MiReplacePageTablePage
__int64 __fastcall MiReplacePageTablePage(__int64 a1){
__int64 v2;
int v3;
UINT64 v4;
__int64 v5;
__int64 v6;
_MMPFN *PfnDb;
INT64 v8;
int v9;
INT64 v10;
_MMPTE *PteBase;
unsigned __int64 v12;
int v13;
unsigned __int64 LeafVa;
unsigned __int64 v15;
int SystemRegionType;
INT64 v17;
INT64 *v18;
INT64 v19;
INT64 v20;
char v21;
unsigned __int64 v22;
unsigned __int64 v23;
_MMPFN *v24;
__int64 v25;
unsigned __int64 v26;
unsigned __int64 v27;
__int64 v28;
unsigned __int64 v29;
INT64 v30;
INT64 v31;
__int64 v32;
__int64 v33;
_MMPFN *v34;
unsigned __int64 v35;
char *v36;
int v37;
INT64 v38;
unsigned __int64 v39;
__int64 v40;
__int64 v41;
_MMPFN *v42;
__int64 v43;
unsigned __int64 v44;
int v45;
int v46;
int v47;
int v48;
UINT64 v49;
INT64 v50;
__int64 v51;
int v52;
__int64 v53;
INT64 *v54;
UINT64 SpinCount;
__int64 v56;
INT64 v57;
__int64 v58;
__int64 v59;
INT64 v60;
INT64 v61;
int result;
__int16 result_4;
int v64;
__int64 v65;
__int64 v66;
v56 = a1;
memset((INT64)&result, 0i64);
v2 = *(_QWORD *)(a1 + 24);
v3 = 0;
v4 = *(_QWORD *)(a1 + 8);
v5 = *(_QWORD *)(a1 + 32);
v6 = *(_QWORD *)(a1 + 16);
*(_DWORD *)(a1 + 56) = -1073741823;
v57 = v4;
v53 = v2;
v58 = v5;
v54 = (INT64 *)v6;
v51 = v2;
PfnDb = MmGetPfnDb();
v8 = (INT64)PfnDb + 48 * v2;
v9 = *(_DWORD *)(a1 + 60);
v10 = (INT64)PfnDb + 48 * v5;
v46 = 0;
v45 = 0;
v48 = 0;
v61 = v10;
v47 = 0;
PteBase = MmGetPteBase();
if( v9 == 1 )
{
v12 = *(_QWORD *)(*(_QWORD *)(a1 + 48) + 1928i64);
if( !v12 )
return MiSetOriginalPtePfnFromFreeList((UINT64 *)(v10 + 16));
v60 = MI_READ_PTE_LOCK_FREE((INT64)PteBase + ((v12 >> 9) & 0x7FFFFFFFF8i64));
if( (((unsigned __int64)MI_READ_PTE_LOCK_FREE((INT64)&v60) >> 12) & 0xFFFFFFFFFi64) != v2 )
return MiSetOriginalPtePfnFromFreeList((UINT64 *)(v10 + 16));
}
v13 = 1;
if( (*(_QWORD *)(v8 + 40) & 0xFFFFFFFFFi64) == v2 )
{
v52 = 1;
if( v9 == 1 )
v51 = *(_QWORD *)(*(_QWORD *)(a1 + 48) + 40i64) >> 12;
}
else
{
v52 = 0;
LeafVa = MiGetLeafVa(v4);
if( LeafVa > 0x7FFFFFFEFFFFi64
&& (LeafVa < qword_140C4F878 || LeafVa > qword_140C4E0A8)
&& (LeafVa < (unsigned __int64)MmGetPteBase() || LeafVa > v15) )
{
SystemRegionType = MiGetSystemRegionType(LeafVa);
v13 = 0;
if( SystemRegionType == 1 )
v13 = 2;
}
}
v65 = 0i64;
v66 = 0i64;
v17 = v4;
v18 = v54;
v59 = -(__int64)v4;
result = v13;
