PfpPrivSourceEnum
NTSTATUS __stdcall PfpPrivSourceEnum(_SUPERFETCH_INFORMATION *Info, INT8 PreviousMode, UINT64 *OutSize){
_EPROCESS *v5;
_EPROCESS *v6;
unsigned __int64 v7;
UINT64 v8;
INT64 v9;
int v10;
NTSTATUS IsAppContainerOrIdentifyLevelContext;
_EPROCESS *i;
_EPROCESS *NextSession;
_EPROCESS *j;
_EPROCESS *NextProcess;
unsigned __int64 v16;
unsigned int v17;
UINT64 v18;
int v19;
int v20;
__int64 v21;
_EPROCESS *k;
__int64 v23;
int v24;
_EPROCESS *v25;
unsigned __int64 WorkingSetPrivateSize;
unsigned __int64 WorkingSetSize;
volatile unsigned __int64 NumberOfPrivatePages;
char v29;
unsigned int v30;
__int64 v31;
UINT8 IsAppContainerContext;
char v34;
char SystemAppIdentifier[2];
int v36;
PFP_PRIVSOURCE_QUERY_CONTEXT Context[4];
__int64 v38;
PF_PRIVSOURCE_INFO NewSource[24];
UINT64 StoreSizeInBytes;
UINT64 *v41;
UINT64 v42;
_SUPERFETCH_INFORMATION *v43;
__int64 v44;
UINT64 *v45;
__int128 SessionWsEntry;
__int128 SessionWsEntry_16;
__int64 v48;
_PS_DEEP_FREEZE_STATS DeepFreezeStats;
__int128 SystemInformation[6];
__int128 v51;
v41 = OutSize;
v43 = Info;
v45 = OutSize;
memset(&SystemInformation[2], 0i64, 0x40u);
SystemInformation[0] = 0i64;
SessionWsEntry = 0i64;
SessionWsEntry_16 = 0i64;
v48 = 0i64;
IsAppContainerContext = 0;
memset(&DeepFreezeStats, 0, sizeof(DeepFreezeStats));
StoreSizeInBytes = 0i64;
*(_OWORD *)Context = 0i64;
v38 = 0i64;
v5 = 0i64;
v44 = 0i64;
v6 = 0i64;
LODWORD(v7) = 0;
v8 = *((_QWORD *)Info + 2);
v42 = v8;
v9 = (unsigned int)Info[6];
if( (unsigned int)v9 < 0x10 )
{
v10 = -1073741789;
goto LABEL_63;
}
if( PreviousMode )
ProbeForWrite(v8, v9, 8i64);
v51 = *(_OWORD *)v8;
*(_DWORD *)(v8 + 8) = 0;
if( (_DWORD)v51 != 8 || (DWORD1(v51) & 0xFFFFFFF8) != 0 || (BYTE4(v51) & 3) == 3 )
{
v10 = -1073741811;
goto LABEL_63;
}
if( SeSinglePrivilegeCheck(*(_QWORD *)&SeProfileSingleProcessPrivilege, PreviousMode) )
{
v34 = 1;
}
else
{
IsAppContainerOrIdentifyLevelContext = SeIsAppContainerOrIdentifyLevelContext(0i64, &IsAppContainerContext);
v10 = IsAppContainerOrIdentifyLevelContext;
if( IsAppContainerOrIdentifyLevelContext == -1073741659 )
{
IsAppContainerContext = 1;
}
else if( IsAppContainerOrIdentifyLevelContext < 0 )
{
goto LABEL_63;
}
v34 = 0;
v8 = v42;
}
if( !IsAppContainerContext )
{
*(_QWORD *)&Context[2] = 1i64;
for( i = 0i64; ; i = NextSession )
{
NextSession = (_EPROCESS *)MmGetNextSession(i);
v5 = NextSession;
if( !NextSession )
break;
++*(_QWORD *)&Context[2];
}
}
for( j = 0i64; ; j = NextProcess )
{
NextProcess = ExGetNextProcess(j, 0);
v6 = NextProcess;
if( !NextProcess )
break;
++*(_QWORD *)&Context[2];
}
if( *(_QWORD *)&Context[2] > 0xFFFFFFFFui64 || (v16 = 96i64 * *(_QWORD *)&Context[2] + 16, v16 > 0xFFFFFFFF) )
{
v10 = -1073741670;
goto LABEL_63;
}
LODWORD(v7) = 96 * Context[2] + 16;
v17 = v43[6];
if( (unsigned int)v16 > v17 )
{
v10 = -1073741789;
goto LABEL_63;
}
HIDWORD(v38) = (v17 - 16) / 0x60;
*(_QWORD *)Context = v8;
if( !IsAppContainerContext )
{
memset(NewSource, 0i64, sizeof(NewSource));
RtlStringCbCopyA((INT8 *)&NewSource[13], 0x10ui64, (INT8 *)"KernelSpace");
ZwQuerySystemInformation();
v10 = v19;
if( v19 < 0 )
goto LABEL_63;
MmQuerySystemMemoryInformation(SystemInformation, v18);
v10 = v20;
if( v20 < 0 )
goto LABEL_63;
*(_QWORD *)&NewSource[8] = *(_QWORD *)&SystemInformation[2] >> 12;
v21 = *(_QWORD *)&SystemInformation[0];
if( *(_QWORD *)&SystemInformation[0] <= *(_QWORD *)&SystemInformation[2] >> 12 )
