MiDispatchFault
INT64 __fastcall MiDispatchFault(
UINT64 FaultStatus,
VOID *VirtualAddress,
_MMPTE *PointerProtoPte,
UINT64 RecheckAccess,
_MMSUPPORT_INSTANCE *Vm,
UINT64 VmIrql,
VOID *TrapInformation,
_MMVAD *Vad,
CHAR PreviousMode,
_MMINPAGE_SUPPORT **InPageSupport){
__m128i v10;
__int128 v12;
__int128 v13;
__m128i v14;
__int128 v15;
__int128 v16;
__int128 v17;
__int128 v18;
_MMSUPPORT_INSTANCE *v19;
unsigned __int64 v20;
unsigned int v21;
UINT64 v22;
UINT64 v23;
_MMSUPPORT_INSTANCE *v24;
UINT64 v25;
unsigned __int64 v26;
unsigned __int64 v27;
int v28;
unsigned __int64 v29;
__int16 v30;
bool v31;
INT64(*v32)(void);
int v33;
int v34;
char v35;
char MinimumWorkingSetSize;
_KGATE *ExitOutswapGate;
unsigned __int64 v39;
__int64 v40;
NTSTATUS v41;
int v42;
int v43;
unsigned __int64 v44;
unsigned __int64 v45;
INT64 v46;
INT64 v47;
int v48;
int v49;
UINT64 v50;
VOID *v51;
_MMPTE *PageLockHeld;
unsigned int a2[2];
CHAR v54[8];
_MMSUPPORT_INSTANCE ReadBlock;
*(_QWORD *)VirtualAddress = 0i64;
v10 = *(__m128i *)FaultStatus;
v12 = *(_OWORD *)(FaultStatus + 32);
v13 = *(_OWORD *)(FaultStatus + 80);
v14 = *(__m128i *)(FaultStatus + 48);
v15 = *(_OWORD *)(FaultStatus + 16);
ReadBlock.VmWorkingSetList = (_MMWSL_INSTANCE *)VirtualAddress;
*(_OWORD *)&ReadBlock.AgeDistribution[3] = v12;
v16 = *(_OWORD *)(FaultStatus + 64);
*(_QWORD *)&ReadBlock.NextPageColor = 0i64;
*(_OWORD *)&ReadBlock.MinimumWorkingSetSize = v13;
v17 = *(_OWORD *)(FaultStatus + 112);
*(_OWORD *)&ReadBlock.AgeDistribution[7] = v16;
v18 = *(_OWORD *)(FaultStatus + 96);
*(_OWORD *)&ReadBlock.WorkingSetPrivateSize = v17;
*(__m128i *)&ReadBlock.WorkingSetExpansionLinks.Blink = v10;
*(_OWORD *)&ReadBlock.WorkingSetLeafPrivateSize = v18;
*(_QWORD *)&v18 = *(_QWORD *)(FaultStatus + 128);
*(__m128i *)&ReadBlock.AgeDistribution[5] = v14;
ReadBlock.AgeDistribution[0] = _mm_srli_si128(v10, 8).m128i_u64[0];
v19 = (_MMSUPPORT_INSTANCE *)(ReadBlock.AgeDistribution[0] & 2);
ReadBlock.PeakWorkingSetSize = v18;
ReadBlock.TrimmedPageCount = _mm_srli_si128(v14, 8).m128i_u64[0];
v20 = (unsigned __int64)MmGetPteBase() + (((unsigned __int64)v10.m128i_i64[0] >> 9) & 0x7FFFFFFFF8i64);
*(_OWORD *)&ReadBlock.AgeDistribution[1] = v15;
v21 = 0;
if( (v15 & 1) == 0 || (*(_QWORD *)v54 = v15 & 0xFFFFFFFFFFFFFFFEui64, *(_BYTE *)(v15 & 0xFFFFFFFFFFFFFFFEui64) != 5) )
