MiReplacePageTablePage
VOID __stdcall MiReplacePageTablePage(_MI_REPLACE_INFO *ReplaceInfo){
__int64 v2;
int v3;
UINT64 v4;
__int64 v5;
__int64 v6;
_MMPFN *PfnDb;
_MMPFN *v8;
_MI_REPLACE_INFO v9;
_MMPFN *v10;
_MMPTE *PteBase;
unsigned __int64 v12;
INT64 v13;
unsigned __int64 v14;
_MI_TB_FLUSH_LIST v15;
UINT64 v16;
UINT64 v17;
NTSTATUS SystemRegionType;
INT64 v19;
INT64 *v20;
INT64 v21;
INT64 v22;
char v23;
unsigned __int64 v24;
unsigned __int64 v25;
int v26;
_MMPFN *v27;
INT64 v28;
__int64 bf_0;
unsigned __int64 v30;
__int64 v31;
unsigned __int64 EntireField;
INT64 v33;
__int64 v34;
unsigned __int64 v35;
INT64 v36;
INT64 v37;
__int64 v38;
__int64 v39;
_MMPFN *v40;
unsigned __int64 v41;
_MMPFN *v42;
int v43;
INT64 v44;
INT64 v45;
unsigned __int64 v46;
__int64 v47;
__int64 v48;
__int64 v49;
_MMPFN *v50;
INT64 v51;
unsigned __int64 v52;
int v53;
int v54;
int v55;
int v56;
UINT64 v57;
INT64 v58;
__int64 v59;
int v60;
__int64 v61;
INT64 *v62;
UINT64 SpinCount;
_MI_REPLACE_INFO *v64;
INT64 v65;
__int64 v66;
__int64 v67;
INT64 v68;
_MMPFN *v69;
_MI_TB_FLUSH_LIST TbFlushList[48];
v64 = ReplaceInfo;
memset(TbFlushList, 0i64, 0xB8u);
v2 = *((_QWORD *)ReplaceInfo + 3);
v3 = 0;
v4 = *((_QWORD *)ReplaceInfo + 1);
v5 = *((_QWORD *)ReplaceInfo + 4);
v6 = *((_QWORD *)ReplaceInfo + 2);
ReplaceInfo[14] = -1073741823;
v65 = v4;
v61 = v2;
v66 = v5;
v62 = (INT64 *)v6;
v59 = v2;
PfnDb = MmGetPfnDb();
v8 = &PfnDb[v2];
v9 = ReplaceInfo[15];
v10 = &PfnDb[v5];
v54 = 0;
v53 = 0;
v56 = 0;
v69 = v10;
v55 = 0;
PteBase = MmGetPteBase();
if( v9 == 1 )
{
v12 = *(_QWORD *)(*((_QWORD *)ReplaceInfo + 6) + 1928i64);
if( !v12 )
goto LABEL_94;
LODWORD(v13) = MI_READ_PTE_LOCK_FREE((INT64)PteBase + ((v12 >> 9) & 0x7FFFFFFFF8i64));
v68 = v13;
LODWORD(v14) = MI_READ_PTE_LOCK_FREE((INT64)&v68);
if( ((v14 >> 12) & 0xFFFFFFFFFi64) != v2 )
goto LABEL_94;
}
v15 = 1;
if( (v8->u4._bf_0 & 0xFFFFFFFFFi64) == v2 )
{
v60 = 1;
if( v9 == 1 )
v59 = *(_QWORD *)(*((_QWORD *)ReplaceInfo + 6) + 40i64) >> 12;
}
else
{
v60 = 0;
LODWORD(v16) = MiGetLeafVa(v4);
if( v16 > 0x7FFFFFFEFFFFi64
&& (v16 < *(&stru_140C4DB30 + 937) || v16 > *(&stru_140C4DB30 + 175))
&& (v16 < (unsigned __int64)MmGetPteBase() || v16 > v17) )
{
SystemRegionType = MiGetSystemRegionType(v16);
v15 = 0;
if( SystemRegionType == 1 )
v15 = 2;
}
}
*(_QWORD *)&TbFlushList[4] = 0i64;
