NtLockVirtualMemory
NTSTATUS __stdcall NtLockVirtualMemory(VOID *ProcessHandle, VOID **BaseAddress, UINT64 *RegionSize, UINT64 MapType){
int v5;
NTSTATUS result;
unsigned __int64 v7;
unsigned __int64 v8;
VOID *v9;
_MMPTE *PteBase;
UINT64 v11;
unsigned __int64 v12;
NTSTATUS v13;
_MMVAD_SHORT *Address;
_QWORD *p_NextVad;
__int64 v16;
__int64 v17;
_QWORD *v18;
_QWORD **v19;
_QWORD *i;
char *v21;
_MMSUPPORT_INSTANCE *v22;
UINT8 v23;
UINT8 v24;
UINT64 v25;
_MMPTE *PdeBase;
_MMVAD_SHORT *v27;
_MMVAD_SHORT **ExtraCreateInfo;
_MMVAD_SHORT *j;
_MMPTE *NextPageTable;
_UNICODE_STRING *v31;
_MMPTE *v32;
UINT64 v33;
INT64 v34;
unsigned __int64 v35;
_MMPFN *v36;
UINT8 v37;
wchar_t *v38;
int v39;
_MMPFN *v40;
unsigned __int64 v41;
_MMPFN *PfnDb;
_UNICODE_STRING *v43;
UINT8 v44;
wchar_t *v45;
int v46;
UINT64 v47;
_MI_PARTITION *v48;
int v49;
UINT64 v50;
UINT64 v51;
UINT64 v52;
int v53;
_UNICODE_STRING *v54;
UINT8 v55;
PWCHAR v56;
int v57;
UINT64 v58;
unsigned __int64 v59;
unsigned __int64 v60;
unsigned __int64 v61;
char *v62;
int v63;
int v64;
unsigned int EffectivePagePriorityThread;
char v66;
int v67;
int v68;
bool v69;
UINT64 v70;
unsigned __int64 v71;
VOID **OutCapturedBase;
VOID **OutTargetProcess;
UINT8 WsIrql;
NTSTATUS v75;
NTSTATUS v76;
unsigned __int64 v77;
_MMVAD_SHORT *v78;
unsigned __int64 v79;
char v80;
unsigned __int64 v81;
PVOID Object;
INT64 v83;
int v84;
_MMPTE *PointerPte;
PVOID P;
UINT64 LargePage;
unsigned __int64 v88;
VOID *StartingVa;
unsigned __int64 v90;
char *v91;
UINT64 OutCapturedRegionSize;
UINT64 NumberOfVads;
_MMPTE *LastPte;
INT64 v95;
INT64 v96;
_ETHREAD *Thread;
UINT64 *v98;
VOID **v99;
_KAPC_STATE ApcState;
v98 = RegionSize;
v99 = BaseAddress;
memset(&ApcState, 0, sizeof(ApcState));
OutCapturedRegionSize = 0i64;
v90 = 0i64;
Object = 0i64;
LODWORD(LargePage) = 0;
v5 = 0;
v80 = 0;
v84 = 0;
result = MiLockUnlockCommon(
ProcessHandle,
BaseAddress,
(VOID **)RegionSize,
MapType,
(VOID **)&v90,
&OutCapturedRegionSize,
&Object);
if( result < 0 )
return result;
Thread = (_ETHREAD *)KeGetCurrentThread();
v7 = v90;
v8 = (v90 + OutCapturedRegionSize - 1) & 0xFFFFFFFFFFFFF000ui64;
v88 = v8;
v9 = (VOID *)(v90 & 0xFFFFFFFFFFFFF000ui64);
v81 = v90 & 0xFFFFFFFFFFFFF000ui64;
v77 = 0i64;
P = MiAllocatePool(
64i64,
8
* (((((v8 - (v90 & 0xFFFFFFFFFFFFF000ui64)) >> 12) + 1) >> 6)
+ ((((unsigned __int8)((v8 - (v90 & 0xFFFFFFFFFFFFF000ui64)) >> 12) + 1) & 0x3F) != 0)),
0x6B6C6D4Dui64);
if( !P )
{
ObfDereferenceObjectWithTag(Object, 0x6D566D4Dui64);
return -1073741670;
}
if( ProcessHandle != (VOID *)-1i64 )
{
