MmQueryVirtualMemory
NTSTATUS __stdcall MmQueryVirtualMemory(
PVOID ProcessHandle,
PVOID BaseAddress,
_MEMORY_INFORMATION_CLASS MemoryInformationClass,
PVOID MemoryInformation,
UINT64 MemoryInformationLength,
UINT64 *ReturnLength,
UINT64 Flags){
unsigned __int64 v10;
_ETHREAD *CurrentThread;
INT8 PreviousMode;
unsigned int v13;
unsigned int v14;
__int64 v15;
_EPROCESS *v16;
void *v17;
_ETHREAD *v18;
_MMVAD *NextVad;
unsigned __int64 v20;
unsigned __int64 v21;
_ETHREAD *v22;
INT64 v23;
INT64 v24;
NTSTATUS v25;
VOID *v26;
int v27;
union {unsigned int LongFlags;_MMVAD_FLAGS VadFlags;_MM_PRIVATE_VAD_FLAGS PrivateVadFlags;_MM_GRAPHICS_VAD_FLAGS GraphicsVadFlags;_MM_SHARED_VAD_FLAGS SharedVadFlags;volatile unsigned int VolatileVadLong;} v28;
__int64 v29;
union {unsigned int LongFlags;_MMVAD_FLAGS VadFlags;_MM_PRIVATE_VAD_FLAGS PrivateVadFlags;_MM_GRAPHICS_VAD_FLAGS GraphicsVadFlags;_MM_SHARED_VAD_FLAGS SharedVadFlags;volatile unsigned int VolatileVadLong;} v30;
_SEGMENT *Segment;
int v32;
__int64 v33;
unsigned __int64 v34;
int v35;
__int64 v36;
unsigned __int64 v37;
NTSTATUS result;
_SUBSECTION *Subsection;
NTSTATUS v40;
unsigned __int64 v41;
__int64 v42;
unsigned __int64 v43;
_EPROCESS *v44;
_MI_PARTITION *ProcessPartition;
INT64 v46;
INT64 v47;
union {unsigned int LongFlags;_MMVAD_FLAGS VadFlags;_MM_PRIVATE_VAD_FLAGS PrivateVadFlags;_MM_GRAPHICS_VAD_FLAGS GraphicsVadFlags;_MM_SHARED_VAD_FLAGS SharedVadFlags;volatile unsigned int VolatileVadLong;} v48;
VOID **v49;
_MI_PARTITION *ControlAreaPartition;
unsigned __int16 PartitionId;
int v52;
unsigned __int64 v53;
char v54;
_QWORD *v55;
int v56;
__int64 v57;
__int64 v58;
__int64 v59;
int v60;
int v61;
int v62;
char *AddressSpan;
__int64 LongFlags1;
UINT64 v65;
bool v66;
__int64 StartingVpn;
unsigned __int64 ExtraCreateInfo;
_QWORD *v69;
unsigned __int64 v70;
unsigned __int64 v71;
unsigned __int64 v72;
NTSTATUS IsUserQueryVmCallerTrusted;
NTSTATUS MemoryPhysicalContiguity;
_CONTROL_AREA **p_ControlArea;
unsigned __int64 v76;
__int64 v77;
volatile unsigned __int64 SharedCommitCharge;
NTSTATUS VirtualMemory;
_EPROCESS *v80;
__int64 ********VadEvent;
__int64 v82;
__int64 ********v83;
UINT64 Tag;
unsigned int v85;
CHAR v86;
UINT64 v87;
UINT64 *v88;
unsigned __int64 v89;
_ETHREAD *Thread;
unsigned __int8 v91;
PVOID Object;
_EPROCESS *Process;
char Info[48];
__int128 v95;
__int64 v96;
_MEMORY_INFORMATION_CLASS v97;
char *v98;
PADAPTER_OBJECT DmaAdapter;
__int64 v100;
_MMVAD_SHORT *Vad;
_QWORD *v102;
__int128 Source;
__int128 v104;
__int128 v105;
_KAPC_STATE ApcState;
v102 = MemoryInformation;
v97 = MemoryInformationClass;
v89 = (unsigned __int64)BaseAddress;
v88 = ReturnLength;
LODWORD(v87) = 0;
Object = 0i64;
