MiProtectAweRegion
NTSTATUS __stdcall MiProtectAweRegion(VOID *StartingAddress, VOID *EndingAddress, UINT64 ProtectionMask){
int v3;
int v4;
int v7;
_ETHREAD *CurrentThread;
_MMPTE *PteBase;
unsigned __int64 v10;
unsigned __int64 v11;
_MMPTE *AweNode;
INT64 v13;
VOID *v14;
__int64 v15;
INT64 v16;
INT64 bf_0;
union {unsigned __int64 Long;volatile unsigned __int64 VolatileLong;_MMPTE_HARDWARE Hard;_MMPTE_PROTOTYPE Proto;_MMPTE_SOFTWARE Soft;_MMPTE_TIMESTAMP TimeStamp;_MMPTE_TRANSITION Trans;_MMPTE_SUBSECTION Subsect;_MMPTE_LIST List;} v18;
int v19;
unsigned int VadCacheAttribute;
int v21;
unsigned __int64 v22;
int v23;
unsigned __int64 v24;
unsigned __int64 v25;
__int64 v26;
int v27;
int v28;
_MMPTE *v29;
_MMSUPPORT_INSTANCE *v30;
__int64 v31;
unsigned __int64 v32;
char v33;
char v34;
_MMPTE *v35;
UINT64 v36;
NTSTATUS v37;
int v38;
int v39;
unsigned int v40;
int v42;
UINT64 v43;
UINT64 v44;
int v45;
int v46;
char *v47;
__int64 v48;
char *v49;
unsigned __int64 v50;
_MMVAD_SHORT *v51;
_EPROCESS *v52;
__int64 v53;
__int64 v54;
__int64 v55;
UINT64 v56;
UINT64 v57;
UINT64 v58;
int v59;
INT64 v60;
INT64 v61;
int v62;
UINT64 v63;
int v64;
int v65;
unsigned __int64 v66;
UINT64 v67;
__int64 v68;
unsigned __int64 v69;
UINT64 v70;
CHAR WsIrql;
char WsIrqla;
int WsIrql_4;
UINT64 v74;
int v75;
int v76;
INT64 p_Vm;
unsigned int v78;
int v79;
unsigned int v80;
unsigned __int64 v81;
unsigned __int64 v82;
UINT64 v83;
UINT64 a2;
INT64 v85;
unsigned __int64 v86;
unsigned __int64 v87;
INT64 *v88;
__int64 v89;
_EPROCESS *Process;
__int64 v91;
unsigned __int64 v92;
int *v93;
_MI_TB_FLUSH_LIST TbFlushList[48];
int *v95;
v4 = ProtectionMask;
v79 = ProtectionMask;
v93 = v95;
v88 = 0i64;
v7 = v3;
memset(TbFlushList, 0i64, 0xB8u);
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
WsIrql_4 = 1;
v83 = 0i64;
Process = CurrentThread->Tcb.ApcState.Process;
p_Vm = (INT64)&Process->Vm;
PteBase = MmGetPteBase();
v10 = (unsigned __int64)PteBase + (((unsigned __int64)StartingAddress >> 9) & 0x7FFFFFFFF8i64);
v82 = v10;
v11 = (unsigned __int64)PteBase + (((unsigned __int64)EndingAddress >> 9) & 0x7FFFFFFFF8i64);
TbFlushList[0] = 1;
v81 = v11;
LOWORD(TbFlushList[1]) = 0;
*(_QWORD *)&TbFlushList[4] = 0i64;
TbFlushList[2] = 20;
*(_QWORD *)&TbFlushList[6] = 0i64;
MiLockAweVadsShared(&CurrentThread->Tcb);
AweNode = MiGetAweNode((UINT64)StartingAddress);
v15 = 24i64;
v16 = (INT64)AweNode;
bf_0 = AweNode[3].u.Hard._bf_0;
v18.Long = (unsigned __int64)AweNode[4].u;
v85 = bf_0;
if( v4 != 24 )
{
v19 = v4 & 7;
if( v19 != 1 && v19 != 4 )
goto LABEL_47;
VadCacheAttribute = MiGetVadCacheAttribute(bf_0);
