MiCheckSlabPage
NTSTATUS __stdcall MiCheckSlabPage(INT64 a1, INT64 a2, CHAR a3){
unsigned int v3;
__int64 v4;
INT64 v5;
__int64 v6;
__int64 v7;
volatile int *v8;
unsigned __int8 v9;
__int64 v10;
NTSTATUS v11;
unsigned __int64 v12;
int v13;
int v14;
__int64 v15;
unsigned __int64 v17;
v3 = a2;
v4 = (unsigned __int128)((a1 - (__int64)MmGetPfnDb()) * (__int128)0x2AAAAAAAAAAAAAABi64) >> 64;
v5 = *(_QWORD *)(*(&stru_140C4DB30 + 267) + 8 * ((*(_QWORD *)(a1 + 40) >> 39) & 0x3FFi64));
v17 = ((unsigned __int64)v4 >> 63) + (v4 >> 3);
LODWORD(v6) = MiGetSlabAllocator(v5, v3, a3);
v7 = v6;
v8 = (volatile int *)(v6 + 16);
v9 = ExAcquireSpinLockShared((INT64 *)(v6 + 16));
v10 = *(_QWORD *)v7;
v11 = 0;
v12 = v9;
if( (*(_BYTE *)(v7 + 8) & 1) != 0 )
{
if( v10 )
v10 ^= v7;
else
v10 = 0i64;
}
v13 = *(_BYTE *)(v7 + 8) & 1;
while( v10 )
{
v14 = MiCompareSlabEntry(&v17, v10);
if( v14 >= 0 )
{
if( v14 <= 0 )
break;
v15 = *(_QWORD *)(v10 + 8);
}
else
{
v15 = *(_QWORD *)v10;
}
if( v13 && v15 )
v10 ^= v15;
else
v10 = v15;
}
ExReleaseSpinLockSharedFromDpcLevel(v8);
__writecr8(v12);
LOBYTE(v11) = v10 != 0;
return v11;
}Referenced by:
MiFinalizeImageHeaderPage
MiMakeDriverPagesPrivate
MiWalkEntireImage