MiInsertInSystemSpace
INT64 __fastcall MiInsertInSystemSpace(INT64 a1, UINT64 a2, INT64 r8_0, UINT64 *a4, CHAR a5, INT64 a6, UINT64 *a7){
int v9;
unsigned int v10;
__int64 v11;
_MMPTE *v12;
UINT64 v13;
unsigned int v14;
_MI_SYSTEM_PTE_TYPE *v15;
_MI_PARTITION *v16;
UINT64 v17;
unsigned int v18;
int v19;
int v20;
__int64 v21;
UINT64 v22;
int v23;
unsigned int v24;
INT64 v25;
__int64 v26;
_CONTROL_AREA *v27;
_CONTROL_AREA *v28;
int v29;
int v30;
int v31;
UINT64 v32;
_SUBSECTION *v33;
unsigned __int64 v34;
int v35;
_ETHREAD *CurrentThread;
INT64 v37;
INT64 *SharedVm;
KIRQL v39;
bool v40;
UINT8 v41;
_QWORD *v42;
unsigned __int64 v43;
_QWORD *v44;
UINT64 v45;
_ETHREAD *v46;
ULONG_PTR v47;
char v48;
int v49;
bool v50;
__int64 v51;
unsigned __int64 v52;
__int64 v53;
VOID *v54;
UINT64 v55;
unsigned int v56;
__int64 v57;
NTSTATUS v58;
UINT64 PageTablesForLargeMap;
int v61;
int v62;
NTSTATUS active;
__int64 *v64;
__int64 *v65;
KIRQL v66;
bool v67;
_QWORD *v68;
unsigned __int64 v69;
unsigned __int64 v70;
_QWORD *v71;
__int64 v72;
UINT64 v73;
UINT64 v74;
unsigned __int64 *v75;
unsigned __int64 *v76;
CHAR *v77;
unsigned __int64 v78;
ULONG_PTR BugCheckParameter4;
INT64 v80;
unsigned int a3;
int a3_4;
_MI_PARTITION *Partition;
UINT64 v84;
INT64 v85;
UINT64 v86;
_CONTROL_AREA *ControlArea;
VOID *BaseAddress;
_SUBSECTION *v89;
int v90;
int v91;
UINT64 SessionId;
INT64 AnyMultiplexedVm;
INT64 v94;
UINT64 PteOffset[2];
INT64 result[25];
char v98;
PteOffset[0] = 0i64;
memset((INT64)result, 0i64);
v9 = 3;
BaseAddress = 0i64;
v10 = 0x7FFFF;
v86 = 0i64;
a3_4 = 0x7FFFF;
*a7 = 0i64;
v11 = 0i64;
v12 = 0i64;
v98 = 0;
v84 = 0i64;
v13 = 0i64;
Partition = 0i64;
v85 = (INT64)&PteInfo;
a3 = 3;
ControlArea = MiSectionControlArea((_SECTION *)r8_0);
v18 = (a2 >> 16) + ((_WORD)a2 != 0);
if( v18 >= 0x10000 )
{
v23 = -1073741793;
v32 = 0i64;
LABEL_91:
v61 = 0;
goto LABEL_92;
}
v89 = MiOffsetToProtos(ControlArea, *a4, PteOffset);
if( !v89 )
{
v23 = -1073741801;
v15 = &PteInfo;
v32 = 0i64;
v16 = 0i64;
LABEL_90:
v17 = v84;
v14 = a3;
goto LABEL_91;
}
if( (_MMSESSION *)a1 == &Session )
{
AnyMultiplexedVm = (INT64)MiGetAnyMultiplexedVm(1i64);
v19 = 0;
v94 = 0i64;
LODWORD(SessionId) = -1;
v20 = 640;
if( (a6 & 8) == 0 )
v20 = 128;
LOBYTE(v19) = (a6 & 8) != 0;
v9 = v19 + 3;
}
else
{
v20 = 256;
AnyMultiplexedVm = MiGetSessionVm();
v9 = 2;
v94 = AnyMultiplexedVm - 256;
v85 = AnyMultiplexedVm - 256 + 880;
LODWORD(SessionId) = MmGetSessionIdEx(*((_QWORD *)KeGetCurrentThread() + 23));
}
v13 = (a2 >> 12) + ((a2 & 0xFFF) != 0);
v21 = *(unsigned __int16 *)(AnyMultiplexedVm + 174);
v22 = 16 * v18;
v84 = v22;
Partition = *(_MI_PARTITION **)(qword_140C4E388 + 8 * v21);
