MiQueryProcessActivePatches
__int64 __fastcall MiQueryProcessActivePatches(
__int64 Handle,
INT64 *a2,
_DWORD *a3,
__int64 a4,
int a5,
_KPROCESSOR_MODE AccessMode){
INT64 *v7;
_DWORD *v8;
unsigned int v9;
unsigned __int64 j;
unsigned __int64 k;
__int64 v12;
unsigned int v13;
_ETHREAD *v14;
_ETHREAD *Lock;
_QWORD *v16;
INT64 v17;
unsigned __int64 i;
unsigned __int64 v19;
_QWORD **v20;
_QWORD *v21;
INT64 v22;
INT64 *v23;
int v24;
__int64 v25;
NTSTATUS v26;
_EX_RUNDOWN_REF *v27;
signed __int64 v28;
unsigned int v29;
UINT8 v30;
_EX_PUSH_LOCK *ProcessHotPatchContext;
_EX_PUSH_LOCK *v32;
__int64 bf_0;
unsigned __int64 n;
_QWORD **v35;
unsigned __int64 v36;
_QWORD *v37;
unsigned __int64 v38;
int v39;
_QWORD *Pool;
INT64 v41;
__int64 v42;
INT64 v43;
INT64 v44;
INT64 v45;
_QWORD **v46;
unsigned __int64 v47;
_QWORD *v48;
INT64 m;
int v50;
INT64 v51;
INT64 v52;
__int64 v53;
_QWORD **v54;
unsigned __int64 v55;
_QWORD *v56;
_ETHREAD *v57;
_EX_PUSH_LOCK *v58;
INT64 v60;
_ETHREAD *CurrentThread;
INT64 *v62;
_DWORD *v63;
INT64 v64;
INT64 v65;
INT64 v66;
PADAPTER_OBJECT DmaAdapter;
PVOID Process;
_EX_PUSH_LOCK *v69;
__int64 v70;
__int64 v71;
_KAPC_STATE ApcState;
v62 = a2;
v71 = Handle;
v7 = a2;
v70 = a4;
v63 = a3;
v60 = 0i64;
v8 = a3;
DmaAdapter = 0i64;
LOBYTE(v9) = 0;
v69 = 0i64;
j = 0i64;
k = 0i64;
v12 = 0i64;
v13 = 0;
memset(&ApcState, 0, sizeof(ApcState));
v14 = (_ETHREAD *)KeGetCurrentThread();
CurrentThread = v14;
if( !Handle )
{
v9 = 8;
Lock = MmAcquireLoadLock((INT64)v14, 0);
v16 = (_QWORD *)MiSecureImageActivePatches;
v17 = 0i64;
CurrentThread = Lock;
while( v16 )
{
k = (unsigned __int64)v16;
v16 = (_QWORD *)*v16;
}
i = k;
while( i )
{
++v13;
v19 = i;
v12 += *(unsigned __int16 *)(i + 48) + 24i64;
v20 = *(_QWORD ***)(i + 8);
if( v20 )
{
v21 = *v20;
for( i = *(_QWORD *)(i + 8); v21; v21 = (_QWORD *)*v21 )
i = (unsigned __int64)v21;
}
else
{
while( 1 )
{
i = *(_QWORD *)(i + 16) & 0xFFFFFFFFFFFFFFFCui64;
if( !i || *(_QWORD *)i == v19 )
break;
v19 = i;
}
}
}
v22 = PsLoadedModuleList;
v23 = &PsLoadedModuleList;
while( (INT64 *)v22 != v23 )
{
LOBYTE(v24) = MiIsActiveSystemHotPatch(v22);
if( v24 )
{
++v13;
v12 += *(unsigned __int16 *)(v25 + 72) + 24i64;
}
v22 = *(_QWORD *)v25;
}
LABEL_40:
v38 = v12 + 40;
if( (unsigned int)a5 >= v38 )
{
v39 = v38;
Pool = MiAllocatePool(256i64, (unsigned int)v38, 0x71486D4Dui64);
v28 = 0i64;
v41 = (INT64)Pool;
if( Pool )
{
v42 = v71;
Pool[1] = v71;
*(_DWORD *)Pool = 2;
if( v13 )
{
v43 = (INT64)(Pool + 5);
v44 = (INT64)Pool - v70;
v45 = (INT64)&Pool[2 * v13 + 5];
v65 = (INT64)(Pool + 5);
v66 = v45;
Pool[3] = Pool + 5;
Pool[4] = v45;
v64 = v45 + 8i64 * v13;
if( v42 )
{
while( j )
{
if( *(_DWORD *)(j + 88) )
{
MiFillActivePatchesQueryBuffer(
v41,
v45,
v43,
v44,
(INT64)&v66,
(INT64)&v65,
(INT64)&v64,
j + 48,
(PCUNICODE_STRING)(j + 64));
v28 = 0i64;
}
v54 = *(_QWORD ***)(j + 8);
v55 = j;
if( v54 )
{
v56 = *v54;
for( j = *(_QWORD *)(j + 8); v56; v56 = (_QWORD *)*v56 )
j = (unsigned __int64)v56;
}
else
{
while( 1 )
{
j = *(_QWORD *)(j + 16) & 0xFFFFFFFFFFFFFFFCui64;
if( !j || *(_QWORD *)j == v55 )
break;
v55 = j;
