MiValidateSectionCreate
INT64 __fastcall MiValidateSectionCreate(ULONG_PTR a1, __int64 a2, int a3, __int64 a4, int a5, char a6, char a7){
int v8;
_ETHREAD *CurrentThread;
int v10;
ULONG_PTR v11;
__int64 v12;
__int64 v13;
signed __int64 v14;
int v15;
int v16;
__int64 v17;
__int64 v18;
unsigned int v19;
char *v20;
void *v21;
char *v22;
unsigned int v23;
unsigned int v24;
int v25;
int v26;
_BYTE *v27;
INT64 v28;
int v29;
unsigned int v30;
__int64 v31;
INT64 v32;
signed __int64 v33;
bool v34;
signed __int64 v35;
int v36;
unsigned __int64 v37;
signed __int64 v38;
NTSTATUS PerSessionProtos;
ULONG_PTR BugCheckParameter4;
UINT64 v41;
char v42[8];
unsigned __int64 v43;
int v44;
int v45;
int v46;
int v47;
unsigned int v48;
unsigned int v49;
int v50;
int v51;
int v52;
int v53;
int v54;
int v55;
unsigned int v56;
unsigned int v57;
int v58;
int v59;
INT64 v60;
__int64 v61;
int v62;
unsigned int v63;
int v64;
VOID *PageBase;
ULONG_PTR BugCheckParameter2;
_ETHREAD *v67;
__int64 v68;
__int64 v69;
char *v70;
__int64 v71;
__int64 v72;
__int64 v73;
ULONG_PTR v74;
__int64 v75;
__int64 v76;
INT64 result[2];
unsigned int v78;
v68 = a4;
v58 = a3;
BugCheckParameter2 = a1;
v74 = a1;
v75 = a2;
v62 = a3;
v76 = a4;
v43 = 0i64;
v42[0] = 0;
memset((INT64)result, 0i64);
v46 = 0;
v54 = 1;
v8 = 6;
v45 = 6;
v44 = 0;
v59 = 0;
v52 = 0;
CurrentThread = 0i64;
v67 = 0i64;
if( (*(_DWORD *)(a2 + 56) & 0x800) != 0 )
{
if( (a5 & 0x40000000) != 0 )
{
dword_140C4C958 = 115;
return 3221226547i64;
}
a5 |= 0x10000000u;
}
if( (a5 & 0x40000000) != 0 && !*(_QWORD *)(a2 + 144) )
{
dword_140C4C958 = 116;
return 3221225595i64;
}
if( (a5 & 5) != 0 )
{
v8 = 7;
v45 = 7;
v44 = 2;
}
v51 = 0;
v69 = *((_QWORD *)KeGetCurrentThread() + 23);
v71 = v69;
while( 1 )
{
v10 = v8 & 1;
v53 = v10;
v55 = v10;
if( (v8 & 1) != 0 )
{
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v67 = CurrentThread;
v36 = PsSetSystemPagePriorityThread((__int64)CurrentThread, 1);
v52 = v36;
if( (*(_DWORD *)(a2 + 56) & 0x4000000) != 0 )
{
PerSessionProtos = MiCreatePerSessionProtos((_CONTROL_AREA *)a2, 0xFFFFFFFFui64);
if( PerSessionProtos < 0 )
{
PsRevertToUserPagePriorityThread((__int64)CurrentThread, v36);
return(unsigned int)PerSessionProtos;
}
v51 = 1;
v8 = v45;
}
if( v54 )
{
LODWORD(v41) = -1;
LODWORD(BugCheckParameter4) = 0;