{
if( (v15 & 1) == 0
|| (*(_QWORD *)v54 = v15 & 0xFFFFFFFFFFFFFFFEui64, *(_BYTE *)(v15 & 0xFFFFFFFFFFFFFFFEui64) != 2)
&& ((v15 & 1) == 0
|| (*(_QWORD *)v54 = v15 & 0xFFFFFFFFFFFFFFFEui64, *(_BYTE *)(v15 & 0xFFFFFFFFFFFFFFFEui64) != 1)) )
{
*(_QWORD *)v54 = 0i64;
}
}
v22 = 0i64;
v23 = MiComputeMaximumFaultCluster((UINT64 *)&ReadBlock.WorkingSetExpansionLinks.Blink, 0i64);
v25 = v23;
if( v23 > 1 )
BYTE5(ReadBlock.AgeDistribution[7]) |= 4u;
BYTE5(ReadBlock.AgeDistribution[7]) &= ~2u;
if( !v23 )
goto LABEL_34;
v26 = ReadBlock.AgeDistribution[1];
while( 1 )
{
if( (ReadBlock.AgeDistribution[7] & 0x80000000000i64) != 0 )
{
if( (*(_BYTE *)(ReadBlock.TrimmedPageCount + 187) & 8) != 0
|| (*(_BYTE *)(ReadBlock.TrimmedPageCount + 184) & 0x40) != 0
&& (unsigned __int64)(*(_QWORD *)(ReadBlock.TrimmedPageCount + 120) + 1i64) >= *(_QWORD *)(ReadBlock.TrimmedPageCount
+ 152) )
{
goto LABEL_34;
}
if( MiWorkingSetIsContended(ReadBlock.TrimmedPageCount) )
goto LABEL_34;
if( (ReadBlock.AgeDistribution[7] & 0x10000000000i64) != 0 )
goto LABEL_34;
MiPageTableLockIsContended(
v46,
(UINT64)MmGetPteBase() + ((v20 >> 9) & 0x7FFFFFFFF8i64),
v46,
v47,
(INT64)v51,
(INT64)PageLockHeld,
a2[0]);
if( v48 || KeShouldYieldProcessor() )
goto LABEL_34;
v26 = ReadBlock.AgeDistribution[1];
}
v27 = *(_QWORD *)v20;
if( !*(_QWORD *)v20 || (v27 & 1) != 0 )
{
v28 = 0;
goto LABEL_26;
}
a2[0] = 256;
if( (v27 & 0x400) != 0 )
{
if( ReadBlock.WorkingSetLeafPrivateSize )
goto LABEL_13;
v39 = MiCheckProtoAccess(v20, a2);
v26 = ReadBlock.AgeDistribution[1];
if( !v39 )
{
v28 = -1073741819;
goto LABEL_26;
}
LODWORD(v40) = a2[0];
ReadBlock.WorkingSetLeafPrivateSize = v39;
}
else
{
if( (ReadBlock.AgeDistribution[7] & 0x80000000000i64) == 0 )
goto LABEL_13;
v40 = (v27 >> 5) & 0x1F;
}
if( (_DWORD)v40 == 256 )
goto LABEL_13;
if( (v40 & 0xFFFFFFF8) == 16 && (ReadBlock.AgeDistribution[7] & 0x80000000000i64) != 0 )
{
v28 = -1073741819;
goto LABEL_26;
}
v41 = MiAccessCheck(
(MMPTE *)v20,
(INT64)v19,
(ReadBlock.MinimumWorkingSetSize & 0x40) != 0,
(unsigned int)v40,
(PVOID)v26,
0);
v26 = ReadBlock.AgeDistribution[1];
v28 = v41;
if( !v41 )
{
LABEL_13:
if( (ReadBlock.AgeDistribution[1] & 1) != 0 && *(_BYTE *)(v26 & 0xFFFFFFFFFFFFFFFEui64) == 2 )
{
MiAdjustFaultList(&ReadBlock.WorkingSetExpansionLinks.Blink);
