MiProbeLockFrame
NTSTATUS __stdcall MiProbeLockFrame(_MI_PROBE_PACKET *Packet){
unsigned __int64 v1;
_MI_PROBE_PACKET v3;
_MMPTE *PteBase;
_MMPFN *PfnDb;
unsigned __int64 v6;
_MMPFN *v7;
UINT8 v8;
unsigned __int16 ReferenceCount;
unsigned __int64 EntireField;
_MI_LOCK_PAGE_TABLE_TYPE v11;
__int64 v12;
__int64 v13;
bool v14;
int v15;
unsigned __int64 v16;
unsigned __int64 v17;
_MI_PARTITION *v18;
signed __int32 v19;
signed __int32 v20;
_MI_RESAVAIL_CHARGE v21;
union {unsigned __int64 Long;volatile unsigned __int64 VolatileLong;_MMPTE_HARDWARE Hard;_MMPTE_PROTOTYPE Proto;_MMPTE_SOFTWARE Soft;_MMPTE_TIMESTAMP TimeStamp;_MMPTE_TRANSITION Trans;_MMPTE_SUBSECTION Subsect;_MMPTE_LIST List;} v22;
char v23;
int v24;
__int64 v25;
_MMPFN *v26;
NTSTATUS result;
int v28;
__int64 bf_0;
_MMVAD *Address;
union {unsigned int LongFlags;_MMVAD_FLAGS VadFlags;_MM_PRIVATE_VAD_FLAGS PrivateVadFlags;_MM_GRAPHICS_VAD_FLAGS GraphicsVadFlags;_MM_SHARED_VAD_FLAGS SharedVadFlags;volatile unsigned int VolatileVadLong;} v31;
UINT8 PageIrql;
UINT64 SpinCount;
UINT64 v34;
v1 = *((_QWORD *)Packet + 16);
if( v1 > 0xFFFFFFFFFi64 || (MmGetPfnDb()[v1].u4._bf_0 & 0x4000000000000i64) == 0 )
{
if( !*((_QWORD *)Packet + 10)
|| (Address = MiLocateAddress(*(VOID **)Packet)) != 0i64
&& ((v31.LongFlags = (unsigned int)Address->Core.u, (v31.LongFlags & 0x70) == 64) || (v31.LongFlags & 0x70) == 16) )
{
result = MiReferenceIoPages(0, *((_QWORD *)Packet + 16), 1i64, 0, 0i64, 0i64);
if( result >= 0 )
{
*(_WORD *)(*((_QWORD *)Packet + 7) + 10i64) |= 0x800u;
return 0;
}
else
{
++*(&stru_140C4DB30 + 619);
}
}
else
{
++*(&stru_140C4DB30 + 618);
return -1073741819;
}
return result;
}
v3 = Packet[16];
PageIrql = 17;
PteBase = MmGetPteBase();
PfnDb = MmGetPfnDb();
if( (v3 & 0xF) != 4
|| (v6 = *(_QWORD *)Packet, MI_IS_PHYSICAL_ADDRESS(*(VOID **)Packet))
|| (v7 = MiLockNonPagedPoolPte((unsigned int)PteBase + ((v6 >> 9) & 0xFFFFFFF8), &PageIrql),
v1 = v7 - PfnDb,
*((_QWORD *)Packet + 16) = v1,
!v7) )
{
v7 = &PfnDb[v1];
PageIrql = 17;
LODWORD(SpinCount) = 0;
while( _interlockedbittestandset64((volatile signed __int32 *)&v7->u2, 0x3Fui64) )
{
do
KeYieldProcessorEx(&SpinCount);
while( v7->u2._bf_0 < 0 );
}
}
v8 = *((_BYTE *)&v7->u3 + 2);
if( (v8 & 7u) <= 1 || (ReferenceCount = v7->u3.ReferenceCount) == 0 )
{
_InterlockedAnd64(&v7->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
if( PageIrql != 17 )
__writecr8(PageIrql);
++*(&stru_140C4DB30 + 615);
return -1073741819;
}
if( ReferenceCount >= 0x7FFFu )
goto LABEL_71;
EntireField = v7->u4.EntireField;
v11 = PageTableLockShared;
v12 = 1023i64;
if( (EntireField & 0x1000000000i64) == 0 && (EntireField & 0x2000000000000i64) == 0 )
{
v13 = v7->u2._bf_0 & 0x3FFFFFFFFFFFFFFFi64;
if( ReferenceCount == 1 )
{
if( v13 )
goto LABEL_20;
}
else if( ReferenceCount != 2 || !v13 )
{
goto LABEL_37;
}
if( (v8 & 8) != 0 )
{
LABEL_20:
v14 = 0;
LOBYTE(v15) = MI_PFN_IS_PROTO((_UNICODE_STRING *)v7, (_UNICODE_STRING *)EntireField, v8, (PWCHAR)0x3FF);
if( v15 && (*(_DWORD *)(&v7->3 + 1) & 0x400i64) != 0 )
{
v14 = 1;
}
else
{
v8 = 0;
v17 = v7->PteLong | 0x8000000000000000ui64;
if( v17 <= (unsigned __int64)&PteBase[0x7FFFFFFEFi64] && v17 >= (unsigned __int64)PteBase )
