MiCheckAndUpdateIoAttribution
VOID __stdcall MiCheckAndUpdateIoAttribution(_MMPFN *Pfn1){
_ETHREAD *CurrentThread;
union {unsigned __int64 Long;volatile unsigned __int64 VolatileLong;_MMPTE_HARDWARE Hard;_MMPTE_PROTOTYPE Proto;_MMPTE_SOFTWARE Soft;_MMPTE_TIMESTAMP TimeStamp;_MMPTE_TRANSITION Trans;_MMPTE_SUBSECTION Subsect;_MMPTE_LIST List;} v2;
__int64 v3;
unsigned __int64 v4;
VOID *v5;
unsigned __int8 v6;
__int64 v7;
unsigned __int64 v8;
unsigned __int64 v9;
__int64 v10;
PVOID OpaqueContext;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v2.Long = (unsigned __int64)Pfn1->OriginalPte.u;
OpaqueContext = 0i64;
if( *(&stru_140C4DB30 + 42) && (v2.Long & 0x10) == 0 )
v2.Long &= ~*(&stru_140C4DB30 + 42);
v3 = *(_QWORD *)(v2.Hard._bf_0 >> 16);
if( (*(_DWORD *)(v3 + 56) & 0x20) == 0 && IoReferenceIoAttributionFromThread(CurrentThread, &OpaqueContext) >= 0 )
{
v4 = (unsigned __int64)OpaqueContext;
if( OpaqueContext == (PVOID)(8i64 * *(_QWORD *)(v3 + 120)) )
{
v5 = OpaqueContext;
}
else
{
v6 = ExAcquireSpinLockExclusive((INT64 *)(v3 + 72));
v7 = *(_QWORD *)(v3 + 120);
v8 = v6;
v9 = v7 & 0xE000000000000000ui64;
v10 = 8 * v7;
*(_QWORD *)(v3 + 120) = (v4 >> 3) | v9;
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)(v3 + 72));
__writecr8(v8);
if( !v10 )
return;
v5 = (VOID *)v10;
}
IoDiskIoAttributionDereference(v5);
}
}Referenced by:
MiCompleteProtoPteFault
MiValidFault