ExpSaAllocatorAllocate
NTSTATUS __fastcall ExpSaAllocatorAllocate(UINT64 P2, UINT64 a2){
unsigned int v3;
char v4;
_ETHREAD *CurrentThread;
NTSTATUS Memory;
__int64 AbOrphanedEntrySummary;
unsigned int v8;
char v9;
__int64 v10;
NTSTATUS SessionId;
bool v12;
UINT64 v13;
_EX_SA_PAGE_GROUP_DESCRIPTOR *v14;
__int64 v15;
_ETHREAD *v17;
unsigned __int8 v18;
int v19;
__int64 v20;
_KLOCK_ENTRY *v21;
__int64 v22;
_EX_SA_PAGE_GROUP_DESCRIPTOR *v23;
VOID **v24;
VOID **v25;
_EX_SA_PAGE_GROUP_DESCRIPTOR *v26;
__int64 v27;
_ETHREAD *v28;
unsigned __int8 AbEntrySummary;
__int64 v30;
__int64 v31;
NTSTATUS v32;
VOID ***v33;
UINT64 a3;
__int64 v35[2];
unsigned int SizeInPointers;
UINT64 v37;
SizeInPointers = a2;
v3 = a2;
LODWORD(a3) = 0;
v4 = 0;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
Memory = -1;
--CurrentThread->Tcb.SpecialApcDisable;
if( ++CurrentThread->Tcb.AbAllocationRegionCount != 1 )
KeBugCheckEx(0x192u, CurrentThread, (PVOID)P2, (PVOID)KeGetCurrentIrql(), 0i64);
LOBYTE(AbOrphanedEntrySummary) = CurrentThread->Tcb.AbEntrySummary;
v8 = -1;
if( !(_BYTE)AbOrphanedEntrySummary )
{
if( !CurrentThread->Tcb.AbOrphanedEntrySummary )
{
v10 = 0i64;
goto LABEL_46;
}
AbOrphanedEntrySummary = CurrentThread->Tcb.AbOrphanedEntrySummary;
CurrentThread->Tcb.AbOrphanedEntrySummary = 0;
LOBYTE(AbOrphanedEntrySummary) = CurrentThread->Tcb.AbEntrySummary | AbOrphanedEntrySummary;
}
v9 = AbOrphanedEntrySummary;
_BitScanForward((unsigned int *)&AbOrphanedEntrySummary, (unsigned __int8)AbOrphanedEntrySummary);
CurrentThread->Tcb.AbEntrySummary = v9 & ~(1 << AbOrphanedEntrySummary);
v10 = (__int64)&CurrentThread->Tcb.LockEntries[AbOrphanedEntrySummary];
if( v10 )
{
if( P2 >= 0xFFFF800000000000ui64 && *((_BYTE *)&MiState[1537] + ((P2 >> 39) & 0x1FF)) == 1 )
SessionId = MmGetSessionIdEx(CurrentThread->Tcb.ApcState.Process);
else
SessionId = -1;
*(_DWORD *)(v10 + 40) = SessionId;
*(_QWORD *)(v10 + 32) = P2 & 0x7FFFFFFFFFFFFFFCi64;
goto LABEL_8;
}
LABEL_46:
_interlockedbittestandset((volatile signed __int32 *)&CurrentThread->Tcb.116 + 1, 0x10u);
LABEL_8:
--CurrentThread->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&CurrentThread->Tcb, (VOID *)P2, &a3);
v12 = CurrentThread->Tcb.SpecialApcDisable++ == -1;
if( v12
&& ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)CurrentThread->Tcb.ApcState.ApcListHead[0].Flink != &CurrentThread->Tcb.152 )
{
KiCheckForKernelApcDelivery();
}
if( _InterlockedCompareExchange64((volatile signed __int64 *)P2, 17i64, 0i64) )
ExfAcquirePushLockSharedEx((_EX_PUSH_LOCK *)P2, (VOID *)v10, (VOID *)P2);
if( v10 )
*(_BYTE *)(v10 + 26) |= 1u;
v13 = P2 + 8;
v14 = *(_EX_SA_PAGE_GROUP_DESCRIPTOR **)(P2 + 8);
