MiInPagePageTable
VOID __stdcall MiInPagePageTable(INT64 FaultStatus, INT64 a2){
__int64 v2;
_MMPTE *v4;
__int64 v5;
_EPROCESS *v6;
UINT64 v7;
__int64 v8;
unsigned __int64 PteBase;
_MMVAD *v10;
unsigned __int64 v11;
__int64 v12;
_MMPTE *PteLimit;
_MMVAD *VadHint;
__int64 v15;
_EPROCESS *v16;
unsigned __int64 v17;
unsigned int v18;
_MMVAD *v19;
_MMINPAGE_SUPPORT **v20;
_ETHREAD *ForkInProgress;
__int64 v22;
__int64 v23;
__int64 v24;
int v25;
__int64 v26;
__int128 v27;
__int128 v28;
__int128 v29;
__int128 v30;
unsigned int ClosestImplicitNode;
_MMPTE *v32;
UINT64 v33;
NTSTATUS v34;
VOID *v35;
_MMINPAGE_SUPPORT *v36;
_MMPTE *v37;
char v38;
VOID *v39;
unsigned __int64 v40;
_MI_FAULT_VA_LIST *v41;
unsigned int LargeVadMappingIndex;
VOID *v43;
CHAR v44;
INT64 v45;
char v46;
VOID *v47;
ULONG_PTR v48;
unsigned __int64 v49;
int v50;
_MMSUPPORT_INSTANCE *BugCheckParameter4;
VOID *BugCheckParameter4a;
UINT8 v53;
UINT64 v54;
VOID *TrapInformation;
_MMVAD *Vad;
UINT64 PreviousMode;
_MMINPAGE_SUPPORT **InPageSupport;
_EPROCESS *Process;
__int64 VirtualAddress;
INT64 v61;
_MMSUPPORT_FULL *p_Vm;
_MMSUPPORT_INSTANCE FaultStatusa;
v2 = (int)a2;
v4 = 0i64;
HIDWORD(TrapInformation) = a2;
LODWORD(TrapInformation) = 0;
VirtualAddress = 0i64;
memset(&FaultStatusa, 0i64, 0x88u);
v5 = *(_QWORD *)(FaultStatus + 16);
v6 = KeGetCurrentThread()->ApcState.Process;
Process = v6;
p_Vm = &v6->Vm;
if( (v5 & 1) == 0
|| (InPageSupport = (_MMINPAGE_SUPPORT **)(v5 & 0xFFFFFFFFFFFFFFFEui64), *(_BYTE *)(v5 & 0xFFFFFFFFFFFFFFFEui64) != 1) )
{
InPageSupport = 0i64;
}
v7 = *(_QWORD *)(FaultStatus + 8 * v2 + 24);
v61 = FaultStatus + 56;
v8 = *(_QWORD *)v7;
PteBase = (unsigned __int64)MmGetPteBase();
v10 = *(_MMVAD **)FaultStatus;
v11 = (unsigned __int64)v10;
Vad = *(_MMVAD **)FaultStatus;
v12 = (__int64)((v7 << 25) - (PteBase << 25)) >> 16;
PteLimit = MmGetPteLimit();
if( (unsigned __int64)v10 >= PteBase )
{
do
{
if( v11 > (unsigned __int64)PteLimit )
break;
v11 = (__int64)((v11 << 25) - (PteBase << 25)) >> 16;
}
while( v11 >= PteBase );
Vad = (_MMVAD *)v11;
}
VadHint = 0i64;
if( (unsigned __int64)v10 > 0x7FFFFFFEFFFFi64 )
{
if( (unsigned __int64)v10 >= PteBase && v10 <= (_MMVAD *)PteLimit )
{
v18 = 4;
goto LABEL_18;
}
LABEL_17:
v18 = 24;
LABEL_18:
LODWORD(TrapInformation) = v18;
goto LABEL_19;
}
if( (KeGetCurrentThread()->ApcState.Process->Flags3 & 1) == 0 )
{
v15 = (unsigned __int64)v10 & 0x7FFFFFFFF000i64;