v100 = 0i64;
memset(Info, 0, sizeof(Info));
v95 = 0i64;
v96 = 0i64;
memset(&ApcState, 0, sizeof(ApcState));
v85 = 0;
DmaAdapter = 0i64;
Vad = 0i64;
if( MemoryInformationClass == MemoryImageInformation )
{
v10 = MemoryInformationLength;
if( MemoryInformationLength >= 0x18 )
goto LABEL_6;
return -1073741820;
}
if( MemoryInformationClass != MemoryRegionInformation )
{
if( MemoryInformationClass )
{
switch( MemoryInformationClass )
{
case 1:
v10 = MemoryInformationLength;
v66 = MemoryInformationLength < 8;
goto LABEL_137;
case 2:
v10 = MemoryInformationLength;
goto LABEL_6;
case 4:
v10 = MemoryInformationLength;
v66 = MemoryInformationLength < 0x10;
LABEL_137:
if( !v66 )
goto LABEL_138;
return -1073741820;
case 5:
v10 = MemoryInformationLength;
if( MemoryInformationLength < 8 )
return -1073741820;
goto LABEL_6;
case 7:
v10 = MemoryInformationLength;
if( MemoryInformationLength < 0x20 )
return -1073741820;
goto LABEL_6;
case 8:
break;
case 11:
v10 = MemoryInformationLength;
if( MemoryInformationLength < 0x28 )
return -1073741820;
LABEL_138:
v85 = 64;
goto LABEL_6;
default:
return -1073741821;
}
}
v10 = MemoryInformationLength;
if( MemoryInformationLength >= 0x30 )
goto LABEL_6;
return -1073741820;
}
v10 = MemoryInformationLength;
if( MemoryInformationLength < 0x18 )
return -1073741820;
LABEL_6:
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
Thread = CurrentThread;
PreviousMode = CurrentThread->Tcb.PreviousMode;
v86 = PreviousMode;
v13 = v85;
if( v85 < 0x40
|| !PreviousMode
|| (IsUserQueryVmCallerTrusted = MiIsUserQueryVmCallerTrusted(CurrentThread),
PreviousMode = v86,
IsUserQueryVmCallerTrusted) )
{
v14 = Flags;
}
else
{
v14 = Flags | 0x40000000;
}
if( PreviousMode )
{
ProbeForWrite((UINT64)MemoryInformation, v10, 8i64);
if( v88 )
{
v15 = (__int64)v88;
if( (unsigned __int64)v88 >= 0x7FFFFFFF0000i64 )
v15 = 0x7FFFFFFF0000i64;
*(_QWORD *)v15 = *(_QWORD *)v15;
v13 = v85;
}
PreviousMode = v86;
}
if( v89 > 0x7FFFFFFEFFFFi64 )
return -1073741811;
v98 = (char *)(v89 & 0x7FFFFFFFF000i64);
if( MemoryInformationClass != 10 )
goto LABEL_16;
Source = *(_OWORD *)MemoryInformation;
v104 = *((_OWORD *)MemoryInformation + 1);
v105 = *((_OWORD *)MemoryInformation + 2);
v76 = *((_QWORD *)&v104 + 1);
*((_QWORD *)&v104 + 1) = 0i64;
LODWORD(v77) = RtlCompareMemoryUlong(&Source, 48, 0i64);
if( v77 != 48 || v76 > 0x7FFFFFFF0000i64 - v89 )
return -1073741811;
Vad = (_MMVAD_SHORT *)&v98[((v89 & 0xFFF) + v76 + 4095) & 0xFFFFFFFFFFFFF000ui64];
CurrentThread = Thread;
PreviousMode = v86;
LABEL_16:
if( ProcessHandle == (PVOID)-1i64 )
{
v16 = CurrentThread->Tcb.ApcState.Process;
Process = v16;
Object = v16;
}
else
{
v65 = 4096i64;
if( (v14 & 0x40000000) != 0 )
