RtlpHpVaMgrAlloc
NTSTATUS __stdcall RtlpHpVaMgrAlloc(ULONG_PTR BugCheckParameter2){
unsigned __int64 *v1;
unsigned __int64 v2;
UINT64 v3;
unsigned __int64 v4;
unsigned __int64 *v5;
UINT64 v6;
UINT64 v7;
char v8;
unsigned __int64 v9;
unsigned __int64 v10;
unsigned __int64 v11;
unsigned int v12;
UINT8 *v13;
__int64 v14;
UINT64 v15;
UINT64 v16;
_ETHREAD *v17;
unsigned __int8 v18;
int v19;
bool v20;
__int64 v21;
_KLOCK_ENTRY *v22;
__int64 v23;
_ETHREAD *CurrentThread;
unsigned int SessionId;
unsigned __int8 v26;
int v27;
__int64 v28;
_KLOCK_ENTRY *v29;
unsigned __int8 v30;
UINT64 v32;
int v33;
UINT64 v34;
char a3[12];
UINT8 *v36;
INT64 v37[2];
__int64 v38;
__int64 v39;
UINT64 v40;
int v41;
int v42;
v36 = 0i64;
v32 = 0i64;
v3 = v2;
v4 = *v1;
v5 = v1;
v40 = 0x10000000100000i64;
v6 = *(_QWORD *)&BugCheckParameter2;
v41 = 0x200000;
v42 = 0x40000000;
if( !v4 )
__int2c();
if( v4 <= (unsigned __int64)(*(unsigned __int16 *)(*(_QWORD *)&BugCheckParameter2 + 40i64) << 20) >> 1 )
{
v9 = v4 >> 20;
v10 = RtlpHpAcquireLockExclusive(
*(_EX_PUSH_LOCK **)&BugCheckParameter2,
*(_BYTE *)(*(_QWORD *)&BugCheckParameter2 + 46i64) & 1);
v11 = RtlpHpVaMgrRangeFind(v6, v9, v3 >> 20, &v36);
v12 = -1;
v13 = (UINT8 *)v11;
if( v11 )
{
RtlRbRemoveNode((UINT64 *)(v6 + 8), v11);
v14 = (__int64)v36;
if( v36 != v13 )
{
*(_OWORD *)v13 = 0i64;
*((_QWORD *)v13 + 2) = 0i64;
*v13 = 1;
v13[1] = *(_BYTE *)(v6 + 44);
RtlpHpVaMgrRangeSplit(v6, (INT64)v13, (v14 - (__int64)v13) >> 5);
RtlpHpVaMgrFree(v6, (UINT64)v13);
v13 = (UINT8 *)v14;
}
}
else
{
if( (*(_BYTE *)(v6 + 46) & 1) != 0 )
{
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)v6);
__writecr8(v10);
}
else
{
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v6, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((_EX_PUSH_LOCK *)v6);
LODWORD(v34) = 0;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
if( MiGetSystemRegionType(v6) == 1 )
SessionId = MmGetSessionIdEx(CurrentThread->Tcb.ApcState.Process);
else
SessionId = -1;
--CurrentThread->Tcb.SpecialApcDisable;
v26 = ++CurrentThread->Tcb.AbAllocationRegionCount;
v27 = ((char)CurrentThread->Tcb.AbEntrySummary | (char)CurrentThread->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
v20 = !_BitScanReverse((unsigned int *)&v28, v27);
v33 = v28;
if( v20 )
goto LABEL_52;
while( 1 )
{
v29 = &CurrentThread->Tcb.LockEntries[v28];
v27 &= ~(1 << v28);
if( (v29->AcquiredByte & 1) != 0
&& (v29->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v29->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == (v6 & 0x7FFFFFFFFFFFFFFCi64)
&& v29->LockState.SessionId == SessionId )
{
v29->AcquiredByte &= ~1u;
if( v29->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
break;
}
v20 = !_BitScanReverse((unsigned int *)&v28, v27);
v33 = v28;
if( v20 )
goto LABEL_52;
}
if( !v29 )
{
LABEL_52:
if( (*(&CurrentThread->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, CurrentThread, (PVOID)v6, (PVOID)SessionId, 0i64);
}
else
{
v29->CrossThreadReleasableAndBusyByte |= 2u;
if( v29->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v29);
LODWORD(v34) = v29->BoostBitmap.AllFields & 0x1FFFF;
v29->BoostBitmap.AllFields &= 0xFFFE0000;
v29->ThreadLocalFlags &= ~1u;
v29->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v30 = 1 << (v29 - CurrentThread->Tcb.LockEntries);
if( v26 == 1 )
CurrentThread->Tcb.AbEntrySummary |= v30;
else
_InterlockedOr8((volatile signed __int8 *)&CurrentThread->Tcb.AbOrphanedEntrySummary, v30);
}
--CurrentThread->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&CurrentThread->Tcb, (VOID *)v6, &v34);
v20 = CurrentThread->Tcb.SpecialApcDisable++ == -1;
if( v20
&& ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)CurrentThread->Tcb.ApcState.ApcListHead[0].Flink != &CurrentThread->Tcb.152 )
{
KiCheckForKernelApcDelivery();
}
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
}
v13 = RtlpHpVaMgrRegionAllocate(v6);
if( !v13 )
goto LABEL_9;
LOBYTE(v10) = RtlpHpAcquireLockExclusive((_EX_PUSH_LOCK *)v6, *(_BYTE *)(v6 + 46) & 1);
}
v15 = *(_QWORD *)(*(_QWORD *)(v6 + 24) + 8i64)
+ ((unsigned __int64)&v13[-*(_QWORD *)(*(_QWORD *)(v6 + 24) + 40i64)] >> *(_DWORD *)(*(_QWORD *)(v6 + 24) + 24i64) << 20);
*(_OWORD *)v13 = 0i64;
*((_QWORD *)v13 + 2) = 0i64;
*v13 = 1;
v13[1] = *(_BYTE *)(v6 + 44);
if( *((_WORD *)v13 + 12) > (unsigned __int16)v9 )
{
LODWORD(v16) = RtlpHpVaMgrRangeSplit(v6, (INT64)v13, (unsigned __int16)v9);
RtlpHpVaMgrFree(v6, v16);
}
v32 = v15;
if( (*(_BYTE *)(v6 + 46) & 1) != 0 )
{
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)v6);
__writecr8((unsigned __int8)v10);
}
else
{
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v6, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((_EX_PUSH_LOCK *)v6);
*(_DWORD *)a3 = 0;
v17 = (_ETHREAD *)KeGetCurrentThread();
if( MiGetSystemRegionType(v6) == 1 )
v12 = MmGetSessionIdEx(v17->Tcb.ApcState.Process);
--v17->Tcb.SpecialApcDisable;
v18 = ++v17->Tcb.AbAllocationRegionCount;
v19 = ((char)v17->Tcb.AbEntrySummary | (char)v17->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
while( 1 )
{
v20 = !_BitScanReverse((unsigned int *)&v21, v19);
HIDWORD(v34) = v21;
if( v20 )
break;
v22 = &v17->Tcb.LockEntries[v21];
v19 &= ~(1 << v21);
if( (v22->AcquiredByte & 1) != 0
&& (v22->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v22->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == (v6 & 0x7FFFFFFFFFFFFFFCi64)
&& v22->LockState.SessionId == v12 )
{
v22->AcquiredByte &= ~1u;
if( v22->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
{
if( v22 )
{
v22->CrossThreadReleasableAndBusyByte |= 2u;
if( v22->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v22);
*(_DWORD *)a3 = v22->BoostBitmap.AllFields & 0x1FFFF;
v22->BoostBitmap.AllFields &= 0xFFFE0000;
v22->ThreadLocalFlags &= ~1u;
v22->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v23 = v22 - v17->Tcb.LockEntries;
if( v18 == 1 )
v17->Tcb.AbEntrySummary |= 1 << v23;
else
_InterlockedOr8((volatile signed __int8 *)&v17->Tcb.AbOrphanedEntrySummary, 1 << v23);
goto LABEL_34;
}
break;
}
}
}
if( (*(&v17->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, v17, (PVOID)v6, (PVOID)v12, 0i64);
LABEL_34:
--v17->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v17->Tcb, (VOID *)v6, (UINT64 *)a3);
v20 = v17->Tcb.SpecialApcDisable++ == -1;
if( v20 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v17->Tcb.ApcState.ApcListHead[0].Flink != &v17->Tcb.152 )
KiCheckForKernelApcDelivery();
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
}
LABEL_9:
LODWORD(v7) = v32;
return v7;
}
if( v2 <= *((unsigned int *)&v40
+ (((unsigned __int64)*(unsigned __int8 *)(*(_QWORD *)&BugCheckParameter2 + 46i64) >> 1) & 3)) )
v3 = *((unsigned int *)&v40
+ (((unsigned __int64)*(unsigned __int8 *)(*(_QWORD *)&BugCheckParameter2 + 46i64) >> 1) & 3));
*(_QWORD *)&a3[4] = v4 - ((v3 - 1) & (v3 + v4 - 1)) + v3 - 1;
LODWORD(v7) = RtlpHpVaMgrAllocAligned(*(INT64 *)&BugCheckParameter2, (INT64 *)&a3[4], v3);
v32 = v7;
if( v7 )
{
v8 = *(_BYTE *)(v6 + 44);
*(_OWORD *)v37 = 0i64;
BYTE1(v37[0]) = v8;
v39 = *(_QWORD *)&a3[4] >> 20;
v38 = 0i64;
LOBYTE(v37[0]) = 5;
if( RtlpHpVaMgrRangeCreate(v6, v7, (INT64)v37) )
{
*v5 = *(_QWORD *)&a3[4];
goto LABEL_9;
}
RtlpHpEnvFreeVA(&v32, (UINT64 *)&a3[4], 0x8000i64);
LODWORD(v7) = 0;
}
return v7;
}Referenced by:
RtlpHpVaMgrCtxAlloc