MiDrainSystemAccessLog
VOID __stdcall MiDrainSystemAccessLog(_MMSUPPORT_INSTANCE *Vm){
char v2;
_MM_PAGE_ACCESS_INFO_HEADER **AgeDistribution;
unsigned __int8 CurrentIrql;
unsigned __int64 *v5;
_KLOCK_QUEUE_HANDLE LockQueue;
v2 = Vm->Flags._bf_0 & 7;
*(_QWORD *)&LockQueue.OldIrql = 0i64;
if( v2 == 2 )
AgeDistribution = (_MM_PAGE_ACCESS_INFO_HEADER **)((char *)&stru_140C4DB30 + 6584);
else
AgeDistribution = (_MM_PAGE_ACCESS_INFO_HEADER **)Vm[1].AgeDistribution;
if( *AgeDistribution )
{
CurrentIrql = KeGetCurrentIrql();
__writecr8(2ui64);
if( (Vm->Flags._bf_0 & 7) == 2 )
v5 = (unsigned __int64 *)((char *)&stru_140C4DB30 + 6608);
else
v5 = &Vm[1].AgeDistribution[3];
LockQueue.LockQueue.Lock = v5;
LockQueue.LockQueue.Next = 0i64;
KxAcquireQueuedSpinLock(&LockQueue.LockQueue, v5);
if( *AgeDistribution )
{
MiEmptyPageAccessLog(*AgeDistribution);
*AgeDistribution = 0i64;
}
KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockQueue);
__writecr8(CurrentIrql);
}
}Referenced by:
MiCaptureAndResetWorkingSetAccessBits
MiCleanWorkingSet
MiDeletePartialVad
MiDeleteSessionAddressSpace
MiDeleteVad
MiEmptyAccessLogs