v65 = 1024i64;
LODWORD(Tag) = 1834380621;
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
v65,
(_OBJECT_TYPE *)PsProcessType,
PreviousMode,
Tag,
&Object,
0i64);
if( result < 0 )
return result;
v16 = (_EPROCESS *)Object;
Process = (_EPROCESS *)Object;
if( (*((_DWORD *)Object + 543) & 0x1000) != 0 )
{
ObfDereferenceObjectWithTag(Object, 0x6D566D4Dui64);
return -1073741790;
}
}
switch( MemoryInformationClass )
{
case MemoryRegionInformation|0x8:
MemoryPhysicalContiguity = MiQueryMemoryPhysicalContiguity(
(PFN_WDFDRIVERERRORREPORTAPIMISSING *)v16,
(INT128 *)MemoryInformation,
v10,
v86);
if( ProcessHandle != (PVOID)-1i64 )
ObfDereferenceObjectWithTag(v16, 0x6D566D4Dui64);
if( MemoryPhysicalContiguity >= 0 )
{
if( v88 )
*v88 = v10;
return 0;
}
return MemoryPhysicalContiguity;
case MemoryWorkingSetExInformation:
MemoryPhysicalContiguity = MiGetWorkingSetInfoList((ULONG_PTR)v16, v14, (_EPROCESS *)MemoryInformation, v10);
if( ProcessHandle != (PVOID)-1i64 )
ObfDereferenceObjectWithTag(v16, 0x6D566D4Dui64);
if( MemoryPhysicalContiguity >= 0 )
{
if( v88 )
*v88 = v10;
return 0;
}
return MemoryPhysicalContiguity;
case MemoryWorkingSetInformation:
MemoryPhysicalContiguity = MiGetWorkingSetInfo((__int64)v16, v14, (__int64)MemoryInformation, v10, &v100);
if( ProcessHandle != (PVOID)-1i64 )
ObfDereferenceObjectWithTag(v16, 0x6D566D4Dui64);
if( MemoryPhysicalContiguity >= 0 )
{
if( v88 )
*v88 = 8 * v100 + 8;
return 0;
}
return MemoryPhysicalContiguity;
case MemorySharedCommitInformation:
SharedCommitCharge = v16->SharedCommitCharge;
if( ProcessHandle != (PVOID)-1i64 )
ObfDereferenceObjectWithTag(Object, 0x6D566D4Dui64);
*(_QWORD *)MemoryInformation = SharedCommitCharge;
if( v88 )
*v88 = 8i64;
return 0;
}
v17 = Process;
if( ProcessHandle != (PVOID)-1i64 )
{
KeStackAttachProcess(&Process->Pcb, &ApcState);
v13 |= 1u;
LOBYTE(v85) = v13;
}
if( MemoryInformationClass == 8 )
{
if( *((_QWORD *)v17 + 124) )
{
VirtualMemory = VslQueryVirtualMemory((__int64)v17, v89, Info);
if( VirtualMemory >= 0 )
{
if( *(_DWORD *)&Info[32] == 4096 )
*(_WORD *)&Info[20] = MiGetProcessPartition(v17, v80)->Core.PartitionId;
else
*(_WORD *)&Info[20] = 0;
if( (v13 & 1) != 0 )
{
KeUnstackDetachProcess(&ApcState);
ObfDereferenceObjectWithTag(v17, 0x6D566D4Dui64);
}
*(_OWORD *)MemoryInformation = *(_OWORD *)Info;
*((_OWORD *)MemoryInformation + 1) = *(_OWORD *)&Info[16];
*((_OWORD *)MemoryInformation + 2) = *(_OWORD *)&Info[32];
if( v88 )
*v88 = 48i64;
return 0;
}
}
}
while( 2 )
{
v18 = Thread;
while( 1 )
{
LOCK_ADDRESS_SPACE_SHARED(v18, (_EPROCESS *)v17);
if( (*((_DWORD *)v17 + 281) & 0x20) != 0 )
{
UNLOCK_ADDRESS_SPACE_SHARED(v18, (_EPROCESS *)v17);
if( (v13 & 1) != 0 )
{
KeUnstackDetachProcess(&ApcState);
