MiHandleTransitionFault
INT64 __fastcall MiHandleTransitionFault(){
_MMPTE *v0;
_MMSUPPORT_INSTANCE *v1;
_MMPFN *v2;
UNICODE_STRING *v3;
_MMPTE *v4;
UINT64 *p_NextPageColor;
ULONG_PTR v6;
_MMPFN *v7;
int v8;
RTL_BALANCED_NODE *v9;
ULONG_PTR v10;
int v11;
RTL_BALANCED_NODE *Address;
unsigned __int64 v13;
UINT64 v14;
unsigned __int64 v15;
UINT64 v16;
INT64 TransitionHeatBatch;
int v18;
UINT64 v19;
RTL_BALANCED_NODE *v20;
__int64 v21;
__int64 v22;
__int64 v23;
__int64 v24;
UINT8 v26;
WCHAR *v27;
__int64 v28;
int v29;
__int64 v30;
UINT8 v31;
WCHAR *v32;
bool v33;
int v34;
int v35;
int v36;
_MMSUPPORT_INSTANCE *v37;
_MMPFN *v38;
UINT64 v39;
__int64 v40;
__int64 v41;
void *BugCheckParameter4;
_MMINPAGE_SUPPORT **v43;
__int64 v44[7];
_MMSUPPORT_INSTANCE *Vm;
_QWORD *v46;
unsigned __int64 v47;
_MMPFN *LockedProtoPfn;
Vm = v1;
v4 = v0;
p_NextPageColor = (UINT64 *)&v1->NextPageColor;
LOBYTE(v44[0]) = 0;
v6 = (ULONG_PTR)v3;
*(_QWORD *)LockedProtoPfn = 0i64;
v7 = v2;
*v46 = 0i64;
LOBYTE(v8) = MI_PFN_IS_PROTO(v3, 0i64, (UINT8)v2, &v3->Length);
v11 = v8;
if( !v8 )
{
v10 = *(_QWORD *)(v10 + 8);
if( v4 != (_MMPTE *)(v10 | 0x8000000000000000ui64) )
KeBugCheckEx(0x1Au, 0x888Aui64, (ULONG_PTR)v4, v10, v6);
}
Address = v9;
v13 = *(_QWORD *)(v6 + 16);
v14 = *p_NextPageColor;
v15 = v13 >> 11;
v16 = v13 >> 3;
if( (*(_QWORD *)(v6 + 16) & 0x400i64) != 0 )
v16 = (unsigned int)v15;
if( (v16 & 1) != 0 )
{
if( v14 <= 0x7FFFFFFEFFFFi64 && !v11 )
Address = MiLocateAddress(*p_NextPageColor);
TransitionHeatBatch = MiMakeTransitionHeatBatch(v6);
p_NextPageColor[14] = TransitionHeatBatch;
if( TransitionHeatBatch )
{
LABEL_25:
_InterlockedAnd64((volatile signed __int64 *)(v6 + 24), 0x7FFFFFFFFFFFFFFFui64);
if( v7 )
{
LOBYTE(v16) = 17;
MiUnlockProtoPoolPage(v7, v16);
return 3221226548i64;
}
return 3221226548i64;
}
}
LOBYTE(v18) = MI_PFN_IS_PROTO((UNICODE_STRING *)v6, (UNICODE_STRING *)v16, (UINT8)Address, (PWCHAR)v10);
if( !v18 )
goto LABEL_23;
v21 = *(_QWORD *)(v6 + 16);
if( (v21 & 0x400) == 0 || ((*(_QWORD *)(v6 + 40) >> 60) & 7) == 3 )
goto LABEL_23;
v22 = *(_QWORD *)(v6 + 16);
if( qword_140C4DC80 && (v21 & 0x10) == 0 )
v22 = ~qword_140C4DC80 & v21;
v23 = v22 >> 16;
if( (*(_DWORD *)(*(_QWORD *)v23 + 56i64) & 0x20) == 0 )
goto LABEL_23;
v24 = *(_QWORD *)(*(_QWORD *)(*(_QWORD *)v23 + 96i64) + 40i64);
if( !v24 || (v24 & 0xFFFFFFFFFFFFFFF8ui64) == 8 || (v24 & 3) == 2 )
goto LABEL_23;
if( v14 < 0xFFFF800000000000ui64 )
{
if( Address )
{
LABEL_30:
v19 = LODWORD(v20[2].Children[0]);
if( ((__int64)v20[2].Children[0] & 0x70) != 32 )