v26 = ReadBlock.AgeDistribution[1];
}
if( (v27 & 0x400) != 0 )
{
v42 = MiResolveProtoPteFault(
(UINT64)&ReadBlock.WorkingSetExpansionLinks.Blink,
v19,
(_MMPTE *)&ReadBlock,
v24,
(UINT8)v51,
PageLockHeld,
*(VOID **)a2,
v54[0],
*(_MMINPAGE_SUPPORT ***)&ReadBlock.NextPageColor);
v26 = ReadBlock.AgeDistribution[1];
v28 = v42;
goto LABEL_26;
}
if( (v27 & 0x800) != 0 )
{
v43 = MiResolveTransitionFault(
&ReadBlock.WorkingSetExpansionLinks.Blink,
(_MMPTE *)v20,
0i64,
v19,
&ReadBlock,
(UINT64)PageLockHeld,
*(INT64 *)a2,
v54[0],
*(_MMINPAGE_SUPPORT ***)&ReadBlock.NextPageColor);
v26 = ReadBlock.AgeDistribution[1];
v28 = v43;
goto LABEL_26;
}
if( (v27 & 4) != 0 )
{
if( (ReadBlock.AgeDistribution[7] & 0x80000000000i64) != 0 )
{
if( *(_QWORD *)v54 )
{
MiAdvanceFaultList(*(_QWORD **)v54);
v26 = ReadBlock.AgeDistribution[1];
}
v28 = -1073740748;
}
else
{
v49 = MiResolvePageFileFault(
&ReadBlock.WorkingSetExpansionLinks.Blink,
(_MMPTE *)v20,
0i64,
&ReadBlock,
v51,
(_MMINPAGE_SUPPORT **)PageLockHeld);
v26 = ReadBlock.AgeDistribution[1];
v28 = v49;
}
goto LABEL_26;
}
v28 = 0;
v29 = v26 & 1;
if( (v26 & 1) != 0
&& *(_BYTE *)(v26 & 0xFFFFFFFFFFFFFFFEui64) == 1
&& (*(_DWORD *)((v26 & 0xFFFFFFFFFFFFFFFEui64) + 80) & 0x4000) == 0 )
{
goto LABEL_26;
}
if( (v26 & 1) == 0 )
goto LABEL_19;
if( *(_BYTE *)(v26 & 0xFFFFFFFFFFFFFFFEui64) != 1 )
{
if( (v26 & 1) == 0 )
goto LABEL_19;
if( *(_BYTE *)(v26 & 0xFFFFFFFFFFFFFFFEui64) == 3 )
goto LABEL_89;
if( (v26 & 1) == 0 )
{
LABEL_19:
if( !v26 )
goto LABEL_25;
v30 = *(_WORD *)(v26 + 368);
v31 = 0;
if( v30 == 16 )
{
if( (*(_DWORD *)(v26 + 376) & 0x200) == 0
&& (KiRspInIstStack(3ui64, *(_QWORD *)(v26 + 384)) || KiRspInIstStack(2ui64, v50)) )
{
goto LABEL_25;
}
v32 = ExpInterlockedPopEntrySListFault;
v44 = *(_QWORD *)(v26 + 360);
v31 = KiDynamicTraceEnabled
&& v44 >= *(_QWORD *)ControlPc
&& v44 < qword_140CFBBE0
&& KeGetCurrentIrql() == 15;
}
else
{
if( v30 != 51 )
goto LABEL_25;
v32 = (INT64(*)(void))KeUserPopEntrySListFault;
}
if( *(INT64(**)(void))(v26 + 360) != v32 && !v31 )
goto LABEL_25;
goto LABEL_89;
}
if( *(_BYTE *)(v26 & 0xFFFFFFFFFFFFFFFEui64) != 6 )
{
if( (v26 & 1) != 0 )
goto LABEL_25;
goto LABEL_19;
}
}
LABEL_89:
if( v29 && *(_BYTE *)(v26 & 0xFFFFFFFFFFFFFFFEui64) == 6
|| ReadBlock.WorkingSetExpansionLinks.Blink < (_LIST_ENTRY *)0xFFFF800000000000i64
