MiMapViewOfSection
NTSTATUS __stdcall MiMapViewOfSection(
VOID *SectionToMap,
_EPROCESS *Process,
VOID **CapturedBase,
UINT64 ZeroBits,
UINT64 CommitSize,
_LARGE_INTEGER *SectionOffset,
UINT64 *CapturedViewSize,
_SECTION_INHERIT InheritDisposition,
UINT64 AllocationType,
UINT64 Win32Protect,
UINT64 ProbeMode,
VOID **SecureHandle){
__int64 v15;
__int64 v16;
__int64 v17;
_CONTROL_AREA *v18;
_SEGMENT *Segment;
int DirectoryTableBase_high;
int v21;
int v22;
int v23;
_LIST_ENTRY *v24;
char *v25;
unsigned __int64 v26;
unsigned __int64 v27;
__int64 v28;
__int64 v29;
UINT64 v30;
__int64 v31;
_LIST_ENTRY *v32;
int v33;
unsigned __int64 *v34;
unsigned __int64 v35;
UINT64 v36;
int v37;
__int16 Short0;
UINT64 v39;
NTSTATUS v40;
int v41;
_SECTION_INHERIT v42;
_ETHREAD *CurrentThread;
_EPROCESS *v44;
union {unsigned int LongFlags;_MMSECTION_FLAGS Flags;} v45;
NTSTATUS v46;
int v47;
int DirectoryTableBase;
_LIST_ENTRY *v50;
VOID **v51;
int v52;
_LIST_ENTRY *v53;
NTSTATUS v54;
int v55;
_SECTION *Section;
_SECTION *Sectiona;
UINT8 *v58;
_SECTION *v59;
UINT8 *ProtectionMask;
UINT8 *v61;
UINT8 *v62;
UINT64 v63;
UINT64 v64;
UINT8 v65[8];
UINT8 *CfgTargetsValid;
UINT64 PreferredNode;
VOID **v68;
PVOID Processa;
_LIST_ENTRY *Flink;
UINT64 v71;
VOID **CapturedBasea;
VOID **v73;
VOID *v74;
_CONTROL_AREA *v75;
_LIST_ENTRY *v76;
_EPROCESS *v77;
_EPROCESS *v78;
VOID **v79;
_KAPC_STATE ApcState;
v71 = ZeroBits;
v73 = CapturedBase;
v78 = Process;
v79 = CapturedBase;
CapturedBasea = (VOID **)CommitSize;
memset(&ApcState, 0, sizeof(ApcState));
CfgTargetsValid = 0i64;
PreferredNode = 0i64;
Processa = (PVOID)Process->Pcb.Affinity.Bitmap[0];
v77 = (_EPROCESS *)Processa;
LODWORD(v68) = 0;
v74 = SectionToMap;
v18 = MiSectionControlArea((_SECTION *)SectionToMap);
v75 = v18;
Segment = v18->Segment;
Flink = Process->Pcb.ProfileListHead.Flink;
if( !(_DWORD)CapturedViewSize )
{
if( (unsigned int)((_DWORD)SectionOffset - 1) > 1 )
return -1073741811;
if( (v18->u.LongFlags & 0x400) == 0
&& *(_QWORD *)&Process->Pcb.gap0[16] >= 0x10000ui64
&& (*(_WORD *)CapturedBase != (_WORD)v17 || *(_WORD *)CommitSize != (_WORD)v17) )
{
return -1073741280;
}
}
if( !(_DWORD)CapturedViewSize
&& ((Process->Pcb.DirectoryTableBase & 0x9F2BDFFF) != 0
|| (Process->Pcb.DirectoryTableBase & 0x40000000) != 0 && *(_QWORD *)(v16 + 2240) == v17) )
{
return -1073741811;
}
v65[0] = 1;
DirectoryTableBase_high = HIDWORD(Process->Pcb.DirectoryTableBase);
if( (DirectoryTableBase_high & 0x40000000) != 0 )
{
if( (DirectoryTableBase_high & 0xF0) == 0 )
return -1073741811;
v65[0] = v17;
HIDWORD(Process->Pcb.DirectoryTableBase) = DirectoryTableBase_high & 0xBFFFFFFF;
}
if( (*(_DWORD *)(v15 + 56) & 0x20) != 0 )
{
if( *(_QWORD *)&Process->Pcb.Affinity.Count != v17 && (HIDWORD(Process->Pcb.ThreadListHead.Blink) & 0x2000000) == 0 )
return -1073741811;
DirectoryTableBase = Process->Pcb.DirectoryTableBase;
if( (DirectoryTableBase & 0x2000) != 0 )
return -1073741811;
if( (DirectoryTableBase & 0x20000000) != 0
&& (*(_QWORD *)CommitSize != v17
|| (MiFlags & 0x40000) != 0
|| (v18->u.LongFlags & 0x20000) != 0
|| !SeSinglePrivilegeCheck(*(_QWORD *)&SeLockMemoryPrivilege, Process->Pcb.Affinity.Bitmap[2])) )