*(_QWORD *)&TbFlushList[6] = 0i64;
v19 = v4;
v20 = v62;
v67 = -(__int64)v4;
TbFlushList[0] = v15;
LOWORD(TbFlushList[1]) = 0;
TbFlushList[2] = 20;
do
{
while( 1 )
{
LODWORD(v21) = MI_READ_PTE_LOCK_FREE(v19);
v58 = v21;
v22 = v21;
if( (v21 & 1) != 0 )
break;
v23 = v21;
if( (v21 & 0x400) != 0 || (v21 & 0x800) == 0 )
goto LABEL_35;
v24 = (unsigned __int64)MmGetPteBase();
v25 = (__int64)((v19 << 25) - (v24 << 25)) >> 16;
if( v25 >= v24 && v25 <= (unsigned __int64)MmGetPteLimit() )
{
LOBYTE(v26) = MiIsPdeOrAboveAccessible(v19);
if( !v26 )
goto LABEL_84;
}
v27 = MiLockTransitionLeafPage(v19, (_BYTE *)(v3 != 0));
if( v27 )
{
LODWORD(v28) = MI_READ_PTE_LOCK_FREE(v19);
v22 = v28;
v58 = v28;
bf_0 = v27->u4._bf_0;
v23 = v22;
if( (bf_0 & 0xFFFFFFFFFi64) != v59 && (bf_0 & 0x1000000000i64) != 0 )
++v56;
if( (*(_BYTE *)(&v27->u3 + 1) & 0x20) != 0 )
{
_InterlockedAnd64(&v27->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
goto LABEL_84;
}
++v3;
goto LABEL_35;
}
}
++v54;
if( (v21 & 0x80u) != 0i64 )
goto LABEL_32;
LODWORD(v30) = MI_READ_PTE_LOCK_FREE((INT64)&v58);
v31 = (v30 >> 12) & 0xFFFFFFFFFi64;
if( v31 != *(&stru_140C4DB30 + 495) )
{
EntireField = MmGetPfnDb()[v31].u4.EntireField;
if( ((EntireField >> 50) & 1) == 0 || (EntireField & 0x1000000000i64) == 0 )
goto LABEL_33;
LABEL_32:
++v53;
goto LABEL_33;
}
++v55;
LABEL_33:
if( v59 == v61 )
goto LABEL_37;
LODWORD(v33) = MI_READ_PTE_LOCK_FREE(*((_QWORD *)v64 + 8) + 8 * ((v19 + v67) >> 3));
v22 = v33;
v58 = v33;
v23 = v33;
LABEL_35:
if( v59 != v61 )
{
v22 &= -(__int64)((v23 & 1) != 0);
v58 = v22;
}
LABEL_37:
*v20 = v22;
v19 += 8i64;
++v20;
}
while( (v19 & 0xFFF) != 0 );
if( v3 )
{
MiLockNestedPageAtDpcInline(v8);
}
else
{
LODWORD(SpinCount) = 0;
while( _interlockedbittestandset64((volatile signed __int32 *)&v8->u2, 0x3Fui64) )
{
do
KeYieldProcessorEx(&SpinCount);
while( v8->u2._bf_0 < 0 );
}
}
v34 = v8->u2._bf_0;
v35 = v34 & 0x3FFFFFFFFFFFFFFFi64;
if( (v60 || (unsigned __int16)v34 == (unsigned __int64)(unsigned int)(v3 - v55 - v56 - v53 + v54 + 1))
&& v8->u3.ReferenceCount == 1
&& v35 < 0x10000 )
{
MiLockNestedPageAtDpcInline(v10);
v10->u2._bf_0 = v35 | v10->u2._bf_0 & 0xC000000000000000ui64;
_InterlockedAnd64(&v10->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
_InterlockedAnd64(&v8->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
v36 = v65;
v37 = v65;
if( v3 )
