MiProtectPrivateMemory
NTSTATUS __stdcall MiProtectPrivateMemory(
_MMVAD_SHORT *FoundVad,
VOID *StartingAddress,
VOID *EndingAddress,
UINT64 ProtectionMask,
UINT64 NewProtectWin32,
UINT64 *CapturedOldProtect,
UINT64 *AnyPageLocked){
unsigned __int64 v9;
_MMPTE *PteBase;
_MMSUPPORT_INSTANCE *v11;
UINT64 v12;
_MMPTE *v13;
union {unsigned int LongFlags;_MMVAD_FLAGS VadFlags;_MM_PRIVATE_VAD_FLAGS PrivateVadFlags;_MM_GRAPHICS_VAD_FLAGS GraphicsVadFlags;_MM_SHARED_VAD_FLAGS SharedVadFlags;volatile unsigned int VolatileVadLong;} v14;
unsigned int v15;
UINT64 v16;
__int64 v17;
__int64 v18;
__int64 v19;
UINT8 v20;
__int64 v21;
_MMPTE *v23;
UINT64 v24;
__int64 v25;
UINT8 v26;
char *v27;
__int64 v28;
INT64 v29;
INT64 v30;
NTSTATUS PageProtection;
UINT64 v32;
__int64 v33;
_MMVAD_SHORT *v34;
int v35;
int v36;
int v37;
UINT64 v38;
int v39;
UINT64 v40;
_UNICODE_STRING *v41;
UINT8 v42;
wchar_t *v43;
__int64 v44;
_UNICODE_STRING *v45;
int v46;
NTSTATUS ProtoPrivate;
_MMPFN *v48;
unsigned int updated;
PTE_CHANGE_TYPE v50;
VOID *v51;
UINT64 v52;
unsigned int v53;
__int64 v54;
UINT64 v55;
unsigned __int64 v56;
int v57;
UINT64 *ReducedCommitClonePages;
UINT64 *ReducedCommitClonePagesa;
CHAR ReducedCommitClonePagesb;
UINT64 *ReducedCommitClonePagesc;
UINT8 v62;
int v63;
unsigned int ProtectionMaska;
__int16 ProtectionMask_4;
UINT64 WsExclusive;
UINT64 v68;
__int64 v69;
UINT64 QuotaCharge;
__int64 v71;
UINT64 PreferredNode;
UINT8 WsIrql[8];
ULONG_PTR TargetProcess[2];
INT64 v75;
_MI_TB_FLUSH_LIST TbFlushList[2];
__int64 v77;
__int64 v78;
__int64 v79;
__int128 v80;
__int128 v81;
__int128 v82;
__int128 v83;
__int128 v84;
__int128 v85;
__int128 v86;
__int128 v87;
__int128 v88;
__int64 v89;
INT64 v90;
v75 = v90;
*(_QWORD *)TbFlushList = 1i64;
v89 = 0i64;
v80 = 0i64;
v77 = 20i64;
v81 = 0i64;
v78 = 0i64;
v82 = 0i64;
v79 = 0i64;
v83 = 0i64;
v84 = 0i64;
ProtectionMaska = ProtectionMask;
v85 = 0i64;
v9 = ((unsigned __int64)StartingAddress >> 9) & 0x7FFFFFFFF8i64;
v86 = 0i64;
*(_QWORD *)WsIrql = 0i64;
v87 = 0i64;
ProtectionMask_4 = 0;
v88 = 0i64;
LODWORD(WsExclusive) = 0;
QuotaCharge = 0i64;
PteBase = MmGetPteBase();
*(_QWORD *)TargetProcess = KeGetCurrentThread()->ApcState.Process;
v11 = (_MMSUPPORT_INSTANCE *)(*(_QWORD *)TargetProcess + 1664i64);
v12 = (UINT64)PteBase + v9;
v13 = PteBase;
v14.LongFlags = (unsigned int)FoundVad->u;
v15 = 3;
v16 = (UINT64)v13 + (((unsigned __int64)EndingAddress >> 9) & 0x7FFFFFFFF8i64);
v71 = 1i64;
v68 = v16;
if( (v14.LongFlags & 0x500000) == 5242880 )
{
v17 = (v14.LongFlags >> 18) & 3;
v18 = MiVadPageSizes[v17];
v15 = MiVadPageIndices[v17];
