PfSnLogPageFaultCommon
NTSTATUS __stdcall PfSnLogPageFaultCommon(
PFSN_TRACE_HEADER *Trace,
_FILE_OBJECT *FileObject,
UINT64 FileKey,
UINT64 FileOffset,
UINT64 Flags){
UINT64 v8;
unsigned int v9;
NTSTATUS result;
unsigned __int64 *v11;
UINT64 *v12;
v12 = 0i64;
PfSnGetFileInformation(Trace, FileObject);
if( (Trace[121] & 1) == 0 && *(_BYTE *)(*((_QWORD *)Trace + 44) + 1850i64) == 2 )
_InterlockedOr16((volatile signed __int16 *)Trace + 242, 1u);
if( FileOffset >= 0x20000000000i64 )
return -1073739516;
v8 = FileOffset >> 9;
if( (Flags & 1) != 0 )
v9 = 1;
else
v9 = (Flags & 2) != 0 ? 3 : 0;
PfSnCheckLogSequenceNumber((INT64)Trace);
if( v9 || (v12 = (UINT64 *)*((_QWORD *)Trace + 51), *v12 >> 3 != v8) || v12[1] != FileKey )
{
result = PfSnTraceGetLogEntry((__int64)Trace, 1u, &v12);
if( result < 0 )
return result;
v11 = v12;
*v12 = (8 * v8) | *(_DWORD *)v12 & 7;
v11[1] = FileKey;
*v11 = v9 | *v11 & 0xFFFFFFFFFFFFFFF8ui64;
_InterlockedAdd(Trace + 83, 1u);
if( !v9 )
*((_QWORD *)Trace + 51) = v12;
}
return 0;
}Referenced by:
MiCompleteRestrictedImageFault
MiMakeSystemCacheRangeValid
PfFileInfoNotify
PfSnLogPageFault