryDescriptorList;
LABEL_49:
MiUnlockWorkingSetShared(v20, v24);
if( v12 )
{
v44 = MmGetPfnDb();
do
{
v45 = (UINT64 *)v12;
v46 = *((_QWORD *)v12 + 3) & 0xFFFFFFFFFi64;
if( v46 == 0xFFFFFFFFFi64 )
v12 = 0i64;
else
v12 = (char *)v44 + 48 * v46;
MiSetOriginalPtePfnFromFreeList(v45 + 2);
MiReleaseFreshPage(v47);
}
while( v12 );
v4 = MemoryDescriptorList;
}
if( v21 == v59 )
{
v48 = v56;
}
else
{
MiReturnFaultCharges(Partition, v59 - v21, 0i64);
v48 = v56;
if( !v21 )
v48 = 1;
}
v4->ByteCount = v21 << 12;
if( v21 )
{
v49 = v72;
_InterlockedExchangeAdd64((volatile signed __int64 *)(v72 + 1272), v21);
result_4 = 0;
v76 = 0i64;
v77 = 0i64;
result = 1;
v75 = 20;
MiInsertTbFlushEntry((INT64)&result, StartVa & 0xFFFFFFFFFFFFF000ui64, v21, 0i64);
MiFlushTbList((__int64)&result);
v4->Process = (_EPROCESS *)v49;
v4->MdlFlags |= 2u;
_InterlockedExchangeAdd64((volatile signed __int64 *)(v49 + 1280), v21);
if( (MmTrackLockedPages & 1) != 0 )
MiAddMdlTracker(v4, v21, 4ui64);
}
return v48;
}Referenced by:
MmRotatePhysicalView