MiTerminateWsle
VOID __fastcall MiTerminateWsle(VOID *VirtualAddress, _MMSUPPORT_INSTANCE *WsInfo, UINT64 WsPfnIndex, UINT64 LogAccess){
int v4;
int v6;
_MMPTE *v7;
_MMPTE v8;
BOOL v9;
_UNICODE_STRING *v10;
VOID *v11;
_UNICODE_STRING *v12;
__int64 v13;
INT64 v14;
INT64 v15;
int v16;
UINT64 *v17;
UINT64 v18;
INT64 v19;
_MMPFN *v20;
char v21;
int v22;
char v23;
UINT64 v25;
_DWORD *v26;
_OWORD v27[2];
v4 = 1;
v26 = (_DWORD *)LogAccess;
v23 = WsPfnIndex;
v6 = 0;
v7 = (_MMPTE *)((char *)MmGetPteBase() + (((unsigned __int64)WsInfo >> 9) & 0x7FFFFFFFF8i64));
v8.u.Long = v7->u.Long;
v9 = MiPteInShadowRange((UINT64)v7);
v10 = (_UNICODE_STRING *)&MmGetPfnDb()[(v8.u.Long >> 12) & 0xFFFFFFFFFi64];
if( WsInfo >= (_MMSUPPORT_INSTANCE *)MmGetPteBase() && WsInfo <= (_MMSUPPORT_INSTANCE *)MmGetPteLimit() )
{
v4 = 0;
LABEL_4:
v11 = VirtualAddress;
goto LABEL_5;
}
v12 = (_UNICODE_STRING *)(HIBYTE(v7->u.Long) & 0xF);
v13 = (unsigned __int8)((unsigned __int8)v12 | (16 * ((v7->u.Long >> 60) & 7)));
MI_PFN_IS_PROTO(v10, v12, v9, &v10->Length);
if( (v13 & 0xF) != 8 )
goto LABEL_4;
v11 = VirtualAddress;
MiUnlockWsle((_MMSUPPORT_INSTANCE *)VirtualAddress, (UINT64)WsInfo, v14);
MiGetWsleContents(v15, (UINT64)WsInfo);
LABEL_5:
if( (v23 & 3) == 0 )
{
if( v4 )
{
MI_WRITE_INVALID_PTE_TB_FLUSH_NEEDED(v7, ZeroPte);
if( v16 )
v6 = 1;
}
else
{
if( !MiEvictPageTableLock((INT64)v11, &v7->u.Long, ZeroPte.u.Hard._bf_0, 0) )
{
*v26 = 0;
return;
}
v6 = 1;
}
}
MiRemoveWsle((UINT64)v11, WsInfo);
if( v4 )
{
v17 = (unsigned __int64 *)((char *)&MmGetPdeBase()->u.Long + (((unsigned __int64)WsInfo >> 18) & 0x3FFFFFF8));
v18 = *v17;
MiPteInShadowRange((UINT64)v17);
v25 = v18;
MiPteInShadowRange((UINT64)&v25);
v20 = &MmGetPfnDb()[(v18 >> 12) & 0xFFFFFFFFFi64];
if( ((LODWORD(v20->ListEntry.Flink) >> 4) & 0x3FF) == 0 )
{
MiCountWslesInPageTable(v19, (UINT64)WsInfo, v27);
v21 = 8;
while( 1 )
{
v22 = *((_DWORD *)v27 + (unsigned __int8)--v21);
if( v22 )
break;
if( !v21 )
goto LABEL_21;
}
v20->u1.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0 = v20->u1.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0 & 0xFFFFFFFFFFFE000Fui64 | (16 * (v22 & 0x3FF | ((unsigned __int64)(v21 & 7) << 10)));
}
}
LABEL_21:
*v26 = v6;
}Referenced by:
MiDecommitPages
MiDeleteEmptyPageTable
MiRemoveSystemImagePage