v19 = 16i64;
v69 = v18;
if( v18 != 16 )
v19 = 1i64;
v71 = v19;
}
else
{
v69 = 1i64;
}
v63 = 0;
PreferredNode = (v14.LongFlags >> 12) & 0x3F;
MiLockWorkingSetShared();
v62 = v20;
LODWORD(ReducedCommitClonePages) = 0;
LODWORD(v21) = MiComputePageCommitment(StartingAddress, EndingAddress, FoundVad, v20, ReducedCommitClonePages);
if( v21 != ((__int64)(v16 - v12) >> 3) + 1 )
{
MiUnlockWorkingSetShared(v11, v62);
return -1073741779;
}
v23 = MmGetPteBase();
v24 = v12;
if( v15 <= 1 )
{
v25 = 2 - v15;
do
{
v24 = (UINT64)v23 + ((v24 >> 9) & 0x7FFFFFFFF8i64);
v16 = (UINT64)v23 + ((v16 >> 9) & 0x7FFFFFFFF8i64);
--v25;
}
while( v25 );
v68 = v16;
}
v26 = v62;
LODWORD(ReducedCommitClonePagesa) = 0;
v27 = (char *)v23 + ((v24 >> 9) & 0x7FFFFFFFF8i64);
MiMakeSystemAddressValid((VOID *)v24, 0i64, (unsigned int)PreferredNode, v62, (UINT64)ReducedCommitClonePagesa);
LODWORD(v28) = MI_READ_PTE_LOCK_FREE(v24);
if( v28 )
{
while( 1 )
{
ReducedCommitClonePagesc = (UINT64 *)&ProtectionMask_4;
PageProtection = MiGetPageProtection(FoundVad, (PVOID)v24, (UINT8)WsIrql, (UINT64)&WsExclusive);
v32 = *(_QWORD *)WsIrql;
if( !*(_QWORD *)WsIrql )
break;
MiUnlockPageTableInternal((INT64)v11, (UINT64)v27);
MiUnlockWorkingSetShared(v11, v62);
MiFaultInPagedPool(v32);
MiLockWorkingSetShared();
LODWORD(ReducedCommitClonePagesc) = 0;
MiMakeSystemAddressValid((VOID *)v24, 0i64, (unsigned int)PreferredNode, v62, (UINT64)ReducedCommitClonePagesc);
LODWORD(v33) = MI_READ_PTE_LOCK_FREE(v24);
if( !v33 )
goto LABEL_15;
}
v34 = FoundVad;
v36 = MmProtectToValue[PageProtection];
v37 = 1;
v35 = WsExclusive;
v63 = 1;
}
else
{
LABEL_15:
v34 = FoundVad;
v35 = MI_GET_GRAPHICS_PROTECTION_FROM_VAD(
(INT64)FoundVad,
v29,
v30,
(UINT64 *)(unsigned int)MmProtectToValue[(FoundVad->u.LongFlags >> 7) & 0x1F],
ReducedCommitClonePagesb);
v37 = 0;
LODWORD(WsExclusive) = v35;
}
*(_DWORD *)AnyPageLocked = v35 | v36;
v38 = v68;
while( v24 <= v38 )
{
if( (v24 & 0xFFF) == 0 || v37 == 1 )
{
v63 = 0;
if( v27 )
{
MiFlushTbList(TbFlushList);
MiUnlockPageTableInternal((INT64)v11, (UINT64)v27);
}
LOBYTE(v39) = MiWorkingSetIsContended((INT64)v11);
if( v39 || (unsigned int)KeShouldYieldProcessor() )
{
MiUnlockWorkingSetShared(v11, v26);
MiLockWorkingSetShared();
}
v27 = (char *)MmGetPteBase() + ((v24 >> 9) & 0x7FFFFFFFF8i64);
LODWORD(ReducedCommitClonePagesc) = 0;
MiMakeSystemAddressValid(
(VOID *)v24,
TbFlushList,
(unsigned int)PreferredNode,
v26,
(UINT64)ReducedCommitClonePagesc);
}
v40 = *(_QWORD *)v24;
v68 = v40;
if( (v40 & 1) != 0 )
{
MiPteInShadowRange((UINT64)&v68);
v44 = (v40 >> 12) & 0xFFFFFFFFFi64;
