MiTranslatePageForCopy
VOID __fastcall MiTranslatePageForCopy(
VOID *VirtualAddress,
_MMSUPPORT_INSTANCE **VmOut,
UINT64 *PageFrameIndexOut,
_MMPFN **LockedProtoPfnOut,
UINT8 *WsIrqlOut,
UINT64 *FillPattern){
UINT64 *v6;
unsigned __int64 v10;
_MMPFN *PfnDb;
int v12;
NTSTATUS SystemRegionType;
VOID *v14;
INT64 v15;
_MI_WORKING_SET_TYPE v16;
_MMSUPPORT_INSTANCE *SessionVm;
INT64 v18;
__int128 v19;
__int64 v20;
__int64 bf_0;
UINT64 v22;
UINT64 v23;
__int64 v24;
_MIPFNBLINK *p_u2;
_MMSUPPORT_INSTANCE *v26;
UINT64 v27;
UINT64 v28;
__int64 v29;
unsigned __int64 v30;
__int16 v31;
__int64 v32;
__int64 v33;
_MIPFNBLINK *v34;
_MMSUPPORT_FULL *p_Vm;
char v36;
_MMPTE *v37;
__int64 v38;
__int64 v39;
_MMPFN *v40;
_MMSUPPORT_INSTANCE *v41;
_MMPFN *v42;
char v43;
__int64 v44;
_MMPFN *v45;
__int64 v46;
unsigned __int64 v47;
INT64 v48;
int v49;
_MMPFN *v50;
_MMPFN *v51;
UINT64 v52;
ULONG_PTR v53;
UINT8 v54;
char v55;
NTSTATUS PagingFileOffset;
UINT8 v57;
UINT64 *PageIrql;
UINT64 v59;
UINT8 WsIrql[4];
UINT64 SpinCount;
char ProtectCode[12];
INT64 v63;
_MMPFN **v64;
UINT8 *v65;
_MMVAD *VadOut;
_MMPFN v67[3];
v6 = PageFrameIndexOut;
VadOut = 0i64;
v63 = 0i64;
*(_DWORD *)ProtectCode = 0;
*(_QWORD *)&ProtectCode[4] = PageFrameIndexOut;
v65 = WsIrqlOut;
v64 = LockedProtoPfnOut;
memset(v67, 0i64, 0x88u);
memset(VmOut, 0i64, 0x80u);
v10 = -1i64;
*v6 = -1i64;
*LockedProtoPfnOut = 0i64;
*(_QWORD *)WsIrqlOut = 0i64;
MiInitializePageFaultPacket(0i64, (UINT64)VirtualAddress, 0, 0i64, (INT64)v67);
if( (unsigned __int64)(((__int64)VirtualAddress >> 47) + 1) > 1
|| VirtualAddress >= MmGetPteBase() && VirtualAddress <= MmGetPteLimit() )
{
return;
}
PfnDb = MmGetPfnDb();
if( VirtualAddress >= PfnDb && VirtualAddress < &PfnDb[0x1000000000i64] )
return;
if( (unsigned __int64)VirtualAddress >= 0xFFFF800000000000ui64 )
{
LOBYTE(v12) = MiVaIsUltra((UINT64)VirtualAddress);
if( v12 )
return;
}
if( (unsigned __int64)VirtualAddress >= *(&stru_140C4DB30 + 937)
&& (unsigned __int64)VirtualAddress <= *(&stru_140C4DB30 + 175) )
{
p_Vm = &KeGetCurrentThread()->ApcState.Process->Vm;
v67[1].PteLong = (unsigned __int64)p_Vm;
MiLockWorkingSetShared();
bf_0 = v67[0].u2._bf_0;
*((_BYTE *)&v67[1].3 + 20) = v36;
v37 = MiLockLowestValidPageTable((INT64)p_Vm, (INT64 *)v67[0].u2._bf_0, (INT64 **)&v63);
v67[1].u2._bf_0 = (__int64)v37;
if( v37 != (_MMPTE *)((char *)MmGetPdeBase() + (((unsigned __int64)VirtualAddress >> 18) & 0x3FFFFFF8)) )
{
LODWORD(v38) = MI_READ_PTE_LOCK_FREE(v63);