ObfDereferenceObjectWithTag(v17, 0x6D566D4Dui64);
}
return -1073741558;
}
NextVad = 0i64;
v20 = 0i64;
if( *((_QWORD *)v17 + 253) )
{
NextVad = (_MMVAD *)*((_QWORD *)v17 + 251);
v20 = v89 >> 12;
while( NextVad )
{
v21 = NextVad->Core.StartingVpn | ((unsigned __int64)NextVad->Core.StartingVpnHigh << 32);
if( v20 < v21 )
goto LABEL_35;
if( v20 <= (NextVad->Core.EndingVpn | ((unsigned __int64)NextVad->Core.EndingVpnHigh << 32)) )
{
v13 |= 2u;
LOBYTE(v85) = v13;
break;
}
if( v20 < v21 )
{
LABEL_35:
if( !NextVad->Core.NextVad )
break;
NextVad = (_MMVAD *)NextVad->Core.NextVad;
}
else
{
if( !NextVad->Core.ExtraCreateInfo )
break;
NextVad = (_MMVAD *)NextVad->Core.ExtraCreateInfo;
}
}
}
if( (v13 & 2) == 0 )
{
if( NextVad )
{
StartingVpn = NextVad->Core.StartingVpn;
if( (StartingVpn | ((unsigned __int64)NextVad->Core.StartingVpnHigh << 32)) < v20 )
{
ExtraCreateInfo = (unsigned __int64)NextVad->Core.ExtraCreateInfo;
if( ExtraCreateInfo )
{
v69 = *(_QWORD **)ExtraCreateInfo;
if( *(_QWORD *)ExtraCreateInfo )
{
do
{
ExtraCreateInfo = (unsigned __int64)v69;
v69 = (_QWORD *)*v69;
}
while( v69 );
}
}
else
{
for( ExtraCreateInfo = NextVad->Core.VadNode.ParentValue & 0xFFFFFFFFFFFFFFFCui64;
ExtraCreateInfo;
ExtraCreateInfo = *(_QWORD *)(ExtraCreateInfo + 16) & 0xFFFFFFFFFFFFFFFCui64 )
{
if( *(_MMVAD **)ExtraCreateInfo == NextVad )
break;
NextVad = (_MMVAD *)ExtraCreateInfo;
}
}
v70 = v89 & 0xFFFFFFFFFFFFF000ui64;
if( ExtraCreateInfo )
v71 = (*(unsigned int *)(ExtraCreateInfo + 24) | ((unsigned __int64)*(unsigned __int8 *)(ExtraCreateInfo + 32) << 32)) << 12;
else
v71 = 0x7FFFFFFF0000i64;
LABEL_150:
v89 = v70;
v72 = v71 - v70;
UNLOCK_ADDRESS_SPACE_SHARED(Thread, (_EPROCESS *)v17);
if( (v13 & 1) != 0 )
{
KeUnstackDetachProcess(&ApcState);
ObfDereferenceObjectWithTag(v17, 0x6D566D4Dui64);
}
if( (MemoryInformationClass & 0xFFFFFFF5) == 0 && MemoryInformationClass != MemoryMappedFilenameInformation )
{
*((_QWORD *)MemoryInformation + 1) = 0i64;
*((_DWORD *)MemoryInformation + 4) = 0;
*(_QWORD *)MemoryInformation = v89;
*((_QWORD *)MemoryInformation + 3) = v72;
*((_DWORD *)MemoryInformation + 8) = 0x10000;
*(_QWORD *)((char *)MemoryInformation + 36) = 1i64;
*((_WORD *)MemoryInformation + 10) = 0;
if( v88 )
*v88 = 48i64;
return 0;
}
return -1073741503;
}
v71 = (StartingVpn | ((unsigned __int64)NextVad->Core.StartingVpnHigh << 32)) << 12;
}
else
{
v71 = 0x7FFFFFFF0000i64;
}
v70 = v89 & 0xFFFFFFFFFFFFF000ui64;
goto LABEL_150;
}
MiReferenceVad(&NextVad->Core);
v22 = Thread;
--Thread->Tcb.KernelApcDisable;
UNLOCK_ADDRESS_SPACE_SHARED(v22, (_EPROCESS *)v17);
MiLockVadShared((INT64)Thread, (INT64)NextVad);
KeLeaveCriticalRegionThread(&Thread->Tcb);