v45 = (_UNICODE_STRING *)&MmGetPfnDb()[v44];
if( (FoundVad->u.LongFlags & 0x70) == 64 && MiRotatedToFrameBuffer((_MMPTE *)v24) == 1 )
{
v34 = FoundVad;
updated = ProtectionMaska;
}
else
{
LOBYTE(v46) = MI_PFN_IS_PROTO(v45, v41, v42, v43);
if( v46 )
{
MiFlushTbList(TbFlushList);
v26 = v62;
ProtoPrivate = MiMakeProtoPrivate((PFnIoInitializeTimer *)v11, v62, v24);
if( ProtoPrivate )
{
if( ProtoPrivate == 1 )
{
--QuotaCharge;
}
else
{
v27 = 0i64;
v63 = 1;
MiLockWorkingSetShared();
}
}
v34 = FoundVad;
goto LABEL_33;
}
if( (NewProtectWin32 & 0x101) != 0 )
{
v34 = FoundVad;
v26 = v62;
if( MiMakeVaRangeNoAccess(FoundVad, v24, v38, (INT64)TbFlushList, (INT64)ReducedCommitClonePagesc, v75) )
{
v12 += 8 * v69;
v24 += 8 * v71;
}
goto LABEL_33;
}
v48 = (_MMPFN *)v45;
v34 = FoundVad;
updated = MiUpdatePfnProtection(FoundVad, v48, ProtectionMaska);
ProtectionMaska = updated;
}
MiRevertValidPte(v34, (_MMPTE *)v24, updated, v44, TbFlushList);
v12 += 8 * v69;
v24 += 8 * v71;
}
else
{
if( (v40 & 0x400) != 0 )
{
MiFlushTbList(TbFlushList);
v26 = v62;
if( (int)MiMakeProtoLeafValid(v24, 1ui64, v62) < 0 )
{
v12 += 8i64;
v24 += 8i64;
}
v37 = 1;
v63 = 1;
continue;
}
if( (v40 & 0x800) == 0 )
{
if( v69 != 1 )
KeBugCheckEx(0x1Au, (PVOID)0x44000, (PVOID)v12, (PVOID)v40, 0i64);
if( v40 )
{
v52 = v40 >> 5;
}
else
{
LODWORD(v51) = MiGetUsedPtesHandle((PSLIST_ENTRY)((__int64)((v12 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16));
MiIncreaseUsedPtesCount(v51, (VOID *)1);
LODWORD(v52) = v34->u.LongFlags >> 7;
}
MiSanitizePfnProtection(v34, v52 & 0x1F, ProtectionMaska);
ProtectionMaska = v53;
v54 = 32i64 * (v53 & 0x1F);
if( v40 )
v55 = v54 | v40 & 0xFFFFFFFFFFFFFC1Fui64;
else
v55 = MiSwizzleInvalidPte(v54);
v68 = v55;
v56 = v55;
LOBYTE(v57) = MiPteInShadowRange(v12);
if( v57 )
{
if( (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) == 0 )
{
*(_QWORD *)v12 = v55;
LABEL_71:
v34 = FoundVad;
v12 += 8i64;
v26 = v62;
v24 += 8i64;
goto LABEL_33;
}
if( (v55 & 1) != 0 )
v56 = v55 | 0x8000000000000000ui64;
}
*(_QWORD *)v12 = v56;
goto LABEL_71;
}
v50 = MiSetProtectionOnTransitionPte(v34, (_MMPTE *)v24, ProtectionMaska, 1ui64);
if( v69 != 1 )
{
v12 += 8 * v69;
v26 = v62;
v24 += 8 * v71;
goto LABEL_33;
}
if( v50 == PteChanged )
{
v26 = v62;
v12 += 8i64;
v24 += 8i64;
goto LABEL_33;
}
}
v26 = v62;
LABEL_33:
v37 = v63;
}
MiFlushTbList(TbFlushList);
if( v27 )
MiUnlockPageTableInternal((INT64)v11, (UINT64)v27);
MiUnlockWorkingSetShared(v11, v26);
if( QuotaCharge )
MiReturnFullProcessCommitment(*(_EPROCESS **)TargetProcess, QuotaCharge);
return 0;
}Referenced by:
MmProtectVirtualMemory