KeStackAttachProcess((PRKPROCESS)Object, &ApcState);
v5 = 2;
v80 = 2;
v84 = 2;
}
PteBase = MmGetPteBase();
PointerPte = (_MMPTE *)((char *)PteBase + ((v7 >> 9) & 0x7FFFFFFFF8i64));
StartingVa = v9;
LastPte = (_MMPTE *)((char *)PteBase + ((v8 >> 9) & 0x7FFFFFFFF8i64));
LODWORD(v11) = MiLockVadRange((_EPROCESS *)Object, v9, (VOID *)v8);
v12 = v11;
NumberOfVads = v11;
if( !v11 )
{
v13 = -1073741819;
LABEL_90:
MiUnlockVadRange((_EPROCESS *)Object, StartingVa, v12);
if( (v5 & 2) != 0 )
KeUnstackDetachProcess(&ApcState);
ObfDereferenceObjectWithTag(Object, 0x6D566D4Dui64);
ExFreePoolWithTag(P, 0);
return v13;
}
Address = (_MMVAD_SHORT *)MiLocateAddress(v9);
v78 = Address;
p_NextVad = &Address->NextVad;
if( v16 )
{
while( MiVadPagesTradable((INT64)p_NextVad) )
{
v18 = p_NextVad;
v19 = (_QWORD **)p_NextVad[1];
if( v19 )
{
p_NextVad = (_QWORD *)p_NextVad[1];
for( i = *v19; i; i = (_QWORD *)*i )
p_NextVad = i;
}
else
{
while( 1 )
{
p_NextVad = (_QWORD *)(p_NextVad[2] & 0xFFFFFFFFFFFFFFFCui64);
if( !p_NextVad || (_QWORD *)*p_NextVad == v18 )
break;
v18 = p_NextVad;
}
}
if( v17 + 1 >= v12 )
goto LABEL_18;
}
v13 = -1073741747;
goto LABEL_90;
}
LABEL_18:
v75 = MiVadPureReserve(Address);
v21 = 0i64;
v22 = (_MMSUPPORT_INSTANCE *)((char *)Object + 1664);
v95 = (INT64)Object + 1664;
v91 = (char *)*((_QWORD *)Object + 210);
LABEL_19:
MiLockWorkingSetShared();
WsIrql = v23;
v24 = v23;
LABEL_20:
v25 = v81;
PdeBase = MmGetPdeBase();
while( v25 <= v8 )
{
if( v25 >> 12 > (Address->EndingVpn | ((unsigned __int64)Address->EndingVpnHigh << 32)) )
{
v27 = Address;
ExtraCreateInfo = (_MMVAD_SHORT **)Address->ExtraCreateInfo;
if( ExtraCreateInfo )
{
Address = (_MMVAD_SHORT *)Address->ExtraCreateInfo;
v78 = (_MMVAD_SHORT *)ExtraCreateInfo;
for( j = *ExtraCreateInfo; j; j = j->NextVad )
{
Address = j;
v78 = j;
}
}
else
{
Address = (_MMVAD_SHORT *)(Address->VadNode.ParentValue & 0xFFFFFFFFFFFFFFFCui64);
v78 = Address;
if( Address )
{
do
{
if( Address->NextVad == v27 )
break;
v27 = Address;
Address = (_MMVAD_SHORT *)(Address->VadNode.ParentValue & 0xFFFFFFFFFFFFFFFCui64);
}
while( Address );
v78 = Address;
}
}
v75 = MiVadPureReserve(Address);
}
v83 = (INT64)PdeBase + ((v25 >> 18) & 0x3FFFFFF8);
if( v21 != (char *)v83 )
{
if( v21 )
{
MiUnlockPageTable((INT64)v22, (UINT64)v21);
v21 = 0i64;
v24 = WsIrql;
}
if( v75 )
{
LODWORD(OutCapturedBase) = 0;
NextPageTable = MiGetNextPageTable(
PointerPte,
LastPte,
0i64,
v24,
(UINT64)OutCapturedBase,
&LargePage,
(UINT64)OutTargetProcess);
if( NextPageTable )
v21 = (char *)MmGetPteBase() + (((unsigned __int64)NextPageTable >> 9) & 0x7FFFFFFFF8i64);
