MiCreateImageFileMap
NTSTATUS __fastcall MiCreateImageFileMap(
FILE_OBJECT *File,
volatile INT64 *a2,
UINT64 a3,
INT64 er9,
INT64 a5,
INT64 a6,
INT64 a7,
INT64 a8){
INT64 v8;
int v9;
unsigned int v10;
NTSTATUS result;
unsigned __int64 v13;
_CONTROL_AREA *v14;
PVOID *v15;
MDL *v16;
NTSTATUS ImageHeaders;
ULONG LowPart;
LARGE_INTEGER v19;
PMDL v20;
INT64 StartVa;
__int64 v22;
LARGE_INTEGER v23;
int v24;
__int64 v25;
unsigned __int64 v26;
unsigned int v27;
_DWORD *Ptr;
INT64 v29;
unsigned int v30;
__int128 v31;
unsigned int v32;
__int64 v33;
unsigned __int64 v34;
__int64 v35;
FILE_OBJECT *v36;
unsigned int v37;
char *v38;
int v39;
__int64 v40;
char v41;
PMDL v42;
unsigned int v43;
unsigned __int16 v44;
__int64 v45;
char v46;
unsigned __int16 v47;
char v48;
UINT64 v49;
int v50;
char v51;
__int64 v52;
_MDL *v53;
volatile INT64 *v54;
UINT64 v55;
union _LARGE_INTEGER v56;
int v57;
unsigned __int64 v58;
PHYSICAL_EXTENTS_DESCRIPTOR *v59;
MDL *v60;
MDL *v61;
unsigned int v62;
__int64 v63;
LARGE_INTEGER v64;
__int64 v65;
bool v66;
unsigned __int64 v67;
unsigned __int64 v68;
MDL *v69;
PHYSICAL_EXTENTS_DESCRIPTOR *v70;
FILE_OBJECT *v71;
__int64 v72;
int v73;
UINT64 v74;
int v75;
PHYSICAL_EXTENTS_DESCRIPTOR *v76;
INT64 CreateSectionFlags;
char v78;
__int64 v79;
PMDL MemoryDescriptorList;
MDL *v83;
unsigned int v84;
INT64 a3a;
union _LARGE_INTEGER FileSize;
UINT64 *v87;
int v88;
_CONTROL_AREA *ControlArea;
INT64 BugCheckParameter3;
LARGE_INTEGER Timeout[2];
UINT64 QuotaCharge;
_MDL *Mdl;
__int64 v94;
INT64 a4[2];
int v96;
UINT64 *v97;
UINT64 ImagePageFrameNumber;
__int128 v99;
_QWORD *v100;
_QWORD *v101;
EVENT_DATA_DESCRIPTOR EventData;
v8 = 0i64;
v100 = (_QWORD *)a5;
v101 = (_QWORD *)a6;
v9 = er9;
v10 = a3;
a3a = a7;
EventData.Ptr = a8;
v88 = 0;
*(_OWORD *)&Timeout[0].LowPart = 0i64;
FileSize.QuadPart = 0i64;
v99 = 0i64;
result = FsRtlGetFileSize(File, &FileSize);
if( result >= 0 )
{
if( FileSize.HighPart )
{
dword_140C4C958 = 34;
return -1073741792;
}
Mdl = 0i64;
v13 = 1i64;
QuotaCharge = 0i64;
ControlArea = 0i64;
v79 = 0i64;
v14 = 0i64;
v87 = 0i64;
v15 = 0i64;
v16 = MiCreateMdl((UINT64)a2);
MemoryDescriptorList = v16;
if( !v16 )
{
dword_140C4C958 = 35;
return -1073741670;
}
v16->Process = 0i64;
ImagePageFrameNumber = (UINT64)v16[1].Next;
CcZeroEndOfLastPage(File);
ImageHeaders = MiFlushDataSection(File);
if( ImageHeaders == -1073741740 )
{
dword_140C4C958 = 36;
goto LABEL_82;
}
v78 = 0;
if( v88 == 1 )