if( ((unsigned __int64)v10 & 0xFFFFFFFFFFFFF000ui64) == 2147352576 )
{
v4 = (_MMPTE *)*(&stru_140C4DB30 + 9);
v18 = 1;
goto LABEL_18;
}
if( v15 == *(&stru_140C4DB30 + 11) && v15 )
{
v4 = (_MMPTE *)*(&stru_140C4DB30 + 10);
v18 = 1;
goto LABEL_18;
}
}
v16 = KeGetCurrentThread()->ApcState.Process;
VadHint = (_MMVAD *)v16->VadHint;
if( !VadHint )
{
LABEL_16:
VadHint = 0i64;
v6 = Process;
goto LABEL_17;
}
v17 = (unsigned __int64)v10 >> 12;
if( (unsigned __int64)v10 >> 12 < (VadHint->Core.StartingVpn | ((unsigned __int64)VadHint->Core.StartingVpnHigh << 32))
|| v17 > (VadHint->Core.EndingVpn | ((unsigned __int64)VadHint->Core.EndingVpnHigh << 32)) )
{
VadHint = (_MMVAD *)v16->VadRoot.Root;
if( VadHint )
{
while( 1 )
{
if( v17 > (VadHint->Core.EndingVpn | ((unsigned __int64)VadHint->Core.EndingVpnHigh << 32)) )
{
VadHint = (_MMVAD *)VadHint->Core.ExtraCreateInfo;
}
else
{
if( v17 >= (VadHint->Core.StartingVpn | ((unsigned __int64)VadHint->Core.StartingVpnHigh << 32)) )
{
v16->VadHint = VadHint;
goto LABEL_47;
}
VadHint = (_MMVAD *)VadHint->Core.NextVad;
}
if( !VadHint )
goto LABEL_16;
}
}
goto LABEL_16;
}
LABEL_47:
v37 = MiCheckUserVirtualAddress(v10, (UINT64 *)&TrapInformation, VadHint, (UINT64)v10);
v6 = Process;
v4 = v37;
v11 = (unsigned __int64)Vad;
v18 = (unsigned int)TrapInformation;
LABEL_19:
if( !v8 )
{
v19 = *(_MMVAD **)FaultStatus;
v20 = InPageSupport;
if( *(_QWORD *)FaultStatus >= 0xFFFF800000000000ui64 )
{
if( InPageSupport )
return;
if( v19 >= (_MMVAD *)MmGetPteBase()
&& v19 <= (_MMVAD *)MmGetPteLimit()
&& *(_MMINPAGE_SUPPORT ***)(FaultStatus + 16) != InPageSupport )
{
KeBugCheckEx(0x50u, *(PVOID *)FaultStatus, *(PVOID *)(FaultStatus + 8), (PVOID)v7, (PVOID)6);
}
}
if( v18 == 24 )
{
if( (unsigned __int64)&v19[-482].Core.VadNode.ParentValue <= 0x7FFFFFFDFFFFi64
&& !VadHint
&& (*(_BYTE *)(FaultStatus + 8) & 2) != 0 )
{
if( (v6->Flags3 & 0x1000) != 0 )
KeBugCheckEx(0x1Au, (PVOID)0x4477, v19, 0i64, 0i64);
if( MiIsStoreProcess(v6) )
KeBugCheckEx(0x1Au, (PVOID)0x4478, v19, 0i64, 0i64);
}
if( (unsigned __int64)v19 <= 0x7FFFFFFEFFFFi64 && VadHint && v20 )
{
LODWORD(v39) = MiGetLeafVa(v7 + 8);
if( (unsigned __int64)v39 >= v40 )
{
MiLeapPrefetch((_MI_FAULT_VA_LIST *)v20, v39);
}
else
{
v20[3] = (_MMINPAGE_SUPPORT *)((char *)v20[3] + 1);
v20[4] = 0i64;
}
*((_BYTE *)v20 + 1) = 1;
}
return;
}
if( VadHint && (VadHint->Core.u.LongFlags & 0x100000) != 0 && InPageSupport )