if( NextPageTable != PointerPte )
{
v13 = -1073741819;
goto LABEL_64;
}
}
else
{
LODWORD(OutCapturedBase) = 0;
v32 = PointerPte;
MiMakeSystemAddressValid(PointerPte, 0i64, (Address->u.LongFlags >> 12) & 0x3F, v24, (UINT64)OutCapturedBase);
v21 = (char *)MmGetPteBase() + (((unsigned __int64)v32 >> 9) & 0x7FFFFFFFF8i64);
}
}
if( (PointerPte->u.Long & 1) == 0 )
{
MiUnlockPageTable((INT64)v22, (UINT64)v21);
v21 = 0i64;
v83 = 0i64;
LOBYTE(v33) = WsIrql;
MiUnlockWorkingSetShared(v22, v33);
goto LABEL_19;
}
LODWORD(v34) = MI_READ_PTE_LOCK_FREE((INT64)PointerPte);
v96 = v34;
LODWORD(v35) = MI_READ_PTE_LOCK_FREE((INT64)&v96);
v36 = &MmGetPfnDb()[(v35 >> 12) & 0xFFFFFFFFFi64];
if( (MiGetWsleContents(0xFFFFFFFFFi64, v81) & 0xF) == 8 )
{
v5 |= 1u;
v80 = v5;
v84 = v5;
}
else
{
if( v22->MinimumWorkingSetSize <= *((_QWORD *)v91 + 4) + 6i64 )
{
v13 = -1073741663;
goto LABEL_64;
}
LOBYTE(v39) = MI_PFN_IS_PROTO((_UNICODE_STRING *)v36, v31, v37, v38);
if( v39 && !MiLockPageTablePage(v40, PageTableLockShared) )
goto LABEL_63;
LODWORD(v41) = MI_READ_PTE_LOCK_FREE(v83);
PfnDb = MmGetPfnDb();
v83 = (INT64)&PfnDb[(v41 >> 12) & 0xFFFFFFFFFi64];
if( !MiLockPageTablePage((_MMPFN *)v83, PageTableLockPrivateFork) )
{
LOBYTE(v46) = MI_PFN_IS_PROTO((_UNICODE_STRING *)v36, v43, v44, v45);
if( v46 )
MiUnlockPageTableCharges((_DWORD)PfnDb + 48 * LODWORD(v36->u4._bf_0), 1u, v47);
goto LABEL_63;
}
v48 = 0i64;
if( (*(_DWORD *)(&v36->3 + 1) & 0x400i64) != 0 )
{
LOBYTE(v49) = MI_PFN_IS_PROTO((_UNICODE_STRING *)v36, v43, v44, v45);
if( v49 )
{
v48 = *(_MI_PARTITION **)(*(&stru_140C4DB30 + 267) + 8 * (((unsigned __int64)v36->u4._bf_0 >> 39) & 0x3FF));
if( !MiChargeCommit(v48, 1ui64, 0i64) )
{
MiUnlockPageTableCharges(v83, 2u, v50);
MiUnlockPageTableCharges((unsigned int)MmGetPfnDb() + 48 * LODWORD(v36->u4._bf_0), 1u, v51);
v13 = -1073741523;
goto LABEL_64;
}
_InterlockedAdd64((volatile signed __int64 *)&v48->Vp.ProcessLockedFilePages, 1ui64);
}
}
else if( MiGetPagingFileOffset(&v36->OriginalPte) )
{
MiLockPageAndSetDirty(v36, (VOID *)1);
}
MiLockWsle((INT64)v22);
if( !v53 )
{
MiUnlockPageTableCharges(v83, 2u, v52);
LOBYTE(v57) = MI_PFN_IS_PROTO((_UNICODE_STRING *)v36, v54, v55, v56);
if( v57 )
{
MiUnlockPageTableCharges((unsigned int)MmGetPfnDb() + 48 * LODWORD(v36->u4._bf_0), 1u, v58);
if( (*(_DWORD *)(&v36->3 + 1) & 0x400i64) != 0 )
MiReturnCommit(v48, 1ui64);
}
LABEL_63:
v13 = -1073741670;
LABEL_64:
v76 = v13;
if( v21 )
{
MiUnlockPageTable((INT64)v22, (UINT64)v21);
v21 = 0i64;
}
if( !v77 )
{
LABEL_87:
if( v21 )
