MiParseImageSectionHeaders
NTSTATUS __stdcall MiParseImageSectionHeaders(
_MI_CREATE_SECTION_FLAGS CreateSectionFlags,
_CONTROL_AREA *ControlArea,
_IMAGE_SECTION_HEADER *SectionTableEntry,
UINT64 NumberOfSubsections,
_MI_CAPTURED_OPTIONAL_HEADER *OptionalHeader,
UINT64 NumberOfPtes){
_SEGMENT *Segment;
_CONTROL_AREA *v7;
_MI_CREATE_SECTION_FLAGS v8;
int v9;
_CONTROL_AREA *v10;
unsigned __int64 *v11;
_MI_CAPTURED_OPTIONAL_HEADER *v12;
unsigned int SizeOfImage;
char *v14;
unsigned int ImageFileSize;
unsigned int v16;
unsigned int *p_PointerToRawData;
union {unsigned int LongFlags;_MMSECTION_FLAGS Flags;} v18;
unsigned int v19;
int v20;
union {unsigned int LongFlags;_MMSECTION_FLAGS Flags;} *p_u;
union {unsigned int LongFlags;_MMSECTION_FLAGS Flags;} v22;
int LongFlags;
unsigned int v24;
unsigned int v25;
int v26;
int v27;
unsigned int v28;
__int64 v29;
_KSCHEDULING_GROUP *v30;
_KSCHEDULING_GROUP_POLICY v31;
__int64 v32;
__int64 v33;
char v34;
char v35;
__int64 DemandZeroPte;
unsigned int v37;
char v38;
char v39;
unsigned int v40;
union {unsigned int LongFlags;_MMSECTION_FLAGS Flags;} v41;
int v42;
unsigned __int64 v43;
bool v44;
unsigned __int64 v45;
unsigned int v46;
unsigned __int64 Long;
int v49;
unsigned int *p_SizeOfRawData;
unsigned int v51;
unsigned int v52;
unsigned int v53;
__int16 v54;
unsigned int v55;
unsigned int v56;
unsigned int v57;
unsigned int v58;
unsigned int v59;
_SEGMENT *v60;
union {unsigned int LongFlags;_MMSECTION_FLAGS Flags;} *v61;
unsigned int *v62;
union {_MI_SECTION_IMAGE_INFORMATION *ImageInformation;void *FirstMappedVa;} v63;
int v66;
v66 = NumberOfSubsections;
Segment = ControlArea->Segment;
v7 = ControlArea + 1;
v8.EntireFlags = CreateSectionFlags.EntireFlags;
v9 = NumberOfSubsections;
v10 = ControlArea;
v60 = Segment;
v11 = (unsigned __int64 *)(*(_QWORD *)ControlArea[1].gap8 + 8i64 * HIDWORD(ControlArea[1].NumberOfMappedViews));
Segment->SegmentFlags.UChar1 = ControlArea->Segment->SegmentFlags.UChar1 & 0xC1 | 0xE;
if( (CreateSectionFlags.EntireFlags & 0x200000) != 0 )
{
if( (_DWORD)NumberOfSubsections )
{
p_SizeOfRawData = &SectionTableEntry->SizeOfRawData;
while( 1 )
{
v51 = *p_SizeOfRawData;
v52 = *p_SizeOfRawData;
v53 = p_SizeOfRawData[1];
if( *(p_SizeOfRawData - 2) )
v52 = *(p_SizeOfRawData - 2);
if( v51 + v53 < v53 )
break;
if( v53 != *(p_SizeOfRawData - 1) || v52 > v51 )
{
dword_140C4C958 = 17;
return -1073741701;
}
p_SizeOfRawData += 10;
if( !--v9 )
goto LABEL_62;
}
dword_140C4C958 = 16;
return -1073741701;
}
else
{
LABEL_62:
v10->u3._bf_0 = Segment->TotalNumberOfPtes;
return 0;
}
}
else
{
v12 = OptionalHeader;
SizeOfImage = OptionalHeader->SizeOfImage;
v14 = (char *)Segment->ExtendInfo + (unsigned int)(HIDWORD(ControlArea[1].NumberOfMappedViews) << 12);
v63.ImageInformation = (_MI_SECTION_IMAGE_INFORMATION *)Segment->u2;
ImageFileSize = v63.ImageInformation->ExportedImageInformation.ImageFileSize;
v58 = SizeOfImage;
v16 = ImageFileSize + 1;
if( (_DWORD)NumberOfSubsections )
{
p_PointerToRawData = &SectionTableEntry->PointerToRawData;
v18.LongFlags = NumberOfPtes;
v62 = p_PointerToRawData;
while( 1 )
{
v19 = *(p_PointerToRawData - 3);
v20 = *(p_PointerToRawData - 1);
if( !v19 )
v19 = *(p_PointerToRawData - 1);
v57 = v19;
if( !v20 && *p_PointerToRawData )
{
if( (v8.EntireFlags & 0x10000) != 0 )
{
dword_140C4C958 = 18;
return -1073741701;
}
*p_PointerToRawData = 0;
}
if( *p_PointerToRawData + v20 < *p_PointerToRawData )
break;
*(_QWORD *)&v7->u.LongFlags = v10;
*(_QWORD *)&v7->gap8[8] = &v7->u;
p_u = &v7->u;
v61 = p_u;
if( v14 != (char *)(*(_QWORD *)&v12->ImageBase + *(p_PointerToRawData - 2)) || !v19 )
{
dword_140C4C958 = 20;
return -1073741701;
}
if( SizeOfImage + v19 - 1 <= v19 )
{
