MiGetSystemAddressForImage
VOID *__stdcall MiGetSystemAddressForImage(_SECTION *SectionPointer, UINT64 LoadFlags, UINT64 *SharePages){
char v4;
_CONTROL_AREA *v6;
unsigned __int64 v7;
unsigned __int64 v8;
VOID *v9;
int v10;
INT64 *v11;
INT64 *v12;
_SECTION *v13;
int v14;
int v15;
_MI_RELOCATION_IMAGE_SPACE v17;
VOID *v18;
__int64 v19;
__int64 v20;
__int64 v21;
__int16 v22;
int v23;
unsigned int v24;
int v25;
int v26;
unsigned int v27;
int v28;
int v29;
UINT64 DynamicRelocationsExist;
_MI_RELOCATION_IMAGE_SPACE RelocationImageType;
_MMPTE *PteAddress;
NTSTATUS v33;
int v34;
int v35;
_CONTROL_AREA *v36;
__int64 SystemImageInfo[10];
_BYTE OptionalHeader[112];
v4 = LoadFlags;
v35 = LoadFlags;
LODWORD(DynamicRelocationsExist) = 0;
memset(OptionalHeader, 0i64, sizeof(OptionalHeader));
memset(SystemImageInfo, 0i64, sizeof(SystemImageInfo));
*(_DWORD *)SharePages = 1;
v6 = MiSectionControlArea(SectionPointer);
v36 = v6;
LOBYTE(v7) = MiBytesToMapSystemImage((_FAST_MUTEX *)(v6->Segment->TotalNumberOfPtes << 12));
if( !v7 )
return 0i64;
v8 = v7 >> 12;
v34 = v7 >> 12;
v9 = MiImageSuitableForSystem(v6, &DynamicRelocationsExist);
if( v9 )
{
v11 = (INT64 *)PsLoadedModuleList;
v12 = &PsLoadedModuleList;
while( v11 != v12 )
{
v13 = (_SECTION *)v11[14];
if( v13 && v6 == MiSectionControlArea(v13) )
{
*(_DWORD *)SharePages = 0;
v10 = 1;
break;
}
v11 = (INT64 *)*v11;
}
}
if( v9 )
{
if( v10 != 1 && (v4 & 2) == 0 )
{
v14 = v4 & 1;
if( ((v4 & 1) == 0 || MiGetSystemRegionType((UINT64)v9) == 1)
&& ((v4 & 1) != 0 || MiGetSystemRegionType((UINT64)v9) != 1) )
{
PteAddress = MiGetPteAddress(v9);
if( MiReservePrivilegedPtes((__int64)v6) >= 0 )
{
v15 = 0;
goto LABEL_17;
}
return 0i64;
}
}
}
v14 = v4 & 1;
LODWORD(PteAddress) = v14;
RelocationImageType = v14 + 1;
if( (_DWORD)DynamicRelocationsExist )
{
v17 = (v4 & 1) + 1;
goto LABEL_21;
}
v33 = MiMapImageInSystemSpace(v6, 3ui64, (_MI_SYSTEM_SPACE_IMAGE *)SystemImageInfo);
if( v33 < 0 )
return 0i64;
v19 = SystemImageInfo[0];
LODWORD(v20) = RtlImageNtHeader(SystemImageInfo[0]);
v21 = v20;
HIDWORD(DynamicRelocationsExist) = *(_DWORD *)(v19 + 60) + 48;
v22 = *(_WORD *)(v20 + 24);
if( v22 != 523 )
{
*(_WORD *)&OptionalHeader[48] = v22;
*(_DWORD *)&OptionalHeader[8] = *(_DWORD *)(v21 + 60);
*(_DWORD *)&OptionalHeader[12] = *(_DWORD *)(v21 + 56);
*(_DWORD *)&OptionalHeader[16] = *(_DWORD *)(v21 + 80);