MiUnlockPageTable((INT64)v22, (UINT64)v21);
LOBYTE(v31) = WsIrql;
MiUnlockWorkingSetShared(v22, (UINT64)v31);
v12 = NumberOfVads;
goto LABEL_90;
}
v59 = v77 - 1;
v79 = v77 - 1;
v60 = (unsigned __int64)StartingVa + 4096 * v77 - 4096;
v83 = v60;
v61 = v77;
while( 2 )
{
if( _bittest64((const signed __int64 *)P, v59) == 1 )
{
v62 = (char *)MmGetPdeBase() + ((v60 >> 18) & 0x3FFFFFF8);
v91 = v62;
if( v21 != v62 )
{
if( v21 )
{
MiUnlockPageTable((INT64)v22, (UINT64)v21);
v62 = v91;
}
v21 = v62;
MiLockPageTable((INT64)v22, (UINT64)v62);
}
MiUnlockVa(v22, (VOID *)v60);
v59 = v79;
}
v63 = 0;
if( (v59 & 0xF) != 0 )
{
LABEL_81:
if( v63 == 1 )
goto LABEL_82;
}
else
{
LOBYTE(v64) = MiWorkingSetIsContended((INT64)v22);
if( !v64 && (!v21 || !(unsigned int)MiPageTableLockIsContended((__int64)v22, (UINT64)v21)) )
{
if( MiShouldYieldProcessor() )
v63 = 1;
v59 = v79;
goto LABEL_81;
}
LABEL_82:
if( v21 )
{
MiUnlockPageTable((INT64)v22, (UINT64)v21);
v21 = 0i64;
}
LOBYTE(v31) = WsIrql;
MiUnlockWorkingSetShared(v22, (UINT64)v31);
MiLockWorkingSetShared();
v59 = v79;
}
v60 = v83 - 4096;
v83 -= 4096i64;
v79 = --v59;
if( !--v61 )
{
LOBYTE(v5) = v80;
v13 = v76;
goto LABEL_87;
}
continue;
}
}
EffectivePagePriorityThread = MiGetEffectivePagePriorityThread(Thread);
MiLockPageAtDpc((INT64)v36);
MiUpdatePfnPriority(v36, EffectivePagePriorityThread, 0i64);
_InterlockedAnd64(&v36->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
_bittestandset64((signed __int64 *)P, v77);
Address = v78;
}
++v77;
v66 = (_BYTE)PointerPte++ + 8;
v25 = v81 + 4096;
v81 = v25;
v67 = 0;
if( v25 <= v88 && (v66 & 0x78) == 0 )
{
LOBYTE(v68) = MiWorkingSetIsContended((INT64)v22);
if( v68 || (unsigned int)MiPageTableLockIsContended((__int64)v22, (UINT64)v21) )
{
LABEL_103:
MiUnlockPageTable((INT64)v22, (UINT64)v21);
LOBYTE(v70) = WsIrql;
MiUnlockWorkingSetShared(v22, v70);
v21 = 0i64;
MiLockWorkingSetShared();
v8 = v88;
v24 = WsIrql;
goto LABEL_20;
}
if( MiShouldYieldProcessor() )
v67 = 1;
v25 = v81;
}
v69 = v67 == 0;
v8 = v88;
v24 = WsIrql;
PdeBase = MmGetPdeBase();
if( !v69 )
goto LABEL_103;
}
if( v21 )
{
MiUnlockPageTable((INT64)v22, (UINT64)v21);
v24 = WsIrql;
}
LOBYTE(v25) = v24;
MiUnlockWorkingSetShared(v22, v25);
MiUnlockVadRange((_EPROCESS *)Object, StartingVa, NumberOfVads);
if( (v5 & 2) != 0 )
KeUnstackDetachProcess(&ApcState);
ObfDereferenceObjectWithTag(Object, 0x6D566D4Dui64);
ExFreePoolWithTag(P, 0);
v71 = v90 & 0xFFFFFFFFFFFFF000ui64;
*v98 = v8 - (v90 & 0xFFFFFFFFFFFFF000ui64) + 4096;
*v99 = (VOID *)v71;
return(v5 & 1) != 0 ? 0x40000019 : 0;
}Referenced by:
No references.