if( MiVadDeleted(&NextVad->Core) != 1 )
break;
v18 = Thread;
MiUnlockVadShared(&Thread->Tcb, (_EX_PUSH_LOCK *)NextVad);
MiLockVad(Thread, &NextVad->Core);
MiWaitForVadDeletion(&NextVad->Core);
MiUnlockAndDereferenceVad(&NextVad->Core);
v13 &= ~2u;
LOBYTE(v85) = v13;
}
if( v20 < (NextVad->Core.StartingVpn | ((unsigned __int64)NextVad->Core.StartingVpnHigh << 32))
|| v20 > (NextVad->Core.EndingVpn | ((unsigned __int64)NextVad->Core.EndingVpnHigh << 32)) )
{
MiUnlockAndDereferenceVadShared(NextVad);
v13 &= ~2u;
LOBYTE(v85) = v13;
continue;
}
break;
}
memset(&Info[8], 0, 40);
*(_QWORD *)Info = v98;
*(_QWORD *)&Info[8] = (NextVad->Core.StartingVpn | ((unsigned __int64)NextVad->Core.StartingVpnHigh << 32)) << 12;
*(_DWORD *)&Info[16] = MmProtectToValue[(NextVad->Core.u.LongFlags >> 7) & 0x1F];
v25 = MI_GET_GRAPHICS_PROTECTION_FROM_VAD((INT64)NextVad, v23, v24, (UINT64 *)*(unsigned int *)&Info[16], Tag);
*(_DWORD *)&Info[16] = v27 | v25;
v28.LongFlags = (unsigned int)NextVad->Core.u;
if( (v28.LongFlags & 0x100000) == 0 )
{
if( (v28.LongFlags & 0x70) == 32 )
{
*(_DWORD *)&Info[40] = 0x1000000;
if( MemoryInformationClass == MemoryRegionInformationEx
&& (NextVad->Subsection->ControlArea->u.LongFlags & 0x40000000) != 0 )
{
LABEL_235:
LOBYTE(v13) = v13 | 4;
LOBYTE(v85) = v13;
}
}
else
{
*(_DWORD *)&Info[40] = 0x40000;
if( MemoryInformationClass == MemoryRegionInformation && v10 >= 0x30
|| MemoryInformationClass == MemoryRegionInformationEx )
{
Subsection = NextVad->Subsection;
if( !Subsection->ControlArea->FilePointer.Value )
{
*(_DWORD *)&Info[40] = 0x8000000;
goto LABEL_45;
}
if( MemoryInformationClass == MemoryRegionInformationEx
&& (Subsection->ControlArea->u.LongFlags & 0x40000000) != 0 )
{
goto LABEL_235;
}
}
}
LABEL_45:
if( MemoryInformationClass == MemoryMappedFilenameInformation )
{
p_ControlArea = &NextVad->Subsection->ControlArea;
v29 = (*p_ControlArea)->FilePointer.Value & 0xFFFFFFFFFFFFFFF0ui64;
if( v29 )
{
v29 = (__int64)MiReferenceControlAreaFile(*p_ControlArea);
v26 = v98;
}
if( !v29 )
v29 = 1i64;
}
else
{
v29 = (__int64)DmaAdapter;
}
goto LABEL_47;
}
*(_DWORD *)&Info[40] = 0x20000;
if( MiIsSoftwareEnclave((INT64)NextVad) )
{
LOBYTE(v13) = v13 | 0x10;
LOBYTE(v85) = v13;
}
LongFlags1 = NextVad->Core.u1.LongFlags1;
LODWORD(LongFlags1) = LongFlags1 & 0x7FFFFFFF;
if( (LongFlags1 | ((unsigned __int64)NextVad->Core.CommitChargeHigh << 31)) == 0x7FFFFFFFDi64 )
{
LOBYTE(v13) = v13 | 0x20;
LOBYTE(v85) = v13;
}
v29 = (__int64)DmaAdapter;
if( (NextVad->Core.u.LongFlags & 0x70) == 16 )
{
LOBYTE(v13) = v13 | 8;
LOBYTE(v85) = v13;
}
LABEL_47:
if( ((MemoryInformationClass - 3) & 0xFFFFFFFB) != 0 )
{
if( MemoryInformationClass == MemoryImageInformation )
{
v95 = 0i64;