LODWORD(v20) = v38 != 0 ? -1073741608 : -1073741819;
goto LABEL_26;
}
goto LABEL_21;
}
SystemRegionType = MiGetSystemRegionType((UINT64)VirtualAddress);
switch( SystemRegionType )
{
case 8:
v16 = MiWorkingSetTypeSystemCache;
break;
case 1:
SessionVm = MiGetSessionVm(v15, (INT64)v14, 1);
if( !SessionVm )
return;
goto LABEL_18;
case 6:
v16 = MiWorkingSetTypePagedPool;
break;
case 9:
v16 = MiWorkingSetTypeSystemPtes;
break;
default:
v16 = MiWorkingSetTypeSystemViews;
if( SystemRegionType != 12 && SystemRegionType != 3 )
v16 = MiWorkingSetTypeNonPagedPool;
break;
}
SessionVm = MiGetAnyMultiplexedVm(v16, v14);
LABEL_18:
*((_DWORD *)VmOut + 1) |= 4u;
if( MiSynchronizeSystemVa((INT64)SessionVm, (UINT64)VirtualAddress, v18, 0i64, (INT64)VmOut) )
{
v19 = *(_OWORD *)(VmOut + 3);
v20 = *((int *)VmOut + 4);
v67[1].u2._bf_0 = (__int64)VmOut[5];
*(_OWORD *)&v67[1].PteLong = v19;
if( !(_DWORD)v20 )
{
bf_0 = v67[0].u2._bf_0;
LABEL_21:
LOBYTE(PageIrql) = 17;
LODWORD(v20) = 0;
LODWORD(v22) = MI_READ_PTE_LOCK_FREE(bf_0);
v59 = v22;
v23 = v22;
if( (v22 & 1) != 0 )
{
LABEL_22:
MiPteInShadowRange((UINT64)&v59);
v10 = (v23 >> 12) & 0xFFFFFFFFFi64;
v24 = 6 * v10;
if( (((unsigned __int64)MmGetPfnDb()[v10].u4._bf_0 >> 50) & 1) != 0 )
{
HIDWORD(SpinCount) = 0;
p_u2 = &MmGetPfnDb()->u2;
while( _interlockedbittestandset64((volatile signed __int32 *)&p_u2[v24], 0x3Fui64) )
{
do
KeYieldProcessorEx((UINT64 *)((char *)&SpinCount + 4));
while( p_u2[v24]._bf_0 < 0 );
}
}
else
{
LODWORD(v20) = -1073741503;
}
goto LABEL_25;
}
v39 = v22;
while( (v39 & 0x400) == 0 )
{
if( (v39 & 0x3E0) == 768 || (v39 & 0x3E0) == 0 )
goto LABEL_78;
if( (v39 & 0x800) == 0 )
{
if( MiGetPagingFileOffset((_MMPTE *)&v59) )
goto LABEL_80;
LABEL_68:
LODWORD(v20) = 273;
goto LABEL_25;
}
v40 = MiLockTransitionLeafPage(bf_0, &PageIrql);
v42 = v40;
if( v40 )
{
v43 = *((_BYTE *)&v40->u3 + 2);
if( (v43 & 0x20) == 0 )
{
v44 = (unsigned __int128)(((char *)v42 - (char *)MmGetPfnDb()) * (__int128)0x2AAAAAAAAAAAAAABi64) >> 64;
v10 = ((unsigned __int64)v44 >> 63) + (v44 >> 3);
goto LABEL_25;
}
if( (v43 & 8) == 0 )
{
v45 = 0i64;
LABEL_79:
LOBYTE(v41) = (_BYTE)PageIrql;
*(_DWORD *)WsIrql = 1;
MiWaitForCollidedFaultComplete(v67, v42, v45, v41, (UINT8)WsIrql, v57, PageIrql);
}
LABEL_80:
LODWORD(v20) = -1073741608;
LABEL_25:
v6 = *(UINT64 **)&ProtectCode[4];
goto LABEL_26;
}
LODWORD(v22) = MI_READ_PTE_LOCK_FREE(bf_0);
v59 = v22;
v39 = v22;
v23 = v22;
if( (v22 & 1) != 0 )
goto LABEL_22;
}
if( (v39 & 2) != 0 )
{
v46 = v39;