v13 = VadCacheAttribute;
if( VadCacheAttribute )
{
v21 = 0;
if( (_DWORD)v13 == 2 )
v21 = v15;
}
else
{
v21 = 8;
}
bf_0 = v85;
v4 = v21 | v19;
v79 = v4;
}
if( (*(_DWORD *)v18.Long & 1) != 0 )
{
v78 = 4;
goto LABEL_11;
}
v78 = (*(_DWORD *)(bf_0 + 48) >> 7) & 0x1F;
if( (v78 & 7) == 1 && (v4 & 7) != 1 )
goto LABEL_47;
if( !v7 )
goto LABEL_11;
v37 = MI_GET_GRAPHICS_PROTECTION_FROM_VAD(bf_0, 1i64, v13, (UINT64 *)v15, WsIrql);
v38 = v7 & 0x20000;
if( (v37 & 0x20000) != 0 )
{
if( !v38 )
goto LABEL_47;
}
else if( v38 )
{
goto LABEL_47;
}
v39 = v7 & 0x40000;
if( (v37 & 0x40000) != 0 )
{
if( !v39 )
goto LABEL_47;
goto LABEL_43;
}
if( v39 )
{
LABEL_47:
MiUnlockAweVadsShared(&CurrentThread->Tcb, v14);
return -1073741800;
}
LABEL_43:
v40 = v37 & 0xFFF9FFFF;
if( (v40 & 0x1C000) == 0 && (v7 & 0x1C000) != 0
|| (v40 & 0x12000) == 0 && (v7 & 0x12000) != 0
|| v40 == 2048 && (v7 & 0xFFF9F7FF) != 0 )
{
goto LABEL_47;
}
LABEL_11:
MiUnlockAweVadsShared(&CurrentThread->Tcb, v14);
v87 = *(_QWORD *)(v18.Long + 8);
v76 = *(_DWORD *)(v85 + 48) & 0x300000;
v75 = 0;
LODWORD(v22) = MiGetAweViewPageSize(v16);
v25 = v24;
if( v22 )
v25 = v22;
v26 = v24;
v92 = v25;
if( v25 == 512 )
v26 = 1i64;
v89 = v26;
v27 = v23 | 0x4000000;
if( v25 != 512 )
v27 = v23;
v80 = v27;
v28 = v25 == 512;
LODWORD(a2) = v28;
if( v24 != 1 && (((v10 >> 3) & 0x1FF) % v25 || (((__int64)(v11 - v10) >> 3) + 1) % v25) )
return -1073741800;
if( v25 == 512 )
{
v29 = MmGetPteBase();
do
{
v10 = (unsigned __int64)v29 + ((v10 >> 9) & 0x7FFFFFFFF8i64);
v11 = (unsigned __int64)v29 + ((v11 >> 9) & 0x7FFFFFFFF8i64);
--v28;
}
while( v28 );
v81 = v11;
v82 = v10;
}
v30 = (_MMSUPPORT_INSTANCE *)p_Vm;
v31 = 0i64;
v86 = v10;
MiLockWorkingSetShared();
v32 = v81;
v34 = v33;
WsIrqla = v33;
if( v10 <= v81 )
{
v35 = 0i64;
while( !v35 || (v10 & 0xFFF) == 0 )
{
MiFlushTbList(TbFlushList);
if( v35 )
{
MiUnlockPageTableInternal((INT64)v30, (UINT64)v35);
LOBYTE(v36) = WsIrqla;
MiUnlockWorkingSetShared(v30, v36);
MiLockWorkingSetShared();
v31 = 0i64;
}
v35 = MiLockLowestValidPageTable((INT64)v30, (INT64 *)v10, &v88);
v83 = (UINT64)v35;
if( v35 == (_MMPTE *)((char *)MmGetPteBase() + ((v10 >> 9) & 0x7FFFFFFFF8i64)) )
break;
v10 = v10 & 0xFFFFFFFFFFFFF000ui64 | 0xFF8;
LABEL_107:
v10 += 8i64;
v82 = v10;
if( v10 > v32 )
{
v34 = WsIrqla;
goto LABEL_109;
}
}
if( v76 == 3145728 && (v89 == 1 || !(((v10 >> 3) & 0x1FF) % v87)) )
{
v42 = 0;
v75 = 0;
}
else
{
v42 = v75;
}
LODWORD(v43) = MI_READ_PTE_LOCK_FREE(v10);
v74 = v43;
v44 = v43;
if( !v43 )
goto LABEL_105;
if( (v43 & 1) == 0 )
{
v62 = WsIrql_4;
if( v10 == v86 )
v62 = 1;
WsIrql_4 = v62;
if( v4 == 24 )
