MiCanFileBeTruncatedInternal
_CONTROL_AREA *__stdcall MiCanFileBeTruncatedInternal(
_MI_SECTION_OBJECT_POINTERS *SectionPointer,
_LARGE_INTEGER *NewFileSize,
UINT64 BlockNewViews,
UINT64 CanPurgeUserViews,
UINT8 *EntryIrql){
int v5;
bool v8;
unsigned __int64 v9;
__int64 v10;
_SUBSECTION *LastSubsection;
_SUBSECTION *i;
unsigned __int64 v14;
INT64 *v15;
char v16;
unsigned __int64 v17;
int v18;
v18 = BlockNewViews;
v5 = CanPurgeUserViews;
while( 1 )
{
v8 = *((_QWORD *)SectionPointer + 2) == 0i64;
*EntryIrql = 17;
if( v8 )
{
v9 = (unsigned __int8)ExAcquireSpinLockExclusive(&SpinLock);
if( !*((_QWORD *)SectionPointer + 2) )
goto LABEL_4;
ExReleaseSpinLockExclusiveFromDpcLevel(&SpinLock);
__writecr8(v9);
}
MmFlushImageSection((_SECTION_OBJECT_POINTERS *)SectionPointer, MmFlushForWrite);
if( !v16 )
return 0i64;
LOBYTE(v9) = ExAcquireSpinLockExclusive(&SpinLock);
LABEL_4:
v10 = *(_QWORD *)SectionPointer;
if( !*(_QWORD *)SectionPointer )
{
ExReleaseSpinLockExclusiveFromDpcLevel(&SpinLock);
__writecr8((unsigned __int8)v9);
*EntryIrql = 0;
return 0i64;
}
if( (unsigned int)ExTryAcquireSpinLockExclusiveAtDpcLevel((INT64 *)(v10 + 72)) )
break;
ExReleaseSpinLockExclusiveFromDpcLevel(&SpinLock);
__writecr8((unsigned __int8)v9);
}
ExReleaseSpinLockExclusiveFromDpcLevel(&SpinLock);
if( *(_DWORD *)(v10 + 56) & 1 | ((*(_DWORD *)(v10 + 56) & 2) != 0)
|| *(_QWORD *)(v10 + 112) > 1ui64 && (*(_DWORD *)(v10 + 56) & 8) == 0 && !v5 )
{
goto LABEL_21;
}
if( !*(_QWORD *)(v10 + 48) || v18 == 1 && (!*(_QWORD *)(v10 + 40) || v5 == 1) )
goto LABEL_11;
if( !NewFileSize )
{
LABEL_21:
v15 = (INT64 *)(v10 + 72);
LABEL_20:
ExReleaseSpinLockExclusiveFromDpcLevel(v15);
__writecr8((unsigned __int8)v9);
return 0i64;
}
LastSubsection = (_SUBSECTION *)(v10 + 128);
if( *(_QWORD *)(v10 + 64) )
LastSubsection = MiFindLastSubsection((_CONTROL_AREA *)v10, 1ui64);
for( i = LastSubsection->NextSubsection; i; i = i->NextSubsection )
LastSubsection = i;
MiEndingOffset(LastSubsection);
if( NewFileSize->QuadPart < v14 )
{
v15 = (INT64 *)(v10 + 72);
goto LABEL_20;
}
v17 = (v14 + 4095) & 0xFFFFFFFFFFFFF000ui64;
if( NewFileSize->QuadPart < v17 )
NewFileSize->QuadPart = v17;
LABEL_11:
*EntryIrql = v9;
return(_CONTROL_AREA *)v10;
}Referenced by:
MmCanFileBeTruncated
MmPurgeSection