v96 = 0i64;
v30.LongFlags = (unsigned int)NextVad->Core.u;
if( (v30.LongFlags & 0x100000) == 0 && (v30.LongFlags & 0x70) == 32 )
{
Segment = NextVad->Subsection->ControlArea->Segment;
*(_QWORD *)&v95 = (NextVad->Core.StartingVpn | ((unsigned __int64)NextVad->Core.StartingVpnHigh << 32)) << 12;
*((_QWORD *)&v95 + 1) = _InterlockedCompareExchange64(
(volatile signed __int64 *)&Segment->SizeOfSegment,
-1i64,
-1i64);
v32 = v96 & 0xFFFFFFC3 | (Segment->SegmentFlags.UChar2 >> 2) & 0x3FFFFFFC;
LODWORD(v96) = v32;
if( (NextVad->Core.u.LongFlags & 0xF80) == 128 )
LODWORD(v96) = v32 | 2;
if( MiVadMapsLargeImage(NextVad) )
{
VadEvent = MiLocateVadEvent(v33, 16);
v91 = *((_BYTE *)VadEvent + 8);
v37 = (unsigned __int64)VadEvent[2];
*(_QWORD *)&v95 = v82 + ((unsigned __int64)v91 << 16);
}
else
{
v37 = (NextVad->Core.EndingVpn | ((unsigned __int64)NextVad->Core.EndingVpnHigh << 32))
- (NextVad->Core.StartingVpn | ((unsigned __int64)NextVad->Core.StartingVpnHigh << 32))
+ 1;
}
if( (v34 & 0xFFF) == 0 )
v36 = 0i64;
v17 = Object;
LOBYTE(v13) = v85;
if( v37 < v36 + (v34 >> 12) )
LODWORD(v96) = v35 | 1;
}
MiUnlockAndDereferenceVadShared(NextVad);
if( (v13 & 1) != 0 )
{
KeUnstackDetachProcess(&ApcState);
ObfDereferenceObjectWithTag(v17, 0x6D566D4Dui64);
}
LODWORD(v87) = 24;
*(_OWORD *)MemoryInformation = v95;
*((_QWORD *)MemoryInformation + 2) = v96;
if( v88 )
*v88 = 24i64;
return 0;
}
if( (MemoryInformationClass & 0xFFFFFFF5) == 0 && MemoryInformationClass != MemoryMappedFilenameInformation )
{
AddressSpan = (char *)MiQueryAddressSpan((_MEMORY_BASIC_INFORMATION *)Info, v26, Vad);
*(_QWORD *)&Info[24] = &AddressSpan[-*(_QWORD *)Info];
}
MiUnlockAndDereferenceVadShared(NextVad);
if( (v13 & 1) != 0 )
{
KeUnstackDetachProcess(&ApcState);
ObfDereferenceObjectWithTag(v17, 0x6D566D4Dui64);
}
if( (MemoryInformationClass & 0xFFFFFFF5) == 0 && MemoryInformationClass != MemoryMappedFilenameInformation )
{
*(_OWORD *)MemoryInformation = *(_OWORD *)Info;
*((_OWORD *)MemoryInformation + 1) = *(_OWORD *)&Info[16];
*((_OWORD *)MemoryInformation + 2) = *(_OWORD *)&Info[32];
if( v88 )
*v88 = 48i64;
return 0;
}
if( !v29 )
return -1073741503;
if( v29 == 1 )
return -1073741672;
if( (unsigned int)v10 < v10 )
{
HalPutDmaAdapter((PADAPTER_OBJECT)v29);
return -1073741581;
}
LODWORD(v87) = 0;
MemoryPhysicalContiguity = ObQueryNameStringMode(
(VOID *)v29,
(_OBJECT_NAME_INFORMATION *)MemoryInformation,
(unsigned int)v10,
&v87,
v86);
HalPutDmaAdapter((PADAPTER_OBJECT)v29);
if( v88 )
*v88 = (unsigned int)v87;
return MemoryPhysicalContiguity;
}
v40 = 0;
v41 = ((NextVad->Core.EndingVpn | ((unsigned __int64)NextVad->Core.EndingVpnHigh << 32))
- (NextVad->Core.StartingVpn | ((unsigned __int64)NextVad->Core.StartingVpnHigh << 32))
