MiInPagePageTable
VOID __stdcall MiInPagePageTable(INT64 FaultStatus, INT64 a2){
__int64 v2;
_MMPTE *v4;
__int64 v5;
__int64 v6;
ULONG_PTR v7;
__int64 v8;
unsigned __int64 PteBase;
unsigned __int64 v10;
unsigned __int64 v11;
__int64 v12;
_MMPTE *PteLimit;
INT64 v14;
__int64 v15;
__int64 v16;
unsigned __int64 v17;
unsigned int v18;
_MMVAD *v19;
_MMINPAGE_SUPPORT **v20;
_ETHREAD *v21;
_MMPFN *v22;
_MMPFN *v23;
__int64 v24;
__int128 v25;
__int128 v26;
__int128 v27;
__int128 v28;
unsigned int ClosestImplicitNode;
_MMPTE *v30;
UINT64 v31;
int v32;
_MMPTE *v33;
char v34;
UINT64 LeafVa;
UINT64 v36;
unsigned __int64 v37;
unsigned int LargeVadMappingIndex;
void *v39;
INT8 v40;
INT64 v41;
INT64 v42;
_MMPFN *UsedPtesHandle;
UINT64 v44;
__int64 v45;
int v46;
_MMSUPPORT_INSTANCE *BugCheckParameter4;
UINT64 v48;
VOID *TrapInformation;
_MMVAD *Vad;
UINT64 PreviousMode;
_MMINPAGE_SUPPORT **InPageSupport;
__int64 v53;
UINT64 VirtualAddress;
INT64 a1;
INT64 v56;
INT64 result[2];
UINT64 v58[2];
__int128 v59;
__m256i v60;
__int128 v61;
__int128 v62;
__int128 v63;
__int64 v64;
v2 = (int)a2;
v4 = 0i64;
HIDWORD(TrapInformation) = a2;
LODWORD(TrapInformation) = 0;
VirtualAddress = 0i64;
memset((INT64)result, 0i64);
v5 = *(_QWORD *)(FaultStatus + 16);
v6 = *((_QWORD *)KeGetCurrentThread() + 23);
v53 = v6;
v56 = v6 + 1664;
if( (v5 & 1) == 0
|| (InPageSupport = (_MMINPAGE_SUPPORT **)(v5 & 0xFFFFFFFFFFFFFFFEui64), *(_BYTE *)(v5 & 0xFFFFFFFFFFFFFFFEui64) != 1) )
{
InPageSupport = 0i64;
}
v7 = *(_QWORD *)(FaultStatus + 8 * v2 + 24);
a1 = FaultStatus + 56;
v8 = *(_QWORD *)v7;
PteBase = (unsigned __int64)MmGetPteBase();
v10 = *(_QWORD *)FaultStatus;
v11 = v10;
Vad = *(_MMVAD **)FaultStatus;
v12 = (__int64)((v7 << 25) - (PteBase << 25)) >> 16;
PteLimit = MmGetPteLimit();
if( v10 >= PteBase )
{
do
{
if( v11 > (unsigned __int64)PteLimit )
break;
v11 = (__int64)((v11 << 25) - (PteBase << 25)) >> 16;
}
while( v11 >= PteBase );
Vad = (_MMVAD *)v11;
}
v14 = 0i64;
if( v10 > 0x7FFFFFFEFFFFi64 )
{
if( v10 >= PteBase && v10 <= (unsigned __int64)PteLimit )
{
v18 = 4;
goto LABEL_18;
}
LABEL_17:
v18 = 24;
LABEL_18:
LODWORD(TrapInformation) = v18;
goto LABEL_19;
}
if( (*(_DWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 2172i64) & 1) == 0 )
{
v15 = v10 & 0x7FFFFFFFF000i64;
if( (v10 & 0xFFFFFFFFFFFFF000ui64) == 2147352576 )
{
v4 = (_MMPTE *)ProtoPte;
v18 = 1;
goto LABEL_18;
}
if( v15 == qword_140C4DB88 && v15 )
{
v4 = (_MMPTE *)qword_140C4DB80;
v18 = 1;
goto LABEL_18;
}
}
v16 = *((_QWORD *)KeGetCurrentThread() + 23);
v14 = *(_QWORD *)(v16 + 2016);
if( !v14 )
{
LABEL_16:
v14 = 0i64;
v6 = v53;
goto LABEL_17;
}
v17 = v10 >> 12;
if( v10 >> 12 < (*(unsigned int *)(v14 + 24) | ((unsigned __int64)*(unsigned __int8 *)(v14 + 32) << 32))
|| v17 > (*(unsigned int *)(v14 + 28) | ((unsigned __int64)*(unsigned __int8 *)(v14 + 33) << 32)) )