MiPrefetchControlArea(a2, RtlpInterceptorRoutines, 0i64, 1ui64, BugCheckParameter4, v41);
}
}
LODWORD(v11) = MiMapImageInSystemSpace(a2, v8, (__int64)result);
if( (v11 & 0x80000000) != 0i64 )
{
if( v51 == 1 )
MiDereferencePerSessionProtos((__int64 *)a2, 0xFFFFFFFF);
if( v10 )
PsRevertToUserPagePriorityThread((__int64)CurrentThread, v52);
return(unsigned int)v11;
}
v12 = result[0];
v60 = result[0];
v13 = *(_QWORD *)(a2 + 96);
v61 = v13;
v73 = v13;
v14 = *(_QWORD *)(v13 + 40);
v72 = v14;
v43 = v14;
if( v14 )
{
if( (v14 & 0xFFFFFFFFFFFFFFF8ui64) == 8 )
{
v15 = 1;
v47 = 1;
v43 = v14 & 3;
goto LABEL_11;
}
v37 = v14;
if( (v14 & 3) != 0 )
{
v37 = v14 & 0xFFFFFFFFFFFFFFFCui64;
v15 = ((v14 & 3) != 1) + 2;
}
else
{
v15 = 4;
}
v43 = v37 & 0xFFFFFFFFFFFFFFFBui64;
}
else
{
v15 = 0;
}
v47 = v15;
LABEL_11:
v48 = v78;
v16 = v78 << 12;
v50 = v78 << 12;
v63 = v78 << 12;
v17 = v78 << 12;
v49 = v78 << 12;
v42[0] = 1;
v18 = *(_QWORD *)(v13 + 32);
if( !v18 || *(_QWORD *)(v18 + 40) == *(_QWORD *)(v18 + 48) )
{
v21 = (void *)result[0];
if( v44 == 1 )
v44 = 2;
}
else
{
if( v44 == 2 )
{
v56 = v78;
}
else
{
v19 = *(_DWORD *)(*(_QWORD *)(*(_QWORD *)a2 + 56i64) + 64i64);
v48 = (v19 >> 12) + ((v19 & 0xFFF) != 0);
v56 = v48;
v49 = v48 << 12;
}
LODWORD(v20) = MiAllocatePool((struct _SLIST_ENTRY *)0x100);
v21 = v20;
v70 = v20;
if( v20 )
{
LODWORD(v11) = 0;
v64 = 0;
v22 = v20;
PageBase = v20;
v23 = 0;
v24 = v48;
while( 1 )
{
v57 = v23;
if( v23 >= v24 )
break;
KeCopyPage(v22);
v24 = v48;
v23 = v57 + 1;
v22 = (char *)PageBase + 4096;
PageBase = (char *)PageBase + 4096;
}
MiRevertRelocations((__int64)v21, (_QWORD *)a2, v24);
}
else
{
LODWORD(v11) = -1073741670;
}
v17 = v49;
v12 = v60;
v16 = v50;
}
v55 = v44;
if( (v11 & 0x80000000) == 0i64 )
{
v25 = SeValidateImageHeader(
BugCheckParameter2,
(__int64)v21,
v17,
v12,
v16,
(__int64)&v44,
v69,
v68,
a5,
(__int64)&v43,
a6,
a7,
(__int64)v42,
(__int64)&v59);
v11 = v25;
if( v25 == 301 )
{
MiImageCantMove(a2);
v46 = 1;
LABEL_96:
if( (*(_DWORD *)(a2 + 56) & 0x40000000) != 0 )
KeBugCheckEx(0x1Au, 0x5150Eui64, BugCheckParameter2, v11, 0i64);
MiStrongCodeImage(a2, 1u);
goto LABEL_26;
}
v26 = v46;
if( v25 == 302 )
v26 = 1;
v46 = v26;
if( v26 )
goto LABEL_96;
}
LABEL_26:
if( v21 != (void *)v60 && v21 )
ExFreePoolWithTag(v21, 0);
MiUnmapImageInSystemSpace((INT64)result);
