PipGetPersistentMemory
NTSTATUS __stdcall PipGetPersistentMemory(INT64 a1, INT64 a2, size_t *a3, VOID *a4, INT64 a5){
VOID **v5;
_QWORD *v6;
__int64 v8;
__int16 *v9;
_WORD *v10;
VOID **v11;
VOID **v12;
__int64 v13;
__int64 v14;
__int64 v15;
_WORD *v16;
__int64 v17;
unsigned __int64 *v18;
PWCHAR v19;
_MDL *v20;
int DriverKsrGuid;
unsigned int v22;
__int64 v23;
VOID **PoolWithTag;
unsigned int v25;
VOID **v26;
__int64 v27;
unsigned __int64 v28;
VOID **v29;
_QWORD *v30;
unsigned int v31;
unsigned int v32;
unsigned int i;
unsigned __int64 v34;
unsigned __int64 v35;
__int64 v36;
__int64 v37;
VOID *v38;
unsigned __int64 v39;
NTSTATUS DeviceObjectLocation;
unsigned __int64 v41;
__int64 v42;
size_t *v43;
PVOID BugCheckParameter4;
UINT64 Priority;
char v47;
unsigned int v48;
unsigned int NumberOfBytes;
unsigned int NumberOfBytes_4;
PVOID P;
size_t *v52;
PWCHAR String1;
int v54;
int v55;
__int128 v56;
VOID *v57;
INT64 v58;
__int64 v59;
_GUID v60;
v5 = 0i64;
v52 = a3;
v57 = a4;
v58 = a2;
v6 = (_QWORD *)a2;
v54 = 0;
v48 = 0;
v60 = 0i64;
if( a2 )
{
v8 = *(_QWORD *)(*(_QWORD *)(a2 + 312) + 40i64);
if( !v8 || (*(_DWORD *)(v8 + 396) & 0x20000) != 0 )
{
IoAddTriageDumpDataBlock((VOID *)a2, (_BYTE *)*(unsigned __int16 *)(a2 + 2));
v9 = (__int16 *)v6[1];
if( v9 )
{
IoAddTriageDumpDataBlock(v9, (_BYTE *)(unsigned int)v9[1]);
v10 = (_WORD *)(v6[1] + 56i64);
if( *v10 )
{
IoAddTriageDumpDataBlock(v10, (_BYTE *)2);
IoAddTriageDumpDataBlock(*(VOID **)(v6[1] + 64i64), (_BYTE *)*(unsigned __int16 *)(v6[1] + 56i64));
}
}
v11 = *(VOID ***)(v6[39] + 40i64);
if( v11 )
{
v12 = v11 + 5;
IoAddTriageDumpDataBlock(v11, (_BYTE *)0x310);
if( *(_WORD *)v12 )
{
IoAddTriageDumpDataBlock(v12, (_BYTE *)2);
IoAddTriageDumpDataBlock(v12[1], (_BYTE *)*(unsigned __int16 *)v12);
}
v13 = v6[39];
v14 = *(_QWORD *)(v13 + 40);
if( *(_WORD *)(v14 + 56) )
{
IoAddTriageDumpDataBlock((VOID *)(v14 + 56), (_BYTE *)2);
IoAddTriageDumpDataBlock(
*(VOID **)(*(_QWORD *)(v6[39] + 40i64) + 64i64),
(_BYTE *)*(unsigned __int16 *)(*(_QWORD *)(v6[39] + 40i64) + 56i64));
v13 = v6[39];
}
v15 = *(_QWORD *)(*(_QWORD *)(v13 + 40) + 16i64);
if( v15 )
{
v16 = (_WORD *)(v15 + 56);
if( *v16 )
{
IoAddTriageDumpDataBlock(v16, (_BYTE *)2);
v17 = *(_QWORD *)(*(_QWORD *)(v6[39] + 40i64) + 16i64);
IoAddTriageDumpDataBlock(*(VOID **)(v17 + 64), (_BYTE *)*(unsigned __int16 *)(v17 + 56));
}
}
}
KeBugCheckEx(0xCAu, (PVOID)2, v6, 0i64, 0i64);
}
}
v47 = 0;
String1 = 0i64;
v18 = 0i64;
P = 0i64;
v19 = 0i64;
NumberOfBytes = 0;
v20 = 0i64;
DriverKsrGuid = PipGetDriverKsrGuid(a1, &v60);
if( DriverKsrGuid >= 0 )
{
v56 = 0i64;
DriverKsrGuid = KsrEnumeratePersistedMemory(&v60, PipEnumeratePersistedMemory, &v56);
if( DriverKsrGuid >= 0 )
{
if( !DWORD2(v56) )
return -1073741772;
*(_QWORD *)&v56 = ExAllocatePoolWithTag(0x200ui64, 8i64 * DWORD2(v56), 1634758224i64);
if( !(_QWORD)v56 )
return -1073741670;
DriverKsrGuid = KsrEnumeratePersistedMemory(&v60, PipEnumeratePersistedMemory, &v56);
if( DriverKsrGuid < 0 )
return DriverKsrGuid;
v22 = 0;
NumberOfBytes_4 = 0;
if( DWORD2(v56) )
{
v55 = a5;
while( 1 )
{
v18 = 0i64;
v20 = 0i64;
v5 = 0i64;
P = 0i64;
if( v47 )
goto LABEL_74;
v59 = *(_QWORD *)(v56 + 8i64 * v22);
v23 = v59;
KsrQueryMetadata(&v60, v59, 0i64, 0i64, &NumberOfBytes);
PoolWithTag = ExAllocatePoolWithTag(0x200ui64, NumberOfBytes, 1634758224i64);
