MiInitializeShadowPageTable
VOID __fastcall MiInitializeShadowPageTable(INT64 Va, CHAR *a2, INT64 a3){
unsigned int v3;
_MMPTE *PteBase;
INT64 v5;
INT64 v6;
INT64 v7;
UINT64 v8;
int v9;
int v10;
MMPTE *v11;
INT64 v12;
UINT64 v13;
UINT64 v14;
MMPTE *PteAddress;
int v16;
__int64 v17;
v3 = a3;
PteBase = MmGetPteBase();
v5 = Va;
if( !(_DWORD)a3 )
{
v6 = ((Va << 25) - ((_QWORD)PteBase << 25)) >> 16;
if( (unsigned int)MI_IS_PHYSICAL_ADDRESS((PVOID)v6) )
{
PteAddress = (MMPTE *)v5;
do
PteAddress = MiGetPteAddress(PteAddress);
while( v16 != 1 );
v7 = MI_READ_PTE_LOCK_FREE((INT64)PteAddress);
v8 = MiVaToPfn((PVOID)v6);
}
else
{
v7 = MI_READ_PTE_LOCK_FREE(v5);
v8 = ((unsigned __int64)v7 >> 12) & 0xFFFFFFFFFi64;
}
v9 = 3;
v10 = ((v7 & 0x800) != 0 ? 4 : 1) | 2;
if( v7 < 0 )
v10 = (v7 & 0x800) != 0 ? 4 : 1;
goto LABEL_6;
}
*(_QWORD *)a2 = 0i64;
v10 = 6;
v9 = 3;
v8 = (a2 - (CHAR *)MmGetPfnDb()) / 48;
if( (_DWORD)a3 != 3 )
{
LABEL_6:
v11 = MiGetPteAddress((PVOID)v5);
v13 = (MiReadWriteAnyLevelShadowPte((UINT64)v11, v12, 0i64, ZeroPte) >> 12) & 0xFFFFFFFFFi64;
goto LABEL_7;
}
v13 = -1i64;
LABEL_7:
v14 = MiMakeValidPte(v5, v8, v10 | (v3 != 0 ? -1744830464 : -1879048192)) & 0xFFFFFFFFFFFFFEFFui64;
if( v3 )
{
if( v3 == 3 )
v13 = *((_QWORD *)PsInitialSystemProcess + 5) >> 12;
MiInitializePfnForOtherProcess(v8, (MMPTE *)v5, v13, 0xA00ui64);
}
MiReadWriteAnyLevelShadowPte(v5, v3, 1i64, v14);
if( v3 == 3 )
{
MiMarkPxeAsShadowed(v5);
v17 = (_QWORD)MmGetPteBase() << 25;
do
{
v5 = ((v5 << 25) - v17) >> 16;
--v9;
}
while( v9 );
MiReplicatePteChange((MMPTE *)v5, (MMPTE *)v5);
}
}Referenced by:
No references.