MiSetReadOnlyOnSectionView
NTSTATUS __stdcall MiSetReadOnlyOnSectionView(
_EPROCESS *Process,
_MMVAD *FoundVad,
VOID *StartingAddress,
VOID *EndingAddress){
_MMVAD *v4;
UINT64 v6;
unsigned __int64 v7;
__int64 v8;
NTSTATUS v10;
unsigned int updated;
unsigned int v12;
UINT64 v13;
_MMPTE *PteBase;
unsigned __int64 v15;
unsigned __int64 v16;
UINT8 v17;
UINT64 v18;
int v19;
UINT64 v20;
int v21;
_UNICODE_STRING *v22;
UINT8 v23;
wchar_t *v24;
__int64 v25;
_MMPFN *v26;
int v27;
_MMPTE *v28;
unsigned __int64 v29;
__int64 v30;
union {unsigned __int64 Long;volatile unsigned __int64 VolatileLong;_MMPTE_HARDWARE Hard;_MMPTE_PROTOTYPE Proto;_MMPTE_SOFTWARE Soft;_MMPTE_TIMESTAMP TimeStamp;_MMPTE_TRANSITION Trans;_MMPTE_SUBSECTION Subsect;_MMPTE_LIST List;} v31;
NTSTATUS WsleProtection;
unsigned __int64 v33;
int v34;
UINT64 v35;
UINT64 v36;
int v37;
PTE_CHANGE_TYPE v38;
UINT64 v39;
UINT64 v40;
UINT64 Flags;
UINT8 v42;
UINT64 ProtectionMask;
int v44;
UINT64 v45;
UINT64 v46;
INT64 v47;
_MMVAD_SHORT *FoundVada;
__int64 v49;
unsigned __int64 v50;
unsigned __int64 v51;
__int64 v52;
_MMPTE *PointerPte;
unsigned __int64 v54;
_MI_TB_FLUSH_LIST TbFlushList;
__int16 v56;
__int16 v57;
__int64 v58;
UINT64 v59;
UINT64 v60;
__int128 v61;
__int128 v62;
__int128 v63;
__int128 v64;
__int128 v65;
__int128 v66;
__int128 v67;
__int128 v68;
__int128 v69;
__int64 v70;
FoundVada = &FoundVad->Core;
v54 = (unsigned __int64)StartingAddress;
v4 = FoundVad;
v57 = 0;
v70 = 0i64;
v52 = 0i64;
v61 = 0i64;
v62 = 0i64;
v63 = 0i64;
v64 = 0i64;
v65 = 0i64;
v66 = 0i64;
v67 = 0i64;
v68 = 0i64;
v69 = 0i64;
if( MiVadPureReserve(&FoundVad->Core) )
return -1073741755;
v10 = v6;
updated = 1;
v12 = 4;
HIDWORD(ProtectionMask) = v6;
v13 = v6;
v56 = v6;
v59 = v6;
v60 = v6;
v46 = v6;
v44 = 4;
LODWORD(ProtectionMask) = 1;
v58 = 20i64;
TbFlushList = 1;
PteBase = MmGetPteBase();
v51 = (unsigned __int64)PteBase + ((v7 >> 9) & 0x7FFFFFFFF8i64);
v15 = v51;
v16 = (unsigned __int64)PteBase + (((unsigned __int64)EndingAddress >> 9) & 0x7FFFFFFFF8i64);
v50 = v16;
v47 = v8 + 1664;
MiLockWorkingSetShared();
v42 = v17;
if( v51 <= v16 )
{
do
{
if( (v15 & 0xFFF) != 0 )
{
if( v13 )
goto LABEL_10;
}
else if( v13 )
{
MiFlushTbList(&TbFlushList);
MiUnlockPageTableInternal(v47, v13);
v17 = v42;
}
LODWORD(Flags) = 0;
MiMakeSystemAddressValid((VOID *)v15, &TbFlushList, (v4->Core.u.LongFlags >> 12) & 0x3F, v17, Flags);
v46 = (UINT64)MmGetPteBase() + ((v15 >> 9) & 0x7FFFFFFFF8i64);
LABEL_10:
v18 = *(_QWORD *)v15;
LOBYTE(v19) = MiPteInShadowRange(v15);
v21 = v19;
v45 = v18;
if( !v18 )
goto LABEL_49;
if( (v18 & 1) != 0 )
{
MiPteInShadowRange((UINT64)&v45);
v25 = (v18 >> 12) & 0xFFFFFFFFFi64;
v26 = &MmGetPfnDb()[v25];
if( v26->u3.ReferenceCount > 1u && (updated & 7) != 4 )
goto LABEL_49;
LOBYTE(v27) = MI_PFN_IS_PROTO((_UNICODE_STRING *)v26, v22, v23, v24);