{
if( ((v41 = (_MI_FAULT_VA_LIST *)(*(_QWORD *)(FaultStatus + 16) & 0xFFFFFFFFFFFFFFFEui64), v18 >> 3 != 3)
|| (v18 & 7) == 0)
&& v18 >> 3 != 1
|| (v41[20] & 0x4000) == 0 )
{
MiAdvanceFaultList(v41);
return;
}
}
ForkInProgress = v6->ForkInProgress;
if( ForkInProgress )
{
if( InPageSupport && InPageSupport[7] != (_MMINPAGE_SUPPORT *)(InPageSupport + 7) )
return;
if( ForkInProgress != (_ETHREAD *)KeGetCurrentThread() )
{
*(_DWORD *)(FaultStatus + 80) |= 4u;
return;
}
v18 = (unsigned int)TrapInformation;
}
if( InPageSupport != 0i64 && VadHint != 0i64 && MiIsVadLarge((INT64)VadHint) )
{
MiLeapPrefetch(
(_MI_FAULT_VA_LIST *)v20,
(VOID *)((((VadHint->Core.EndingVpn | ((unsigned __int64)VadHint->Core.EndingVpnHigh << 32)) << 12) | 0xFFF)
+ 4096));
*((_BYTE *)v20 + 1) = 1;
return;
}
if( VadHint && (VadHint->Core.u.LongFlags & 0x70) == 80 && !MiVadPureReserve(&VadHint->Core) )
{
LargeVadMappingIndex = MiGetLargeVadMappingIndex(VadHint, *(_QWORD *)FaultStatus);
if( HIDWORD(TrapInformation) == LargeVadMappingIndex )
{
LODWORD(BugCheckParameter4) = v18;
if( MiInsertLargeVadMapping(
*(_QWORD *)FaultStatus,
(UINT64)v4,
LargeVadMappingIndex,
(UINT64 *)v7,
(INT64)BugCheckParameter4) )
{
if( (v7 < (unsigned __int64)MmGetPml4eBase() || v7 > (unsigned __int64)MmGetPml4eLimit())
&& (unsigned __int64)Vad <= 0x7FFFFFFEFFFFi64 )
{
LODWORD(v47) = MiGetUsedPtesHandle((PSLIST_ENTRY)v12);
MiIncreaseUsedPtesCount(v47, (VOID *)1);
}
MiLargePageFault(FaultStatus, (VOID *)v7, v43, v44);
}
else
{
v45 = v61;
MiReleaseFaultState(v61, 0x11u, 0i64);
MmAccessFault(0i64, v4, 0, 0i64);
*(_BYTE *)(v45 + 13) &= ~1u;
MiLockWorkingSetShared();
*(_BYTE *)(v45 + 12) = v46;
}
return;
}
v11 = (unsigned __int64)Vad;
}
if( (v7 < (unsigned __int64)MmGetPml4eBase() || v7 > (unsigned __int64)MmGetPml4eLimit())
&& v11 <= 0x7FFFFFFEFFFFi64 )
{
LODWORD(v22) = MiGetUsedPtesHandle((PSLIST_ENTRY)v12);
LODWORD(PreviousMode) = 0;
v23 = v22;
while( _interlockedbittestandset64((volatile signed __int32 *)(v23 + 24), 0x3Fui64) )
{
do
KeYieldProcessorEx(&PreviousMode);
while( *(__int64 *)(v23 + 24) < 0 );
}
*(_QWORD *)(v23 + 16) ^= ((unsigned int)*(_QWORD *)(v23 + 16) ^ ((unsigned int)*(_QWORD *)(v23 + 16) + 0x10000)) & 0x3FF0000;
_InterlockedAnd64((volatile signed __int64 *)(v23 + 24), 0x7FFFFFFFFFFFFFFFui64);
MmIsAddressValidEx(*(_QWORD *)(v23 + 8) | 0x8000000000000000ui64);
}
v24 = MiSwizzleInvalidPte(128i64);