while( 1 )
{
if( v14 != (_EX_SA_PAGE_GROUP_DESCRIPTOR *)v13 )
{
while( 1 )
{
LODWORD(v15) = ExpSaPageGroupAllocateMemory(v14, v3);
Memory = v15;
if( v15 != -1 )
break;
v14 = *(_EX_SA_PAGE_GROUP_DESCRIPTOR **)v14;
if( v14 == (_EX_SA_PAGE_GROUP_DESCRIPTOR *)v13 )
goto LABEL_48;
}
if( !v14[9] )
_InterlockedOr((volatile signed __int32 *)(P2 + 64), 2u);
goto LABEL_20;
}
LABEL_48:
v23 = *(_EX_SA_PAGE_GROUP_DESCRIPTOR **)v13;
if( !v4 && _InterlockedCompareExchange64((volatile signed __int64 *)P2, 1i64, 17i64) != 17 )
{
v27 = 0i64;
if( _InterlockedCompareExchange64((volatile signed __int64 *)P2, 0i64, 17i64) != 17 )
ExfReleasePushLockShared((_EX_PUSH_LOCK *)P2);
KeAbPostRelease((VOID *)P2);
LODWORD(v35[0]) = 0;
v28 = (_ETHREAD *)KeGetCurrentThread();
--v28->Tcb.SpecialApcDisable;
if( ++v28->Tcb.AbAllocationRegionCount != 1 )
KeBugCheckEx(0x192u, v28, (PVOID)P2, (PVOID)KeGetCurrentIrql(), 0i64);
AbEntrySummary = v28->Tcb.AbEntrySummary;
HIDWORD(a3) = 0;
if( !AbEntrySummary )
{
if( !v28->Tcb.AbOrphanedEntrySummary )
goto LABEL_72;
v30 = v28->Tcb.AbOrphanedEntrySummary;
v28->Tcb.AbOrphanedEntrySummary = 0;
AbEntrySummary = v30 | v28->Tcb.AbEntrySummary;
}
_BitScanForward((unsigned int *)&v31, AbEntrySummary);
HIDWORD(a3) = v31;
v28->Tcb.AbEntrySummary = AbEntrySummary & ~(1 << v31);
v27 = (__int64)&v28->Tcb.LockEntries[v31];
if( v27 )
{
if( P2 >= 0xFFFF800000000000ui64 && *((_BYTE *)&MiState[1537] + ((P2 >> 39) & 0x1FF)) == 1 )
v32 = MmGetSessionIdEx(v28->Tcb.ApcState.Process);
else
v32 = -1;
*(_DWORD *)(v27 + 40) = v32;
*(_QWORD *)(v27 + 32) = P2 & 0x7FFFFFFFFFFFFFFCi64;
goto LABEL_75;
}
LABEL_72:
_interlockedbittestandset((volatile signed __int32 *)&v28->Tcb.116 + 1, 0x10u);
LABEL_75:
--v28->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v28->Tcb, (VOID *)P2, (UINT64 *)v35);
v12 = v28->Tcb.SpecialApcDisable++ == -1;
if( v12 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v28->Tcb.ApcState.ApcListHead[0].Flink != &v28->Tcb.152 )
KiCheckForKernelApcDelivery();
if( _interlockedbittestandset64((volatile signed __int32 *)P2, 0i64) )
ExfAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)P2, (VOID *)v27, (VOID *)P2);
if( v27 )
*(_BYTE *)(v27 + 26) |= 1u;
}
v14 = *(_EX_SA_PAGE_GROUP_DESCRIPTOR **)v13;
v4 = 1;
if( v23 == *(_EX_SA_PAGE_GROUP_DESCRIPTOR **)v13 )
break;
v3 = SizeInPointers;
}
v24 = ExpSaPageGroupDescriptorAllocate(P2, *(_DWORD *)(P2 + 64) & 1);
v25 = v24;
if( v24 )
{
Memory = ExpSaPageGroupAllocateMemory((_EX_SA_PAGE_GROUP_DESCRIPTOR *)v24, SizeInPointers);
if( *((_DWORD *)v25 + 9) )
{
*((_DWORD *)v25 + 10) = 0;
v26 = *(_EX_SA_PAGE_GROUP_DESCRIPTOR **)v13;