v14 = (*((_BYTE *)&v7->u3 + 3) & 0x20) != 0;
}
v18 = *(_MI_PARTITION **)(*(&stru_140C4DB30 + 267) + 8 * (v12 & (v16 >> 39)));
if( !v14 || MiChargeCommit(v18, 1ui64, 8ui64) )
{
if( v18 == &Irp )
{
EntireField = (unsigned __int64)KeGetCurrentPrcb();
v19 = *(_DWORD *)(EntireField + 33564);
while( v19 )
{
if( v19 == -1 )
break;
v20 = v19;
v19 = _InterlockedCompareExchange((volatile signed __int32 *)(EntireField + 33564), v19 - 1, v19);
if( v20 == v19 )
goto LABEL_37;
}
}
v21 = MiChargePartitionResidentAvailable(v18, 1ui64, 0i64);
if( v21 == MiChargeFailed && v14 )
MiReturnCommit(v18, 1ui64);
if( v21 )
goto LABEL_37;
}
LABEL_71:
_InterlockedAnd64(&v7->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
if( PageIrql != 17 )
__writecr8(PageIrql);
++*(&stru_140C4DB30 + 616);
return -1073741663;
}
}
LABEL_37:
++v7->u3.ReferenceCount;
if( (v7->u2._bf_0 & 0x3FFFFFFFFFFFFFFFi64) == 0 )
{
v22.Long = (unsigned __int64)v7->OriginalPte.u;
if( (v22.Long & 0x400) == 0 && (v22.Long & 4) != 0 )
*(_BYTE *)(*(_QWORD *)(*(&stru_140C4DB30 + 267) + 8 * (((unsigned __int64)v7->u4._bf_0 >> 39) & 0x3FF)) + 675i64) = 1;
}
v23 = *((_BYTE *)&v7->u3 + 2);
if( (v23 & 0x20) != 0 && (v23 & 8) == 0 && (v7->u2._bf_0 & 0x3FFFFFFFFFFFFFFFi64) == 0 )
_InterlockedIncrement64((volatile signed __int64 *)(v7->u1.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0
+ 232));
_InterlockedAnd64(&v7->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
if( PageIrql != 17 )
__writecr8(PageIrql);
if( (Packet[16] & 0xF) == 1 )
{
EntireField = v7->u4.EntireField;
if( (EntireField & 0x1000000000i64) == 0 && ((EntireField >> 60) & 7) != 1 )
{
EntireField &= 0xFFFFFFFFFui64;
if( EntireField != 0xFFFFFFFFDi64 && *((_QWORD *)Packet + 17) != EntireField )
{
LOBYTE(v24) = MI_PFN_IS_PROTO((_UNICODE_STRING *)v7, (_UNICODE_STRING *)EntireField, v8, (PWCHAR)v12);
if( !v24 )
{
v26 = &MmGetPfnDb()[v25];
v11 = PageTableLockPrivateFork;
}
if( !MiLockPageTablePage(v26, v11) )
{
LODWORD(v34) = 0;
while( _interlockedbittestandset64((volatile signed __int32 *)&v7->u2, 0x3Fui64) )
{
do
KeYieldProcessorEx(&v34);
while( v7->u2._bf_0 < 0 );
}
MiRemoveLockedPageChargeAndDecRef(v7);
_InterlockedAnd64(&v7->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
++*(&stru_140C4DB30 + 617);
return -1073741663;
}
*((_QWORD *)Packet + 17) = v7->u4._bf_0 & 0xFFFFFFFFFi64;
*(_WORD *)(*((_QWORD *)Packet + 7) + 10i64) |= 0x100u;
}
}
}
if( *(char *)(*((_QWORD *)Packet + 7) + 10i64) < 0 )
{
LOBYTE(v28) = MI_PFN_IS_PROTO((_UNICODE_STRING *)v7, (_UNICODE_STRING *)EntireField, v8, (PWCHAR)v12);
if( v28 )
{
bf_0 = v7->OriginalPte.u.Hard.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0;
if( (bf_0 & 0x400) != 0 )
{
if( *(&stru_140C4DB30 + 42) && (bf_0 & 0x10) == 0 )
bf_0 &= ~*(&stru_140C4DB30 + 42);
_InterlockedIncrement64((volatile signed __int64 *)(*(_QWORD *)(bf_0 >> 16) + 112i64));
}
}
}
if( (((unsigned __int64)v7->u4._bf_0 >> 39) & 0x3FF) != 0 )
ExAcquireRundownProtectionCacheAware(*(_EX_RUNDOWN_REF_CACHE_AWARE **)(*(_QWORD *)(*(&stru_140C4DB30 + 267)
+ 8
* (((unsigned __int64)v7->u4._bf_0 >> 39) & 0x3FF))
+ 2144i64));
return 0;
}Referenced by:
MiProbeAndLockPages
MmProbeAndLockSelectedPages