MiFreeUnusedPfnPages
VOID __stdcall MiFreeUnusedPfnPages(PVOID Context){
ULONG_PTR *v1;
unsigned int SessionId;
_ETHREAD *CurrentThread;
ULONG_PTR v5;
_ETHREAD *v6;
char v7;
int v8;
bool v9;
__int64 v10;
unsigned __int64 v11;
__int64 v12;
_ETHREAD *v13;
unsigned int v14;
char v15;
int v16;
__int64 v17;
unsigned __int64 v18;
__int64 v19;
char v20;
int v21;
__int64 v22;
unsigned __int64 v23;
__int64 v24;
int v25;
_ETHREAD *v26;
__int64 Contexta[2];
int v28;
int v29;
__int128 PcValue[6];
int v31;
int v32;
int v33;
int v34;
v29 = 0;
v1 = &MiSystemPartition;
v28 = 0;
Contexta[0] = (__int64)Context;
Contexta[1] = (__int64)PcValue;
if( Context )
v1 = (ULONG_PTR *)Context;
memset(PcValue, 0, 32);
SessionId = -1;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v26 = CurrentThread;
v5 = (ULONG_PTR)(v1 + 24);
while( 1 )
{
--*((_WORD *)CurrentThread + 243);
ExAcquirePushLockExclusiveEx((UINT64)(v1 + 24), 0i64);
if( !Context && *((_BYTE *)v1 + 204) == 1 )
{
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v5, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)v1 + 24);
v34 = 0;
v6 = (_ETHREAD *)KeGetCurrentThread();
if( (unsigned int)MiGetSystemRegionType((UINT64)(v1 + 24)) == 1 )
SessionId = MmGetSessionIdEx(*((_QWORD *)v6 + 23));
--*((_WORD *)v6 + 243);
v20 = ++*((_BYTE *)v6 + 794);
v21 = (*((char *)v6 + 792) | *((char *)v6 + 870)) ^ 0x3F;
while( 1 )
{
v9 = !_BitScanReverse((unsigned int *)&v22, v21);
v33 = v22;
if( v9 )
break;
v23 = *((_QWORD *)v6 + 100) + 96 * v22;
v21 &= ~(1 << v22);
if( (*(_BYTE *)(v23 + 26) & 1) != 0
&& (*(_DWORD *)(v23 + 32) & 1) == 0
&& (*(_QWORD *)(v23 + 32) & 0x7FFFFFFFFFFFFFFCi64) == (v5 & 0x7FFFFFFFFFFFFFFCi64)
&& *(_DWORD *)(v23 + 40) == SessionId )
{
*(_BYTE *)(v23 + 26) &= ~1u;
if( *(_QWORD *)(v23 + 32) )
{
if( v23 )
{
*(_BYTE *)(v23 + 32) |= 2u;
if( *(__int64 *)(v23 + 32) < 0 )
KiAbEntryRemoveFromTree(v23);
v34 = *(_DWORD *)(v23 + 88) & 0x1FFFF;
*(_DWORD *)(v23 + 88) &= 0xFFFE0000;
*(_BYTE *)(v23 + 25) &= ~1u;
*(_QWORD *)(v23 + 32) = 0i64;
v24 = (__int64)(v23 - *((_QWORD *)v6 + 100)) / 96;
if( v20 == 1 )
*((_BYTE *)v6 + 792) |= 1 << v24;
else
_InterlockedOr8((volatile signed __int8 *)v6 + 870, 1 << v24);
goto LABEL_74;
}
break;
}
}
}
if( (*((_DWORD *)v6 + 30) & 0x10000) == 0 )
KeBugCheckEx(0x162u, (ULONG_PTR)v6, v5, SessionId, 0i64);
LABEL_74:
--*((_BYTE *)v6 + 794);
KiAbThreadRemoveBoosts((ULONG_PTR)v6, v5, (unsigned int *)&v34);
v9 = (*((_WORD *)v6 + 243))++ == 0xFFFF;
if( !v9 )
goto LABEL_25;
LABEL_27:
if( *((_ETHREAD **)v6 + 19) != (_ETHREAD *)((char *)v6 + 152) )
KiCheckForKernelApcDelivery();
goto LABEL_25;
}
KeGenericCallDpc((PKDEFERRED_ROUTINE)MiFreeUnusedPfnPagesDpc, Contexta);
if( v28 != 259 )
break;
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v5, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)v1 + 24);
v31 = 0;
v13 = (_ETHREAD *)KeGetCurrentThread();
if( (unsigned int)MiGetSystemRegionType((UINT64)(v1 + 24)) == 1 )
v14 = MmGetSessionIdEx(*((_QWORD *)v13 + 23));
else
v14 = -1;
--*((_WORD *)v13 + 243);
v15 = ++*((_BYTE *)v13 + 794);
