MiInitializeShadowPageTable

VOID __fastcall MiInitializeShadowPageTable(INT64 Va, CHAR *a2, INT64 a3){
  unsigned int v3; 
  _MMPTE *PteBase; 
  INT64 v5; 
  INT64 v6; 
  INT64 v7; 
  UINT64 v8; 
  int v9; 
  int v10; 
  MMPTE *v11; 
  INT64 v12; 
  UINT64 v13; 
  UINT64 v14; 
  MMPTE *PteAddress; 
  int v16; 
  __int64 v17; 
  v3 = a3;
  PteBase = MmGetPteBase();
  v5 = Va;
  if( !(_DWORD)a3 )
  {
    v6 = ((Va << 25) - ((_QWORD)PteBase << 25)) >> 16;
    if( (unsigned int)MI_IS_PHYSICAL_ADDRESS((PVOID)v6) )
    {
      PteAddress = (MMPTE *)v5;
      do
        PteAddress = MiGetPteAddress(PteAddress);
      while( v16 != 1 );
      v7 = MI_READ_PTE_LOCK_FREE((INT64)PteAddress);
      v8 = MiVaToPfn((PVOID)v6);
    }
    else
    {
      v7 = MI_READ_PTE_LOCK_FREE(v5);
      v8 = ((unsigned __int64)v7 >> 12) & 0xFFFFFFFFFi64;
    }
    v9 = 3;
    v10 = ((v7 & 0x800) != 0 ? 4 : 1) | 2;
    if( v7 < 0 )
      v10 = (v7 & 0x800) != 0 ? 4 : 1;
    goto LABEL_6;
  }
  *(_QWORD *)a2 = 0i64;
  v10 = 6;
  v9 = 3;
  v8 = (a2 - (CHAR *)MmGetPfnDb()) / 48;
  if( (_DWORD)a3 != 3 )
  {
LABEL_6:
    v11 = MiGetPteAddress((PVOID)v5);
    v13 = (MiReadWriteAnyLevelShadowPte((UINT64)v11, v12, 0i64, ZeroPte) >> 12) & 0xFFFFFFFFFi64;
    goto LABEL_7;
  }
  v13 = -1i64;
LABEL_7:
  v14 = MiMakeValidPte(v5, v8, v10 | (v3 != 0 ? -1744830464 : -1879048192)) & 0xFFFFFFFFFFFFFEFFui64;
  if( v3 )
  {
    if( v3 == 3 )
      v13 = *((_QWORD *)PsInitialSystemProcess + 5) >> 12;
    MiInitializePfnForOtherProcess(v8, (MMPTE *)v5, v13, 0xA00ui64);
  }
  MiReadWriteAnyLevelShadowPte(v5, v3, 1i64, v14);
  if( v3 == 3 )
  {
    MiMarkPxeAsShadowed(v5);
    v17 = (_QWORD)MmGetPteBase() << 25;
    do
    {
      v5 = ((v5 << 25) - v17) >> 16;
      --v9;
    }
    while( v9 );
    MiReplicatePteChange((MMPTE *)v5, (MMPTE *)v5);
  }
}

Referenced by:

No references.