MiFindActualFaultingPte
_MMPTE *__stdcall MiFindActualFaultingPte(VOID *FaultingAddress){
UINT64 v1;
UINT64 v2;
_MMPTE *PdeBase;
_MMPTE *result;
_MMPTE *v6;
UINT64 v7;
int v8;
__int64 v9;
unsigned __int64 v10;
__int64 v11;
_MMPTE *v12;
char v13;
UINT64 ProtectCode;
_MMVAD *VadOut;
UINT64 v16[2];
__int128 v17;
__int64 FaultingAddressa[18];
v2 = v1;
VadOut = 0i64;
LODWORD(ProtectCode) = 0;
*(_OWORD *)v16 = 0i64;
v17 = 0i64;
memset(FaultingAddressa, 0i64, 0x88u);
PdeBase = MmGetPdeBase();
if( (*((_BYTE *)FaultingAddress + 69) & 1) == 0 )
{
result = (_MMPTE *)*((_QWORD *)FaultingAddress + 9);
if( result != (_MMPTE *)((char *)PdeBase + ((v2 >> 18) & 0x3FFFFFF8)) )
return result;
v6 = (_MMPTE *)((char *)MmGetPteBase() + ((v2 >> 9) & 0x7FFFFFFFF8i64));
LABEL_4:
LODWORD(v7) = MI_READ_PTE_LOCK_FREE((INT64)v6);
if( (v7 & 1) == 0 )
{
if( (v7 & 0x400) == 0 )
return v6;
LOBYTE(v8) = MiIsPrototypePteVadLookup(v7);
if( !v8 )
{
if( *(&stru_140C4DB30 + 42) )
{
if( (v9 & 0x10) != 0 )
v9 &= ~0x10ui64;
else
v9 &= ~*(&stru_140C4DB30 + 42);
}
v10 = v9 >> 16;
LABEL_11:
BYTE5(FaultingAddressa[8]) &= ~1u;
FaultingAddressa[0] = v10;
BYTE4(FaultingAddressa[8]) = 17;
WORD1(FaultingAddressa[8]) = 0;
FaultingAddressa[9] = (__int64)PdeBase + ((v10 >> 18) & 0x3FFFFFF8);
result = MiFindActualFaultingPte(FaultingAddressa);
if( result )
return result;
return v6;
}
v10 = (unsigned __int64)MiCheckVirtualAddress((VOID *)v2, &ProtectCode, &VadOut);
if( v10 )
goto LABEL_11;
}
return 0i64;
}
MiFillPteHierarchy(v2, v16);
v11 = 4i64;
while( 1 )
{
v12 = (_MMPTE *)v16[--v11];
v13 = MI_READ_PTE_LOCK_FREE((INT64)v12);
if( (v13 & 1) == 0 )
return v12;
if( v13 < 0 )
return 0i64;
if( v11 == 1 )
{
v6 = (_MMPTE *)v16[0];
goto LABEL_4;
}
}
}Referenced by:
MiFindActualFaultingPte
MiIsFaultPteIntact