MiSoftFaultMappedView
VOID __stdcall MiSoftFaultMappedView(INT64 rcx0){
int v1;
INT64 v2;
__int64 v3;
__int64 *v4;
__int64 v5;
int v6;
unsigned int v7;
__int64 v8;
_MMSUPPORT_FULL *p_Vm;
__int64 v10;
unsigned __int64 v11;
_MMPTE *v12;
_MMPTE *PteBase;
unsigned __int64 v14;
unsigned __int64 v15;
unsigned __int64 v16;
char v17;
_MMPTE *v18;
INT64 v19;
_DWORD *v20;
unsigned __int64 i;
_MMPTE v22;
_MMPTE v23;
__int64 v24;
_MMPFN *v25;
int v26;
INT64 v27;
INT64 v28;
_XSTATE_CONFIGURATION *v29;
unsigned __int64 v30;
int v31;
_XSTATE_CONFIGURATION *v32;
unsigned int v33;
int v34;
UINT64 Flags;
UINT8 PageIrql[16];
INT64 v37;
INT64 v38[2];
UINT64 v39;
ULONG_PTR ProtoPagePfn[2];
INT64 v41;
UINT64 SpinCount;
unsigned __int64 v43;
__int64 v44[16];
v1 = *(_DWORD *)(rcx0 + 48);
v39 = 0i64;
v37 = rcx0;
v2 = rcx0;
*(_OWORD *)v38 = 0i64;
if( (v1 & 0xF80) == 128 || (v1 & 0x100000) == 0 && (v1 & 0x70) == 32 && (v1 & 0x200000) != 0 )
return;
if( MiVadMapsLargeImage((_MMVAD *)rcx0) )
return;
v4 = *(__int64 **)(v3 + 72);
v5 = *v4;
if( (*(_DWORD *)(*v4 + 56) & 0x4000000) != 0 )
return;
v6 = 0;
v7 = 0;
memset(&PageIrql[4], 0, 12);
*(_QWORD *)ProtoPagePfn = 0i64;
v8 = *(_QWORD *)(v5 + 32);
p_Vm = &KeGetCurrentThread()->ApcState.Process->Vm;
v41 = (INT64)p_Vm;
if( !v8 )
return;
v10 = *(unsigned int *)(v2 + 24);
v11 = (unsigned __int64)*(unsigned __int8 *)(v2 + 32) << 32;
v12 = *(_MMPTE **)(v2 + 80);
PageIrql[0] = 17;
PteBase = MmGetPteBase();
v14 = (unsigned __int64)&PteBase[(v10 | v11) & 0xFFFFFFFFFi64];
v15 = (*(unsigned int *)(v2 + 28) | ((unsigned __int64)*(unsigned __int8 *)(v2 + 33) << 32)) & 0xFFFFFFFFFi64;
BYTE5(v38[1]) |= 4u;
v16 = (unsigned __int64)&PteBase[v15];
v43 = v16;
v38[0] = (INT64)p_Vm;
MiLockWorkingSetShared();
BYTE4(v38[1]) = v17;
if( v14 > v16 )
goto LABEL_46;
v18 = v12;
while( 1 )
{
if( (unsigned __int64)v18 > *(_QWORD *)(v2 + 88) || !v8 )
goto LABEL_41;
if( v6
&& (v6 & 8) == 0
&& ((v19 = v41, (*(_BYTE *)(v41 + 184) & 7) == 2) ? (v20 = (_DWORD *)((char *)&stru_140C4DB30 + 6544)) : (v20 = (_DWORD *)(v41 + 192)),
(*v20 & 0x40000000) != 0 || (unsigned int)KeShouldYieldProcessor()) )
{
v31 = 1;
}
else
{
if( v39 && (v14 & 0xFFF) != 0 )
goto LABEL_20;
v19 = v41;
v31 = 2;
}
if( PageIrql[0] != 17 )
{
MiUnlockProtoPoolPage(ProtoPagePfn[0], PageIrql[0]);
PageIrql[0] = 17;
}
if( *(_DWORD *)&PageIrql[4] )
{
if( !MiCompleteRestrictedImageFault((INT64)v38, *(INT64 *)&PageIrql[8], v44, *(unsigned int *)&PageIrql[4]) )
{
v7 = 0;
LABEL_41:
v28 = *(_QWORD *)&PageIrql[8];
LABEL_42:
if( PageIrql[0] != 17 )
MiUnlockProtoPoolPage(ProtoPagePfn[0], PageIrql[0]);
if( v7 )
MiCompleteRestrictedImageFault((INT64)v38, v28, v44, v7);
goto LABEL_46;
}
*(_DWORD *)&PageIrql[4] = 0;
}
v32 = (_XSTATE_CONFIGURATION *)v39;
if( v39 )
{
MiUnlockPageTableInternal(v19, v39);
v39 = 0i64;
}
if( v31 == 1 )
MiUnlockFaultWorkingSet((INT64)v38, v32);
v33 = (*(_DWORD *)(v2 + 48) >> 12) & 0x3F;
if( v31 == 1 )
MiLockWorkingSetShared();
LODWORD(Flags) = 0;
MiMakeSystemAddressValid((VOID *)v14, 0i64, v33, BYTE4(v38[1]), Flags);
v7 = *(_DWORD *)&PageIrql[4];
v39 = (UINT64)MmGetPteBase() + ((v14 >> 9) & 0x7FFFFFFFF8i64);
LABEL_20:
++v6;
if( !*(_QWORD *)v14 )
break;
