RtlScrubMemory
NTSTATUS __stdcall RtlScrubMemory(PVOID VirtualAddress){
char *v2;
unsigned __int64 v3;
unsigned __int64 v4;
struct _KPRCB *CurrentPrcb;
__int64 v6;
char *i;
void *v8;
void *v9;
int v11[14];
v2 = (char *)VirtualAddress;
v3 = 1024i64;
v4 = __rdtsc() >> 4;
if( ((unsigned __int8)VirtualAddress & 4) != 0 )
{
*(_DWORD *)VirtualAddress = v4;
v2 = (char *)VirtualAddress + 4;
v3 = 1023i64;
}
memset64(v2, (unsigned int)v4 | ((unsigned __int64)(unsigned int)v4 << 32), v3 >> 1);
if( (v3 & 1) != 0 )
*(_DWORD *)&v2[4 * v3 - 4] = v4;
CurrentPrcb = KeGetCurrentPrcb();
v6 = *((unsigned int *)CurrentPrcb + 58);
if( *((_DWORD *)CurrentPrcb + 58) )
{
_InterlockedOr(v11, 0);
for( i = (char *)((unsigned __int64)VirtualAddress & ~(v6 - 1)); i < (char *)VirtualAddress + 4096; i += v6 )
_mm_clflush(i);
}
if( RtlCompareMemoryUlong(VirtualAddress, 0x1000ui64, v4) == 4096
&& RtlpGenericMATSPlusWorker(0i64, 0xFFFFFFFFui64, VirtualAddress)
&& RtlpGenericMATSPlusWorker(0xFFFFFFFFui64, 0i64, VirtualAddress)
&& RtlpGenericInverseCouplingWorker(0i64, 0xFFFFFFFFui64, VirtualAddress)
&& RtlpGenericInverseCouplingWorker(0xFFFFFFFFui64, 0i64, VirtualAddress)
&& RtlpGenericStrideWorker(0i64, 0xFFFFFFFFui64, v8)
&& RtlpGenericStrideWorker(0xFFFFFFFFui64, 0i64, v9)
&& RtlpGenericRandomPatternWorker(VirtualAddress) )
{
return 0;
}
else
{
return -1073740023;
}
}Referenced by:
MiScrubPage