MiMapViewOfDataSection
NTSTATUS __stdcall MiMapViewOfDataSection(
_CONTROL_AREA *ControlArea,
_EPROCESS *Process,
VOID **CapturedBase,
_LARGE_INTEGER *SectionOffset,
UINT64 *CapturedViewSize,
_SECTION *Section,
_SECTION_INHERIT InheritDisposition,
UINT64 ProtectionMask,
UINT8 *CommitSize,
UINT64 AllocationType,
UINT64 ProbeMode,
UINT8 *CfgTargetsValid,
VOID **SecureHandle,
VOID **a14){
int Blink_high;
int v18;
__int64 v19;
__int64 *v20;
_MMVAD_SHORT *v21;
__int64 v22;
_EPROCESS *v23;
int v24;
int v25;
bool v26;
unsigned __int64 v28;
UINT64 v29;
_ETHREAD *CurrentThread;
unsigned __int64 QuadPart;
unsigned __int64 v32;
int inserted;
_ADAPTER_OBJECT *v34;
UINT64 v35;
bool v36;
_SUBSECTION *SubsectionNode;
unsigned __int64 v38;
UINT64 v39;
INT64 *v40;
UINT64 v41;
int v42;
_DWORD *PoolMm;
_SECTION_INHERIT v44;
unsigned int v45;
int v46;
int v47;
int v48;
_BOOL8 v49;
unsigned int v50;
unsigned int v51;
unsigned __int64 v52;
unsigned __int64 v53;
int v54;
unsigned __int64 v55;
unsigned __int64 v56;
_DWORD *v57;
_DWORD *Pool;
UINT64 v59;
unsigned __int64 v60;
VOID **p_ControlArea;
UINT64 v62;
__int64 v63;
_SUBSECTION *v64;
_SUBSECTION *v65;
INT64 v66;
__int32 v67;
INT64 DeepFreezeStartTime_high;
NTSTATUS v69;
_EX_PUSH_LOCK *v70;
UINT64 v71;
UINT64 *HINTHonored;
PVOID *StartingAddress;
_SUBSECTION *Subsection;
_ETHREAD *Thread;
int v76;
INT64 a2;
_MMVAD_SHORT *Vad;
UINT64 StartingVpn;
UINT64 StartingVpna;
UINT64 StartingVpnb;
int v82;
UINT64 v83;
UINT64 v84;
unsigned __int64 LastPteOffset;
UINT64 LastPteOffseta;
__int64 a3;
char *v88;
__int64 v89;
UINT64 OutPteOffset;
UINT64 QuotaCharge;
_MMPTE *StartingPte;
UINT64 v93;
UINT64 EndingVpn;
INT64 a6;
PVOID P;
_EX_PUSH_LOCK *PushLock;
NTSTATUS PlaceholderStorage;
VOID **v99;
_LARGE_INTEGER *v100;
v100 = SectionOffset;
v99 = CapturedBase;
Blink_high = HIDWORD(Process->Pcb.ThreadListHead.Blink);
a2 = 0i64;
OutPteOffset = 0i64;
a6 = 0i64;
v76 = 0;
if( (Blink_high & 2) != 0 )
return -1073741811;
LOBYTE(v18) = MiAweControlArea((INT64)ControlArea);
if( v18 )
return -1073741811;
v22 = *v20;
v23 = *(_EPROCESS **)(v19 + 88);
v24 = *(_DWORD *)(v19 + 40);
QuotaCharge = (UINT64)v21;
v89 = v22;
if( (v24 & 0x2000) != 0 && ControlArea->FilePointer.Object == v21 )
return -1073741811;
v25 = v24 & 0x40000000;
if( (v24 & 0x20000000) == 0 )
{
if( !v25 || (v24 & 0x2000) == 0 && (v23->PicoContext != v21 || (Process->Pcb.DeepFreezeStartTime & 1) != 0) )
goto LABEL_20;
return -1073741811;
}
if( v25
|| (v24 & 0x2000) != 0
|| InheritDisposition == 24
|| (InheritDisposition & 0xFFFFFFF8) == 16
|| (InheritDisposition & 5) == 5 )
{
return -1073741811;
}
v26 = ControlArea->FilePointer.Object == v21 ? (*(_WORD *)(v22 + 12) & 0x1000) == 0 : (ControlArea->u.LongFlags & 0x40000000) == 0;
if( v26 )
return -1073741811;
LABEL_20:
v28 = *(_QWORD *)&Process->Pcb.gap0[16];
