MiSmallVaStillMapsFrame
UINT64 __stdcall MiSmallVaStillMapsFrame(PVOID Va, UINT64 PageFrameIndex){
UINT64 v3;
UINT64 result;
UINT64 v5[2];
__int128 v6;
INT64 v7;
UINT64 v8;
LODWORD(v7) = 0;
*(_OWORD *)v5 = 0i64;
v6 = 0i64;
MiFillPteHierarchy((UINT64)Va, v5);
result = 0;
if( (unsigned int)MiPageTableStillExists((INT64)v5, &v7) )
{
if( !(_DWORD)v7 )
{
if( PageFrameIndex == -1i64 )
return 1;
v8 = MI_READ_PTE_LOCK_FREE(v5[0]);
v3 = v8;
if( (v8 & 1) != 0 )
{
MiPteInShadowRange((UINT64)&v8);
if( ((v3 >> 12) & 0xFFFFFFFFFi64) == PageFrameIndex
|| (_MMPTE *)v5[0] == MmGetPxeSelfRef()
&& (*((_QWORD *)MmGetPfnDb() + 6 * PageFrameIndex + 5) & 0xFFFFFFFFFi64) == PageFrameIndex
&& PageFrameIndex == *(_QWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 904i64) >> 12 )
{
return 1;
}
}
}
}
return result;
}Referenced by:
MiLockStealSystemVm