MmExtendSection
NTSTATUS __stdcall MmExtendSection(PVOID SectionToExtend, UINT64 *NewSectionSize, UINT64 IgnoreFileSizeChecking){
int v3;
_CONTROL_AREA *v6;
__int64 v7;
__int64 v8;
UINT64 v9;
UINT64 v10;
int v11;
_SUBSECTION *LastSubsection;
unsigned __int64 v13;
unsigned __int64 v14;
int updated;
UINT64 v16;
_FILE_OBJECT *v18;
_FILE_OBJECT *v19;
NTSTATUS v20;
_ETHREAD *CurrentThread;
union _LARGE_INTEGER *v22;
UINT64 v23;
__int128 v24[2];
__int64 v25;
union _LARGE_INTEGER FileSize;
ULONG_PTR BugCheckParameter2;
FileSize.QuadPart = 0i64;
v3 = IgnoreFileSizeChecking;
memset(v24, 0, sizeof(v24));
v25 = 0i64;
v6 = MiSectionControlArea((_SECTION *)SectionToExtend);
v7 = (__int64)v6;
if( (*((_DWORD *)v6 + 14) & 0x420) != 0 || !*((_QWORD *)v6 + 8) )
return -1073741689;
if( *NewSectionSize <= 0x3FFFFFFFFFF000i64 )
{
v8 = *(_QWORD *)v6;
v9 = *NewSectionSize + 4095;
DWORD2(v24[0]) = 16;
v10 = v9 >> 12;
MiLockControlAreaSectionExtend(v6);
if( (*(_DWORD *)(v7 + 56) & 0x8000) == 0 )
{
v23 = *((_QWORD *)SectionToExtend + 6);
if( *NewSectionSize <= v23 )
{
*NewSectionSize = v23;
MiUnlockControlAreaSectionExtend(v7, (__int64)v24);
return 0;
}
}
if( v3 )
goto LABEL_6;
MiUnlockControlAreaSectionExtend(v7, (__int64)v24);
v18 = MiReferenceControlAreaFile((_CONTROL_AREA *)v7);
DWORD2(v24[0]) = 32;
v19 = v18;
MiLockControlAreaSectionExtend((PVOID)v7);
v11 = FsRtlGetFileSize(v19, &FileSize);
if( v11 >= 0 )
{
if( *NewSectionSize <= FileSize.QuadPart )
{
LABEL_18:
if( *(_QWORD *)(v8 + 32) )
{
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 243);
ExAcquirePushLockExclusiveEx((UINT64)&qword_140C4C6D0, 0i64);
v22 = *(union _LARGE_INTEGER **)(v8 + 32);
if( v22 )
*v22 = FileSize;
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&qword_140C4C6D0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)&qword_140C4C6D0);
KeAbPostRelease(&qword_140C4C6D0);
KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
}
MiUnlockControlAreaSectionExtend(v7, (__int64)v24);
MiDereferenceControlAreaFile(v7, (unsigned __int64)v19);
DWORD2(v24[0]) = 16;
MiLockControlAreaSectionExtend((PVOID)v7);
LABEL_6:
v11 = 0;
BugCheckParameter2 = 0i64;
LastSubsection = MiFindLastSubsection((_CONTROL_AREA *)v7, 0i64);
v13 = *(unsigned int *)(v8 + 8) | ((unsigned __int64)(*(_WORD *)(v8 + 12) & 0x3FF) << 32);
if( v10 <= v13 )
{
*((_QWORD *)SectionToExtend + 6) = *NewSectionSize;
if( _InterlockedCompareExchange64((volatile signed __int64 *)(v8 + 24), -1i64, -1i64) < *NewSectionSize )
{
_InterlockedExchange64((volatile __int64 *)(v8 + 24), *NewSectionSize);
MiUpdateLastSubsectionSize((__int64)LastSubsection, NewSectionSize, 0);
}
}
else
{
v14 = v10 - v13;
if( v14 <= (*((_DWORD *)LastSubsection + 13) & 0x3FFFFFFFu) )
{
if( MiControlAreaUsingExtents(v7) && *((_QWORD *)LastSubsection + 1) )
{
MiSubsectionNeedsExtents(LastSubsection);
BugCheckParameter2 = (ULONG_PTR)LastSubsection;
}
updated = MiUpdateLastSubsectionSize((__int64)LastSubsection, NewSectionSize, v14);
}
else
{
updated = MiExtendSection(
(__int64)LastSubsection,
NewSectionSize,
*((_DWORD *)LastSubsection + 13) & 0x3FFFFFFF,
v14 - (*((_DWORD *)LastSubsection + 13) & 0x3FFFFFFF),
&BugCheckParameter2);
}
v11 = updated;
if( updated >= 0 )
{
v11 = 0;
_InterlockedExchange64((volatile __int64 *)(v8 + 24), *NewSectionSize);
*((_QWORD *)SectionToExtend + 6) = *NewSectionSize;
}
}
MiUnlockControlAreaSectionExtend(v7, (__int64)v24);
if( BugCheckParameter2 )
return MiUpdateActiveSubsection((_SUBSECTION *)BugCheckParameter2, v16);
return v11;
}
if( (*((_DWORD *)SectionToExtend + 15) & 0x44) != 0 )
{
FileSize.QuadPart = *NewSectionSize;
v20 = FsRtlSetFileSize(v19, &FileSize);
if( v20 >= 0 )
goto LABEL_18;
v11 = v20;
}
else
{
v11 = -1073741689;
}
}
MiUnlockControlAreaSectionExtend(v7, (__int64)v24);
MiDereferenceControlAreaFile(v7, (unsigned __int64)v19);
return v11;
}
return -1073741760;
}Referenced by:
CcSetFileSizesEx
MiAllocateVirtualMemory
MiCreateSection
NtExtendSection