v16 = (*((char *)v13 + 792) | *((char *)v13 + 870)) ^ 0x3F;
while( 1 )
{
v9 = !_BitScanReverse((unsigned int *)&v17, v16);
v32 = v17;
if( v9 )
break;
v18 = *((_QWORD *)v13 + 100) + 96 * v17;
v16 &= ~(1 << v17);
if( (*(_BYTE *)(v18 + 26) & 1) != 0
&& (*(_DWORD *)(v18 + 32) & 1) == 0
&& (*(_QWORD *)(v18 + 32) & 0x7FFFFFFFFFFFFFFCi64) == (v5 & 0x7FFFFFFFFFFFFFFCi64)
&& *(_DWORD *)(v18 + 40) == v14 )
{
*(_BYTE *)(v18 + 26) &= ~1u;
if( *(_QWORD *)(v18 + 32) )
{
if( v18 )
{
*(_BYTE *)(v18 + 32) |= 2u;
if( *(__int64 *)(v18 + 32) < 0 )
KiAbEntryRemoveFromTree(v18);
v31 = 0;
v31 = *(_DWORD *)(v18 + 88) & 0x1FFFF;
*(_DWORD *)(v18 + 88) &= 0xFFFE0000;
*(_BYTE *)(v18 + 25) &= ~1u;
*(_QWORD *)(v18 + 32) = 0i64;
v19 = (__int64)(v18 - *((_QWORD *)v13 + 100)) / 96;
if( v15 == 1 )
*((_BYTE *)v13 + 792) |= 1 << v19;
else
_InterlockedOr8((volatile signed __int8 *)v13 + 870, 1 << v19);
goto LABEL_49;
}
break;
}
}
}
if( (*((_DWORD *)v13 + 30) & 0x10000) == 0 )
KeBugCheckEx(0x162u, (ULONG_PTR)v13, (ULONG_PTR)(v1 + 24), v14, 0i64);
LABEL_49:
--*((_BYTE *)v13 + 794);
KiAbThreadRemoveBoosts((ULONG_PTR)v13, (__int64)(v1 + 24), (unsigned int *)&v31);
v9 = (*((_WORD *)v13 + 243))++ == 0xFFFF;
if( v9 && *((_ETHREAD **)v13 + 19) != (_ETHREAD *)((char *)v13 + 152) )
KiCheckForKernelApcDelivery();
CurrentThread = v26;
KiLeaveGuardedRegionUnsafe((__int64)v26);
if( !Contexta[0] )
return;
KeWaitForGate((char *)PcValue + 8, 18);
}
v1[10] = 0i64;
*((_BYTE *)v1 + 204) = 0;
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v5, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)v1 + 24);
v25 = 0;
v6 = (_ETHREAD *)KeGetCurrentThread();
if( (unsigned int)MiGetSystemRegionType((UINT64)(v1 + 24)) == 1 )
SessionId = MmGetSessionIdEx(*((_QWORD *)v6 + 23));
--*((_WORD *)v6 + 243);
v7 = ++*((_BYTE *)v6 + 794);
v8 = (*((char *)v6 + 792) | *((char *)v6 + 870)) ^ 0x3F;
while( 1 )
{
v9 = !_BitScanReverse((unsigned int *)&v10, v8);
if( v9 )
break;
v11 = *((_QWORD *)v6 + 100) + 96 * v10;
v8 &= ~(1 << v10);
if( (*(_BYTE *)(v11 + 26) & 1) != 0
&& (*(_DWORD *)(v11 + 32) & 1) == 0
&& (*(_QWORD *)(v11 + 32) & 0x7FFFFFFFFFFFFFFCi64) == (v5 & 0x7FFFFFFFFFFFFFFCi64)
&& *(_DWORD *)(v11 + 40) == SessionId )
{
*(_BYTE *)(v11 + 26) &= ~1u;
if( *(_QWORD *)(v11 + 32) )
{
if( v11 )
{
*(_BYTE *)(v11 + 32) |= 2u;
if( *(__int64 *)(v11 + 32) < 0 )
KiAbEntryRemoveFromTree(v11);
v25 = *(_DWORD *)(v11 + 88) & 0x1FFFF;
*(_DWORD *)(v11 + 88) &= 0xFFFE0000;
*(_BYTE *)(v11 + 25) &= ~1u;
*(_QWORD *)(v11 + 32) = 0i64;
v12 = (__int64)(v11 - *((_QWORD *)v6 + 100)) / 96;
if( v7 == 1 )
*((_BYTE *)v6 + 792) |= 1 << v12;
else
_InterlockedOr8((volatile signed __int8 *)v6 + 870, 1 << v12);
goto LABEL_24;
}
break;
}
}
}
if( (*((_DWORD *)v6 + 30) & 0x10000) == 0 )
KeBugCheckEx(0x162u, (ULONG_PTR)v6, v5, SessionId, 0i64);
LABEL_24:
--*((_BYTE *)v6 + 794);
KiAbThreadRemoveBoosts((ULONG_PTR)v6, v5, (unsigned int *)&v25);
v9 = (*((_WORD *)v6 + 243))++ == 0xFFFF;
if( v9 )
goto LABEL_27;
LABEL_25:
KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
}Referenced by:
MiInitNucleus