IopGetPhysicalMemoryBlock
VOID __stdcall IopGetPhysicalMemoryBlock(){
PHYSICAL_MEMORY_RANGE *PhysicalMemoryRanges;
PHYSICAL_MEMORY_RANGE *v1;
LARGE_INTEGER *p_NumberOfBytes;
unsigned int v3;
LARGE_INTEGER NumberOfBytes;
char *v5;
unsigned __int64 v6;
__int64 v7;
size_t v8;
VOID **PoolWithTag;
VOID **v10;
signed __int64 v11;
unsigned __int64 QuadPart;
PhysicalMemoryRanges = MmGetPhysicalMemoryRanges();
v1 = PhysicalMemoryRanges;
if( PhysicalMemoryRanges )
{
p_NumberOfBytes = &PhysicalMemoryRanges->NumberOfBytes;
v3 = 0;
NumberOfBytes = PhysicalMemoryRanges->NumberOfBytes;
v5 = 0i64;
if( !NumberOfBytes.QuadPart )
goto LABEL_13;
do
{
++v3;
v5 += (unsigned __int64)NumberOfBytes.QuadPart >> 12;
NumberOfBytes = v1[v3].NumberOfBytes;
}
while( NumberOfBytes.QuadPart );
if( v3
&& (v6 = 16i64 * v3, v7 = v3, v6 <= 0xFFFFFFFF)
&& (int)v6 + 32 >= (unsigned int)v6
&& (v8 = v6 + 32,
PoolWithTag = ExAllocatePoolWithTag(0x200ui64, (unsigned int)(v6 + 32), 1886209091i64),
(v10 = PoolWithTag) != 0i64) )
{
memset(PoolWithTag, 0i64, v8);
*(_DWORD *)v10 = v3;
v10[1] = v5;
v11 = (char *)v10 - (char *)v1;
do
{
*(LONGLONG *)((char *)&p_NumberOfBytes[1].QuadPart + v11) = (unsigned __int64)p_NumberOfBytes[-1].QuadPart >> 12;
QuadPart = p_NumberOfBytes->QuadPart;
p_NumberOfBytes += 2;
*(LONGLONG *)((char *)&p_NumberOfBytes->QuadPart + v11) = QuadPart >> 12;
--v7;
}
while( v7 );
ExFreePoolWithTag(v1, 0);
}
else
{
LABEL_13:
ExFreePoolWithTag(v1, 0);
}
}
}Referenced by:
IoUpdateDumpPhysicalRanges
IopLiveDumpAllocAndInitResources
IopLoadCrashdumpDriver