|| ((v27 >> 5) & 0x18) != 16 )
{
LABEL_25:
v33 = MiResolveDemandZeroFault(
&ReadBlock.WorkingSetExpansionLinks.Blink,
(_MMPTE *)v20,
0i64,
v19,
v51,
(unsigned __int64)PageLockHeld,
a2[0]);
v26 = ReadBlock.AgeDistribution[1];
v28 = v33;
goto LABEL_26;
}
v28 = -1073741819;
}
LABEL_26:
v34 = v28;
if( (ReadBlock.AgeDistribution[7] & 0x80000000000i64) != 0 )
v34 = v21;
if( v28 < 0 )
break;
ReadBlock.WorkingSetExpansionLinks.Blink += 256;
v35 = BYTE5(ReadBlock.AgeDistribution[7]) | 8;
v20 += 8i64;
BYTE5(ReadBlock.AgeDistribution[7]) = v35;
++v22;
ReadBlock.AgeDistribution[2] = v20;
if( (v35 & 2) != 0 )
{
v21 = v34;
BYTE5(ReadBlock.AgeDistribution[7]) = v35 & 0xFD;
if( v22 == v25 )
goto LABEL_34;
v25 = MiComputeMaximumFaultCluster((UINT64 *)&ReadBlock.WorkingSetExpansionLinks.Blink, v25 - v22);
if( v25 == 1 && (ReadBlock.AgeDistribution[7] & 0x40000000000i64) != 0 )
BYTE5(ReadBlock.AgeDistribution[7]) &= ~4u;
v26 = ReadBlock.AgeDistribution[1];
v22 = 0i64;
}
ReadBlock.WorkingSetLeafPrivateSize = 0i64;
if( (v26 & 1) == 0 || *(_BYTE *)(v26 & 0xFFFFFFFFFFFFFFFEui64) != 2 )
{
v19 = 0i64;
ReadBlock.AgeDistribution[0] &= ~2ui64;
}
if( (v26 & 1) != 0 )
{
v45 = v26 & 0xFFFFFFFFFFFFFFFEui64;
if( *(_BYTE *)(v26 & 0xFFFFFFFFFFFFFFFEui64) == 5 )
{
v26 &= ~1ui64;
ReadBlock.AgeDistribution[1] = v45;
}
}
v21 = v34;
if( v22 >= v25 )
goto LABEL_34;
}
v21 = v34;
if( v28 != -1073741802 )
{
LABEL_34:
MinimumWorkingSetSize = ReadBlock.MinimumWorkingSetSize;
goto LABEL_35;
}
MinimumWorkingSetSize = ReadBlock.MinimumWorkingSetSize;
if( (ReadBlock.MinimumWorkingSetSize & 0x100) != 0 )
*(_DWORD *)(FaultStatus + 80) |= 0x100u;
LABEL_35:
ExitOutswapGate = ReadBlock.ExitOutswapGate;
*(_OWORD *)(FaultStatus + 112) = *(_OWORD *)&ReadBlock.WorkingSetPrivateSize;
*(_QWORD *)(FaultStatus + 128) = ReadBlock.PeakWorkingSetSize;
*(_QWORD *)(FaultStatus + 104) = ReadBlock.WorkingSetSize;
*(_OWORD *)(FaultStatus + 56) = *(_OWORD *)&ReadBlock.AgeDistribution[6];
*(_QWORD *)(FaultStatus + 72) = ExitOutswapGate;
if( MinimumWorkingSetSize < 0 )
*(_DWORD *)(FaultStatus + 80) ^= ((unsigned __int8)MinimumWorkingSetSize ^ (unsigned __int8)*(_DWORD *)(FaultStatus + 80)) & 0x80;
if( v21 == -1073532109 )
ReadBlock.VmWorkingSetList->NextPteToTrim = *(_MMPTE **)&ReadBlock.NextPageColor;
return v21;
}Referenced by:
MiInPagePageTable
MmAccessFault