MiFreeUnusedPfnPages
VOID __stdcall MiFreeUnusedPfnPages(VOID *Context){
_MI_PARTITION *v1;
unsigned int SessionId;
_ETHREAD *CurrentThread;
_EX_PUSH_LOCK *p_DynamicMemoryPushLock;
_ETHREAD *v6;
unsigned __int8 v7;
int v8;
bool v9;
__int64 v10;
_KLOCK_ENTRY *v11;
__int64 v12;
_ETHREAD *v13;
unsigned int v14;
unsigned __int8 v15;
int v16;
__int64 v17;
_KLOCK_ENTRY *v18;
__int64 v19;
CHAR v20;
unsigned __int8 v21;
int v22;
__int64 v23;
_KLOCK_ENTRY *v24;
__int64 v25;
char a3[12];
__int64 v27[2];
int v28;
int v29;
__int128 v30[6];
UINT64 v31;
int v32;
int v33;
UINT64 v34;
v29 = 0;
v1 = &Irp;
v28 = 0;
v27[0] = (__int64)Context;
v27[1] = (__int64)v30;
if( Context )
v1 = (_MI_PARTITION *)Context;
memset(v30, 0, 32);
SessionId = -1;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
*(_QWORD *)&a3[4] = CurrentThread;
p_DynamicMemoryPushLock = &v1->Core.DynamicMemoryPushLock;
while( 1 )
{
--CurrentThread->Tcb.SpecialApcDisable;
ExAcquirePushLockExclusiveEx(&v1->Core.DynamicMemoryPushLock, 0i64);
if( !Context && v1->Core.PfnUnmapActive == 1 )
{
if( (_InterlockedExchangeAdd64(&p_DynamicMemoryPushLock->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(&v1->Core.DynamicMemoryPushLock);
LODWORD(v34) = 0;
v6 = (_ETHREAD *)KeGetCurrentThread();
if( MiGetSystemRegionType((UINT64)&v1->Core.DynamicMemoryPushLock) == 1 )
SessionId = MmGetSessionIdEx(v6->Tcb.ApcState.Process);
--v6->Tcb.SpecialApcDisable;
v21 = ++v6->Tcb.AbAllocationRegionCount;
v22 = ((char)v6->Tcb.AbEntrySummary | (char)v6->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
while( 1 )
{
v9 = !_BitScanReverse((unsigned int *)&v23, v22);
v33 = v23;
if( v9 )
break;
v24 = &v6->Tcb.LockEntries[v23];
v22 &= ~(1 << v23);
if( (v24->AcquiredByte & 1) != 0
&& (v24->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v24->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == ((unsigned __int64)p_DynamicMemoryPushLock & 0x7FFFFFFFFFFFFFFCi64)
&& v24->LockState.SessionId == SessionId )
{
v24->AcquiredByte &= ~1u;
if( v24->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
{
if( v24 )
{
v24->CrossThreadReleasableAndBusyByte |= 2u;
if( v24->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v24);
LODWORD(v34) = v24->BoostBitmap.AllFields & 0x1FFFF;
v24->BoostBitmap.AllFields &= 0xFFFE0000;
v24->ThreadLocalFlags &= ~1u;
v24->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v25 = v24 - v6->Tcb.LockEntries;
if( v21 == 1 )
v6->Tcb.AbEntrySummary |= 1 << v25;
else
_InterlockedOr8((volatile signed __int8 *)&v6->Tcb.AbOrphanedEntrySummary, 1 << v25);
goto LABEL_74;
}
break;
}
}
}
if( (*(&v6->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, v6, p_DynamicMemoryPushLock, (PVOID)SessionId, 0i64);
LABEL_74:
--v6->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v6->Tcb, p_DynamicMemoryPushLock, &v34);
v9 = v6->Tcb.SpecialApcDisable++ == -1;
if( !v9 )
goto LABEL_25;
LABEL_27:
if( ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v6->Tcb.ApcState.ApcListHead[0].Flink != &v6->Tcb.152 )
KiCheckForKernelApcDelivery();
goto LABEL_25;
}
KeGenericCallDpc((__int64)MiFreeUnusedPfnPagesDpc, (__int64)v27);
if( v28 != 259 )
break;
if( (_InterlockedExchangeAdd64(&p_DynamicMemoryPushLock->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(&v1->Core.DynamicMemoryPushLock);
LODWORD(v31) = 0;
v13 = (_ETHREAD *)KeGetCurrentThread();
if( MiGetSystemRegionType((UINT64)&v1->Core.DynamicMemoryPushLock) == 1 )
v14 = MmGetSessionIdEx(v13->Tcb.ApcState.Process);
else
v14 = -1;
--v13->Tcb.SpecialApcDisable;
v15 = ++v13->Tcb.AbAllocationRegionCount;
v16 = ((char)v13->Tcb.AbEntrySummary | (char)v13->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