{
v38 = v61;
v39 = v66;
v40 = MmGetPfnDb();
do
{
LODWORD(v41) = MI_READ_PTE_LOCK_FREE(v37);
if( (v41 & 1) == 0 && (v41 & 0x400) == 0 && (v41 & 0x800) != 0 )
{
if( *(&stru_140C4DB30 + 42) && (v41 & 0x10) == 0 )
v41 &= ~*(&stru_140C4DB30 + 42);
v42 = &v40[(v41 >> 12) & 0xFFFFFFFFFi64];
if( (v42->u4._bf_0 & 0xFFFFFFFFFi64) == v59 && v59 == v38 )
v42->u4._bf_0 ^= (v39 ^ v42->u4._bf_0) & 0xFFFFFFFFFi64;
--v3;
_InterlockedAnd64(&v42->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
}
v37 += 8i64;
}
while( v3 );
v36 = v65;
}
v43 = v54;
if( v54 )
{
v62 = (INT64 *)((char *)v62 - v36);
do
{
LODWORD(v44) = MI_READ_PTE_LOCK_FREE(v36);
v58 = v44;
v45 = v44;
if( (v44 & 1) != 0 )
{
--v43;
LODWORD(v46) = MI_READ_PTE_LOCK_FREE((INT64)&v58);
v47 = (v46 >> 12) & 0xFFFFFFFFFi64;
v48 = v47;
v49 = v59;
if( (((unsigned __int64)MmGetPfnDb()[v47].u4._bf_0 >> 50) & 1) != 0 && v47 != v59 )
{
v50 = MmGetPfnDb();
LODWORD(v57) = 0;
while( _interlockedbittestandset64((volatile signed __int32 *)&v50[v48].u2, 0x3Fui64) )
{
do
KeYieldProcessorEx(&v57);
while( v50[v48].u2._bf_0 < 0 );
}
if( (v50[v48].u4._bf_0 & 0xFFFFFFFFFi64) == v49 && v49 == v61 )
v50[v48].u4._bf_0 ^= (v66 ^ v50[v48].u4._bf_0) & 0xFFFFFFFFFi64;
_InterlockedAnd64(&v50[v48].u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
v45 = v58;
}
if( v49 != v61 )
{
LODWORD(v51) = MI_READ_PTE_LOCK_FREE(*((_QWORD *)v64 + 8) + 8 * ((v36 + v67) >> 3));
v45 = v51;
}
if( (v45 & 1) != 0 )
{
MiWriteValidPteNewProtection((INT64 *)((char *)v62 + v36), v45 | 0x20);
if( (MiFlags & 0x100) == 0 && (MiFlags & 0x200) == 0 )
MiInsertTbFlushEntry(
TbFlushList,
(VOID *)(((v36 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16),
1ui64,
0i64);
}
}
v36 += 8i64;
}
while( v43 );
}
MiFlushTbList(TbFlushList);
v64[14] = 0;
return;
}
_InterlockedAnd64(&v8->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
LABEL_84:
if( v3 )
{
do
{
v19 -= 8i64;
LODWORD(v52) = MI_READ_PTE_LOCK_FREE(v19);
if( (v52 & 1) == 0 && (v52 & 0x400) == 0 && (v52 & 0x800) != 0 )
{
if( *(&stru_140C4DB30 + 42) && (v52 & 0x10) == 0 )
v52 &= ~*(&stru_140C4DB30 + 42);
--v3;
_InterlockedAnd64(&MmGetPfnDb()[(v52 >> 12) & 0xFFFFFFFFFi64].u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
}
}
while( v3 );
v10 = v69;
}
LABEL_94:
MiSetOriginalPtePfnFromFreeList(&v10->OriginalPte.u.Long);
}Referenced by:
MmStealTopLevelPage