result_4 = 0;
v64 = 20;
do
{
while( 1 )
{
v19 = MI_READ_PTE_LOCK_FREE(v17);
v50 = v19;
v20 = v19;
if( (v19 & 1) != 0 )
break;
v21 = v19;
if( (v19 & 0x400) != 0 || (v19 & 0x800) == 0 )
goto LABEL_35;
v22 = (unsigned __int64)MmGetPteBase();
v23 = (__int64)((v17 << 25) - (v22 << 25)) >> 16;
if( v23 >= v22 && v23 <= (unsigned __int64)MmGetPteLimit() && !MiIsPdeOrAboveAccessible(v17) )
goto LABEL_84;
v24 = MiLockTransitionLeafPage((_MMPTE *)v17, (UINT8 *)(v3 != 0));
if( v24 )
{
v20 = MI_READ_PTE_LOCK_FREE(v17);
v50 = v20;
v25 = *((_QWORD *)v24 + 5);
v21 = v20;
if( (v25 & 0xFFFFFFFFFi64) != v51 && (v25 & 0x1000000000i64) != 0 )
++v48;
if( (*((_BYTE *)v24 + 34) & 0x20) != 0 )
{
_InterlockedAnd64((volatile signed __int64 *)v24 + 3, 0x7FFFFFFFFFFFFFFFui64);
goto LABEL_84;
}
++v3;
goto LABEL_35;
}
}
++v46;
if( (v19 & 0x80u) != 0i64 )
goto LABEL_32;
v26 = ((unsigned __int64)MI_READ_PTE_LOCK_FREE((INT64)&v50) >> 12) & 0xFFFFFFFFFi64;
if( v26 != qword_140C4EAA8 )
{
v27 = *((_QWORD *)MmGetPfnDb() + 6 * v26 + 5);
if( ((v27 >> 50) & 1) == 0 || (v27 & 0x1000000000i64) == 0 )
goto LABEL_33;
LABEL_32:
++v45;
goto LABEL_33;
}
++v47;
LABEL_33:
if( v51 == v53 )
goto LABEL_37;
v20 = MI_READ_PTE_LOCK_FREE(*(_QWORD *)(v56 + 64) + 8 * ((v17 + v59) >> 3));
v50 = v20;
v21 = v20;
LABEL_35:
if( v51 != v53 )
{
v20 &= -(__int64)((v21 & 1) != 0);
v50 = v20;
}
LABEL_37:
*v18 = v20;
v17 += 8i64;
++v18;
}
while( (v17 & 0xFFF) != 0 );
if( v3 )
{
MiLockNestedPageAtDpcInline(v8);
}
else
{
LODWORD(SpinCount) = 0;
while( _interlockedbittestandset64((volatile signed __int32 *)(v8 + 24), 0x3Fui64) )
{
do
KeYieldProcessorEx(&SpinCount);
while( *(__int64 *)(v8 + 24) < 0 );
}
}
v28 = *(_QWORD *)(v8 + 24);
v29 = v28 & 0x3FFFFFFFFFFFFFFFi64;
if( (v52 || (unsigned __int16)v28 == (unsigned __int64)(unsigned int)(v3 - v47 - v48 - v45 + v46 + 1))
&& *(_WORD *)(v8 + 32) == 1
&& v29 < 0x10000 )
{
MiLockNestedPageAtDpcInline(v10);
*(_QWORD *)(v10 + 24) = v29 | *(_QWORD *)(v10 + 24) & 0xC000000000000000ui64;
_InterlockedAnd64((volatile signed __int64 *)(v10 + 24), 0x7FFFFFFFFFFFFFFFui64);
_InterlockedAnd64((volatile signed __int64 *)(v8 + 24), 0x7FFFFFFFFFFFFFFFui64);
v30 = v57;
v31 = v57;
if( v3 )
{
v32 = v53;
v33 = v58;
v34 = MmGetPfnDb();
do
{
v35 = MI_READ_PTE_LOCK_FREE(v31);