if( v28 >= 0x200000 && ((v28 - 1) & (unsigned __int64)Process->Pcb.ProfileListHead.Blink) != 0
|| (v24 & 0x2000) != 0 && SectionOffset->QuadPart >= 0x10000000000ui64 )
{
return -1073741793;
}
v29 = (UINT64)v21;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
Vad = v21;
a3 = (__int64)&v23->Vm.Instance.VmWorkingSetList[1].NextPteToAge;
P = v21;
v82 = (int)v21;
Thread = CurrentThread;
MiCheckPurgeAndUpMapCount(ControlArea);
QuadPart = SectionOffset->QuadPart;
v83 = QuadPart >> 12;
LastPteOffset = ((unsigned __int64)Process->Pcb.ProfileListHead.Flink + QuadPart) >> 12;
LODWORD(v32) = MiGetControlAreaPtes(ControlArea);
StartingVpn = v32;
if( QuadPart >> 12 >= v32 )
{
inserted = -1073741793;
LABEL_27:
MiDereferenceControlArea(ControlArea);
if( v29 )
{
if( *(__int64 *)(v29 + 120) < 0 )
MiDereferenceExtendInfo((_MMVAD *)v29, ControlArea);
v34 = *(_ADAPTER_OBJECT **)(v29 + 128);
if( v34 )
HalPutDmaAdapter(v34);
MiFreePlaceholderStorage(v29);
ExFreePoolWithTag((PVOID)v29, 0);
}
if( P )
ExFreePoolWithTag(P, 0);
return inserted;
}
v35 = ProtectionMask;
v36 = 0;
if( ControlArea->FilePointer.Value == v29 )
{
OutPteOffset = v83;
Subsection = MiLocatePagefileSubsection((_SUBSECTION *)&ControlArea[1], &OutPteOffset);
SubsectionNode = Subsection;
if( !v35 && InheritDisposition == 24 )
v36 = (ControlArea->u.LongFlags & 0x1000) != 0;
}
else
{
SubsectionNode = MiLocateSubsectionNode(ControlArea, v100->QuadPart, 0i64);
Subsection = SubsectionNode;
}
v38 = SubsectionNode->StartingSector | ((unsigned __int64)(SubsectionNode->u.SubsectionFlags._bf_0 & 0xFFC0) << 26);
v84 = v83 - v38;
v39 = LastPteOffset - v38;
if( v36 )
v39 = 1i64;
LastPteOffseta = v39;
PlaceholderStorage = MiAddViewsForSection(SubsectionNode, v39, 8ui64);
inserted = PlaceholderStorage;
if( PlaceholderStorage < 0 )
goto LABEL_27;
v40 = (INT64 *)Subsection;
StartingPte = &Subsection->SubsectionBase[v84];
if( ControlArea->FilePointer.Value == v29 && v35 && MiGetCommittedPages(ControlArea) < StartingVpn )
{
v41 = v29;
LOBYTE(v41) = (v35 & 0xFFF) != 0;
QuotaCharge = (v35 >> 12) + v41;
}
v93 = v29;
StartingVpna = CapturedViewSize[3] << 12;
LOWORD(v42) = MmGetCurrentProcessorColor();
PoolMm = ExAllocatePoolMm(64i64, 0x88ui64, 0x20646156ui64, v42 | 0x80000000);
v29 = (UINT64)PoolMm;
if( !PoolMm )
{
inserted = -1073741670;
goto LABEL_121;
}
v44 = InheritDisposition;
v45 = PoolMm[16] & 0xFBFFFFFF;
*((_QWORD *)PoolMm + 2) = -2i64;
*((_QWORD *)PoolMm + 10) = StartingPte;
v46 = 0;
v26 = (_DWORD)Section == 1;
*(_QWORD *)(v29 + 72) = Subsection;
if( v26 )
v46 = 0x4000000;
v47 = v46 | v45;
v48 = (*(_DWORD *)(v29 + 48) ^ (v44 << 7)) & 0xF80;
*(_DWORD *)(v29 + 64) = v47;
*(_DWORD *)(v29 + 48) ^= v48;
*(_DWORD *)(v29 + 48) ^= (*(_DWORD *)(v29 + 48) ^ (HIDWORD(Process->Pcb.ThreadListHead.Flink) << 12)) & 0x3F000;
if( HIDWORD(Process->Pcb.ThreadListHead.Flink) )
LOBYTE(v23->Vm.Instance.VmWorkingSetList[8].LockedEntries) = 1;