goto LABEL_36;
v19 &= 0xF80u;
if( (_DWORD)v19 != 128
&& ((*(_DWORD *)&v20[2].0 & 0x8000000) == 0 || (v24 & 4) != 0)
&& ((MiFlags & 0x400) == 0 || (*(_BYTE *)(v23 + 34) & 2) == 0) )
{
goto LABEL_36;
}
LABEL_23:
if( !(unsigned int)MiUnlinkPageFromList((_MMPFN *)v6, 0i64) )
{
MiDiscardTransitionPteEx(v6, 0i64);
goto LABEL_25;
}
if( MiIsPfnFileOnly(v6) )
{
LABEL_71:
v41 = *(_QWORD *)(v6 + 24);
++*(_WORD *)(v6 + 32);
*(_QWORD *)(v6 + 24) = v41 & 0xC000000000000000ui64 | 1;
*(_BYTE *)(v6 + 34) = *(_BYTE *)(v6 + 34) & 0xF8 | 6;
return 0i64;
}
v28 = 1i64;
if( v14 > 0x7FFFFFFEFFFFi64 || *(_WORD *)(v6 + 32) )
goto LABEL_63;
LOBYTE(v29) = MI_PFN_IS_PROTO(
(UNICODE_STRING *)v6,
*(UNICODE_STRING **)(*((_QWORD *)KeGetCurrentThread() + 23) + 1680i64),
v26,
v27);
if( v29 )
{
if( (*(_DWORD *)(v6 + 16) & 0x400i64) != 0 )
goto LABEL_63;
v33 = *(_QWORD *)(v30 + 432) == 0i64;
}
else
{
v33 = *(_QWORD *)(v30 + 424) == 0i64;
}
if( !v33 )
{
if( (Address || (Address = MiLocateAddress(v14)) != 0i64)
&& MiVadPageSizes[(LODWORD(Address[2].Children[0]) >> 18) & 3] == 16 )
{
LOBYTE(v34) = MI_PFN_IS_PROTO(
(UNICODE_STRING *)v6,
(UNICODE_STRING *)LODWORD(Address[2].Children[0]),
v31,
v32);
v36 = v35 & 0x100000;
if( v34 )
{
if( !v36 )
{
LABEL_54:
v37 = Vm;
v38 = MiIdealClusterPage(&Vm->NextPageColor, (UINT64)Address, v4, v47, (_MMPFN *)v6, v7, v44);
v28 = (__int64)v38;
if( v38 )
{
if( (_MMPFN *)v6 != v38 )
{
v6 = (ULONG_PTR)v38;
*v46 = v38;
}
}
else
{
_InterlockedAnd64((volatile signed __int64 *)(v6 + 24), 0x7FFFFFFFFFFFFFFFui64);
if( v7 )
{
LOBYTE(v39) = 17;
MiUnlockProtoPoolPage(v7, v39);
}
}
goto LABEL_60;
}
}
else if( v36 )
{
goto LABEL_54;
}
}
v37 = Vm;
LABEL_60:
if( LOBYTE(v44[0]) )
goto LABEL_65;
if( !v28 )
goto LABEL_66;
LABEL_64:
v28 = (__int64)MiMigratePfn(v37, (PVOID)v6, v7, LockedProtoPfn, BugCheckParameter4, v43);
*v46 = v28;
v6 = v28;
LABEL_65:
if( !v28 )
{
LABEL_66:
v40 = *(_QWORD *)LockedProtoPfn;
if( *(_QWORD *)LockedProtoPfn )
{
if( *(int *)(v40 + 176) > 1 )
KeSetEvent((PRKEVENT)(v40 + 56), 0);
MiFreeInPageSupportBlock((PSLIST_ENTRY)v40);
*(_QWORD *)LockedProtoPfn = 0i64;
}
return 3221226548i64;
}
goto LABEL_71;
}
LABEL_63:
v37 = Vm;
goto LABEL_64;
}
v20 = MiLocateAddress(v14);
}
else if( (MiFlags & 0x10000) == 0 || (v21 & 0x40) == 0 )
{
goto LABEL_23;
}
if( v20 )
goto LABEL_30;
LABEL_36:
_InterlockedAnd64((volatile signed __int64 *)(v6 + 24), 0x7FFFFFFFFFFFFFFFui64);
if( v7 )
{
LOBYTE(v19) = 17;
MiUnlockProtoPoolPage(v7, v19);
}
return 3221226536i64;
}Referenced by:
MiResolveTransitionFault