MiDeleteAweInfoPages
NTSTATUS __stdcall MiDeleteAweInfoPages(_EX_CALLBACK_ROUTINE_BLOCK *CallBackBlock){
_ETHREAD *CurrentThread;
NTSTATUS v2;
UINT64 v3;
__int64 v4;
_EX_CALLBACK_ROUTINE_BLOCK *v5;
_MI_PARTITION *v6;
_EX_CALLBACK_ROUTINE_BLOCK v7;
_RTL_BITMAP_EX *v8;
__int64 v9;
UINT64 SetBits;
UINT64 v11;
UINT64 NextForwardRunClear;
UINT64 SizeOfBitMap;
UINT64 v14;
UINT64 v15;
__int64 v16;
__int64 v17;
UINT64 v18;
_MMPFN *v19;
int v20;
_MMPFN *PfnDb;
__int64 v22;
_MI_PARTITION *v24;
_ETHREAD *v25;
UINT64 StartingRunIndex;
__int64 v28;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v2 = 0;
StartingRunIndex = 0i64;
v3 = 0i64;
v4 = 0i64;
v25 = CurrentThread;
v5 = CallBackBlock;
LODWORD(v6) = MiGetAweInfoPartition((INT64)CallBackBlock);
v24 = v6;
MiLockAwePagesExclusive((INT64)v5, (INT64)CurrentThread);
ExGetCallBackBlockRoutine(v5);
v7 = *v5;
v8 = (_RTL_BITMAP_EX *)(v5 + 4);
v28 = v9;
if( (v7 & 1) == 0 || KeGetCurrentThread()->ApcState.Process->VadPhysicalPages )
{
do
{
SetBits = RtlFindSetBitsEx(v8, 1ui64, v3);
v11 = SetBits;
if( SetBits < v3 || SetBits == -1i64 )
break;
NextForwardRunClear = RtlFindNextForwardRunClearEx(v8, SetBits, &StartingRunIndex);
SizeOfBitMap = StartingRunIndex;
v14 = NextForwardRunClear;
if( !NextForwardRunClear )
SizeOfBitMap = v8->SizeOfBitMap;
v15 = SizeOfBitMap - v11;
RtlClearBitsEx(v8, v11, v15);
v16 = v28;
v3 = v11 + v15 + v14;
v17 = v28 * v11;
v4 += v28 * v15;
v18 = 0i64;
v19 = &MmGetPfnDb()[v17];
v20 = *((unsigned __int8 *)&v19->u3 + 2) >> 6;
if( v15 )
{
PfnDb = MmGetPfnDb();
v22 = 48 * v28;
do
{
if( *((unsigned __int8 *)&v19->u3 + 2) >> 6 != v20 )
{
MiFreeMdlPageRun(v17, v18, 0i64);
v20 = *((unsigned __int8 *)&v19->u3 + 2) >> 6;
v16 = v28;
v18 = 0i64;
v17 = v19 - PfnDb;
}
v18 += v16;
v19 = (_MMPFN *)((char *)v19 + v22);
--v15;
}
while( v15 );
v5 = CallBackBlock;
v8 = (_RTL_BITMAP_EX *)(CallBackBlock + 4);
}
MiFreeMdlPageRun(v17, v18, 0i64);
}
while( v3 < v8->SizeOfBitMap );
if( v4 )
{
_InterlockedExchangeAdd64((volatile signed __int64 *)&v24->Vp.VadPhysicalPages, -v4);
if( v24 == &Irp )
_InterlockedExchangeAdd64((_QWORD *)&stru_140C4DB30 + 569, -v4);
}
CurrentThread = v25;
v2 = v4;
}
MiUnlockAwePagesExclusive((INT64)v5, (INT64)CurrentThread);
return v2;
}Referenced by:
MiDeleteSectionAwe
MmCleanProcessAddressSpace