v26 = *(_DWORD *)(v21 + 112);
*(_DWORD *)&OptionalHeader[20] = v26;
*(_QWORD *)OptionalHeader = *(unsigned int *)(v21 + 52);
*(_DWORD *)&OptionalHeader[24] = *(_DWORD *)(v21 + 84);
*(_DWORD *)&OptionalHeader[28] = *(_DWORD *)(v21 + 40);
*(_QWORD *)&OptionalHeader[32] = *(unsigned int *)(v21 + 96);
*(_QWORD *)&OptionalHeader[40] = *(unsigned int *)(v21 + 100);
*(_WORD *)&OptionalHeader[50] = *(_WORD *)(v21 + 92);
*(_DWORD *)&OptionalHeader[52] = *(_DWORD *)(v21 + 72);
*(_DWORD *)&OptionalHeader[56] = *(_DWORD *)(v21 + 64);
*(_WORD *)&OptionalHeader[60] = *(_WORD *)(v21 + 94);
*(_DWORD *)&OptionalHeader[64] = *(_DWORD *)(v21 + 88);
*(_DWORD *)&OptionalHeader[68] = *(_DWORD *)(v21 + 28);
*(_QWORD *)&OptionalHeader[104] = 0i64;
v27 = *(_DWORD *)(v21 + 116);
if( v27 > 6 && *(_DWORD *)(v21 + 168) )
{
*(_QWORD *)&OptionalHeader[104] = *(_QWORD *)(v21 + 168);
v27 = *(_DWORD *)(v21 + 116);
}
if( v27 > 0xC )
{
*(_DWORD *)&OptionalHeader[72] = *(_DWORD *)(v21 + 216);
*(_DWORD *)&OptionalHeader[76] = *(_DWORD *)(v21 + 220);
v27 = *(_DWORD *)(v21 + 116);
}
if( v27 <= 0xE )
{
*(_QWORD *)&OptionalHeader[80] = 0i64;
}
else
{
*(_DWORD *)&OptionalHeader[80] = *(_DWORD *)(v21 + 232);
*(_DWORD *)&OptionalHeader[84] = *(_DWORD *)(v21 + 236);
if( *(_DWORD *)(v21 + 232) && *(_DWORD *)(v21 + 236) )
*(_DWORD *)&OptionalHeader[20] = v26 | 1;
}
if( *(_DWORD *)(v21 + 116) <= 5u )
{
*(_QWORD *)&OptionalHeader[88] = 0i64;
}
else
{
*(_DWORD *)&OptionalHeader[88] = *(_DWORD *)(v21 + 160);
*(_DWORD *)&OptionalHeader[92] = *(_DWORD *)(v21 + 164);
}
if( *(_DWORD *)(v21 + 116) > 0xAu )
{
*(_DWORD *)&OptionalHeader[96] = *(_DWORD *)(v21 + 200);
v25 = *(_DWORD *)(v21 + 204);
goto LABEL_62;
}
LABEL_63:
*(_QWORD *)&OptionalHeader[96] = 0i64;
goto LABEL_64;
}
*(_WORD *)&OptionalHeader[48] = 523;
*(_DWORD *)&OptionalHeader[8] = *(_DWORD *)(v21 + 60);
*(_DWORD *)&OptionalHeader[12] = *(_DWORD *)(v21 + 56);
*(_DWORD *)&OptionalHeader[16] = *(_DWORD *)(v21 + 80);
v23 = *(_DWORD *)(v21 + 128);
*(_DWORD *)&OptionalHeader[20] = v23;
*(_QWORD *)OptionalHeader = *(_QWORD *)(v21 + 48);
*(_DWORD *)&OptionalHeader[24] = *(_DWORD *)(v21 + 84);
*(_DWORD *)&OptionalHeader[28] = *(_DWORD *)(v21 + 40);
*(_QWORD *)&OptionalHeader[32] = *(_QWORD *)(v21 + 96);
*(_QWORD *)&OptionalHeader[40] = *(_QWORD *)(v21 + 104);
*(_WORD *)&OptionalHeader[50] = *(_WORD *)(v21 + 92);