if( v27 )
{
v28 = MmGetPteBase();
v29 = (__int64)((v15 << 25) - ((_QWORD)v28 << 25)) >> 16;
MiGetProtoPteAddress();
if( (v26->PteLong | 0x8000000000000000ui64) != v30 )
goto LABEL_49;
PointerPte = (_MMPTE *)((char *)v28 + ((v29 >> 9) & 0x7FFFFFFFF8i64));
LODWORD(v49) = ((v29 >> 9) & 0xFFFFFFF8) + (_DWORD)v28;
v31.Long = (unsigned __int64)PointerPte->u;
MiPteInShadowRange((UINT64)PointerPte);
WsleProtection = MiGetWsleProtection(v29, HIBYTE(v31.Trans._bf_0) & 0xF | (16 * ((v31.Long >> 60) & 7)));
v12 = v44;
if( WsleProtection != v44 )
{
if( WsleProtection
|| (LODWORD(v33) = MI_READ_PTE_LOCK_FREE((INT64)&v26->OriginalPte.u.Hard), ((v33 >> 5) & 0x1F) != v44) )
{
v4 = (_MMVAD *)FoundVada;
goto LABEL_49;
}
}
updated = ProtectionMask;
MiWriteValidPteVolatile(PointerPte, 0x80000000ui64);
v4 = (_MMVAD *)FoundVada;
}
else
{
if( ((*((_DWORD *)&v26->3 + 4) >> 5) & 0x1F) != (unsigned __int64)v12 )
goto LABEL_49;
updated = MiUpdatePfnProtection(&v4->Core, v26, updated);
LODWORD(ProtectionMask) = updated;
}
MiRevertValidPte(&v4->Core, (_MMPTE *)v15, updated, v25, &TbFlushList);
v16 = v50;
v15 += 8i64;
goto LABEL_35;
}
if( (v18 & 0x400) != 0 )
{
if( (updated & 7) != 4 )
goto LABEL_49;
LOBYTE(v34) = MiIsPrototypePteVadLookup(v18);
if( !v34 )
{
v35 = MiSwizzleInvalidPte(32 * (updated & 0x1F | 0xFFFFFFFFF8000020ui64));
v45 = v35;
if( v37 )
{
if( (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) == 0 )
{
*(_QWORD *)v15 = v36;
goto LABEL_49;
}
v35 = v36;
if( (v36 & 1) != 0 )
v35 = v36 | 0x8000000000000000ui64;
}
*(_QWORD *)v15 = v35;
LABEL_49:
v40 = v46;
if( (_MMPTE *)v46 != (_MMPTE *)((char *)MmGetPdeBase() + ((v54 >> 18) & 0x3FFFFFF8)) )
{
MiFlushTbList(&TbFlushList);
if( v40 )
{
MiUnlockPageTableInternal(v47, v40);
v46 = 0i64;
}
}
v16 = v15 - 8;
v12 = 1;
v15 = v51;
updated = 4;
v10 = -1073741755;
v50 = v16;
v44 = 1;
ProtectionMask = 0xC000004500000004ui64;
goto LABEL_36;
}
}
else
{
if( (v18 & 0x800) != 0 )
{
v38 = MiSetProtectionOnTransitionPte(&v4->Core, (_MMPTE *)v15, updated, (updated & 7) == 4);
if( v38 == PteChanged )
goto LABEL_47;
if( v38 != PteNotTransition )
goto LABEL_49;
goto LABEL_35;
}
if( ((v18 >> 5) & 0x1F) != v12 )
goto LABEL_49;
}
v45 = v18 ^ ((unsigned __int16)v18 ^ (unsigned __int16)(32 * updated)) & 0x3E0;
v39 = v45;
if( !v21 )
goto LABEL_46;
if( (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 )
{
v39 = v20;
if( (v20 & 1) != 0 )
v39 = v20 | 0x8000000000000000ui64;
LABEL_46:
*(_QWORD *)v15 = v39;
LABEL_47:
v15 += 8i64;
goto LABEL_35;
}
*(_QWORD *)v15 = v20;
v15 += 8i64;
LABEL_35:
v10 = HIDWORD(ProtectionMask);
LABEL_36:
v13 = v46;
v17 = v42;
}
while( v15 <= v16 );
}
MiFlushTbList(&TbFlushList);
if( v13 )
MiUnlockPageTableInternal(v47, v13);
MiUnlockWorkingSetShared((_MMSUPPORT_INSTANCE *)v47, v42);
return v10;
}Referenced by:
MmSecureVirtualMemoryAgainstWrites