{
LODWORD(Process->Pcb.DirectoryTableBase) &= ~0x20000000u;
}
}
else
{
v21 = MmCompatibleProtectionMask[MiMakeProtectionMask(*(_DWORD *)(v15 + 60) & 0xFFF) & 7] | 0x700;
if( (v21 | v22) != v21 )
return -1073741746;
v23 = Process->Pcb.DirectoryTableBase;
if( (v23 & 0x840000) != 0 || (v23 & 0x20002000) != 0 && (v18->u.LongFlags & 0x400) != 0 )
return -1073741811;
}
v24 = Process->Pcb.ProfileListHead.Flink;
v25 = (char *)v24 + *(_QWORD *)CommitSize;
if( (unsigned __int64)v25 < *(_QWORD *)CommitSize )
return -1073741793;
v26 = *((_QWORD *)SectionToMap + 6);
if( (unsigned __int64)v25 > v26 && (Process->Pcb.DirectoryTableBase & 0x2000) == 0 )
return -1073741793;
if( !v24 )
Process->Pcb.ProfileListHead.Flink = (_LIST_ENTRY *)(v26 - *(_QWORD *)CommitSize);
if( (v18->u.LongFlags & 0x400) != 0 )
{
if( (*(_DWORD *)CommitSize & 0xFFF) != 0 )
{
if( (Process->Pcb.DeepFreezeStartTime & 2) != 0 )
return -1073741280;
*(_DWORD *)CommitSize &= 0xFFFFF000;
}
}
else
{
v27 = *(_QWORD *)&Process->Pcb.gap0[16];
if( v27 > 0x10000 && v18->FilePointer.Value )
v27 = 0x10000i64;
v28 = *(unsigned int *)CommitSize;
v29 = v28 & (v27 - 1);
if( v29 )
{
if( (Process->Pcb.DeepFreezeStartTime & 2) != 0 )
return -1073741280;
*(_DWORD *)CommitSize = v28 & -(int)v27;
if( (v18->u.LongFlags & 0x20) == 0 )
{
v53 = Process->Pcb.ProfileListHead.Flink;
if( (_LIST_ENTRY *)((char *)v53 + v29) < v53 )
return -1073741793;
Process->Pcb.ProfileListHead.Flink = (_LIST_ENTRY *)((char *)v53 + v29);
}
}
}
v30 = (UINT64)Process->Pcb.ProfileListHead.Flink;
if( (__int64)v30 <= 0 )
return -1073741793;
v31 = *(_QWORD *)&Process->Pcb.gap0[16];
if( ((v31 - 1) & (unsigned __int64)*CapturedBase) == 0 )
goto LABEL_24;
if( (Process->Pcb.DeepFreezeStartTime & 2) != 0 )
return -1073741280;
*CapturedBase = (VOID *)((unsigned __int64)*CapturedBase & -v31);
v30 = (UINT64)Process->Pcb.ProfileListHead.Flink;
LABEL_24:
Process->Pcb.ProfileListHead.Blink = (_LIST_ENTRY *)v30;
v32 = (_LIST_ENTRY *)v30;
if( (v30 & 0xFFF) == 0 )
goto LABEL_25;
v32 = (_LIST_ENTRY *)(v30 + 4096 - (unsigned int)(v30 & 0xFFF));
if( (unsigned __int64)v32 < v30 )
return -1073741793;
Process->Pcb.ProfileListHead.Flink = v32;
LABEL_25:
v33 = Process->Pcb.DeepFreezeStartTime & 1;
v34 = (unsigned __int64 *)CapturedBase;
if( !v33 )
v34 = (unsigned __int64 *)Process;
v35 = *(_QWORD *)&Process->Pcb.gap0[8];
if( *v34 > v35 )
return -1073741811;
if( v35 - *v34 + 1 < (unsigned __int64)v32 )
return(v33 != 0) - 1073741801;
v36 = v71;
if( v71 > v30 && (Process->Pcb.DirectoryTableBase & 0x2000) == 0 )
return -1073741811;
if( v30 > *((_QWORD *)SectionToMap + 6) && (Process->Pcb.DirectoryTableBase & 0x2000) == 0 )
return -1073741793;
v37 = Process->Pcb.DirectoryTableBase;
if( (v37 & 0x2000) != 0 && (*((_DWORD *)SectionToMap + 15) & 0x44) == 0 )
return -1073741746;
if( (v37 & 0x800000) != 0 && ((*((_DWORD *)SectionToMap + 14) & 0x20) == 0 || (v37 & 0x20000000) != 0)
|| (HIDWORD(Process->Pcb.ThreadListHead.Blink) & 0x4000000) != 0
&& ((v18->u.LongFlags & 0x420) != 0
|| (v37 & 0xFFFFDFFF) != 0
|| !v33
|| *CapturedBase != (VOID *)((unsigned __int64)*CapturedBase & 0xFFFFFFFFFFFFF000ui64)
|| !Flink) )
{
return -1073741811;
}