v9 |= 0x100000u;
if( (v9 & 0x100080) != 0 )
{
v78 = 1;
if( PsIsCurrentThreadPrefetching() )
{
dword_140C4C958 = 37;
ImageHeaders = -1073740749;
goto LABEL_82;
}
}
LowPart = FileSize.LowPart;
if( (v9 & 0x10000) != 0 )
{
v56 = FileSize;
if( (v9 & 0x40000) != 0 )
v56.QuadPart = 4096i64;
v57 = MiAllocateEntireImageFileExtents(File, (PHYSICAL_EXTENTS_DESCRIPTOR *)v56.QuadPart, 0i64, &v87);
v8 = (INT64)v87;
ImageHeaders = v57;
if( v57 < 0 )
{
dword_140C4C958 = 38;
goto LABEL_169;
}
LowPart = FileSize.LowPart;
}
if( (v9 & 0x10000) != 0 )
goto LABEL_15;
if( (unsigned int)MiCopyHeaderIfResident(File, ImagePageFrameNumber) == 1 )
{
v19.QuadPart = 4096i64;
Timeout[1].QuadPart = 4096i64;
}
else
{
if( !v78
&& ((v9 & 0x20) != 0 || (v9 & 0x400) != 0 && LowPart <= 0x20000)
&& !File->SectionObjectPointer->DataSectionObject )
{
v13 = ((unsigned __int64)LowPart + 4095) >> 12;
if( v13 > 1 )
{
Mdl = MiCreateMdl((UINT64)a2);
v53 = Mdl;
if( Mdl )
{
MiDeleteImageCreationMdls(MemoryDescriptorList);
v53->Process = 0i64;
MemoryDescriptorList = v53;
}
else
{
v13 = 1i64;
}
}
}
v19 = Timeout[1];
if( !Timeout[1].QuadPart )
{
LABEL_15:
v20 = MemoryDescriptorList;
ImageHeaders = MiReadImageHeaders(File, v8, MemoryDescriptorList, Timeout);
if( ImageHeaders < 0 )
{
dword_140C4C958 = 40;
goto LABEL_169;
}
v19 = Timeout[1];
if( Timeout[1].QuadPart != v13 << 12 && Timeout[1].QuadPart < 0x40ui64 )
{
dword_140C4C958 = 41;
LABEL_80:
ImageHeaders = -1073741521;
LABEL_81:
v15 = 0i64;
LABEL_82:
v54 = a2;
LABEL_83:
MiDeleteImageCreationMdls(MemoryDescriptorList);
v55 = QuotaCharge;
if( QuotaCharge )
{
_InterlockedExchangeAdd64(v54 + 953, -(__int64)QuotaCharge);
MiReturnCommit((_MI_PARTITION *)v54, v55);
v14 = ControlArea;
v8 = (INT64)v87;
}
if( v14 )
{
MiUpdateSystemProtoPtesTree(*((RTL_BALANCED_NODE **)v14 + 12), 0i64);
ExFreePoolWithTag(v15[8], 0);
ExFreePoolWithTag(v15, 0);
ExFreePoolWithTag(v14, 0);
}
goto LABEL_62;
}
LABEL_17:
if( (v20->MdlFlags & 4) != 0 )
StartVa = (INT64)v20->StartVa;
else
StartVa = (INT64)v20->MappedSystemVa;
BugCheckParameter3 = StartVa;
if( *(_WORD *)StartVa != 23117 )
goto LABEL_80;
v22 = *(unsigned int *)(StartVa + 60);
v84 = v22;
if( (int)v22 + 264 <= (unsigned int)v22 )
{
ImageHeaders = -1073741520;
dword_140C4C958 = 42;
goto LABEL_81;
}
v23.QuadPart = v22 + 264;
v24 = v22;
if( (unsigned __int64)(v22 + 264) > FileSize.QuadPart )
{
ImageHeaders = -1073741520;
dword_140C4C958 = 43;
goto LABEL_81;
}