}
}
}
}
else
{
while( k )
{
v60 = *(_QWORD *)(k + 24);
MiFillActivePatchesQueryBuffer(
v41,
v45,
v43,
v44,
(INT64)&v66,
(INT64)&v65,
(INT64)&v64,
(INT64)&v60,
(PCUNICODE_STRING)(k + 48));
v46 = *(_QWORD ***)(k + 8);
v28 = 0i64;
v47 = k;
if( v46 )
{
v48 = *v46;
for( k = *(_QWORD *)(k + 8); v48; v48 = (_QWORD *)*v48 )
k = (unsigned __int64)v48;
}
else
{
while( 1 )
{
k = *(_QWORD *)(k + 16) & 0xFFFFFFFFFFFFFFFCui64;
if( !k || *(_QWORD *)k == v47 )
break;
v47 = k;
}
}
}
for( m = PsLoadedModuleList; (INT64 *)m != &PsLoadedModuleList; m = *(_QWORD *)m )
{
LOBYTE(v50) = MiIsActiveSystemHotPatch(m);
if( v50 )
{
v53 = *(_QWORD *)(m + 280);
LODWORD(v60) = *(_DWORD *)(v53 + 120);
HIDWORD(v60) = *(_DWORD *)(v53 + 156);
MiFillActivePatchesQueryBuffer(
v41,
v51,
v52,
v44,
(INT64)&v66,
(INT64)&v65,
(INT64)&v64,
(INT64)&v60,
(PCUNICODE_STRING)(m + 72));
v28 = 0i64;
}
}
}
*(_QWORD *)(v41 + 32) -= v44;
*(_QWORD *)(v41 + 24) -= v44;
}
*v62 = v41;
v29 = v28;
*v63 = v39;
}
else
{
v29 = -1073741670;
}
}
else
{
v28 = 0i64;
if( v38 <= 0xFFFFFFFF )
{
*v7 = v17;
v29 = v17;
*v8 = v38;
}
else
{
v29 = -1073741675;
}
}
goto LABEL_75;
}
Process = 0i64;
v26 = ObReferenceObjectByHandle((VOID *)Handle, 0x1000ui64, (_OBJECT_TYPE *)PsProcessType, AccessMode, &Process, 0i64);
v27 = (_EX_RUNDOWN_REF *)Process;
v28 = 0i64;
DmaAdapter = (PADAPTER_OBJECT)Process;
v29 = v26;
if( v26 < 0 )
{
v57 = CurrentThread;
goto LABEL_79;
}
v30 = ExAcquireRundownProtection((_EX_RUNDOWN_REF *)Process + 139);
v9 = 2 * (v30 & 1);
if( (v30 & 1) != 0 )
{
KiStackAttachProcess(v27, 0i64, &ApcState);
v9 |= 4u;
ProcessHotPatchContext = (_EX_PUSH_LOCK *)MiGetProcessHotPatchContext((__int64)v27, 0);
v17 = 0i64;
v69 = ProcessHotPatchContext;
v32 = ProcessHotPatchContext;
if( ProcessHotPatchContext )
{
v9 |= 1u;
--CurrentThread->Tcb.SpecialApcDisable;
ExAcquirePushLockSharedEx(ProcessHotPatchContext + 2, 0i64);
bf_0 = v32[1]._bf_0;
if( (bf_0 & 1) != 0 )
{
if( bf_0 != 1 )
j = bf_0 ^ ((unsigned __int64)v32 | 1);
}
else
{
j = v32[1].Value;
}
v17 = 0i64;
n = j;
while( n )
{
if( *(_DWORD *)(n + 88) )
{
++v13;
v12 += *(unsigned __int16 *)(n + 64) + 24i64;
}
v35 = *(_QWORD ***)(n + 8);
v36 = n;
if( v35 )
{
v37 = *v35;
for( n = *(_QWORD *)(n + 8); v37; v37 = (_QWORD *)*v37 )
n = (unsigned __int64)v37;
}
else
{
while( 1 )
{
n = *(_QWORD *)(n + 16) & 0xFFFFFFFFFFFFFFFCui64;
if( !n || *(_QWORD *)n == v36 )
break;
v36 = n;
}
}
}
}
v7 = v62;
v8 = v63;
goto LABEL_40;
}
v29 = -1073741558;
v28 = 0i64;
LABEL_75:
v57 = CurrentThread;
if( v9 < 8 )
{
v27 = (_EX_RUNDOWN_REF *)DmaAdapter;
}
else
{
MmReleaseLoadLock(CurrentThread);
v27 = (_EX_RUNDOWN_REF *)DmaAdapter;
v28 = 0i64;
}
LABEL_79:
if( (v9 & 1) != 0 )
{
v58 = v69;
if( _InterlockedCompareExchange64(&v69[2]._bf_0, v28, 17i64) != 17 )
ExfReleasePushLockShared(v58 + 2);
KeAbPostRelease(&v58[2]);
KiLeaveGuardedRegionUnsafe((__int64)v57);
}
if( (v9 & 4) != 0 )
KiUnstackDetachProcess(&ApcState, 0i64);
if( (v9 & 2) != 0 )
ExReleaseRundownProtection(v27 + 139);
if( v27 )
HalPutDmaAdapter((PADAPTER_OBJECT)v27);
return v29;
}Referenced by:
NtManageHotPatch