Short0 = Segment->SegmentFlags.Short0;
v39 = HIDWORD(Process->Pcb.DirectoryTableBase);
if( Short0 < 0 )
{
LODWORD(v39) = v39 & 0xFFFFF9FF | 0x200;
HIDWORD(Process->Pcb.DirectoryTableBase) = v39;
Short0 = Segment->SegmentFlags.Short0;
}
if( (Short0 & 0x4000) != 0 )
{
LODWORD(v39) = v39 & 0xFFFFF9FF | 0x400;
HIDWORD(Process->Pcb.DirectoryTableBase) = v39;
}
v40 = MiMakeProtectionMask(v39);
LODWORD(Flink) = v40;
if( v40 == -1 )
return -1073741755;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v44 = (_EPROCESS *)Process->Pcb.Affinity.Bitmap[1];
if( (v44->MitigationFlags & 0x100) != 0 && (CurrentThread->CrossThreadFlags & 0x40000) == 0 )
{
if( (*((_DWORD *)SectionToMap + 14) & 0x20) != 0 )
{
LODWORD(Process->Pcb.DirectoryTableBase) = v41 & 0xDFFFFFFF;
}
else if( (v40 & 2) != 0 )
{
return MiArbitraryCodeBlocked(v44);
}
}
if( v44 != Processa )
{
KiStackAttachProcess(Processa, 0i64, &ApcState);
LODWORD(v68) = 1;
v42 = 0;
}
v45.LongFlags = (unsigned int)v18->u;
if( (v45.LongFlags & 0x400) != 0 )
{
v46 = MiMapViewOfPhysicalSection(
Process,
CapturedBase,
(_LARGE_INTEGER *)CommitSize,
(UINT64 *)(unsigned int)v40,
v65,
(UINT64)Section,
v58,
ProtectionMask);
}
else
{
if( (v45.LongFlags & 0x20) != 0 )
{
CfgTargetsValid = (UINT8 *)*CapturedBase;
PreferredNode = (UINT64)CfgTargetsValid;
v50 = Process->Pcb.ProfileListHead.Flink;
v76 = v50;
while( 1 )
{
LODWORD(v58) = v40;
LODWORD(Section) = (_DWORD)SectionOffset;
v51 = CapturedBasea;
v47 = MiMapViewOfImageSection(
v18,
Process,
(_EPROCESS *)&CfgTargetsValid,
CapturedBasea,
(_LARGE_INTEGER *)SectionToMap,
(UINT64 *)Section,
(_SECTION *)v58,
v42,
(UINT64)v61,
v63,
*(UINT64 *)v65,
(UINT64)CfgTargetsValid,
PreferredNode);
LODWORD(v71) = v47;
v52 = Process->Pcb.DirectoryTableBase;
if( (v52 & 0x20000000) == 0 )
break;
LODWORD(Process->Pcb.DirectoryTableBase) = v52 & 0xDFFFFFFF;
LODWORD(v59) = v40;
LODWORD(Sectiona) = (_DWORD)SectionOffset;
v54 = MiMapViewOfImageSection(
v18,
Process,
(_EPROCESS *)&PreferredNode,
v51,
(_LARGE_INTEGER *)SectionToMap,
(UINT64 *)Sectiona,
v59,
(_SECTION_INHERIT)0,
(UINT64)v62,
v64,
*(UINT64 *)v65,
(UINT64)CfgTargetsValid,
PreferredNode);
v55 = v54;
if( v47 < 0 )
{
CfgTargetsValid = (UINT8 *)PreferredNode;
v47 = v54;
break;
}
if( v54 >= 0 )
{
memmove(CfgTargetsValid, (const VOID *)PreferredNode, (size_t)v50);
if( v55 >= 0 )
{
MiUnmapViewOfSection((_EPROCESS *)Processa, (VOID *)PreferredNode, 0i64);
break;
}
MiUnmapViewOfSection((_EPROCESS *)Processa, CfgTargetsValid, 0i64);
MiUnmapViewOfSection((_EPROCESS *)Processa, (VOID *)PreferredNode, 0i64);
v42 = 0;
}
else
{
MiUnmapViewOfSection((_EPROCESS *)Processa, CfgTargetsValid, 0i64);
v42 = 0;
}
}
if( v47 >= 0 )
*v73 = CfgTargetsValid;
goto LABEL_46;
}
LODWORD(Section) = (_DWORD)SectionOffset;
v46 = MiMapViewOfDataSection(
v18,
Process,
CapturedBase,
(_LARGE_INTEGER *)CommitSize,
(UINT64 *)SectionToMap,
Section,
(_SECTION_INHERIT)v40,
v36,
v65,
v63,
*(UINT64 *)v65,
CfgTargetsValid,
(VOID **)PreferredNode,
v68);
}
v47 = v46;
LABEL_46:
if( (_DWORD)v68 )
KiUnstackDetachProcess(&ApcState, 0i64);
return v47;
}Referenced by:
MiMapViewOfSectionExCommon
MmMapSecureViewOfSection
MmMapViewOfSection
NtMapViewOfSection