if( *(_QWORD *)(*(_QWORD *)v13 + 8i64) == v13 )
{
*v25 = v26;
v25[1] = (VOID *)v13;
*((_QWORD *)v26 + 1) = v25;
*(_QWORD *)v13 = v25;
goto LABEL_20;
}
LABEL_86:
__fastfail(3u);
}
*((_DWORD *)v25 + 10) = 1;
v33 = *(VOID ****)(P2 + 32);
if( *v33 != (VOID **)(P2 + 24) )
goto LABEL_86;
*v25 = (VOID *)(P2 + 24);
v25[1] = v33;
*v33 = v25;
*(_QWORD *)(P2 + 32) = v25;
LABEL_20:
if( (*(_DWORD *)(P2 + 64) & 2) != 0 )
{
if( v4 || _InterlockedCompareExchange64((volatile signed __int64 *)P2, 1i64, 17i64) == 17 )
{
v4 = 1;
ExpSaAllocatorOptimizeList(P2);
goto LABEL_21;
}
LABEL_22:
if( _InterlockedCompareExchange64((volatile signed __int64 *)P2, 0i64, 17i64) != 17 )
ExfReleasePushLockShared((_EX_PUSH_LOCK *)P2);
KeAbPostRelease((VOID *)P2);
return Memory;
}
LABEL_21:
if( !v4 )
goto LABEL_22;
}
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)P2, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((_EX_PUSH_LOCK *)P2);
LODWORD(v37) = 0;
v17 = (_ETHREAD *)KeGetCurrentThread();
if( MiGetSystemRegionType(P2) == 1 )
v8 = MmGetSessionIdEx(v17->Tcb.ApcState.Process);
--v17->Tcb.SpecialApcDisable;
v18 = ++v17->Tcb.AbAllocationRegionCount;
v19 = ((char)v17->Tcb.AbEntrySummary | (char)v17->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
while( 1 )
{
v12 = !_BitScanReverse((unsigned int *)&v20, v19);
if( v12 )
break;
v21 = &v17->Tcb.LockEntries[v20];
v19 &= ~(1 << v20);
if( (v21->AcquiredByte & 1) != 0
&& (v21->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v21->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == (P2 & 0x7FFFFFFFFFFFFFFCi64)
&& v21->LockState.SessionId == v8 )
{
v21->AcquiredByte &= ~1u;
if( v21->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
{
if( v21 )
{
v21->CrossThreadReleasableAndBusyByte |= 2u;
if( v21->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v21);
LODWORD(v37) = v21->BoostBitmap.AllFields & 0x1FFFF;
v21->BoostBitmap.AllFields &= 0xFFFE0000;
v21->ThreadLocalFlags &= ~1u;
v21->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v22 = v21 - v17->Tcb.LockEntries;
if( v18 == 1 )
v17->Tcb.AbEntrySummary |= 1 << v22;
else
_InterlockedOr8((volatile signed __int8 *)&v17->Tcb.AbOrphanedEntrySummary, 1 << v22);
goto LABEL_43;
}
break;
}
}
}
if( (*(&v17->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, v17, (PVOID)P2, (PVOID)v8, 0i64);
LABEL_43:
--v17->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v17->Tcb, (VOID *)P2, &v37);
v12 = v17->Tcb.SpecialApcDisable++ == -1;
if( v12 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v17->Tcb.ApcState.ApcListHead[0].Flink != &v17->Tcb.152 )
KiCheckForKernelApcDelivery();
return Memory;
}Referenced by:
ExSaAllocate