*(_DWORD *)&OptionalHeader[52] = *(_DWORD *)(v21 + 72);
*(_DWORD *)&OptionalHeader[56] = *(_DWORD *)(v21 + 64);
*(_WORD *)&OptionalHeader[60] = *(_WORD *)(v21 + 94);
*(_DWORD *)&OptionalHeader[64] = *(_DWORD *)(v21 + 88);
*(_DWORD *)&OptionalHeader[68] = *(_DWORD *)(v21 + 28);
*(_QWORD *)&OptionalHeader[104] = 0i64;
v24 = *(_DWORD *)(v21 + 132);
if( v24 > 6 && *(_DWORD *)(v21 + 184) )
{
*(_QWORD *)&OptionalHeader[104] = *(_QWORD *)(v21 + 184);
v24 = *(_DWORD *)(v21 + 132);
}
if( v24 > 0xC )
{
*(_DWORD *)&OptionalHeader[72] = *(_DWORD *)(v21 + 232);
*(_DWORD *)&OptionalHeader[76] = *(_DWORD *)(v21 + 236);
v24 = *(_DWORD *)(v21 + 132);
}
if( v24 <= 0xE )
{
*(_QWORD *)&OptionalHeader[80] = 0i64;
}
else
{
*(_DWORD *)&OptionalHeader[80] = *(_DWORD *)(v21 + 248);
*(_DWORD *)&OptionalHeader[84] = *(_DWORD *)(v21 + 252);
if( *(_DWORD *)(v21 + 248) && *(_DWORD *)(v21 + 252) )
*(_DWORD *)&OptionalHeader[20] = v23 | 1;
}
if( *(_DWORD *)(v21 + 132) <= 5u )
{
*(_QWORD *)&OptionalHeader[88] = 0i64;
}
else
{
*(_DWORD *)&OptionalHeader[88] = *(_DWORD *)(v21 + 176);
*(_DWORD *)&OptionalHeader[92] = *(_DWORD *)(v21 + 180);
}
if( *(_DWORD *)(v21 + 132) <= 0xAu )
goto LABEL_63;
*(_DWORD *)&OptionalHeader[96] = *(_DWORD *)(v21 + 216);
v25 = *(_DWORD *)(v21 + 220);
LABEL_62:
*(_DWORD *)&OptionalHeader[100] = v25;
LABEL_64:
v28 = v33;
MiUnmapImageInSystemSpace((_MI_SYSTEM_SPACE_IMAGE *)SystemImageInfo);
if( v28 < 0 )
return 0i64;
v17 = RelocationImageType;
MiRelocateImage(
v6->Segment,
(_MI_CAPTURED_OPTIONAL_HEADER *)OptionalHeader,
HIDWORD(DynamicRelocationsExist),
RelocationImageType);
if( v29 < 0 )
return 0i64;
MiImageSuitableForSystem(v6, &DynamicRelocationsExist);
if( !(_DWORD)DynamicRelocationsExist && (v6->u.LongFlags & 0x40000000) == 0 )
return 0i64;
LABEL_21:
v18 = MiSelectSystemImageAddress(v17, (unsigned int)v8);
v9 = v18;
if( v18 )
{
PteAddress = MiGetPteAddress(v18);
if( MiReservePrivilegedPtes((__int64)v6) < 0 )
{
LABEL_70:
MiReturnSystemImageAddress(v9, (unsigned int)((_DWORD)v8 << 12));
return 0i64;
}
v15 = 1;
if( !MiAddPrivateFixupEntryForSystemImage(v6, v9) )
{
LABEL_69:
MiReleasePrivilegedPtes();
goto LABEL_70;
}
LABEL_17:
if( !v14 || MiSessionInsertImage(v9, v6) >= 0 )
return v9;
if( v15 == 1 )
MiFreePrivateFixupEntryForSystemImage(v9, 1ui64);
goto LABEL_69;
}
return 0i64;
}Referenced by:
MiApplyHotPatchToLoadedDriver
MmLoadSystemImageEx