if( v23.QuadPart > v13 << 12 )
{
v54 = a2;
v58 = 0x2000i64;
v59 = (PHYSICAL_EXTENTS_DESCRIPTOR *)((FileSize.QuadPart - ((unsigned int)v22 & 0xFFFFF000) + 4095) & 0xFFFFFFFFFFFFF000ui64);
if( (unsigned __int64)v59 < 0x2000 )
v58 = (FileSize.QuadPart - ((unsigned int)v22 & 0xFFFFF000) + 4095) & 0xFFFFFFFFFFFFF000ui64;
v94 = v58;
v60 = MiCreateMdl((UINT64)a2);
v83 = v60;
v61 = v60;
if( !v60 )
{
ImageHeaders = -1073741670;
dword_140C4C958 = 44;
v15 = 0i64;
goto LABEL_83;
}
v60->Next = MemoryDescriptorList;
v62 = v24 & 0xFFFFF000;
MemoryDescriptorList = v60;
v60->Process = (_EPROCESS *)((v24 & 0xFFFFF000) / 4096i64);
if( (v9 & 0x40000) != 0 )
{
v97 = 0i64;
ImageHeaders = MiAllocateEntireImageFileExtents(File, v59, (_DWORD *)v8, &v97);
if( ImageHeaders < 0 )
{
dword_140C4C958 = 128;
goto LABEL_169;
}
v8 = (INT64)v97;
v61 = v83;
v87 = v97;
}
ImageHeaders = MiReadImageHeaders(File, v8, v61, Timeout);
if( ImageHeaders < 0 )
{
dword_140C4C958 = 45;
goto LABEL_169;
}
v63 = v24 & 0xFFF;
if( Timeout[1].QuadPart != (unsigned int)v94 && Timeout[1].QuadPart < (unsigned __int64)(v63 + 264) )
{
ImageHeaders = -1073741520;
dword_140C4C958 = 46;
goto LABEL_81;
}
v26 = Timeout[1].QuadPart - v63;
v64.QuadPart = v62 + Timeout[1].QuadPart;
v94 = (__int64)v83->MappedSystemVa + v63;
v25 = v94;
Timeout[1] = v64;
StartVa = BugCheckParameter3;
}
else
{
if( v23.QuadPart > (unsigned __int64)v19.QuadPart )
{
ImageHeaders = -1073741520;
dword_140C4C958 = 47;
goto LABEL_81;
}
v25 = StartVa + (unsigned int)v22;
v26 = v19.QuadPart - (unsigned int)v22;
}
ImageHeaders = MiVerifyImageHeader(a3a, v25, StartVa, v26);
if( ImageHeaders )
goto LABEL_169;
v27 = v84;
Ptr = (_DWORD *)EventData.Ptr;
v29 = a3a;
*(_DWORD *)EventData.Ptr = v84 + 48;
if( *(_WORD *)(v29 + 48) == 267 )
*Ptr = v27 + 52;
v30 = *(_DWORD *)(v29 + 16);
if( !((v30 >> 12) + ((v30 & 0xFFF) != 0)) )
{
ImageHeaders = -1073741701;
dword_140C4C958 = 49;
goto LABEL_81;
}
v31 = *(_OWORD *)(v25 + 4);
v96 = *(_DWORD *)(v25 + 20);
v32 = (unsigned __int16)v96 + 24;
*(_OWORD *)a4 = v31;
if( v27 + v32 + 40 * WORD1(v31) <= v27 )
{
ImageHeaders = -1073741701;
dword_140C4C958 = 50;
goto LABEL_81;
}
v33 = v32 + v27;
v34 = (unsigned int)v33;
v35 = 40i64 * WORD1(v31);
v36 = (FILE_OBJECT *)(v35 + v33);
v37 = v35 + v33;
if( *(unsigned int *)(v29 + 24) >= (unsigned __int64)(v35 + v33) )
v37 = *(_DWORD *)(v29 + 24);
v84 = v37;
if( v37 > v30 )
{
ImageHeaders = -1073741701;
dword_140C4C958 = 48;
