MiRotatedToFrameBuffer
UINT64 __stdcall MiRotatedToFrameBuffer(MMPTE *PointerPte){
unsigned __int64 v2;
UNICODE_STRING *v3;
UINT8 v4;
WCHAR *v5;
UNICODE_STRING *v6;
__int64 Buffer;
int v8;
UINT64 result;
INT64 v10;
v10 = MI_READ_PTE_LOCK_FREE((INT64)PointerPte);
result = 0;
if( (v10 & 1) != 0 )
{
v2 = 6 * (((unsigned __int64)MI_READ_PTE_LOCK_FREE((INT64)&v10) >> 12) & 0xFFFFFFFFFi64);
v6 = (UNICODE_STRING *)((char *)MmGetPfnDb() + 8 * v2);
if( ((*((_QWORD *)MmGetPfnDb() + v2 + 5) >> 50) & 1) == 0 )
return 1;
Buffer = (__int64)v6->Buffer;
if( (MMPTE *)(Buffer | 0x8000000000000000ui64) != PointerPte
|| (((unsigned __int64)v6[2].Buffer ^ ((unsigned __int64)MI_READ_PTE_LOCK_FREE(
(INT64)MmGetPteBase()
+ (((unsigned __int64)PointerPte >> 9) & 0x7FFFFFFFF8i64)) >> 12)) & 0xFFFFFFFFFi64) != 0 )
{
LOBYTE(v8) = MI_PFN_IS_PROTO(v6, v3, v4, v5);
if( !v8 || ((__int64)v6[2].Buffer & 0x1000000000i64) != 0 || Buffer <= 0 )
return 1;
}
}
return result;
}Referenced by:
MiActOnPte
MiCheckCommitReleaseFromVad
MiDeleteVa
MiGetPageProtection
MiGetWorkingSetInfoList
MiMakeVaRangeNoAccess
MiProtectPrivateMemory
MiRevertValidPte
NtUnlockVirtualMemory