MiZeroFault
NTSTATUS __stdcall MiZeroFault(INT64 FaultStatus, _BYTE *VirtualAddress, PVOID TrapInformation, _MMPTE **WsIrql){
NTSTATUS v4;
INT64 v5;
_MI_ZERO_FAULT_PACKET v6;
__int64 v7;
bool v8;
__int64 v9;
unsigned __int64 v10;
unsigned __int64 v11;
_MMPTE *PteBase;
_MMPTE *PteLimit;
_MMVAD *VadHint;
unsigned __int64 v15;
_EPROCESS *Process;
unsigned __int64 v17;
unsigned __int64 v18;
union {unsigned int LongFlags;_MMVAD_FLAGS VadFlags;_MM_PRIVATE_VAD_FLAGS PrivateVadFlags;_MM_GRAPHICS_VAD_FLAGS GraphicsVadFlags;_MM_SHARED_VAD_FLAGS SharedVadFlags;volatile unsigned int VolatileVadLong;} v19;
_MMPTE *v20;
_MMPTE *v21;
unsigned int v22;
_MMEXTEND_INFO *ExtendedInfo;
__int64 v24;
NTSTATUS v25;
int v27;
char v28;
__int64 ********LockedVadEvent;
__int64 v30;
__int64 v31;
int v32;
__int64 *v33;
_MI_ZERO_FAULT_PACKET ZeroPacket[2];
INT64 v35;
__int128 v36;
__int128 v37;
__int64 v38;
unsigned __int64 v39;
_MMVAD *v40;
__int64 v41;
v4 = 0;
*(_QWORD *)ZeroPacket = 0i64;
v36 = 0i64;
v5 = FaultStatus;
v37 = 0i64;
v6 = 0;
v7 = *(_QWORD *)(FaultStatus + 56);
v38 = 0i64;
v40 = 0i64;
*VirtualAddress = 1;
v8 = (*(_BYTE *)(v7 + 184) & 7) == 0;
ZeroPacket[0] = 0;
v41 = 0i64;
if( v8 )
{
v6 = 64;
ZeroPacket[0] = 64;
}
v9 = *(_QWORD *)(FaultStatus + 16);
v10 = v9 & 0xFFFFFFFFFFFFFFFEui64;
if( (v9 & 1) != 0 )
{
v28 = *(_BYTE *)v10;
if( *(_BYTE *)v10 == 2 )
{
v6 |= 1u;
}
else if( v28 == 1 )
{
v6 |= 2u;
}
else
{
if( v28 != 5 )
{
LABEL_67:
if( v28 == 4 )
goto LABEL_68;
goto LABEL_4;
}
v6 |= 8u;
}
ZeroPacket[0] = v6;
goto LABEL_67;
}
LABEL_4:
if( (v6 & 0xB) == 0 )
{
v10 = 0i64;
goto LABEL_6;
}
LABEL_68:
if( (v9 & 1) != 0 && *(_BYTE *)v10 == 4 )
v41 = *(_QWORD *)(v10 + 40);
if( (v6 & 2) != 0 && (*(_DWORD *)(v10 + 80) & 0x4000) != 0 )
{
v6 |= 4u;
ZeroPacket[0] = v6;
}
if( (v6 & 8) != 0 && *(_QWORD *)(*(_QWORD *)(v10 + 8) + 8i64) > 0x1000ui64 )
{
v6 |= 0x10u;
ZeroPacket[0] = v6;
}
LABEL_6:
v11 = *(_QWORD *)v5;
v39 = v10;
v35 = v5;
PteBase = MmGetPteBase();
PteLimit = MmGetPteLimit();
v33 = (__int64 *)((char *)PteBase + ((v11 >> 9) & 0x7FFFFFFFF8i64));
if( v11 >= 0xFFFF800000000000ui64 )
{
if( (v6 & 2) != 0 )
return 0;
if( v11 >= (unsigned __int64)PteBase && v11 <= (unsigned __int64)PteLimit && v9 )
KeBugCheckEx(0x50u, (PVOID)v11, *(PVOID *)(v5 + 8), (char *)PteBase + ((v11 >> 9) & 0x7FFFFFFFF8i64), (PVOID)6);
}
VadHint = 0i64;
if( v11 > 0x7FFFFFFEFFFFi64 )
{
if( v11 >= (unsigned __int64)PteBase && v11 <= (unsigned __int64)PteLimit )
{
v22 = 4;
v21 = 0i64;
goto LABEL_29;
}
LABEL_38:
MiCheckFatalAccessViolation((PVOID)v11);
if( (v6 & 2) != 0 && VadHint )
MiPrefetchJumpVad((_MI_FAULT_VA_LIST *)v10, VadHint, (VOID *)v11);
return -1073741819;
}
if( (KeGetCurrentThread()->ApcState.Process->Flags3 & 1) != 0 )
goto LABEL_11;
v15 = v11 & 0xFFFFFFFFFFFFF000ui64;
if( (v11 & 0xFFFFFFFFFFFFF000ui64) == 2147352576 )
{
v21 = (_MMPTE *)*(&stru_140C4DB30 + 9);
v22 = 1;
LOBYTE(v6) = ZeroPacket[0];
goto LABEL_29;
}
if( v15 != *(&stru_140C4DB30 + 11) || !v15 )
{
LABEL_11:
Process = KeGetCurrentThread()->ApcState.Process;
VadHint = (_MMVAD *)Process->VadHint;
if( VadHint )
{
v17 = v11 >> 12;
if( v11 >> 12 >= (VadHint->Core.StartingVpn | ((unsigned __int64)VadHint->Core.StartingVpnHigh << 32))
&& v17 <= (VadHint->Core.EndingVpn | ((unsigned __int64)VadHint->Core.EndingVpnHigh << 32)) )
{
LABEL_14:
if( (KeGetCurrentThread()->ApcState.Process->Flags3 & 1) == 0 )
{