if( *(&stru_140C4DB30 + 42) && (v39 & 0x10) == 0 )
v46 = v39 & ~*(&stru_140C4DB30 + 42);
v47 = v39 & 0xFFFFFFFFFFFFFBFFui64;
if( (v46 & 0xFFFFFFFFFFFF0000ui64) != 0 )
v47 = v39;
*(_QWORD *)v65 = v47 & 0xFFFFFFFFFFFFFFFDui64;
goto LABEL_68;
}
if( *(&stru_140C4DB30 + 42) && (v39 & 0x10) == 0 )
v39 &= ~*(&stru_140C4DB30 + 42);
v48 = v39 >> 16;
LOBYTE(v49) = MiIsPrototypePteVadLookup(v22);
if( !v49 || (v48 = (INT64)MiCheckVirtualAddress(VirtualAddress, (UINT64 *)ProtectCode, &VadOut)) != 0 )
{
v50 = MiLockProtoPoolPage((_MMPTE *)v48, (UINT8 *)&PageIrql);
if( !v50 )
goto LABEL_80;
v51 = MiLockLeafPage((_MMPTE *)v48, 0i64);
LODWORD(v52) = MI_READ_PTE_LOCK_FREE(v48);
v59 = v52;
if( (v52 & 1) != 0 )
goto LABEL_81;
if( v52 )
{
if( (v52 & 0x400) != 0 )
{
v53 = (unsigned int)v50;
}
else
{
if( (v52 & 0x800) == 0 )
{
PagingFileOffset = MiGetPagingFileOffset((_MMPTE *)&v59);
v54 = (unsigned __int8)PageIrql;
v53 = (unsigned int)v50;
if( !PagingFileOffset )
{
MiUnlockProtoPoolPage((ULONG_PTR)v50, (UINT8)PageIrql);
goto LABEL_68;
}
LABEL_86:
MiUnlockProtoPoolPage(v53, v54);
goto LABEL_80;
}
v55 = *((_BYTE *)&v51->u3 + 2);
if( (v55 & 0x20) == 0 )
{
LABEL_81:
v10 = v51 - MmGetPfnDb();
*v64 = v50;
goto LABEL_25;
}
v53 = (unsigned int)v50;
if( (v55 & 8) == 0 )
{
MiObtainProtoReference(v50, 1ui64);
v45 = v50;
v42 = v51;
goto LABEL_79;
}
}
v54 = (unsigned __int8)PageIrql;
goto LABEL_86;
}
MiUnlockProtoPoolPage((ULONG_PTR)v50, (UINT8)PageIrql);
}
LABEL_78:
LODWORD(v20) = -1073741819;
goto LABEL_25;
}
LODWORD(v27) = MI_READ_PTE_LOCK_FREE(*(&v67[0].u2._bf_0 + v20));
v59 = v27;
v28 = v27;
MiPteInShadowRange((UINT64)&v59);
v29 = 1i64;
v10 = (v28 >> 12) & 0xFFFFFFFFFi64;
v30 = (unsigned __int64)v67[0].u1.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0 >> 12;
do
{
v31 = v30;
v30 >>= 9;
v32 = v29 * (v31 & 0x1FF);
v29 <<= 9;
v10 += v32;
LODWORD(v20) = v20 - 1;
}
while( (_DWORD)v20 );
if( v10 <= 0xFFFFFFFFFi64 )
{
v33 = 6 * v10;
if( (((unsigned __int64)MmGetPfnDb()[v10].u4._bf_0 >> 50) & 1) != 0 )
{
LODWORD(SpinCount) = 0;
v34 = &MmGetPfnDb()->u2;
while( _interlockedbittestandset64((volatile signed __int32 *)&v34[v33], 0x3Fui64) )
{
do
KeYieldProcessorEx(&SpinCount);
while( v34[v33]._bf_0 < 0 );
}
goto LABEL_25;
}
}
LODWORD(v20) = -1073741503;
LABEL_26:
v26 = (_MMSUPPORT_INSTANCE *)v67[1].u2._bf_0;
*(_OWORD *)(VmOut + 3) = *(_OWORD *)&v67[1].PteLong;
VmOut[5] = v26;
if( (int)v20 < 0 )
MiUnlockSystemVa((INT64)VmOut);
else
*v6 = v10;
}
}Referenced by:
MmCopyMemory