MmProtectVirtualMemory
INT64 __fastcall MmProtectVirtualMemory(
VOID *a1,
LARGE_INTEGER *a2,
INT64 *a3,
UINT64 *a4,
INT64 a5,
KENLISTMENT *Enlistment){
int v6;
INT64 v7;
UINT64 v8;
int v9;
int v10;
unsigned int v11;
int v12;
unsigned __int64 v13;
void *v14;
INT64 v15;
UINT64 v16;
UINT64 v17;
unsigned int v18;
int v19;
int v20;
int v21;
unsigned __int64 v22;
unsigned __int64 v23;
int v24;
_MMVAD *v25;
int v26;
unsigned int v28;
char v29;
LARGE_INTEGER v30;
unsigned __int64 v31;
unsigned __int64 v32;
unsigned __int64 v33;
__int16 v34;
INT64 VadPageSize;
int v36;
int v37;
UINT64 *CapturedOldProtect;
PVOID *ReturnedBaseAddress;
UINT64 *ReturnedRegionSize;
unsigned int ProtectionMask;
UINT v42;
INT64 v43;
UINT AnyPageLocked;
__int64 v45;
__int64 v46;
int v47;
int v48;
PVOID P;
unsigned __int64 v50;
int v51;
int v52;
__int64 v53;
__int64 v54;
INT64 v55;
unsigned __int64 v56;
unsigned __int64 v57;
unsigned __int64 v58;
INT64 v59[10];
LARGE_INTEGER *StartingAddress;
StartingAddress = a2;
v6 = 0;
LODWORD(v43) = 0;
v42 = 0;
Enlistment->cookie = 1;
AnyPageLocked = 0;
v48 = 1;
v7 = *a3;
v50 = v7;
v55 = v7;
v8 = *a4;
v53 = v8;
v56 = v8;
v9 = a5 & 0x7F800;
v51 = a5 & 0x7F800;
if( (a5 & 0x7F800) != 0 )
{
v26 = xHalUnmaskInterrupt(Enlistment, a2);
LODWORD(v43) = v26;
if( v26 < 0 )
return(unsigned int)v26;
}
HIDWORD(v43) = (unsigned int)a5 >> 31;
LODWORD(P) = (unsigned int)a5 >> 31;
v10 = a5 & 0xB0000000;
v52 = a5 & 0xB0000000;
v11 = a5 & 0x4FF807FF;
if( (a5 & 0x40000000) != 0 )
{
v11 = a5 & 0xFF807FF;
if( (a5 & 0xFF8070F) != 0 )
return 3221225714i64;
v48 = 0;
}
if( v11 )
{
v12 = MiMakeProtectionMask(v11);
ProtectionMask = v12;
v47 = v12;
if( v12 != -1 )
{
a2 = StartingAddress;
goto LABEL_6;
}
return 3221225541i64;
}
if( v10 != 0x80000000 && v10 != 0x10000000 )
return 3221225541i64;
v12 = 24;
ProtectionMask = 24;
v47 = 24;
LABEL_6:
v13 = (v8 + v7 - 1) | 0xFFF;
v58 = v13;
v14 = (void *)(v7 & 0xFFFFFFFFFFFFF000ui64);
v57 = v7 & 0xFFFFFFFFFFFFF000ui64;
v54 = 0i64;
v45 = 0i64;
v46 = 0i64;
if( (v12 & 0xFFFFFFF8) == 16 )
{
if( *((_BYTE *)KeGetCurrentThread() + 586) == 1
|| (v30 = a2[176], v30.QuadPart) && ((v34 = *(_WORD *)(v30.QuadPart + 8), v34 == 332) || v34 == 452) )
{
v31 = v46;
}
else
{
v54 = *((_QWORD *)KeGetCurrentThread() + 30);
v45 = v54;
v31 = *(_QWORD *)(v54 + 16) & 0xFFFFFFFFFFFFF000ui64;
v46 = v31;
}
v45 = v31;
}
P = 0i64;
v56 = v13 >> 12;
v15 = MiObtainReferencedVadEx((UINT64)v14, 0, &v43);
v16 = v15;
v55 = v15;
if( !v15 )
{
v26 = v43;
if( (_DWORD)v43 != -1073741664 )