if( ControlArea->FilePointer.Value && (Process->Pcb.DirectoryTableBase & 0x20002000) == 0 )
*(_DWORD *)(v29 + 64) |= 0x2000000u;
*(_QWORD *)(v29 + 40) = 0i64;
PushLock = (_EX_PUSH_LOCK *)(v29 + 40);
*(_DWORD *)(v29 + 64) = (v100->QuadPart >> 16) & 0xFFFFFF | *(_DWORD *)(v29 + 64) & 0xFF000000;
if( (HIDWORD(Process->Pcb.ThreadListHead.Blink) & 0x4000000) != 0 )
{
PlaceholderStorage = MiCreatePlaceholderStorage((_MMVAD_SHORT *)v29);
inserted = PlaceholderStorage;
if( PlaceholderStorage < 0 )
goto LABEL_121;
v40 = (INT64 *)Subsection;
}
*(_QWORD *)(v29 + 128) = MiReferenceFileObjectForMap((_SECTION *)CapturedViewSize);
v49 = Feature_Servicing_SetVadPageSize__private_IsEnabled() != 0;
if( (Process->Pcb.DirectoryTableBase & 0x20000000) != 0 )
{
if( v49 )
{
if( !ControlArea->FilePointer.Value )
{
*(_DWORD *)(v29 + 48) = *(_DWORD *)(v29 + 48) & 0xFFF3FFFF | 0x80000;
goto LABEL_71;
}
v50 = MiIncrementLargeSubsections(v40, LastPteOffseta);
if( v50 <= 1 )
{
v51 = *(_DWORD *)(v29 + 48) | 0xC0000;
if( v50 == 1 )
v51 = *(_DWORD *)(v29 + 48) & 0xFFF3FFFF | 0x80000;
*(_DWORD *)(v29 + 48) = v51;
LABEL_70:
v76 = 1;
goto LABEL_71;
}
}
else
{
if( !ControlArea->FilePointer.Value )
goto LABEL_71;
if( (unsigned int)MiIncrementLargeSubsections(v40, LastPteOffseta) <= 1 )
goto LABEL_70;
}
inserted = -1073741280;
goto LABEL_121;
}
LABEL_71:
LOCK_ADDRESS_SPACE(CurrentThread, v23);
if( (v23->Flags & 0x20) != 0 )
{
inserted = -1073741558;
goto LABEL_116;
}
if( (Process->Pcb.DeepFreezeStartTime & 1) != 0 )
{
v52 = (unsigned __int64)*v99;
}
else
{
if( !StartingVpna )
{
LODWORD(StartingAddress) = 0;
LODWORD(HINTHonored) = v44;
PlaceholderStorage = MiSelectUserAddress(
LODWORD(Process->Pcb.DirectoryTableBase),
*(_QWORD *)Process->Pcb.gap0,
*(_QWORD *)&Process->Pcb.gap0[8],
(UINT64)Process->Pcb.ProfileListHead.Flink,
*(_QWORD *)&Process->Pcb.gap0[16],
0i64,
HINTHonored,
StartingAddress);
inserted = PlaceholderStorage;
if( PlaceholderStorage < 0 )
goto LABEL_116;
v52 = 0i64;
v53 = (unsigned __int64)&Process->Pcb.ProfileListHead.Flink[-1].Blink + 7;
goto LABEL_85;
}
v52 = StartingVpna + v100->QuadPart;
}
a2 = v52;
v88 = (char *)&Process->Pcb.ProfileListHead.Flink[-1].Blink + v52 + 7;
if( (HIDWORD(Process->Pcb.ThreadListHead.Blink) & 0x4000000) != 0 )
{
Vad = MiFindPlaceholderVadToReplace(
(VOID *)v52,
(__int64)&Process->Pcb.ProfileListHead.Flink[-1].Blink + v52 + 7,
LOBYTE(Process->Pcb.Affinity.Bitmap[2]),
&PlaceholderStorage);
if( !Vad )
{
inserted = PlaceholderStorage;
CurrentThread = Thread;
goto LABEL_116;
}
v53 = (unsigned __int64)v88;
}
else
{
v71 = *(_QWORD *)&Process->Pcb.gap0[8];
MiIsVaRangeAvailable(v23, (VOID *)v52, (UINT64)Process->Pcb.ProfileListHead.Flink, *(VOID **)Process->Pcb.gap0);
if( !v54 )
{
CurrentThread = Thread;
inserted = -1073741800;
goto LABEL_116;
}
}
LABEL_85:
v55 = v52 >> 12;
v56 = v53 >> 12;