if( (*((_DWORD *)ControlArea + 14) & 0x420) != 0 )
{
v24 = a3;
goto LABEL_10;
}
v23 = MiReferenceDataSubsections((__int64)ControlArea, a4, v13, v9 != 2, &a3);
if( v23 < 0 )
{
LABEL_81:
v32 = 0i64;
goto LABEL_88;
}
v24 = a3;
v98 = 1;
if( a3 < 3 )
{
PageTablesForLargeMap = MiGetPageTablesForLargeMap(v22, 9ui64, a3, 0i64);
BaseAddress = (VOID *)PageTablesForLargeMap;
if( PageTablesForLargeMap )
{
v12 = (_MMPTE *)((char *)MmGetPteBase() + ((PageTablesForLargeMap >> 9) & 0x7FFFFFFFF8i64));
goto LABEL_12;
}
v23 = -1073741670;
goto LABEL_81;
}
LABEL_10:
v25 = MiReservePtes(v85, (unsigned int)v22);
v12 = (_MMPTE *)v25;
if( !v25 )
{
v23 = -1073741670;
v32 = 0i64;
goto LABEL_88;
}
BaseAddress = (VOID *)(((v25 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16);
LABEL_12:
LODWORD(v26) = MiAllocatePool((struct _SLIST_ENTRY *)0x40);
v11 = v26;
if( !v26 )
{
v32 = v86;
v23 = -1073741670;
goto LABEL_88;
}
v27 = ControlArea;
v28 = ControlArea;
*(_DWORD *)(v26 + 56) ^= (*(_DWORD *)(v26 + 56) ^ (8 * v24)) & 0x18;
v29 = MiControlAreaRequiresCharge((INT64)v28);
v30 = v29;
if( !v29 )
{
v32 = v86;
v23 = -1073740277;
goto LABEL_88;
}
if( v29 == 2 )
*(_DWORD *)(v11 + 56) |= 4u;
if( (*(_DWORD *)(r8_0 + 56) & 0x8000000) != 0 )
*(_DWORD *)(v11 + 56) |= 1u;
if( (a5 & 1) != 0 )
*(_DWORD *)(v11 + 56) |= 2u;
v31 = *((_DWORD *)v27 + 14);
if( (v31 & 0x20) == 0 )
{
v32 = v86;
LABEL_22:
v33 = v89;
goto LABEL_23;
}
if( (v31 & 0x4000000) != 0 )
{
a3_4 = -1;
if( MiCreatePerSessionProtos(v27, 0xFFFFFFFFui64) < 0 )
{
v32 = v86;
v23 = -1073741801;
v10 = 0x7FFFF;
LABEL_89:
v15 = (_MI_SYSTEM_PTE_TYPE *)v85;
v16 = Partition;
goto LABEL_90;
}
}
v32 = *(_QWORD *)(*(_QWORD *)v27 + 48i64);
if( v32 && !(unsigned int)MiChargeCommit(Partition, v32, 0i64) )
{
v14 = a3;
v61 = 0;
v15 = (_MI_SYSTEM_PTE_TYPE *)v85;
v32 = 0i64;
v10 = a3_4;
v23 = -1073741523;
v16 = Partition;
v17 = v84;
LABEL_92:
++*(_DWORD *)(a1 + 28);
if( v12 )
{
if( v14 >= 3 )
MiReleasePtes((INT64)v15, (INT64)v12, (unsigned int)v17);
else
MiUnmapLargePages(BaseAddress, v17 << 12, MiVaSystemPtes);
v16 = Partition;
v61 = 0;
v14 = a3;
}
if( v98 == 1 )
{
v50 = v9 == 2;
v64 = (__int64 *)ControlArea;
LOBYTE(v61) = v14 < 3;
MiDereferenceDataSubsections((__int64)ControlArea, a4, v13, v61, !v50);
v16 = Partition;
}
else
{
v64 = (__int64 *)ControlArea;
}
if( v10 != 0x7FFFF )
{
MiDereferencePerSessionProtos(v64, v10);
v16 = Partition;
}
if( v32 )
MiReturnCommit(v16, v32);
if( v11 )
ExFreePoolWithTag((PVOID)v11, 0);
return(unsigned int)v23;
}
if( v30 != 2 )
goto LABEL_22;
v62 = v20 | 8;
v89 = (_SUBSECTION *)((char *)ControlArea + 128);
v33 = (_SUBSECTION *)((char *)ControlArea + 128);