goto LABEL_81;
}
if( (unsigned __int64)v36 > Timeout[1].QuadPart )
{
v65 = ((unsigned int)v25 + v32) & 0xFFFi64;
v66 = v35 + v65 == 0;
v67 = v35 + v65;
EventData.Ptr = v67;
if( v66 || (v68 = (v67 + 4095) & 0xFFFFFFFFFFFFF000ui64, v67 > v68) )
{
ImageHeaders = -1073741701;
dword_140C4C958 = 51;
LABEL_169:
if( ImageHeaders >= 0 )
goto LABEL_62;
LABEL_170:
v15 = (PVOID *)v79;
goto LABEL_82;
}
v83 = MiCreateMdl((UINT64)a2);
v69 = v83;
if( !v83 )
{
ImageHeaders = -1073741670;
dword_140C4C958 = 52;
goto LABEL_81;
}
v83->Process = (_EPROCESS *)(v34 >> 12);
v69->Next = MemoryDescriptorList;
MemoryDescriptorList = v69;
if( (v9 & 0x40000) != 0 )
{
BugCheckParameter3 = 0i64;
v70 = (PHYSICAL_EXTENTS_DESCRIPTOR *)v68;
v71 = File;
ImageHeaders = MiAllocateEntireImageFileExtents(File, v70, (_DWORD *)v8, (UINT64 **)&BugCheckParameter3);
if( ImageHeaders < 0 )
{
dword_140C4C958 = 129;
goto LABEL_169;
}
v8 = BugCheckParameter3;
v69 = v83;
v87 = (UINT64 *)BugCheckParameter3;
}
else
{
v71 = File;
}
ImageHeaders = MiReadImageHeaders(v71, v8, v69, Timeout);
if( ImageHeaders < 0 )
{
dword_140C4C958 = 53;
goto LABEL_169;
}
if( Timeout[1].QuadPart < EventData.Ptr )
{
ImageHeaders = -1073741701;
dword_140C4C958 = 54;
goto LABEL_81;
}
v29 = a3a;
v38 = (char *)v83->MappedSystemVa + (v34 & 0xFFF);
}
else
{
v38 = (char *)(v25 + v32);
}
if( *(_DWORD *)(v29 + 12) < 0x1000u )
{
if( (v9 & 0x80000) != 0 )
{
ImageHeaders = -1073741701;
MiLogCreateImageFileMapFailure(v36);
dword_140C4C958 = 55;
goto LABEL_81;
}
if( !(unsigned int)MiLegacyImageArchitecture(a4[0]) )
{
ImageHeaders = -1073741701;
dword_140C4C958 = 56;
goto LABEL_81;
}
v9 |= 0x200000u;
}
LODWORD(CreateSectionFlags) = v9;
v39 = MiBuildImageControlArea(v10, (INT64)v38, v29, (INT64)a4, CreateSectionFlags);
v14 = ControlArea;
ImageHeaders = v39;
if( v39 < 0 )
goto LABEL_170;
*(_DWORD *)(*(_QWORD *)(*(_QWORD *)ControlArea + 56i64) + 64i64) = v84;
*((_WORD *)v14 + 30) ^= (*((_WORD *)v14 + 30) ^ *(_WORD *)a2) & 0x3FF;
if( (v9 & 0x200) != 0 )
*(_BYTE *)(*(_QWORD *)(*(_QWORD *)v14 + 56i64) + 51i64) |= 0x10u;
v40 = *(_QWORD *)v14;
v41 = 0;
v42 = MemoryDescriptorList;
v79 = *(_QWORD *)v14;
if( !Mdl && !MemoryDescriptorList->Next && (v9 & 0x210000) == 0 )
{
v43 = *(_DWORD *)(a3a + 24);
if( v43 < 0x1000 )
{
if( (v43 & 0x1FF) != 0 )
++*(_QWORD *)(v40 + 16);
v41 = 1;
}
}
v44 = HIWORD(v96);
if( !v78 )
{
if( (IoIsDeviceEjectable(File->DeviceObject), v48)