LABEL_39:
++v12;
v14 += 8i64;
v18 = v12;
LABEL_40:
v7 = *(_DWORD *)&PageIrql[4];
if( v14 > v43 )
goto LABEL_41;
}
if( ((unsigned __int16)v12 & 0xFFF) != 0 )
{
if( PageIrql[0] != 17 )
goto LABEL_23;
}
else if( PageIrql[0] != 17 )
{
MiUnlockProtoPoolPage(ProtoPagePfn[0], PageIrql[0]);
PageIrql[0] = 17;
}
if( v7 )
{
v28 = *(_QWORD *)&PageIrql[8];
if( !MiCompleteRestrictedImageFault((INT64)v38, *(INT64 *)&PageIrql[8], v44, v7) )
{
v7 = 0;
goto LABEL_42;
}
*(_DWORD *)&PageIrql[4] = 0;
}
*(_QWORD *)ProtoPagePfn = MiLockProtoPoolPage(v12, PageIrql);
if( !*(_QWORD *)ProtoPagePfn )
{
v30 = 8 * ((unsigned __int64)(4096 - ((unsigned __int16)v12 & 0xFFFu)) >> 3);
v12 = (_MMPTE *)((char *)v12 + v30);
v14 += v30;
v18 = v12;
if( v39 && (_MMPTE *)v39 != (_MMPTE *)((char *)MmGetPteBase() + ((v14 >> 9) & 0x7FFFFFFFF8i64)) )
{
MiUnlockPageTableInternal(v41, v39);
v39 = 0i64;
}
goto LABEL_40;
}
LABEL_23:
if( (v12->u.Long & 1) == 0 )
goto LABEL_39;
for( i = 0x7FFFFFFFFFFFFFFFi64; ; _InterlockedAnd64(&v25->u2.Lock, i) )
{
while( 1 )
{
v22.u.Long = v12->u.Long;
v23.u.Long = v12->u.Long;
if( (v12->u.Long & 1) != 0 )
goto LABEL_26;
if( (v12->u.Long & 0xC00) != 2048 )
goto LABEL_38;
LOBYTE(v34) = MiInvalidPteConforms(v12->u.Long, (INT64 *)i);
if( v34 )
{
v23.u.Long = v22.u.Long;
if( *(&stru_140C4DB30 + 42) && (v22.u.Long & 0x10) == 0 )
v23.u.Long = v22.u.Long & ~*(&stru_140C4DB30 + 42);
LABEL_26:
v24 = (v23.u.Long >> 12) & 0xFFFFFFFFFi64;
if( (MmGetPfnDb()[v24].u4._bf_0 & 0x4000000000000i64) != 0 )
break;
}
}
v25 = &MmGetPfnDb()[v24];
LODWORD(SpinCount) = 0;
if( _interlockedbittestandset64((volatile signed __int32 *)&v25->u2, 0x3Fui64) )
{
do
{
do
KeYieldProcessorEx(&SpinCount);
while( v25->u2._bf_0 < 0 );
}
while( _interlockedbittestandset64((volatile signed __int32 *)&v25->u2, 0x3Fui64) );
i = 0x7FFFFFFFFFFFFFFFi64;
}
if( v12->u.Long == v22.u.Long )
break;
}
if( !v25 )
{
LABEL_38:
v2 = v37;
goto LABEL_39;
}
if( (v12->u.Long & 1) == 0
|| (--v8, (*(_DWORD *)(&v25->3 + 1) & 0x400i64) == 0)
|| (*((_BYTE *)&v25->u3 + 3) & 0x40) != 0 )
{
_InterlockedAnd64(&v25->u2.Lock, i);
goto LABEL_38;
}
if( !MiImagePageOk((VOID *)((__int64)((v14 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16), v25) )
{
_InterlockedAnd64(&v25->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
goto LABEL_38;
}
v25->u2._bf_0 ^= (v25->u2._bf_0 ^ (v25->u2._bf_0 + 1)) & 0x3FFFFFFFFFFFFFFFi64;
_InterlockedAnd64(&v25->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
if( v24 * 48 / 48 == -1 )
goto LABEL_38;
v26 = *(_DWORD *)&PageIrql[4];
v27 = v14;
if( *(_DWORD *)&PageIrql[4] )
v27 = *(_QWORD *)&PageIrql[8];
v44[*(unsigned int *)&PageIrql[4]] = v24 * 48 / 48;
*(_QWORD *)&PageIrql[8] = v27;
*(_DWORD *)&PageIrql[4] = v26 + 1;
if( v26 != 15 )
goto LABEL_38;
MiUnlockProtoPoolPage(ProtoPagePfn[0], PageIrql[0]);
PageIrql[0] = 17;
if( MiCompleteRestrictedImageFault((INT64)v38, v27, v44, 0x10ui64) )
{
*(_QWORD *)&PageIrql[8] = v27;
*(_DWORD *)&PageIrql[4] = 0;
goto LABEL_38;
}
LABEL_46:
v29 = (_XSTATE_CONFIGURATION *)v39;
if( v39 )
{
MiUnlockPageTableInternal(v41, v39);
v39 = 0i64;
}
MiUnlockFaultWorkingSet((INT64)v38, v29);
}Referenced by:
MiMapViewOfImageSection