MiMakePerSessionProtoPte
NTSTATUS __stdcall MiMakePerSessionProtoPte(INT64 a1, INT64 a2){
__int64 v2;
__int64 v3;
unsigned int SessionId;
unsigned int v6;
_CONTROL_AREA *ControlArea;
__int64 v8;
__int64 v9;
_RTL_BALANCED_NODE *SharedProtos;
_SUBSECTION *Subsection;
v3 = v2;
SessionId = MmGetSessionIdEx((_EPROCESS *)a1);
v6 = MmGetSessionIdEx((_EPROCESS *)a2);
if( SessionId == v6 )
return ZeroPte.u.Long;
Subsection = *(_SUBSECTION **)(v3 + 72);
ControlArea = Subsection->ControlArea;
if( (Subsection->ControlArea->u.LongFlags & 0x4000000) == 0 )
return ZeroPte.u.Long;
MiGetProtoPteAddress();
if( !v8 || (Subsection->u.SubsectionFlags._bf_2 & 2) == 0 )
return ZeroPte.u.Long;
v9 = (signed __int64)(v8 - (unsigned __int64)MiGetSharedProtos(ControlArea, SessionId, Subsection)[3].Children[0]) >> 3;
SharedProtos = MiGetSharedProtos(ControlArea, v6, Subsection);
return MiSwizzleInvalidPte((((__int64)SharedProtos[3].Children[0] + 8 * v9) << 16) | 0x400);
}Referenced by:
MiBuildForkPte