if( v51 == 1 )
MiDereferencePerSessionProtos((__int64 *)a2, 0xFFFFFFFF);
v29 = v53;
if( v53 )
{
if( (MiFlags & 0x40000) != 0 )
MiFlushEntireTbDueToAttributeChange(v28, v27);
CurrentThread = v67;
PsRevertToUserPagePriorityThread((__int64)v67, v52);
v29 = v53;
}
else
{
CurrentThread = v67;
}
if( (v11 & 0x80000000) == 0i64 )
break;
if( (_DWORD)v11 != -1073741789 || v55 >= v44 )
{
dword_140C4C958 = 117;
return(unsigned int)v11;
}
v8 = v45;
if( v29 )
{
v54 = 1;
}
else
{
v8 = v45 | 1;
v45 |= 1u;
if( v44 == 1 )
v54 = 0;
}
}
if( !v15 || v15 == 1 && (v43 & 0xFFFFFFFFFFFFFFF8ui64) != 0 )
{
if( (v43 & 0xFFFFFFFFFFFFFFF8ui64) != 0 )
{
if( v15 )
v33 = v43 & 0xFFFFFFFFFFFFFFFCui64 | 2;
else
v33 = v43 & 0xFFFFFFFFFFFFFFFCui64 | 1;
}
else
{
v33 = v43 & 7 | 8;
}
v43 = v33;
if( *(char *)(*(_QWORD *)(*(_QWORD *)a2 + 56i64) + 46i64) < 0 )
{
v33 |= 4ui64;
v43 = v33;
}
v31 = v61;
while( 1 )
{
v35 = _InterlockedCompareExchange64((volatile signed __int64 *)(v31 + 40), v33, v14);
v34 = v14 == v35;
v14 = v35;
if( v34 )
break;
if( (v43 & 0xFFFFFFFFFFFFFFF8ui64) <= 8 )
goto LABEL_78;
if( (v35 & 0xFFFFFFFFFFFFFFF8ui64) != 8 )
{
v43 &= 0xFFFFFFFFFFFFFFF8ui64;
SeReleaseImageValidationContext((VOID *)v43);
LABEL_78:
v43 = v14;
break;
}
v33 = v43 & 0xFFFFFFFFFFFFFFFCui64 | 2;
v43 = v33;
}
v14 = v43;
}
else
{
v30 = v15 - 2;
v31 = v61;
if( v30 <= 1 )
v43 ^= ((unsigned __int8)v43 ^ (unsigned __int8)v14) & 3;
}
if( (v43 & 3) == 0 )
{
LABEL_40:
*(_BYTE *)(*(_QWORD *)a2 + 15i64) = *(_BYTE *)(*(_QWORD *)a2 + 15i64) & 1 | (2 * ((8 * v42[0]) | v59 & 7));
if( v46 )
MiStrongCodeImage(a2, 2u);
return(unsigned int)v11;
}
if( (MiFlags & 0x4000) != 0
&& (*(_DWORD *)(a2 + 92) & 0xC0000) != 0
&& *(_QWORD *)(v31 + 32)
&& (v32 = MiCaptureSecureImageBaseAddress((_QWORD *)a2), (int)v32 < 0) )
{
dword_140C4C958 = 118;
}
else
{
v32 = MiWalkEntireImage(a2, 0i64, 1, v58);
LODWORD(v11) = v32;
if( (int)v32 >= 0 )
{
v38 = v43 & 0xFFFFFFFFFFFFFFFCui64;
v43 &= 0xFFFFFFFFFFFFFFFCui64;
if( *(char *)(*(_QWORD *)(*(_QWORD *)a2 + 56i64) + 46i64) < 0 )
{
v38 |= 4ui64;
v43 = v38;
}
_InterlockedCompareExchange64((volatile signed __int64 *)(v31 + 40), v38, v14);
goto LABEL_40;
}
dword_140C4C958 = 119;
}
return v32;
}Referenced by:
MiMapImageForEnclaveUse
MiPromoteControlAreaToStrongCode
MiValidateSectionSigningPolicy