*(_BYTE *)(v29 + 32) = v52 >> 44;
*(_BYTE *)(v29 + 33) = v53 >> 44;
*(_DWORD *)(v29 + 24) = v52 >> 12;
*(_DWORD *)(v29 + 28) = v53 >> 12;
v26 = (Process->Pcb.DirectoryTableBase & 0x2000) == 0;
StartingVpnb = v52 >> 12;
EndingVpn = v53 >> 12;
if( !v26 )
{
CurrentThread = Thread;
--Thread->Tcb.SpecialApcDisable;
ExAcquirePushLockExclusiveEx(&stru_140C4C6D0, 0i64);
v57 = *(_DWORD **)(v89 + 32);
if( v57 )
{
++v57[2];
}
else
{
Pool = MiAllocatePool(64i64, 0x10ui64, 0x78436D4Dui64);
v57 = Pool;
if( !Pool )
{
if( (_InterlockedExchangeAdd64(&stru_140C4C6D0._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(&stru_140C4C6D0);
KeAbPostRelease(&stru_140C4C6D0);
KiLeaveGuardedRegionUnsafe((__int64)Thread);
inserted = -1073741670;
goto LABEL_114;
}
Pool[2] = 1;
*(_QWORD *)Pool = _InterlockedCompareExchange64((volatile signed __int64 *)(v89 + 24), -1i64, -1i64);
*(_QWORD *)(v89 + 32) = Pool;
}
v59 = CapturedViewSize[6];
if( *(_QWORD *)v57 < v59 )
*(_QWORD *)v57 = v59;
if( (_InterlockedExchangeAdd64(&stru_140C4C6D0._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(&stru_140C4C6D0);
KeAbPostRelease(&stru_140C4C6D0);
KiLeaveGuardedRegionUnsafe((__int64)Thread);
v55 = StartingVpnb;
v56 = EndingVpn;
v52 = a2;
*(_QWORD *)(v29 + 120) = v57;
}
if( (InheritDisposition & 5) == 5 )
{
v60 = (*(unsigned int *)(v29 + 28) | ((unsigned __int64)*(unsigned __int8 *)(v29 + 33) << 32))
- (*(unsigned int *)(v29 + 24) | ((unsigned __int64)*(unsigned __int8 *)(v29 + 32) << 32))
+ 1;
*(_DWORD *)(v29 + 52) ^= ((*(_DWORD *)(v29 + 28) - *(_DWORD *)(v29 + 24) + 1) ^ *(_DWORD *)(v29 + 52)) & 0x7FFFFFFF;
*(_BYTE *)(v29 + 34) = v60 >> 31;
}
p_ControlArea = (VOID **)&Subsection->ControlArea;
*(_QWORD *)(v29 + 88) = MiComputeContiguousSubsectionPte(Subsection, v56 + v84 - v55);
if( (Process->Pcb.DirectoryTableBase & 0x400000) != 0 || (CapturedViewSize[7] & 0x4000) != 0 )
{
P = MiAddSecureEntry((_MI_PARTITION *)v29, v52, v63, 0x80000000, 0);
if( !P )
{
inserted = -1073741670;
LABEL_113:
CurrentThread = Thread;
LABEL_114:
if( Vad )
MiUnlockVad(CurrentThread, Vad);
LABEL_116:
UNLOCK_ADDRESS_SPACE(CurrentThread, v23);
if( v82 == 1 )
MiRemoveSharedCommitNode(ControlArea, v23, 0i64);
if( v76 )
{
v64 = MiLocateSubsectionNode(ControlArea, (UINT64)Process->Pcb.ProfileListHead.Blink + v100->QuadPart - 1, 0i64);
v65 = Subsection;
MiDecrementLargeSubsections(&Subsection->ControlArea, (INT64)v64);
LABEL_122:
MiRemoveViewsFromSectionWithPfn(v65, LastPteOffseta);
goto LABEL_27;
}
LABEL_121:
v65 = Subsection;
goto LABEL_122;
}
}
if( (Process->Pcb.DirectoryTableBase & 0x20000000) != 0 )
{
*(_DWORD *)(v29 + 48) = *(_DWORD *)(v29 + 48) & 0xFFFFFF8F | 0x50;
v52 = a2;
*(_DWORD *)(v29 + 64) |= 0x1000000u;
}
if( !ControlArea->FilePointer.Value )
{
inserted = MiInsertSharedCommitNode((_RTL_BALANCED_NODE *)ControlArea, v23, 0i64);
if( inserted < 0 )
goto LABEL_113;