v21 = *(_QWORD *)&SystemInformation[2] >> 12;
*(_QWORD *)&NewSource[10] = v21;
v10 = PfpPrivSourceAdd(Context, NewSource);
if( v10 < 0 )
goto LABEL_63;
for( k = 0i64; ; k = v5 )
{
v5 = (_EPROCESS *)MmGetNextSession(k);
if( !v5 )
break;
memset(NewSource, 0i64, sizeof(NewSource));
NewSource[0] = 1;
NewSource[1] = MmGetSessionIdEx(v5);
if( v34 )
{
LODWORD(v23) = MmGetSessionGlobalVA(v5);
*(_QWORD *)&NewSource[6] = v23;
}
MiFillSessionWorkingSetEntry((_SYSTEM_WORKINGSET_ENTRY *)&SessionWsEntry, v5->Session);
*(_QWORD *)&NewSource[8] = v48;
*(_QWORD *)&NewSource[20] = *((_QWORD *)&SessionWsEntry + 1);
*(_QWORD *)&NewSource[18] = *((_QWORD *)&SessionWsEntry_16 + 1);
*(_QWORD *)&NewSource[10] = SessionWsEntry_16;
RtlStringCbCopyA((INT8 *)&NewSource[13], 0x10ui64, (INT8 *)"Session");
v10 = PfpPrivSourceAdd(Context, NewSource);
if( v10 < 0 )
goto LABEL_63;
}
}
v6 = ExGetNextProcess(0i64, IsAppContainerContext);
if( v6 )
{
v24 = BYTE4(v51) & 4;
v36 = v24;
do
{
memset(NewSource, 0i64, sizeof(NewSource));
if( !v24 || (v6->Flags3 & 1) == 0 )
{
NewSource[0] = 2;
NewSource[1] = (PF_PRIVSOURCE_INFO)v6->UniqueProcessId;
NewSource[2] = v6->ImagePathHash;
*(_QWORD *)&NewSource[4] = ((__int64)v6->UniqueProcessId ^ v6->CreateTime.QuadPart) & 0x1FFFFFFFFFFFFFFFi64;
v25 = *(_EPROCESS **)&NewSource[6];
if( v34 )
v25 = v6;
*(_QWORD *)&NewSource[6] = v25;
WorkingSetPrivateSize = v6->Vm.Instance.WorkingSetPrivateSize;
*(_QWORD *)&NewSource[8] = WorkingSetPrivateSize;
WorkingSetSize = v6->Vm.Instance.WorkingSetSize;
if( WorkingSetPrivateSize > WorkingSetSize )
WorkingSetSize = WorkingSetPrivateSize;
*(_QWORD *)&NewSource[20] = WorkingSetSize;
NumberOfPrivatePages = v6->NumberOfPrivatePages;
*(_QWORD *)&NewSource[10] = NumberOfPrivatePages;
if( NumberOfPrivatePages <= *(_QWORD *)&NewSource[8] )
NumberOfPrivatePages = *(_QWORD *)&NewSource[8];
*(_QWORD *)&NewSource[10] = NumberOfPrivatePages;
NewSource[12] = MmGetSessionIdEx(v6);
SystemAppIdentifier[0] = 0;
PsQueryProcessAttributes(v6, (UINT8 *)SystemAppIdentifier, 0i64);
v29 = SmStoreExistsForProcess(v6);
v30 = NewSource[23] & 0xFFFFFFF6 | SystemAppIdentifier[0] & 1 | (8 * (v29 & 1));
NewSource[23] = v30;
PsGetProcessDeepFreezeStats(v6, &DeepFreezeStats);
if( DeepFreezeStats.FreezeUnbiasedTime )
{
v30 |= 2u;
NewSource[23] = v30;
NewSource[22] = DeepFreezeStats.FreezeUnbiasedTime / 0x2710;
}
if( v6->Vm.Instance.Flags.MemoryPriority == 2 )
NewSource[23] = v30 | 4;
RtlStringCbCopyA((INT8 *)&NewSource[13], 0x10ui64, (INT8 *)v6->ImageFileName);
if( (BYTE4(v51) & 1) != 0 )
{
MmQueryProcessWorkingSetSwapPages(v6, (UINT64 *)&NewSource[18]);
}
else if( (BYTE4(v51) & 2) != 0 && SmProcessQueryStoreStats(v6, &StoreSizeInBytes, 0i64) >= 0 )
{
*(_QWORD *)&NewSource[18] = StoreSizeInBytes >> 12;
}
v10 = PfpPrivSourceAdd(Context, NewSource);
if( v10 < 0 )
goto LABEL_63;
v24 = v36;
}
v6 = ExGetNextProcess(v6, IsAppContainerContext);
}
while( v6 );
}
LODWORD(v7) = 96 * v38 + 16;
v10 = 0;
LABEL_63:
if( v5 )
HalPutDmaAdapter((PADAPTER_OBJECT)v5);
if( v6 )
ObfDereferenceObjectWithTag(v6, 0x6E457350ui64);
if( v10 == -1073741789 )
{
v31 = *(_QWORD *)&Context[2];
if( (unsigned __int64)(unsigned int)(v38 + 1) > *(_QWORD *)&Context[2] )
v31 = (unsigned int)(v38 + 1);
v7 = 96 * v31 + 16;
if( v7 > 0xFFFFFFFF )
{
LODWORD(v7) = 0;
v10 = -1073741670;
}
}
*(_DWORD *)v41 = v7;
return v10;
}Referenced by:
PfQuerySuperfetchInformation