goto LABEL_105;
v63 = v44 ^ ((unsigned __int16)v44 ^ (unsigned __int16)(32 * v4)) & 0x3E0;
v74 = v63;
LOBYTE(v64) = MiPteInShadowRange(v10);
v65 = v64;
v66 = v63;
if( v64 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (v63 & 1) != 0 )
v66 = v63 | 0x8000000000000000ui64;
*(_QWORD *)v10 = v66;
LODWORD(v67) = MiMakeTransitionPteValid((_XSTATE_CONFIGURATION *)v10);
v68 = v67;
v74 = v67;
if( (v80 & 0x4000000) != 0 )
{
v68 = v67 | 0x80;
v74 = v67 | 0x80;
}
v69 = v68;
if( v65 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (v68 & 1) != 0 )
v69 = v68 | 0x8000000000000000ui64;
*(_QWORD *)v10 = v69;
if( !v31 )
v31 = v10;
LABEL_104:
v32 = v81;
LABEL_105:
v30 = (_MMSUPPORT_INSTANCE *)p_Vm;
goto LABEL_106;
}
if( !v31 )
v31 = v10;
v91 = v31;
if( v10 == v86 )
{
v45 = (v43 & 0x800) != 0 ? 4 : 2;
if( v78 >> 3 == 1 )
{
v46 = v45 | 0x200;
}
else
{
WsIrql_4 = (v43 & 0x800) != 0 ? 4 : 2;
if( v78 >> 3 != 3 )
goto LABEL_65;
WsIrql_4 = (v43 & 0x800) != 0 ? 4 : 2;
if( (v78 & 7) == 0 )
goto LABEL_65;
v46 = v45 | 0x400;
}
WsIrql_4 = v46;
}
LABEL_65:
if( v76 == 3145728 && !v42 && (v43 & 0x42) != 0 )
{
LODWORD(v47) = MiGetLeafVa(v10);
v49 = v47;
v50 = v25 / v87;
if( v50 )
{
v51 = (_MMVAD_SHORT *)v85;
v52 = Process;
v53 = v48;
v54 = v87 << 12;
do
{
MiCaptureWriteWatchDirtyBit(v52, v49, v51);
v49 += v54;
v50 -= v53;
}
while( v50 );
v10 = v82;
LODWORD(v48) = 1;
v4 = v79;
v31 = v91;
}
v25 = v92;
v75 = v48;
}
MiPteInShadowRange((UINT64)&v74);
v55 = (v44 >> 12) & 0xFFFFFFFFFi64;
if( v4 == 24 )
{
LODWORD(v56) = MiMakeTransitionPte(v55, 24);
v74 = v56;
v57 = v56;
if( v25 != 512 )
{
v58 = v56;
LOBYTE(v59) = MiPteInShadowRange(v10);
if( v59 )
{
if( (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (v57 & 1) != 0 )
v58 |= 0x8000000000000000ui64;
v57 = v74;
}
*(_QWORD *)v10 = v58;
}
}
else
{
LODWORD(v60) = MiMakeValidPte((_XSTATE_CONFIGURATION *)v10, v55, v4 | v80);
v57 = v60;
if( v25 != 512 )
MiWriteValidPteNewProtection((INT64 *)v10, v60);
}
if( (v4 & 4) != 0 && v76 != 3145728 )
v57 |= 0x42ui64;
if( v25 == 512 )
{
v61 = v57;
v30 = (_MMSUPPORT_INSTANCE *)p_Vm;
MiRewritePteWithLockBit(p_Vm, (INT64 *)v10, v61);
MiInsertLargeTbFlushEntry(TbFlushList, (unsigned int)a2, v10);
v32 = v81;
LABEL_106:
v35 = (_MMPTE *)v83;
goto LABEL_107;
}
MiInsertTbFlushEntry(
TbFlushList,
(VOID *)((__int64)((v10 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16),
1ui64,
0i64);
goto LABEL_104;
}
LABEL_109:
MiFlushTbList(TbFlushList);
if( v83 )
MiUnlockPageTableInternal((INT64)v30, v83);
LOBYTE(v70) = v34;
MiUnlockWorkingSetShared(v30, v70);
*v93 = WsIrql_4;
return 0;
}Referenced by:
MmProtectVirtualMemory