{
v14 = *(_QWORD *)(v16 + 2008);
if( v14 )
{
while( 1 )
{
if( v17 > (*(unsigned int *)(v14 + 28) | ((unsigned __int64)*(unsigned __int8 *)(v14 + 33) << 32)) )
{
v14 = *(_QWORD *)(v14 + 8);
}
else
{
if( v17 >= (*(unsigned int *)(v14 + 24) | ((unsigned __int64)*(unsigned __int8 *)(v14 + 32) << 32)) )
{
*(_QWORD *)(v16 + 2016) = v14;
goto LABEL_46;
}
v14 = *(_QWORD *)v14;
}
if( !v14 )
goto LABEL_16;
}
}
goto LABEL_16;
}
LABEL_46:
v33 = MiCheckUserVirtualAddress((VOID *)v10, (UINT64 *)&TrapInformation, (_MMVAD *)v14, v10);
v6 = v53;
v4 = v33;
v11 = (unsigned __int64)Vad;
v18 = (unsigned int)TrapInformation;
LABEL_19:
if( !v8 )
{
v19 = *(_MMVAD **)FaultStatus;
v20 = InPageSupport;
if( *(_QWORD *)FaultStatus >= 0xFFFF800000000000ui64 )
{
if( InPageSupport )
return;
if( v19 >= (_MMVAD *)MmGetPteBase()
&& v19 <= (_MMVAD *)MmGetPteLimit()
&& *(_MMINPAGE_SUPPORT ***)(FaultStatus + 16) != InPageSupport )
{
KeBugCheckEx(0x50u, *(_QWORD *)FaultStatus, *(_QWORD *)(FaultStatus + 8), v7, 6ui64);
}
}
if( v18 == 24 )
{
if( (unsigned __int64)v19 - 0x10000 <= 0x7FFFFFFDFFFFi64 && !v14 && (*(_BYTE *)(FaultStatus + 8) & 2) != 0 )
{
if( (*(_DWORD *)(v6 + 2172) & 0x1000) != 0 )
KeBugCheckEx(0x1Au, 0x4477ui64, (ULONG_PTR)v19, 0i64, 0i64);
if( (unsigned int)MiIsStoreProcess(v6) )
KeBugCheckEx(0x1Au, 0x4478ui64, (ULONG_PTR)v19, 0i64, 0i64);
}
if( (unsigned __int64)v19 <= 0x7FFFFFFEFFFFi64 && v14 && v20 )
{
LeafVa = MiGetLeafVa(v7 + 8);
if( LeafVa >= v36 )
{
MiLeapPrefetch(v20, LeafVa);
}
else
{
v20[3] = (_MMINPAGE_SUPPORT *)((char *)v20[3] + 1);
v20[4] = 0i64;
}
*((_BYTE *)v20 + 1) = 1;
}
return;
}
if( v14 && (*(_DWORD *)(v14 + 48) & 0x100000) != 0 && InPageSupport )
{
if( ((v37 = *(_QWORD *)(FaultStatus + 16) & 0xFFFFFFFFFFFFFFFEui64, v18 >> 3 != 3) || (v18 & 7) == 0)
&& v18 >> 3 != 1
|| (*(_DWORD *)(v37 + 80) & 0x4000) == 0 )
{
MiAdvanceFaultList((_QWORD *)v37);
return;
}
}
v21 = *(_ETHREAD **)(v6 + 1248);
if( v21 )
{
if( InPageSupport && InPageSupport[7] != (_MMINPAGE_SUPPORT *)(InPageSupport + 7) )
return;
if( v21 != (_ETHREAD *)KeGetCurrentThread() )
{
*(_DWORD *)(FaultStatus + 80) |= 4u;
return;
}
v18 = (unsigned int)TrapInformation;
}
if( InPageSupport != 0i64 && v14 != 0 && (unsigned int)MiIsVadLarge(v14) )
{
MiLeapPrefetch(
v20,
(((*(unsigned int *)(v14 + 28) | ((unsigned __int64)*(unsigned __int8 *)(v14 + 33) << 32)) << 12) | 0xFFF)
+ 4096);
*((_BYTE *)v20 + 1) = 1;
return;
}
if( v14 && (*(_BYTE *)(v14 + 48) & 0x70) == 80 && !(unsigned int)MiVadPureReserve(v14) )
{
LargeVadMappingIndex = MiGetLargeVadMappingIndex(v14, *(_QWORD *)FaultStatus);
if( HIDWORD(TrapInformation) == LargeVadMappingIndex )
{
LODWORD(BugCheckParameter4) = v18;
if( (unsigned int)MiInsertLargeVadMapping(
*(_QWORD *)FaultStatus,
(UINT64)v4,
LargeVadMappingIndex,
(UINT64 *)v7,