|| (v44 & 0x400) != 0 && ((unsigned __int8)*(_DWORD *)(v45 + 52) & (unsigned __int8)v46) != 0
|| (v44 & v47) != 0 && (*(_DWORD *)(v45 + 52) & 0x10) != 0 )
{
v78 = v46;
}
}
v49 = *(_QWORD *)(v40 + 16);
QuotaCharge = v49;
if( v49 )
{
v54 = a2;
if( !(unsigned int)MiChargeCommit((_MI_PARTITION *)a2, v49, 0i64) )
{
v15 = (PVOID *)v79;
QuotaCharge = 0i64;
ImageHeaders = -1073741523;
dword_140C4C958 = 57;
goto LABEL_83;
}
_InterlockedExchangeAdd64(a2 + 953, QuotaCharge);
v14 = ControlArea;
v8 = (INT64)v87;
}
v50 = *((_DWORD *)v14 + 14);
if( (v50 & 0x20000) != 0 && (v9 & 0x200000) == 0 && (*(_DWORD *)(a3a + 20) & 0x1000000) == 0 )
*((_DWORD *)v14 + 14) = v50 | 0x4000000;
if( Mdl )
MiInitializeImageProtos(v14, Mdl, (_MMPFN *)v40);
if( v41 == 1 )
MiInitializeImageHeaderPage(ImagePageFrameNumber, *(unsigned int *)(a3a + 24));
if( *(_WORD *)(a3a + 48) == 267 )
*(_BYTE *)(v79 + 14) |= 0x40u;
v51 = v78;
if( v78 )
{
*((_DWORD *)v14 + 14) |= 0x800u;
if( (v9 & 0x100080) != 0 )
*((_DWORD *)v14 + 14) |= 0x40000u;
v51 = v78;
}
if( (v9 & 0x10000) == 0 )
goto LABEL_60;
v72 = *((_QWORD *)v14 + 12);
if( !v51 && (MiFlags & 0x2000) == 0 && (v9 & 0x20000) == 0 )
*((_DWORD *)v14 + 14) |= 0x40000000u;
v73 = v9 & 0x40000;
if( v73 )
*(_QWORD *)(v72 + 48) |= 1ui64;
if( (*((_DWORD *)v14 + 14) & 0x40000000) != 0 )
{
*((_QWORD *)v14 + 8) = File;
ImageHeaders = MiInitializeImageExtents((__int64 *)v14);
ObFastReplaceObject((_EX_FAST_REF *)v14 + 8, 0i64, v74);
if( ImageHeaders < 0 )
{
if( ImageHeaders != -1073741800 )
{
dword_140C4C958 = 58;
goto LABEL_169;
}
*((_DWORD *)v14 + 14) &= ~0x40000000u;
}
else
{
MiDeleteImageCreationMdls(MemoryDescriptorList);
v42 = 0i64;
MemoryDescriptorList = 0i64;
}
if( (*((_DWORD *)v14 + 14) & 0x40000000) != 0 )
{
LABEL_60:
v52 = v79;
LABEL_61:
ImageHeaders = 0;
*v100 = v52;
*v101 = v42;
LABEL_62:
if( v8 )
MiDeleteImageExtentList((PVOID)v8);
return ImageHeaders;
}
}
v66 = v73 == 0;
v52 = v79;
if( !v66 )
{
v75 = *(_DWORD *)(v79 + 8);
v83 = 0i64;
v76 = (PHYSICAL_EXTENTS_DESCRIPTOR *)(unsigned int)(v75 << 12);
FileSize.QuadPart = (unsigned int)v76;
ImageHeaders = MiAllocateEntireImageFileExtents(File, v76, (_DWORD *)v8, (UINT64 **)&v83);
if( ImageHeaders < 0 )
{
dword_140C4C958 = 91;
goto LABEL_169;
}
v8 = (INT64)v83;
}
*(_QWORD *)(v72 + 48) |= v8;
v8 = 0i64;
goto LABEL_61;
}
}
v20 = MemoryDescriptorList;
goto LABEL_17;
}
dword_140C4C958 = 33;
if( result == -1073741638 )
return -1073741792;
return result;
}Referenced by:
No references.