active = MiReferenceActiveSubsection((ULONG_PTR)ControlArea + 128, v62, 0x11u);
v23 = active;
if( active < 0 )
{
LABEL_88:
v10 = a3_4;
goto LABEL_89;
}
LABEL_23:
*(_QWORD *)(v11 + 48) = v33;
*(_QWORD *)(v11 + 32) = v13 << 12;
*(_QWORD *)(v11 + 24) = *a4 >> 12;
v34 = (unsigned __int64)BaseAddress | 2;
*(_QWORD *)(v11 + 40) = v32;
*(_QWORD *)(v11 + 88) = v34;
*(_DWORD *)(v11 + 100) = a3_4;
if( (_MMSESSION *)a1 == &Session )
v35 = -1;
else
v35 = *(_DWORD *)(v94 + 8);
*(_DWORD *)(v11 + 96) = v35;
*(_QWORD *)(v11 + 64) = MiReferenceFileObjectForMap(r8_0);
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
if( a3 || (*((_DWORD *)ControlArea + 14) & 0x400) != 0 )
{
--*((_WORD *)CurrentThread + 243);
ExAcquirePushLockExclusiveEx(*(_QWORD *)(a1 + 8), 0i64);
v37 = AnyMultiplexedVm;
SharedVm = MiGetSharedVm(AnyMultiplexedVm);
v39 = ExAcquireSpinLockExclusive((PEX_SPIN_LOCK)SharedVm);
*((_DWORD *)SharedVm + 1) = 0;
v40 = 0;
++*(_DWORD *)(a1 + 24);
v41 = v39;
v42 = *(_QWORD **)(a1 + 16);
if( v42 )
{
while( 1 )
{
v43 = v42[11] & 0xFFFFFFFFFFFFF000ui64;
if( (unsigned __int64)BaseAddress < v43 + v42[4] && (unsigned __int64)BaseAddress < v43 )
{
v44 = (_QWORD *)*v42;
if( !*v42 )
break;
}
else
{
v44 = (_QWORD *)v42[1];
if( !v44 )
{
v40 = 1;
break;
}
}
v42 = v44;
}
}
RtlAvlInsertNodeEx((unsigned __int64 *)(a1 + 16), (__int64)v42, v40, (_QWORD *)v11);
MiUnlockWorkingSetExclusive(v37, v41);
if( (*((_DWORD *)ControlArea + 14) & 0x400) == 0 )
{
result[0] = (INT64)ControlArea;
MiManageSubsectionView(result, v11 + 72, 3i64);
}
v45 = *(_QWORD *)(a1 + 8);
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v45, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)v45);
v91 = 0;
v46 = (_ETHREAD *)KeGetCurrentThread();
if( (unsigned int)MiGetSystemRegionType(v45) == 1 )
v47 = (unsigned int)MmGetSessionIdEx(*((_QWORD *)v46 + 23));
else
v47 = 0xFFFFFFFFi64;
--*((_WORD *)v46 + 243);
v48 = ++*((_BYTE *)v46 + 794);
v49 = (*((char *)v46 + 792) | *((char *)v46 + 870)) ^ 0x3F;
v50 = !_BitScanReverse((unsigned int *)&v51, v49);
v90 = v51;
if( v50 )
goto LABEL_73;
while( 1 )
{
v52 = *((_QWORD *)v46 + 100) + 96 * v51;
v49 &= ~(1 << v51);
if( (*(_BYTE *)(v52 + 26) & 1) != 0
&& (*(_DWORD *)(v52 + 32) & 1) == 0
&& (*(_QWORD *)(v52 + 32) & 0x7FFFFFFFFFFFFFFCi64) == (v45 & 0x7FFFFFFFFFFFFFFCi64)
&& *(_DWORD *)(v52 + 40) == (_DWORD)v47 )
{
*(_BYTE *)(v52 + 26) &= ~1u;
if( *(_QWORD *)(v52 + 32) )
break;
}
v50 = !_BitScanReverse((unsigned int *)&v51, v49);
v90 = v51;
if( v50 )
goto LABEL_73;
}
if( !v52 )
{
LABEL_73:
if( (*((_DWORD *)v46 + 30) & 0x10000) == 0 )
KeBugCheckEx(0x162u, (ULONG_PTR)v46, v45, v47, 0i64);
}
else
{
*(_BYTE *)(v52 + 32) |= 2u;
if( *(__int64 *)(v52 + 32) < 0 )
