RtlScrubMemory
NTSTATUS __stdcall RtlScrubMemory(PVOID VirtualAddress){
char *v2;
unsigned __int64 v3;
unsigned __int64 v4;
struct _KPRCB *CurrentPrcb;
__int64 CFlushSize;
char *i;
__int64 v8;
VOID *v9;
VOID *v10;
int v12[14];
v2 = (char *)VirtualAddress;
v3 = 1024i64;
v4 = __rdtsc() >> 4;
if( ((unsigned __int8)VirtualAddress & 4) != 0 )
{
*(_DWORD *)VirtualAddress = v4;
v2 = (char *)VirtualAddress + 4;
v3 = 1023i64;
}
memset64(v2, (unsigned int)v4 | ((unsigned __int64)(unsigned int)v4 << 32), v3 >> 1);
if( (v3 & 1) != 0 )
*(_DWORD *)&v2[4 * v3 - 4] = v4;
CurrentPrcb = KeGetCurrentPrcb();
CFlushSize = CurrentPrcb->CFlushSize;
if( CurrentPrcb->CFlushSize )
{
_InterlockedOr(v12, 0);
for( i = (char *)((unsigned __int64)VirtualAddress & ~(CFlushSize - 1));
i < (char *)VirtualAddress + 4096;
i += CFlushSize )
{
_mm_clflush(i);
}
}
LODWORD(v8) = RtlCompareMemoryUlong(VirtualAddress, 4096, v4);
if( v8 == 4096
&& RtlpGenericMATSPlusWorker(0i64, 0xFFFFFFFFui64, VirtualAddress)
&& RtlpGenericMATSPlusWorker(0xFFFFFFFFui64, 0i64, VirtualAddress)
&& RtlpGenericInverseCouplingWorker(0i64, 0xFFFFFFFFui64, VirtualAddress)
&& RtlpGenericInverseCouplingWorker(0xFFFFFFFFui64, 0i64, VirtualAddress)
&& RtlpGenericStrideWorker(0i64, 0xFFFFFFFFui64, v9)
&& RtlpGenericStrideWorker(0xFFFFFFFFui64, 0i64, v10)
&& RtlpGenericRandomPatternWorker(VirtualAddress) )
{
return 0;
}
else
{
return -1073740023;
}
}Referenced by:
MiScrubPage