(INT64)BugCheckParameter4) )
{
if( (v7 < (unsigned __int64)MmGetPml4eBase() || v7 > (unsigned __int64)MmGetPml4eLimit())
&& (unsigned __int64)Vad <= 0x7FFFFFFEFFFFi64 )
{
UsedPtesHandle = MiGetUsedPtesHandle(v12);
MiIncreaseUsedPtesCount(UsedPtesHandle, 1ui64);
}
MiLargePageFault(FaultStatus, (PVOID)v7, v39, v40);
}
else
{
v41 = a1;
MiReleaseFaultState(a1, 0x11u, 0i64);
MmAccessFault(0i64, v4, 0, 0i64);
v42 = v56;
*(_BYTE *)(v41 + 13) &= ~1u;
*(_BYTE *)(v41 + 12) = MiLockWorkingSetShared(v42);
}
return;
}
v11 = (unsigned __int64)Vad;
}
if( (v7 < (unsigned __int64)MmGetPml4eBase() || v7 > (unsigned __int64)MmGetPml4eLimit())
&& v11 <= 0x7FFFFFFEFFFFi64 )
{
v22 = MiGetUsedPtesHandle(v12);
LODWORD(PreviousMode) = 0;
v23 = v22;
while( _interlockedbittestandset64((volatile signed __int32 *)v23 + 6, 0x3Fui64) )
{
do
KeYieldProcessorEx(&PreviousMode);
while( *((__int64 *)v23 + 3) < 0 );
}
*((_QWORD *)v23 + 2) ^= ((unsigned int)*((_QWORD *)v23 + 2) ^ ((unsigned int)*((_QWORD *)v23 + 2) + 0x10000)) & 0x3FF0000;
_InterlockedAnd64((volatile signed __int64 *)v23 + 3, 0x7FFFFFFFFFFFFFFFui64);
MmIsAddressValidEx(*((_QWORD *)v23 + 1) | 0x8000000000000000ui64);
}
*(_QWORD *)v7 = MiSwizzleInvalidPte(128i64);
}
v24 = *(_QWORD *)(FaultStatus + 16);
v25 = *(_OWORD *)(FaultStatus + 16);
*(_OWORD *)result = *(_OWORD *)FaultStatus;
*(_OWORD *)v58 = v25;
v26 = *(_OWORD *)(FaultStatus + 48);
v59 = *(_OWORD *)(FaultStatus + 32);
*(_OWORD *)v60.m256i_i8 = v26;
v27 = *(_OWORD *)(FaultStatus + 80);
*(_OWORD *)&v60.m256i_u64[2] = *(_OWORD *)(FaultStatus + 64);
v61 = v27;
LODWORD(v61) = 0;
v28 = *(_OWORD *)(FaultStatus + 112);
v62 = *(_OWORD *)(FaultStatus + 96);
v64 = *(_QWORD *)(FaultStatus + 128);
v63 = v28;
if( (v24 & 1) != 0 )
{
v34 = *(_BYTE *)(v24 & 0xFFFFFFFFFFFFFFFEui64);
if( (unsigned __int8)(v34 - 1) <= 2u || v34 == 5 )
v58[0] = 0i64;
}
ClosestImplicitNode = MiGetClosestImplicitNode(*(_QWORD *)(FaultStatus + 8) >> 57);
result[0] = v12;
result[1] = ((unsigned __int64)ClosestImplicitNode << 57) | 2;
*((_QWORD *)&v61 + 1) = v14;
MiFillPteHierarchy(v12, &v58[1]);
v32 = MiDispatchFault(
(UINT64)result,
&VirtualAddress,
v30,
v31,
BugCheckParameter4,
v48,
TrapInformation,
Vad,
PreviousMode,
InPageSupport);
if( v32 == -1073532109 )
{
v44 = VirtualAddress;
if( (v61 & 0x40) != 0 )
*(_DWORD *)(VirtualAddress + 192) |= 0x40000u;
v32 = MiIssueHardFault((INT64)result, v44);
}
if( (v60.m256i_i8[21] & 1) != 0 )
{
v45 = v60.m256i_i64[3];
*(_OWORD *)(FaultStatus + 56) = *(_OWORD *)&v60.m256i_u64[1];
*(_QWORD *)(FaultStatus + 72) = v45;
}
if( v32 >= 0 && (*(_BYTE *)(FaultStatus + 69) & 1) != 0 )
{
v46 = 3;
do
{
if( (**(_QWORD **)(FaultStatus + 8i64 * SHIDWORD(TrapInformation) + 24) & 1i64) == 0 )
break;
if( v46 == HIDWORD(TrapInformation) )
break;
--v46;
}
while( v46 );
}
}Referenced by:
MiUserFault