KiAbEntryRemoveFromTree(v52);
v91 = *(_DWORD *)(v52 + 88) & 0x1FFFF;
*(_DWORD *)(v52 + 88) &= 0xFFFE0000;
*(_BYTE *)(v52 + 25) &= ~1u;
*(_QWORD *)(v52 + 32) = 0i64;
v53 = (__int64)(v52 - *((_QWORD *)v46 + 100)) / 96;
if( v48 == 1 )
*((_BYTE *)v46 + 792) |= 1 << v53;
else
_InterlockedOr8((volatile signed __int8 *)v46 + 870, 1 << v53);
}
--*((_BYTE *)v46 + 794);
KiAbThreadRemoveBoosts((ULONG_PTR)v46, v45, (unsigned int *)&v91);
v50 = (*((_WORD *)v46 + 243))++ == 0xFFFF;
if( v50 && *((_ETHREAD **)v46 + 19) != (_ETHREAD *)((char *)v46 + 152) )
KiCheckForKernelApcDelivery();
KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
v33 = v89;
v54 = BaseAddress;
goto LABEL_52;
}
v54 = BaseAddress;
v65 = &qword_140C4CAF0[2 * (unsigned __int8)((unsigned __int64)BaseAddress >> 30)];
v66 = ExAcquireSpinLockExclusive((PEX_SPIN_LOCK)v65 + 3);
++*((_DWORD *)v65 + 2);
v67 = 0;
v68 = (_QWORD *)*v65;
v69 = v66;
if( !*v65 )
goto LABEL_113;
while( 1 )
{
v70 = v68[11] & 0xFFFFFFFFFFFFF000ui64;
if( (unsigned __int64)v54 >= v70 + v68[4] || (unsigned __int64)v54 >= v70 )
break;
v71 = (_QWORD *)*v68;
if( !*v68 )
{
v67 = 0;
goto LABEL_113;
}
LABEL_116:
v68 = v71;
}
v71 = (_QWORD *)v68[1];
if( v71 )
goto LABEL_116;
v67 = 1;
LABEL_113:
RtlAvlInsertNodeEx((unsigned __int64 *)v65, (__int64)v68, v67, (_QWORD *)v11);
ExReleaseSpinLockExclusiveFromDpcLevel((__int64 *)((char *)v65 + 12));
__writecr8(v69);
LABEL_52:
if( (*(_DWORD *)(v11 + 56) & 1) != 0 )
_InterlockedIncrement((volatile signed __int32 *)ControlArea + 23);
v55 = 0i64;
if( a3 < 3 )
{
v72 = *((_QWORD *)v33 + 1);
v73 = (UINT64)v54;
v74 = MiLargePageSizes[a3];
v75 = (unsigned __int64 *)(v72 + 8 * PteOffset[0]);
v76 = (unsigned __int64 *)(v72 + 8i64 * *((unsigned int *)v33 + 11));
if( v84 )
{
v77 = MiGetAnyMultiplexedVm(3i64);
do
{
if( v75 == v76 )
{
v89 = (_SUBSECTION *)*((_QWORD *)v89 + 2);
v75 = (unsigned __int64 *)*((_QWORD *)v89 + 1);
v76 = &v75[*((unsigned int *)v89 + 11)];
}
v78 = *v75;
MiPteInShadowRange((UINT64)v75);
LODWORD(v80) = 1;
LODWORD(BugCheckParameter4) = a3;
MiMapWithLargePages((INT64)v77, v73, (v78 >> 12) & 0xFFFFFFFFFi64, v74, BugCheckParameter4, 4, v80);
v73 += v74 << 12;
v75 += v74;
v55 += v74;
}
while( v55 < v84 );
v54 = BaseAddress;
}
v58 = 0;
LABEL_59:
*a7 = (UINT64)v54;
}
else
{
v56 = 0;
if( v13 )
{
v57 = 0i64;
do
{
*((_QWORD *)v12 + v57) = ZeroPte;
v57 = ++v56;
}
while( v56 < v13 );
}
LODWORD(BugCheckParameter4) = SessionId;
v58 = MiAddMappedPtes(v12, v13, ControlArea, (_LARGE_INTEGER *)a4, BugCheckParameter4);
if( v58 >= 0 )
goto LABEL_59;
++*(_DWORD *)(a1 + 28);
MiRemoveFromSystemSpace((_MMSESSION *)a1, v54, 0i64);
}
return(unsigned int)v58;
}Referenced by:
MiMapViewInSystemSpace