dword_140C4C958 = 21;
return -1073741701;
}
v22.LongFlags = ((v19 + (unsigned __int64)SizeOfImage - 1) >> 12) & (~((unsigned __int64)SizeOfImage - 1) >> 12);
p_u[11].LongFlags = v22.LongFlags;
if( v22.LongFlags > v18.LongFlags )
{
dword_140C4C958 = 22;
return -1073741701;
}
LongFlags = ((v19 + (unsigned __int64)SizeOfImage - 1) >> 12) & (~((unsigned __int64)SizeOfImage - 1) >> 12);
if( v9 == 1 && v22.LongFlags != v18.LongFlags )
{
p_u[11].LongFlags = v18.LongFlags;
LongFlags = v18.LongFlags;
}
p_u[8].LongFlags = 0;
v24 = *p_PointerToRawData >> 9;
p_u[9].LongFlags = v24;
v56 = v18.LongFlags - LongFlags;
v25 = -v12->SectionAlignment & (v12->SectionAlignment + *p_PointerToRawData + *(p_PointerToRawData - 1) - 1);
if( v25 < *p_PointerToRawData )
{
dword_140C4C958 = 23;
return -1073741701;
}
*(_QWORD *)&p_u[2].LongFlags = v11;
p_u[10].LongFlags = (v25 >> 9) - v24;
HIWORD(p_u[8].Flags._bf_0) = 16 * (v25 & 0x1FF);
v26 = p_PointerToRawData[4];
v27 = ((unsigned int)v26 >> 29) & 1 | 2;
if( (v26 & 0x40000000) == 0 )
v27 = (p_PointerToRawData[4] >> 29) & 1;
v28 = v27 | 4;
if( v26 >= 0 )
v28 = v27;
v29 = v28 | 8;
v30 = (_KSCHEDULING_GROUP *)(v26 & 0x10000000);
if( !(_DWORD)v30 )
v29 = v28;
v31 = (_KSCHEDULING_GROUP_POLICY)(unsigned int)*((char *)MiImageProtectionArray + v29);
if( (*((_BYTE *)MiImageProtectionArray + v29) & 2) != 0 )
v63.ImageInformation->ExportedImageInformation.ImageContainsCode = 1;
LOWORD(p_u[8].LongFlags) ^= (LOWORD(p_u[8].LongFlags) ^ (2 * v31.Weight)) & 0x3E;
MiMakeSubsectionPte((_KSCHEDULING_GROUP *)p_u, v31, v30);
v33 = v32;
DemandZeroPte = MiMakeDemandZeroPte(v34);
if( !*p_PointerToRawData )
v33 = DemandZeroPte;
v38 = 0;
v55 = *(p_PointerToRawData - 1);
v39 = 0;
v59 = v55 + *p_PointerToRawData;
v54 = 0;
if( (v35 & 4) != 0 )
{
if( (v35 & 5) == 5 )
{
v39 = 1;
v55 = *(p_PointerToRawData - 1);
LOBYTE(v54) = 1;
}
else
{
HIWORD(p_u[8].Flags._bf_0) |= 2u;
v38 = 1;
v10->u.LongFlags |= 0x20000u;
v55 = *(p_PointerToRawData - 1);
HIBYTE(v54) = 1;
}
}
v40 = 0;
v41.LongFlags = 0;
if( v61[11].LongFlags )
{
do
{
if( v40 >= v37 )
{
Long = ZeroPte.u.Long;
LOBYTE(v49) = MiPteInShadowRange((UINT64)v11);
if( v49 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (ZeroPte.u.Long & 1) != 0 )
Long = ZeroPte.u.Long | 0x8000000000000000ui64;
*v11 = Long;
v10 = ControlArea;
v61[13].LongFlags ^= (v61[13].LongFlags ^ (v61[13].LongFlags + 1)) & 0x3FFFFFFF;
}
else
{
if( v38 == 1 )
++v60->NumberOfCommittedPages;
if( v39 == 1 )
++v60->u1.ImageCommitment;
LOBYTE(v42) = MiPteInShadowRange((UINT64)v11);
if( v40 >= v55 )
{
v45 = DemandZeroPte;
if( v42 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (DemandZeroPte & 1) != 0 )
v45 = DemandZeroPte | 0x8000000000000000ui64;
*v11 = v45;
if( !v54 )
++v60->NumberOfCommittedPages;
}
else
{
++v10->u3._bf_0;
v43 = v33;
if( v42 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (v33 & 1) != 0 )
v43 = v33 | 0x8000000000000000ui64;
*v11 = v43;
}
}
v37 = v57;
v40 += 4096;
v39 = v54;
++v11;
v38 = HIBYTE(v54);
v14 += 4096;
++v41.LongFlags;
}
while( v41.LongFlags < v61[11].LongFlags );
v8.EntireFlags = CreateSectionFlags.EntireFlags;
}
p_PointerToRawData = v62 + 10;
v12 = OptionalHeader;
v44 = v66 == 1;
v9 = --v66;
v62 += 10;
if( v44 )
{
v46 = v56;
v16 = v59;
ImageFileSize = v63.ImageInformation->ExportedImageInformation.ImageFileSize;
goto LABEL_46;
}
v7 = (_CONTROL_AREA *)v61;
v18.LongFlags = v56;
SizeOfImage = v58;
}
dword_140C4C958 = 19;
return -1073741701;
}
else
{
v46 = NumberOfPtes;
LABEL_46:
if( v16 > ImageFileSize )
{
dword_140C4C958 = 24;
return -1073741701;
}
else if( v46 >= v12->SizeOfImage >> 12 )
{
dword_140C4C958 = 25;
return -1073741701;
}
else
{
return 0;
}
}
}
}Referenced by:
MiBuildImageControlArea