goto LABEL_117;
goto LABEL_80;
}
P = (PVOID)v15;
if( v56 > (*(unsigned int *)(v15 + 28) | ((unsigned __int64)*(unsigned __int8 *)(v15 + 33) << 32)) )
{
v26 = -1073741800;
goto LABEL_117;
}
if( (*(_DWORD *)(v15 + 48) & 0x1100000) == 17825792 )
{
if( !v9 )
{
v26 = -1073741755;
goto LABEL_117;
}
}
else if( v9 )
{
v26 = -1073741755;
goto LABEL_117;
}
v17 = ProtectionMask;
if( (ProtectionMask & 2) == 0 )
{
LABEL_12:
v18 = *(_DWORD *)(v16 + 48);
v19 = v18 & 0x100000;
if( ((v18 & 0x100000) == 0 || (v18 & 0x400000) == 0 && (v18 & 0xC0000) < 0x80000) && (v18 & 0x70) != 80 )
goto LABEL_14;
if( (v18 & 0x500000) == 5242880 )
{
VadPageSize = MiGetVadPageSize(v16);
if( ((v50 | (v13 + 1)) & ((VadPageSize << 12) - 1)) != 0 )
{
v26 = -1073741800;
goto LABEL_117;
}
LABEL_14:
if( (v18 & 0x3100000) == 34603008 )
{
LODWORD(ReturnedRegionSize) = v17;
LODWORD(ReturnedBaseAddress) = v11;
v28 = MiProtectEnclavePages(
StartingAddress,
a1,
v16,
(UINT64)v14,
(UINT64 *)v13,
ReturnedBaseAddress,
ReturnedRegionSize);
MiUnlockAndDereferenceVad((PVOID)v16);
return v28;
}
if( (v10 & 0x5FFFFFFF) != 0 )
{
v26 = -1073741755;
goto LABEL_117;
}
if( !v11 )
{
v26 = -1073741755;
goto LABEL_117;
}
v20 = v18 & 0x70;
if( v20 == 48 )
{
v36 = MiProtectAweRegion(v14, (PVOID)v13, v17);
if( v36 >= 0 )
{
MiUnlockAndDereferenceVad((PVOID)v16);
*a4 = v13 - (_QWORD)v14 + 1;
*a3 = (INT64)v14;
Enlistment->cookie = v42;
return(unsigned int)v36;
}
v26 = -1073741800;
goto LABEL_117;
}
if( v20 == 16 )
{
v26 = -1073741800;
goto LABEL_117;
}
v21 = HIDWORD(v43);
if( HIDWORD(v43) == 1 && (v19 || (*(_DWORD *)(**(_QWORD **)(v16 + 72) + 56i64) & 0x20) != 0) )
goto LABEL_116;
if( (v18 & 8) == 0 || v6 )
{
v22 = v45;
}
else
{
v26 = MiCheckSecuredVad(v16, v50, v53, v17, *((_BYTE *)KeGetCurrentThread() + 562));
if( v26 < 0 )
goto LABEL_117;
v22 = v46;
v21 = HIDWORD(v43);
LODWORD(v17) = ProtectionMask;
}
v23 = *(unsigned int *)(v16 + 48);
if( (v23 & 0x100000) != 0 )
{
if( (v11 & 0x88) == 0 && v21 != 1 )
{
if( (v23 & 0x70) == 64 )
{
if( (v11 & 0xFFFFF9F9) != 0 )
{
v26 = -1073741755;
goto LABEL_117;
}
v11 &= 0x7FFFF9FFu;
v37 = *(_DWORD *)(v16 + 48) & 0xC00;
if( (*(_DWORD *)(v16 + 48) & 0x380) != 0 && v37 == 3072 )
{
v11 |= 0x400u;
}
else if( v37 == 1024 )
{
v11 |= 0x200u;
}
LODWORD(v17) = MiMakeProtectionMask(v11);
}
v26 = MiProtectPrivateMemory(
v16,
(unsigned __int64)v14,
v13,
v17,
v11,
(int)ReturnedBaseAddress,
(int *)&v42,
&AnyPageLocked);
if( v26 < 0 )
goto LABEL_117;
if( v22 )
{
if( v22 < v13 )
{