while( 1 )
{
v9 = !_BitScanReverse((unsigned int *)&v17, v16);
v32 = v17;
if( v9 )
break;
v18 = &v13->Tcb.LockEntries[v17];
v16 &= ~(1 << v17);
if( (v18->AcquiredByte & 1) != 0
&& (v18->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v18->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == ((unsigned __int64)p_DynamicMemoryPushLock & 0x7FFFFFFFFFFFFFFCi64)
&& v18->LockState.SessionId == v14 )
{
v18->AcquiredByte &= ~1u;
if( v18->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
{
if( v18 )
{
v18->CrossThreadReleasableAndBusyByte |= 2u;
if( v18->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v18);
LODWORD(v31) = 0;
LODWORD(v31) = v18->BoostBitmap.AllFields & 0x1FFFF;
v18->BoostBitmap.AllFields &= 0xFFFE0000;
v18->ThreadLocalFlags &= ~1u;
v18->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v19 = v18 - v13->Tcb.LockEntries;
if( v15 == 1 )
v13->Tcb.AbEntrySummary |= 1 << v19;
else
_InterlockedOr8((volatile signed __int8 *)&v13->Tcb.AbOrphanedEntrySummary, 1 << v19);
goto LABEL_49;
}
break;
}
}
}
if( (*(&v13->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, v13, &v1->Core.DynamicMemoryPushLock, (PVOID)v14, 0i64);
LABEL_49:
--v13->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v13->Tcb, &v1->Core.DynamicMemoryPushLock, &v31);
v9 = v13->Tcb.SpecialApcDisable++ == -1;
if( v9 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v13->Tcb.ApcState.ApcListHead[0].Flink != &v13->Tcb.152 )
KiCheckForKernelApcDelivery();
CurrentThread = *(_ETHREAD **)&a3[4];
KiLeaveGuardedRegionUnsafe(*(__int64 *)&a3[4]);
if( !v27[0] )
return;
KeWaitForGate((_KGATE *)((char *)v30 + 8), WrVirtualMemory, v20);
}
v1->Core.PfnUnmapCount = 0i64;
v1->Core.PfnUnmapActive = 0;
if( (_InterlockedExchangeAdd64(&p_DynamicMemoryPushLock->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(&v1->Core.DynamicMemoryPushLock);
*(_DWORD *)a3 = 0;
v6 = (_ETHREAD *)KeGetCurrentThread();
if( MiGetSystemRegionType((UINT64)&v1->Core.DynamicMemoryPushLock) == 1 )
SessionId = MmGetSessionIdEx(v6->Tcb.ApcState.Process);
--v6->Tcb.SpecialApcDisable;
v7 = ++v6->Tcb.AbAllocationRegionCount;
v8 = ((char)v6->Tcb.AbEntrySummary | (char)v6->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
while( 1 )
{
v9 = !_BitScanReverse((unsigned int *)&v10, v8);
if( v9 )
break;
v11 = &v6->Tcb.LockEntries[v10];
v8 &= ~(1 << v10);
if( (v11->AcquiredByte & 1) != 0
&& (v11->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v11->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == ((unsigned __int64)p_DynamicMemoryPushLock & 0x7FFFFFFFFFFFFFFCi64)
&& v11->LockState.SessionId == SessionId )
{
v11->AcquiredByte &= ~1u;
if( v11->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
{
if( v11 )
{
v11->CrossThreadReleasableAndBusyByte |= 2u;
if( v11->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v11);
*(_DWORD *)a3 = v11->BoostBitmap.AllFields & 0x1FFFF;
v11->BoostBitmap.AllFields &= 0xFFFE0000;
v11->ThreadLocalFlags &= ~1u;
v11->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v12 = v11 - v6->Tcb.LockEntries;
if( v7 == 1 )
v6->Tcb.AbEntrySummary |= 1 << v12;
else
_InterlockedOr8((volatile signed __int8 *)&v6->Tcb.AbOrphanedEntrySummary, 1 << v12);
goto LABEL_24;
}
break;
}
}
}
if( (*(&v6->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, v6, p_DynamicMemoryPushLock, (PVOID)SessionId, 0i64);
LABEL_24:
--v6->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v6->Tcb, p_DynamicMemoryPushLock, (UINT64 *)a3);
v9 = v6->Tcb.SpecialApcDisable++ == -1;
if( v9 )
goto LABEL_27;
LABEL_25:
KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
}Referenced by:
MiInitNucleus