LOBYTE(v25) = MiPteInShadowRange(v7);
if( v25 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (v24 & 1) != 0 )
v24 |= 0x8000000000000000ui64;
*(_QWORD *)v7 = v24;
}
v26 = *(_QWORD *)(FaultStatus + 16);
v27 = *(_OWORD *)(FaultStatus + 16);
*(_OWORD *)&FaultStatusa.NextPageColor = *(_OWORD *)FaultStatus;
*(_OWORD *)&FaultStatusa.VmWorkingSetList = v27;
v28 = *(_OWORD *)(FaultStatus + 48);
*(_OWORD *)&FaultStatusa.WorkingSetExpansionLinks.Blink = *(_OWORD *)(FaultStatus + 32);
*(_OWORD *)&FaultStatusa.AgeDistribution[1] = v28;
v29 = *(_OWORD *)(FaultStatus + 80);
*(_OWORD *)&FaultStatusa.AgeDistribution[3] = *(_OWORD *)(FaultStatus + 64);
*(_OWORD *)&FaultStatusa.AgeDistribution[5] = v29;
LODWORD(FaultStatusa.AgeDistribution[5]) = 0;
v30 = *(_OWORD *)(FaultStatus + 112);
*(_OWORD *)&FaultStatusa.AgeDistribution[7] = *(_OWORD *)(FaultStatus + 96);
FaultStatusa.WorkingSetLeafPrivateSize = *(_QWORD *)(FaultStatus + 128);
*(_OWORD *)&FaultStatusa.MinimumWorkingSetSize = v30;
if( (v26 & 1) != 0 )
{
v38 = *(_BYTE *)(v26 & 0xFFFFFFFFFFFFFFFEui64);
if( (unsigned __int8)(v38 - 1) <= 2u || v38 == 5 )
FaultStatusa.VmWorkingSetList = 0i64;
}
ClosestImplicitNode = MiGetClosestImplicitNode(*(_QWORD *)(FaultStatus + 8) >> 57);
*(_QWORD *)&FaultStatusa.NextPageColor = v12;
FaultStatusa.TrimmedPageCount = ((unsigned __int64)ClosestImplicitNode << 57) | 2;
FaultStatusa.AgeDistribution[6] = (unsigned __int64)VadHint;
MiFillPteHierarchy(v12, (UINT64 *)&FaultStatusa.WorkingSetExpansionLinks);
v34 = MiDispatchFault(
(UINT64)&FaultStatusa,
&VirtualAddress,
v32,
v33,
BugCheckParameter4,
v53,
TrapInformation,
Vad,
PreviousMode,
InPageSupport);
if( v34 == -1073532109 )
{
v48 = VirtualAddress;
if( (FaultStatusa.AgeDistribution[5] & 0x40) != 0 )
*(_DWORD *)(VirtualAddress + 192) |= 0x40000u;
v34 = MiIssueHardFault(&FaultStatusa, v48, v35, v36, BugCheckParameter4a, v54, (CHAR)TrapInformation);
}
if( (FaultStatusa.AgeDistribution[3] & 0x10000000000i64) != 0 )
{
v49 = FaultStatusa.AgeDistribution[4];
*(_OWORD *)(FaultStatus + 56) = *(_OWORD *)&FaultStatusa.AgeDistribution[2];
*(_QWORD *)(FaultStatus + 72) = v49;
}
if( v34 >= 0 && (*(_BYTE *)(FaultStatus + 69) & 1) != 0 )
{
v50 = 3;
do
{
if( (**(_QWORD **)(FaultStatus + 8i64 * SHIDWORD(TrapInformation) + 24) & 1i64) == 0 )
break;
if( v50 == HIDWORD(TrapInformation) )
break;
--v50;
}
while( v50 );
}
}Referenced by:
MiUserFault