IoSetDumpRange
VOID __fastcall IoSetDumpRange(_MM_KERNEL_DUMP_CONTEXT *Context, VOID *StartVa, UINT64 Pages, UINT64 AddressFlags){
unsigned int v4;
int v5;
UINT64 v6;
char *v7;
unsigned __int64 v9;
unsigned int v10;
unsigned __int64 *p_PageCount;
unsigned __int64 v12;
unsigned int v13;
_QWORD *v14;
unsigned __int64 v15;
unsigned __int64 v16;
int v17;
v4 = AddressFlags;
v5 = AddressFlags & 0xF;
v6 = Pages;
v7 = (char *)StartVa;
if( v5 == 1 )
{
LODWORD(v9) = MmGetPhysicalAddress((UINT64)StartVa);
IopAddPageToPageMap(
*((_QWORD *)Context + 3),
*((_RTL_BITMAP_EX **)Context + 2),
*((UINT64 **)Context + 4),
v9 >> 12,
v6,
Context[10] & 1,
0);
}
else if( v5 == 2 )
{
v10 = 0;
if( MmPhysicalMemoryBlock->NumberOfRuns )
{
p_PageCount = &MmPhysicalMemoryBlock->Run[0].PageCount;
do
{
v12 = *(p_PageCount - 1);
if( v12 > (unsigned __int64)v7 )
break;
if( *p_PageCount + v12 > (unsigned __int64)v7 )
{
if( Pages > MmPhysicalMemoryBlock->Run[v10].BasePage
+ MmPhysicalMemoryBlock->Run[v10].PageCount
- (unsigned __int64)v7 )
break;
LABEL_19:
IopAddPageToPageMap(
*((_QWORD *)Context + 3),
*((_RTL_BITMAP_EX **)Context + 2),
*((UINT64 **)Context + 4),
(UINT64)v7,
Pages,
Context[10] & 1,
v4);
return;
}
++v10;
p_PageCount += 2;
}
while( v10 < MmPhysicalMemoryBlock->NumberOfRuns );
}
if( qword_140C508F0 )
{
v13 = 0;
if( *qword_140C508F0 )
{
v14 = qword_140C508F0 + 6;
do
{
v15 = *(v14 - 1);
if( v15 > (unsigned __int64)v7 )
break;
if( *v14 + v15 > (unsigned __int64)v7 )
{
if( Pages > *(_QWORD *)&qword_140C508F0[4 * v13 + 4]
+ *(_QWORD *)&qword_140C508F0[4 * v13 + 6]
- (_QWORD)v7 )
return;
goto LABEL_19;
}
++v13;
v14 += 2;
}
while( v13 < *qword_140C508F0 );
}
}
}
else if( Pages )
{
do
{
if( MmIsAddressValidEx((INT64)v7) )
{
LODWORD(v16) = MmGetPhysicalAddress((UINT64)v7);
v17 = IopAddPageToPageMap(
*((_QWORD *)Context + 3),
*((_RTL_BITMAP_EX **)Context + 2),
*((UINT64 **)Context + 4),
v16 >> 12,
1ui64,
Context[10] & 1,
0);
if( v17 == -1073741789 )
break;
}
v7 += 4096;
--v6;
}
while( v6 );
}
}Referenced by:
IoSetDumpRangeForPartialKernelDump
IopAddPageDumpRange