MiDbgMarkPfnModified
NTSTATUS __stdcall MiDbgMarkPfnModified(VOID *VirtualAddress, _MMPTE PteContents){
int v4;
unsigned __int64 v5;
signed __int64 v6;
NTSTATUS v7;
unsigned __int8 CurrentIrql;
char v10;
__int64 v11;
int v12;
__int64 v13;
__int64 v14;
int v15;
NTSTATUS SystemRegionType;
char v17;
NTSTATUS PagingFileOffset;
__int64 v19;
signed __int64 v20;
UINT64 v21;
__int64 bf_0;
bf_0 = PteContents.u.Hard._bf_0;
MiPteInShadowRange((UINT64)&bf_0);
v4 = 1;
v5 = (PteContents.u.Long >> 12) & 0xFFFFFFFFFi64;
if( (MiFlags & 0x8000000) == 0 )
return 1;
if( (MmGetPfnDb()[v5].u4._bf_0 & 0x4000000000000i64) == 0 )
return 1;
v6 = (signed __int64)&MmGetPfnDb()[v5];
if( (*(_BYTE *)(v6 + 34) & 0x10) != 0 )
return 1;
v7 = 0;
CurrentIrql = 17;
if( KeGetCurrentIrql() <= 2u )
{
CurrentIrql = KeGetCurrentIrql();
__writecr8(2ui64);
}
if( _interlockedbittestandset64((volatile signed __int32 *)(v6 + 24), 0x3Fui64) )
{
if( CurrentIrql != 17 )
__writecr8(CurrentIrql);
return 0;
}
v10 = *(_BYTE *)(v6 + 34);
v11 = *(_QWORD *)(v6 + 16);
if( (v11 & 0x400) == 0 )
{
if( (v10 & 8) == 0 )
{
PagingFileOffset = MiGetPagingFileOffset((_MMPTE *)(v6 + 16));
v4 = 1;
if( PagingFileOffset )
{
v19 = 0i64;
do
{
v20 = _InterlockedCompareExchange64(&MiState[v19 + 1019], v6, 0i64);
if( !v20 )
break;
if( (v20 | 1) == (v6 | 1) )
goto LABEL_36;
v19 = (unsigned int)(v19 + 1);
}
while( (unsigned int)v19 < 0x20 );
if( (_DWORD)v19 == 32 )
goto LABEL_39;
v21 = 5i64;
if( CurrentIrql != 17 )
v21 = 1i64;
MiAddLockedPageCharge((_MMPFN *)v6, v21);
v4 = 1;
_InterlockedAdd64(&MiState[v19 + 1019], 1ui64);
_InterlockedCompareExchange(&ExpDebuggerWork, 1, 0);
goto LABEL_36;
}
}
v17 = v10 | 0x10;
goto LABEL_38;
}
if( (v10 & 0x10) != 0 )
{
LABEL_36:
v7 = v4;
goto LABEL_39;
}
LOBYTE(v12) = MiIsPfnFileOnly(v6);
if( !v12 )
{
if( *(&stru_140C4DB30 + 42) && (v11 & 0x10) == 0 )
v11 &= ~*(&stru_140C4DB30 + 42);
v13 = v11 >> 16;
v14 = *(_QWORD *)v13;
v15 = *(_DWORD *)(*(_QWORD *)v13 + 56i64);
if( (v15 & 0x20) == 0 )
goto LABEL_25;
if( (v15 & 0x40000) != 0 || !*(_QWORD *)(*(_QWORD *)(v14 + 96) + 32i64) )
{
LABEL_21:
if( (*(_BYTE *)(v13 + 32) & 0x3Eu) < 8 )
{
SystemRegionType = MiGetSystemRegionType((UINT64)VirtualAddress);
v4 = 1;
if( SystemRegionType == 1 )
byte_140C4CAC8 = 1;
}
*(&stru_140C4DB30 + 2705) = v4;
LABEL_25:
v17 = v10 | 0x10;
LABEL_38:
*(_BYTE *)(v6 + 34) = v17;
goto LABEL_36;
}
if( (unsigned int)ExTryAcquireSpinLockExclusiveAtDpcLevel((INT64 *)(v14 + 72)) )
{
*(_DWORD *)(v14 + 56) |= 0x40000u;
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)(v14 + 72));
v10 = *(_BYTE *)(v6 + 34);
v4 = 1;
goto LABEL_21;
}
}
LABEL_39:
_InterlockedAnd64((volatile signed __int64 *)(v6 + 24), 0x7FFFFFFFFFFFFFFFui64);
if( CurrentIrql != 17 )
__writecr8(CurrentIrql);
return v7;
}Referenced by:
MiDbgWriteCheck