v18 = v11 & 0xFFFFFFFFFFFFF000ui64;
if( (v11 & 0xFFFFFFFFFFFFF000ui64) == 2147352576 )
{
v21 = (_MMPTE *)*(&stru_140C4DB30 + 9);
v22 = 1;
goto LABEL_28;
}
if( v18 == *(&stru_140C4DB30 + 11) && v18 )
{
v21 = (_MMPTE *)*(&stru_140C4DB30 + 10);
v22 = 1;
goto LABEL_28;
}
}
if( (VadHint->Core.u.LongFlags & 0x70) == 32 && (VadHint->u2.LongFlags2 & 0x10000000) != 0 )
{
LockedVadEvent = MiLocateLockedVadEvent((__int64)VadHint, 32);
if( LockedVadEvent )
{
if( LockedVadEvent[1] != (__int64 *******)KeGetCurrentThread() )
goto LABEL_90;
}
}
v19.LongFlags = (unsigned int)VadHint->Core.u;
if( (v19.LongFlags & 4) != 0 )
{
v22 = 24;
v21 = 0i64;
goto LABEL_28;
}
if( (v19.LongFlags & 0x100000) == 0 )
{
if( (VadHint->u2.LongFlags2 & 0x1000000) == 0 || (VadHint->Core.u.LongFlags & 0x70) == 80 )
{
MiGetProtoPteAddress();
v21 = v20;
if( v20 )
{
v22 = (VadHint->Core.u.LongFlags >> 7) & 0x1F;
if( (VadHint->Core.u.LongFlags & 0x70) == 32 && v22 == 7 )
v22 = 256;
}
else
{
v22 = 24;
}
ExtendedInfo = VadHint->u4.ExtendedInfo;
if( (__int64)ExtendedInfo < 0
&& v17 - (VadHint->Core.StartingVpn | ((unsigned __int64)VadHint->Core.StartingVpnHigh << 32)) > (ExtendedInfo->CommittedSize - 1) >> 12 )
{
v22 = 24;
}
v5 = FaultStatus;
}
else
{
v22 = 24;
v21 = 0i64;
}
LABEL_28:
LOBYTE(v6) = ZeroPacket[0];
if( v22 != 24 )
goto LABEL_29;
goto LABEL_38;
}
if( (v27 = VadHint->Core.u.LongFlags & 0x70, v27 == 16)
|| v27 == 48
|| (v19.LongFlags & 0x400000) != 0
|| (v19.LongFlags & 0xC0000) >= 0x80000
|| v27 == 32 && (VadHint->u2.LongFlags2 & 0x1000000) != 0
|| (VadHint->Core.u1.LongFlags1 & 0x80000000) == 0 )
{
LABEL_90:
v22 = 24;
}
else
{
v22 = (VadHint->Core.u.LongFlags >> 7) & 0x1F;
}
v21 = 0i64;
goto LABEL_28;
}
VadHint = (_MMVAD *)Process->VadRoot.Root;
while( VadHint )
{
if( v17 > (VadHint->Core.EndingVpn | ((unsigned __int64)VadHint->Core.EndingVpnHigh << 32)) )
{
VadHint = (_MMVAD *)VadHint->Core.ExtraCreateInfo;
}
else
{
if( v17 >= (VadHint->Core.StartingVpn | ((unsigned __int64)VadHint->Core.StartingVpnHigh << 32)) )
{
Process->VadHint = VadHint;
goto LABEL_14;
}
VadHint = (_MMVAD *)VadHint->Core.NextVad;
}
}
}
VadHint = 0i64;
LOBYTE(v6) = ZeroPacket[0];
goto LABEL_38;
}
v21 = (_MMPTE *)*(&stru_140C4DB30 + 10);
v22 = 1;
LOBYTE(v6) = ZeroPacket[0];
LABEL_29:
if( (v22 & 0xFFFFFFF8) == 16 )
{
if( (v6 & 2) == 0 )
{
if( MiAllowGuardFault(*(_QWORD *)(v5 + 16)) )
{
MiUpdatePageTableUseCount((VOID *)v11, 1ui64);
v30 = v22 & 0xF;
if( v21 )
v30 |= 0xFFFFFFFFF8000020ui64;
v31 = MiSwizzleInvalidPte(32 * v30);
LOBYTE(v32) = MiPteInShadowRange((UINT64)v33);
if( v32 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (v31 & 1) != 0 )
v31 |= 0x8000000000000000ui64;
*v33 = v31;
*VirtualAddress = 2;
return 0;
}
return -1073741819;
}
return 0;
}
v24 = *(_QWORD *)(v5 + 8) >> 57;
*(_QWORD *)&v36 = v11;
*(_QWORD *)&v37 = v22;
LODWORD(v38) = v24;
*((_QWORD *)&v36 + 1) = v21;
v40 = VadHint;
if( !v21 )
return MiResolvePrivateZeroFault(ZeroPacket);
if( (v6 & 2) == 0 )
{
if( VadHint )
{
if( (__int64)VadHint->u4.ExtendedInfo >= 0 )
{
MiCheckVadSequential();
v4 = v25;
if( v25 == -1073741280 )
{
if( !_InterlockedIncrement(&VadHint->Core.ReferenceCount) )
__fastfail(0xEu);
*(_DWORD *)(FaultStatus + 80) |= 1u;
*(_QWORD *)(FaultStatus + 88) = VadHint;
}
}
}
}
*VirtualAddress = 0;
*(_DWORD *)TrapInformation = v22;
*WsIrql = v21;
MiResolveSharedZeroFault(ZeroPacket);
return v4;
}Referenced by:
MiUserFault