P = PoolWithTag;
if( !PoolWithTag )
{
DriverKsrGuid = -1073741670;
LABEL_71:
v18 = 0i64;
v20 = 0i64;
v5 = 0i64;
goto LABEL_74;
}
*(_DWORD *)PoolWithTag = 0;
DriverKsrGuid = KsrQueryMetadata(&v60, v23, PoolWithTag, NumberOfBytes, &NumberOfBytes);
if( DriverKsrGuid < 0 )
goto LABEL_71;
DriverKsrGuid = KsrClaimPersistedMemory(&v60, v23, 0i64, 0i64, 0, &v48);
if( DriverKsrGuid == -1073741789 )
DriverKsrGuid = 0;
if( DriverKsrGuid < 0 )
goto LABEL_71;
v5 = ExAllocatePoolWithTag(0x200ui64, 8i64 * v48, 1634758224i64);
if( !v5 )
{
DriverKsrGuid = -1073741670;
LABEL_69:
v18 = 0i64;
v20 = 0i64;
goto LABEL_74;
}
DriverKsrGuid = KsrClaimPersistedMemory(&v60, v23, v5, v48, 0, &v48);
if( DriverKsrGuid < 0 )
goto LABEL_69;
v25 = 0;
if( v48 )
{
v26 = v5;
v27 = v48;
do
{
v28 = (unsigned __int64)*v26++;
v25 += v28 >> 40;
--v27;
}
while( v27 );
v6 = (_QWORD *)v58;
}
v29 = ExAllocatePoolWithTag(0x200ui64, 8i64 * v25 + 48, 1634758224i64);
v20 = (_MDL *)v29;
if( !v29 )
{
v18 = 0i64;
goto LABEL_74;
}
*v29 = 0i64;
v30 = v29 + 6;
v31 = v25 << 12;
v32 = 0;
v29[4] = 0i64;
*((_DWORD *)v29 + 11) = 0;
*((_WORD *)v29 + 4) = 8 * ((v31 >> 12) + 6);
*((_DWORD *)v29 + 10) = v31;
*((_WORD *)v29 + 5) = 2;
for( i = v48; v32 < i; ++v32 )
{
v34 = (unsigned __int64)v5[v32];
v35 = v34 >> 40;
v36 = v34 & 0xFFFFFFFFFFi64;
if( (_DWORD)v35 )
{
v37 = (unsigned int)v35;
do
{
*v30++ = v36++;
--v37;
}
while( v37 );
i = v48;
}
}
LODWORD(Priority) = 1073741840;
LODWORD(BugCheckParameter4) = 0;
v18 = (unsigned __int64 *)MmMapLockedPagesSpecifyCache(
v20,
0,
MmCached,
0i64,
(UINT64)BugCheckParameter4,
Priority);
if( !v18 )
{
DriverKsrGuid = -1073741670;
goto LABEL_74;
}
if( *(_WORD *)P > 1u )
{
DriverKsrGuid = -1073741637;
goto LABEL_74;
}
if( *((_DWORD *)P + 1) )
{
if( v6 )
{
DeviceObjectLocation = PipGetDeviceObjectLocation((ULONG_PTR)v6);
v19 = String1;
DriverKsrGuid = DeviceObjectLocation;
if( DeviceObjectLocation < 0 )
goto LABEL_74;
if( PnpCompareMultiSz(String1, (PWCHAR)P + 8, 0) )
{
v38 = v57;
v39 = *v18;
v47 = 1;
if( !v57 )
{
v43 = v52;
DriverKsrGuid = -1073741789;
*(_QWORD *)v52 = v39;
LABEL_62:
if( v47 )
goto LABEL_74;
goto LABEL_73;
}
goto LABEL_55;
}
}
}
else if( !v6 )
{
v38 = v57;
v39 = *v18;
if( !v57 )
{
*(_QWORD *)v52 = v39;
LABEL_50:
DriverKsrGuid = -1073741789;
goto LABEL_74;
}
LABEL_55:
v41 = *(_QWORD *)v52;
*(_QWORD *)v52 = v39;
if( v41 < v39 )
goto LABEL_50;
memmove(v38, v18 + 1, *v18);
v47 = 1;
if( (v55 & 1) != 0 )
{
LOBYTE(v42) = 1;
KsrFreePersistedMemoryBlock(&v60, v59, v42);
v47 = 1;
}
}
++NumberOfBytes_4;
if( v19 )
{
ExFreePoolWithTag(v19, 0x61706E50u);
v19 = 0i64;
String1 = 0i64;
}
MmUnmapLockedPages(v18, v20);
v18 = 0i64;
ExFreePoolWithTag(v20, 0x61706E50u);
v20 = 0i64;
ExFreePoolWithTag(P, 0x61706E50u);
P = 0i64;
ExFreePoolWithTag(v5, 0x61706E50u);
v22 = NumberOfBytes_4;
v5 = 0i64;
if( NumberOfBytes_4 >= DWORD2(v56) )
{
v43 = v52;
goto LABEL_62;
}
}
}
v43 = v52;
LABEL_73:
*(_QWORD *)v43 = 0i64;
DriverKsrGuid = -1073741772;
LABEL_74:
if( v19 )
ExFreePoolWithTag(v19, 0x61706E50u);
if( v18 )
MmUnmapLockedPages(v18, v20);
if( v20 )
ExFreePoolWithTag(v20, 0x61706E50u);
if( P )
ExFreePoolWithTag(P, 0x61706E50u);
if( v5 )
ExFreePoolWithTag(v5, 0x61706E50u);
}
}
return DriverKsrGuid;
}Referenced by:
IoAcquireKsrPersistentMemory
IoQueryKsrPersistentMemorySize
IoReserveKsrPersistentMemory