v32 = v22 >> 12;
if( v32 >= (*(unsigned int *)(v16 + 24) | ((unsigned __int64)*(unsigned __int8 *)(v16 + 32) << 32)) )
{
v33 = *(unsigned int *)(v16 + 28) | ((unsigned __int64)*(unsigned __int8 *)(v16 + 33) << 32);
if( v32 <= v33 && (v13 + 1) >> 12 <= v33 )
*(_QWORD *)(v54 + 16) = v13 + 1;
}
}
}
goto LABEL_34;
}
}
else if( (v11 & 0x600) == 0 )
{
if( (v23 & 0x70) == 32 )
{
if( (v11 & 4) != 0 )
v11 = v11 & 0xFFFFFFF3 | 8;
if( (v11 & 0x40) != 0 )
v11 = v11 & 0xFFFFFF3F | 0x80;
}
v24 = MmCompatibleProtectionMask[(v23 >> 7) & 7] | 0x700;
if( (v11 | v24) != v24 )
{
v26 = -1073741746;
goto LABEL_117;
}
if( (*(_DWORD *)(**(_QWORD **)(v16 + 72) + 56i64) & 0xA0) == 0x80 )
{
LABEL_33:
LODWORD(ReturnedBaseAddress) = v21;
LODWORD(CapturedOldProtect) = v11;
v26 = MiSetProtectionOnSection(
(_EPROCESS *)StartingAddress,
(_MMVAD *)v16,
v14,
(void *)v13,
(UINT64)CapturedOldProtect,
(UINT64)ReturnedBaseAddress,
&v42,
&AnyPageLocked);
if( v26 < 0 )
goto LABEL_117;
LABEL_34:
MiUnlockAndDereferenceVad((PVOID)v16);
*a4 = v13 - (_QWORD)v14 + 1;
*a3 = (INT64)v14;
Enlistment->cookie = v42;
if( AnyPageLocked == 1 )
return 1073741847i64;
return 0i64;
}
if( !MiVadMapsLargeImage(v16) )
{
if( !(unsigned int)MiIsRangeFullyCommitted(v25, v14, (PVOID)v13) )
{
v26 = -1073741779;
goto LABEL_117;
}
goto LABEL_33;
}
if( v11 != 128 && v11 != 8 )
{
v26 = -1073741746;
goto LABEL_117;
}
MiUnlockAndDereferenceVad(v25);
LABEL_93:
*a4 = v13 - (_QWORD)v14 + 1;
*a3 = (INT64)v14;
Enlistment->cookie = MmProtectToValue[ProtectionMask];
return 0i64;
}
LABEL_116:
v26 = -1073741582;
goto LABEL_117;
}
if( (_DWORD)v17 == ((v18 >> 7) & 0x1F) )
{
MiUnlockAndDereferenceVad((PVOID)v16);
goto LABEL_93;
}
LABEL_80:
v26 = -1073741800;
goto LABEL_117;
}
v26 = MiAllowProtectionChange(
(_EPROCESS *)StartingAddress,
(_EPROCESS *)a1,
(_MMVAD *)v15,
ProtectionMask,
v14,
(VOID *)v13);
if( v26 < 0 )
goto LABEL_117;
if( (*(_DWORD *)(v16 + 48) & 0x100) != 0 || !MiIsProcessCfgEnabled() || v48 != 1 )
goto LABEL_50;
if( (v29 & 8) != 0 )
{
v26 = MiCheckSecuredVad(v16, v50, v53, ProtectionMask, *((_BYTE *)KeGetCurrentThread() + 562));
if( v26 < 0 )
goto LABEL_117;
v6 = 1;
v45 = v46;
}
v59[0] = (INT64)v14;
v59[1] = v13;
v26 = MiCommitVadCfgBits(v16, (INT64)v59, 0i64);
if( v26 >= 0 )
{
LABEL_50:
v17 = ProtectionMask;
v10 = a5 & 0xB0000000;
goto LABEL_12;
}
LABEL_117:
if( P )
MiUnlockAndDereferenceVad(P);
return(unsigned int)v26;
}Referenced by:
KiTpWriteUmMemory
MiAllocateVirtualMemory
NtProtectVirtualMemory
PsDispatchIumService