if( (v35 & 1) == 0 && (v35 & 0x400) == 0 && (v35 & 0x800) != 0 )
{
if( qword_140C4DC80 && (v35 & 0x10) == 0 )
v35 &= ~qword_140C4DC80;
v36 = (char *)v34 + 48 * ((v35 >> 12) & 0xFFFFFFFFFi64);
if( (*((_QWORD *)v36 + 5) & 0xFFFFFFFFFi64) == v51 && v51 == v32 )
*((_QWORD *)v36 + 5) ^= (v33 ^ *((_QWORD *)v36 + 5)) & 0xFFFFFFFFFi64;
--v3;
_InterlockedAnd64((volatile signed __int64 *)v36 + 3, 0x7FFFFFFFFFFFFFFFui64);
}
v31 += 8i64;
}
while( v3 );
v30 = v57;
}
v37 = v46;
if( v46 )
{
v54 = (INT64 *)((char *)v54 - v30);
do
{
v50 = MI_READ_PTE_LOCK_FREE(v30);
v38 = v50;
if( (v50 & 1) != 0 )
{
--v37;
v39 = ((unsigned __int64)MI_READ_PTE_LOCK_FREE((INT64)&v50) >> 12) & 0xFFFFFFFFFi64;
v40 = 48 * v39;
v41 = v51;
if( ((*((_QWORD *)MmGetPfnDb() + 6 * v39 + 5) >> 50) & 1) != 0 && v39 != v51 )
{
v42 = MmGetPfnDb();
LODWORD(v49) = 0;
while( _interlockedbittestandset64((volatile signed __int32 *)((char *)v42 + v40 + 24), 0x3Fui64) )
{
do
KeYieldProcessorEx(&v49);
while( *(__int64 *)((char *)v42 + v40 + 24) < 0 );
}
if( (*(_QWORD *)((char *)v42 + v40 + 40) & 0xFFFFFFFFFi64) == v41 && v41 == v53 )
*(_QWORD *)((char *)v42 + v40 + 40) ^= (v58 ^ *(_QWORD *)((char *)v42 + v40 + 40)) & 0xFFFFFFFFFi64;
_InterlockedAnd64((volatile signed __int64 *)((char *)v42 + v40 + 24), 0x7FFFFFFFFFFFFFFFui64);
v38 = v50;
}
if( v41 != v53 )
v38 = MI_READ_PTE_LOCK_FREE(*(_QWORD *)(v56 + 64) + 8 * ((v30 + v59) >> 3));
if( (v38 & 1) != 0 )
{
MiWriteValidPteNewProtection((INT64 *)((char *)v54 + v30), v38 | 0x20);
if( (MiFlags & 0x100) == 0 && (MiFlags & 0x200) == 0 )
MiInsertTbFlushEntry((INT64)&result, ((v30 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16, 1i64, 0i64);
}
}
v30 += 8i64;
}
while( v37 );
}
MiFlushTbList((__int64)&result);
v43 = v56;
*(_DWORD *)(v56 + 56) = 0;
return v43;
}
_InterlockedAnd64((volatile signed __int64 *)(v8 + 24), 0x7FFFFFFFFFFFFFFFui64);
LABEL_84:
if( v3 )
{
do
{
v17 -= 8i64;
v44 = MI_READ_PTE_LOCK_FREE(v17);
if( (v44 & 1) == 0 && (v44 & 0x400) == 0 && (v44 & 0x800) != 0 )
{
if( qword_140C4DC80 && (v44 & 0x10) == 0 )
v44 &= ~qword_140C4DC80;
--v3;
_InterlockedAnd64(
(volatile signed __int64 *)MmGetPfnDb() + 6 * ((v44 >> 12) & 0xFFFFFFFFFi64) + 3,
0x7FFFFFFFFFFFFFFFui64);
}
}
while( v3 );
v10 = v61;
}
return MiSetOriginalPtePfnFromFreeList((UINT64 *)(v10 + 16));
}Referenced by:
No references.