p_ControlArea = (VOID **)&Subsection->ControlArea;
v82 = 1;
}
if( QuotaCharge && !MiChargeSegmentCommit(p_ControlArea, StartingPte, QuotaCharge, v62) )
{
inserted = -1073741523;
goto LABEL_113;
}
PlaceholderStorage = MiInsertVadCharges((_MMVAD_SHORT *)v29, (ULONG_PTR)v23);
inserted = PlaceholderStorage;
if( PlaceholderStorage < 0 )
goto LABEL_113;
if( !ControlArea->FilePointer.Value && ControlArea->u.Flags._bf_0 < 0 )
{
*(_DWORD *)(v29 + 48) = *(_DWORD *)(v29 + 48) & 0xFFF3FFFF | 0x40000;
++*(_QWORD *)(a3 + 384);
}
if( Vad )
{
MiPreparePlaceholderVadReplacement((_RTL_BALANCED_NODE *)Vad, v23, a3);
ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)(v29 + 40), 0i64);
}
else
{
MiLockVad(Thread, (_MMVAD_SHORT *)v29);
}
MiGetWsAndInsertVad((_MMVAD_SHORT *)v29);
if( !ControlArea->FilePointer.Value && !*(_QWORD *)(v89 + 56) )
*(_QWORD *)(v89 + 56) = v52;
if( v93 )
MiAdvanceVadHint(StartingVpnb, EndingVpn, v93, v66, v71);
if( ((InheritDisposition - 4) & 0xFFFFFFFD) == 0 && ControlArea->FilePointer.Value )
{
_InterlockedIncrement(&ControlArea->u2.WritableUserReferences);
v52 = a2;
}
inserted = 0;
PlaceholderStorage = 0;
v67 = InheritDisposition & 2;
if( ((InheritDisposition & 2) == 0 || !MiIsProcessCfgEnabled()) && !*(_QWORD *)&Process->Pcb.Affinity.Count )
{
if( Vad )
{
v70 = PushLock;
if( (_InterlockedExchangeAdd64(&PushLock->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(v70);
KeAbPostRelease(v70);
UNLOCK_ADDRESS_SPACE_UNORDERED(Thread, v23);
inserted = PlaceholderStorage;
MiFinishPlaceholderVadReplacement(Vad);
*v99 = (VOID *)a2;
}
else
{
MiUnlockVad(Thread, (_MMVAD_SHORT *)v29);
UNLOCK_ADDRESS_SPACE(Thread, v23);
*v99 = (VOID *)v52;
}
return inserted;
}
UNLOCK_ADDRESS_SPACE_UNORDERED(Thread, v23);
MiReferenceVad((_MMVAD_SHORT *)v29);
if( v67 )
{
if( MiIsProcessCfgEnabled() )
{
inserted = MiCommitVadCfgBits((_MMVAD *)v29, 0i64, CommitSize);
if( inserted < 0 )
{
LABEL_150:
MiUnmapVad((_MMVAD *)v29, (UINT64)Vad);
if( Vad )
MiFinishPlaceholderVadReplacement(Vad);
return inserted;
}
}
}
if( *(_QWORD *)&Process->Pcb.Affinity.Count )
{
DeepFreezeStartTime_high = HIDWORD(Process->Pcb.DeepFreezeStartTime);
if( (unsigned int)(DeepFreezeStartTime_high - 1) > 1
&& (_DWORD)DeepFreezeStartTime_high != -2147483647
&& (_DWORD)DeepFreezeStartTime_high != 4 )
{
v69 = -1073741755;
LABEL_149:
inserted = v69;
goto LABEL_150;
}
LODWORD(v71) = 0;
v69 = MiSecureVad(
(_MI_PARTITION *)v29,
v52,
(INT64)Process->Pcb.ProfileListHead.Flink,
DeepFreezeStartTime_high,
v71,
(INT64)&a6);
if( v69 < 0 )
goto LABEL_149;
**(_QWORD **)&Process->Pcb.Affinity.Count = *(&stru_140C4DB30 + 12) ^ a6 ^ (unsigned __int64)v23;
}
if( Vad )
{
MiUnlockAndDereferenceNestedVad((_MMVAD_SHORT *)v29);
MiFinishPlaceholderVadReplacement(Vad);
}
else
{
MiUnlockAndDereferenceVad((_MMVAD_SHORT *)v29);
}
*v99 = (VOID *)v52;
return inserted;
}Referenced by:
MiMapViewOfSection