MmRemovePhysicalMemory
NTSTATUS __stdcall MmRemovePhysicalMemory(_LARGE_INTEGER *StartAddress, _LARGE_INTEGER *NumberOfBytes){
unsigned __int64 QuadPart;
unsigned __int64 v4;
UINT64 SizeInPages;
INT64 v6;
bool v7;
UINT64 v8;
NTSTATUS result;
UINT64 v10;
int v11;
NTSTATUS v12;
UINT64 PreferredNode;
UINT64 Flags;
UINT64 *StartingPfn;
LONGLONG StartPage;
_MI_PARTITION *StartPagea;
QuadPart = NumberOfBytes->QuadPart;
v4 = StartAddress->QuadPart;
SizeInPages = QuadPart >> 12;
StartPage = StartAddress->QuadPart;
v6 = (unsigned int)StartAddress->QuadPart;
v7 = (StartPage & 1) != 0 && (StartPage & 0xFFF) != 0;
if( v7 )
{
v6 = (unsigned int)v6 & 0xFFFFFFFE;
LODWORD(StartPage) = v6;
v4 = StartPage;
}
v8 = v4 >> 12;
StartPagea = (_MI_PARTITION *)v8;
if( v8 >= v8 + SizeInPages )
return -1073741585;
if( v7 )
{
result = MiRemoveBadPages(v6, v8, SizeInPages);
}
else
{
LODWORD(StartingPfn) = 202375168;
LODWORD(Flags) = 0x80000000;
LODWORD(PreferredNode) = 0x80000000;
result = MiFindContiguousPages(
&Irp,
v8,
v8 + SizeInPages - 1,
0i64,
SizeInPages,
MiCached,
PreferredNode,
Flags,
StartingPfn);
}
if( result >= 0 )
{
MiRemovePhysicalMemory((UINT64)StartPagea, SizeInPages, 0x10ui64);
v12 = v11;
if( v11 < 0 )
{
if( v7 )
MiReturnBadPagesToBadList((INT64)StartPagea, SizeInPages);
else
MiFreeContiguousPages(StartPagea, SizeInPages, v10);
}
else
{
NumberOfBytes->QuadPart = SizeInPages << 12;
}
return v12;
}
return result;
}Referenced by:
WheapClearPoison