+ 1) << 12;
v42 = NextVad->Core.u1.LongFlags1;
LODWORD(v42) = v42 & 0x7FFFFFFF;
v43 = v42 | ((unsigned __int64)NextVad->Core.CommitChargeHigh << 31);
if( v43 >= 0x7FFFFFFFDi64 )
v43 = 0i64;
ProcessPartition = MiGetProcessPartition(Process, (_EPROCESS *)0x7FFFFFFFDi64);
v47 = v46;
v48.LongFlags = (unsigned int)NextVad->Core.u;
if( (v48.LongFlags & 0x100000) != 0 )
{
if( (v48.LongFlags & 0x70) != 48 )
{
if( (v48.LongFlags & 0x400000) != 0 || (v48.LongFlags & 0xC0000) >= 0x80000 )
{
v83 = MiLocateVadEvent((__int64)NextVad, 16);
if( v83 )
{
v47 = (INT64)v83[3];
if( v47 )
{
if( !PsReferencePartitionSafe((INT64)v83[3]) )
{
v40 = -1073740640;
v47 = v46;
}
}
}
}
goto LABEL_77;
}
LODWORD(ControlAreaPartition) = MiGetAweVadPartition((INT64)NextVad);
goto LABEL_76;
}
v49 = (VOID **)&NextVad->Subsection->ControlArea;
if( v49 && *v49 )
{
ControlAreaPartition = MiGetControlAreaPartition(*v49, v44);
LABEL_76:
ProcessPartition = ControlAreaPartition;
}
LABEL_77:
if( v40 < 0 )
PartitionId = v46;
else
PartitionId = ProcessPartition->Core.PartitionId;
if( v47 )
PsDereferencePartition(v47);
v52 = (NextVad->Core.u.LongFlags >> 12) & 0x3F;
MiUnlockAndDereferenceVadShared(NextVad);
if( (v13 & 1) != 0 )
{
KeUnstackDetachProcess(&ApcState);
ObfDereferenceObjectWithTag(Process, 0x6D566D4Dui64);
}
if( v40 >= 0 )
{
v53 = v43 << 12;
v54 = v13 & 0xFD;
v55 = v102;
*v102 = *(_QWORD *)&Info[8];
*((_DWORD *)v55 + 2) = *(_DWORD *)&Info[16];
v55[2] = v41;
if( v97 == MemoryRegionInformationEx )
{
*((_DWORD *)v55 + 3) = 0;
if( *(_DWORD *)&Info[40] == 0x20000 )
{
*((_DWORD *)v55 + 3) = 1;
}
else if( (v54 & 8) != 0 )
{
*((_DWORD *)v55 + 3) = 16;
}
else
{
switch( *(_DWORD *)&Info[40] )
{
case 0x40000:
*((_DWORD *)v55 + 3) = 2;
break;
case 0x1000000:
*((_DWORD *)v55 + 3) = 4;
break;
case 0x8000000:
*((_DWORD *)v55 + 3) = 8;
break;
}
}
LODWORD(v59) = MiGetVadPageSize((INT64)NextVad);
if( v59 == 16 )
{
v60 |= 0x80u;
*((_DWORD *)v55 + 3) = v60;
}
v61 = v60 | (8 * (v54 & 4));
*((_DWORD *)v55 + 3) = v61;
v62 = v61 | (4 * (v54 & 0x10));
*((_DWORD *)v55 + 3) = v62;
v56 = v62 | (8 * (v54 & 0x20));
}
else
{
v56 = *(_DWORD *)&Info[40];
}
*((_DWORD *)v55 + 3) = v56;
v57 = 24i64;
LODWORD(v87) = 24;
if( MemoryInformationLength >= 0x20 )
{
v55[3] = v53;
v57 = 32i64;
LODWORD(v87) = 32;
}
if( MemoryInformationLength >= 0x28 )
{
v55[4] = PartitionId;
v57 = 40i64;
LODWORD(v87) = 40;
}
if( MemoryInformationLength >= 0x30 )
{
if( v52 )
v58 = (unsigned int)(v52 - 1);
else
v58 = 0xFFFFFFFFi64;
v55[5] = v58;
LODWORD(v87) = 48;
v57 = 48i64;
}
if( v88 )
*v88 = v57;
return 0;
}
return v40;
}Referenced by:
NtQueryVirtualMemory
PfpVirtualQuery
SMKM_STORE::SmStCheckResident