MiCreateImageFileMap
NTSTATUS __stdcall MiCreateImageFileMap(
_FILE_OBJECT *File,
UINT64 PreferredNode,
_MI_CREATE_SECTION_FLAGS CreateSectionFlags,
_SEGMENT **Segment,
_MMPFN **ImageHeaderPage,
_MI_CAPTURED_OPTIONAL_HEADER *OptionalHeader,
UINT64 *OutImageBaseOffset){
INT64 v7;
_MI_CREATE_SECTION_FLAGS v8;
NTSTATUS result;
unsigned __int64 v12;
_CONTROL_AREA *v13;
PVOID *p_ControlArea;
_MDL *v15;
NTSTATUS ImageHeaders;
ULONG LowPart;
_LARGE_INTEGER v18;
_MDL *v19;
INT64 StartVa;
__int64 v21;
_LARGE_INTEGER v22;
int v23;
__int64 v24;
UINT64 v25;
unsigned int v26;
_DWORD *v27;
_MI_CAPTURED_OPTIONAL_HEADER *v28;
unsigned int LoaderFlags;
__int128 v30;
unsigned int v31;
__int64 v32;
unsigned __int64 v33;
__int64 v34;
const INT8 *v35;
unsigned int AddressOfEntryPoint;
_IMAGE_SECTION_HEADER *v37;
_FILE_OBJECT *v38;
NTSTATUS v39;
_MMPFN *v40;
char v41;
_MDL *v42;
unsigned int v43;
unsigned __int16 Characteristics;
__int64 v45;
char v46;
unsigned __int16 v47;
char v48;
UINT64 Long;
union {unsigned int LongFlags;_MMSECTION_FLAGS Flags;} v50;
char v51;
_MMPFN *v52;
_MDL *v53;
_MI_PARTITION *v54;
UINT64 v55;
_LARGE_INTEGER v56;
int v57;
unsigned __int64 v58;
PHYSICAL_EXTENTS_DESCRIPTOR *v59;
_MDL *v60;
_MDL *v61;
unsigned int v62;
__int64 v63;
_LARGE_INTEGER v64;
__int64 v65;
bool v66;
_DWORD *v67;
unsigned __int64 v68;
_MDL *v69;
PHYSICAL_EXTENTS_DESCRIPTOR *v70;
_MI_IMAGE_SECURITY_REFERENCE *SeImageStub;
int v72;
UINT64 v73;
unsigned int TotalNumberOfPtes;
PHYSICAL_EXTENTS_DESCRIPTOR *v75;
const _GUID *CreateSectionFlagsa;
_LARGE_INTEGER *EndOfFile;
char v78;
_SEGMENT *v79;
_MDL *MemoryDescriptorList;
_MDL *v83;
unsigned int v84;
_MI_CAPTURED_OPTIONAL_HEADER *v85;
_LARGE_INTEGER FileSize;
unsigned int *v87;
int v88;
_CONTROL_AREA *ControlArea;
INT64 BugCheckParameter3;
_LARGE_INTEGER Timeout[2];
UINT64 QuotaCharge;
_MDL *Mdl;
__int64 v94;
_IMAGE_FILE_HEADER CapturedFileHeader;
unsigned int *v96;
ULONG_PTR ImagePageFrameNumber[2];
__int128 v98;
_MMPFN **v99;
_MI_CAPTURED_OPTIONAL_HEADER *v100;
_DWORD *v101;
_DWORD *v102;
v7 = 0i64;
v99 = ImageHeaderPage;
v100 = OptionalHeader;
v8.EntireFlags = (unsigned int)Segment;
v85 = (_MI_CAPTURED_OPTIONAL_HEADER *)OutImageBaseOffset;
v101 = v102;
v88 = 0;
*(_OWORD *)&Timeout[0].anonymous_0.LowPart = 0i64;
FileSize.QuadPart = 0i64;
v98 = 0i64;
result = FsRtlGetFileSize(File, &FileSize);
if( result >= 0 )
{
if( FileSize.anonymous_0.HighPart )
{
dword_140C4C958 = 34;
return -1073741792;
}
Mdl = 0i64;
v12 = 1i64;
QuotaCharge = 0i64;
ControlArea = 0i64;
v79 = 0i64;
v13 = 0i64;
v87 = 0i64;
p_ControlArea = 0i64;
v15 = MiCreateMdl(PreferredNode);
MemoryDescriptorList = v15;
if( !v15 )
{
dword_140C4C958 = 35;
return -1073741670;
}
v15->Process = 0i64;
*(_QWORD *)ImagePageFrameNumber = v15[1].Next;
CcZeroEndOfLastPage(File);
ImageHeaders = MiFlushDataSection(File);
if( ImageHeaders == -1073741740 )
{
dword_140C4C958 = 36;
goto LABEL_82;
}
v78 = 0;
if( v88 == 1 )
v8.EntireFlags |= 0x100000u;
if( (v8.EntireFlags & 0x100080) != 0 )
{
v78 = 1;
if( PsIsCurrentThreadPrefetching() )
{
dword_140C4C958 = 37;
ImageHeaders = -1073740749;
goto LABEL_82;
}
}
LowPart = FileSize.anonymous_0.LowPart;
if( (v8.EntireFlags & 0x10000) != 0 )
{
v56 = FileSize;
if( (v8.EntireFlags & 0x40000) != 0 )
v56.QuadPart = 4096i64;
v57 = MiAllocateEntireImageFileExtents(File, (PHYSICAL_EXTENTS_DESCRIPTOR *)v56.QuadPart, 0i64, &v87);
v7 = (INT64)v87;
ImageHeaders = v57;
if( v57 < 0 )
{
dword_140C4C958 = 38;
goto LABEL_169;
}
LowPart = FileSize.anonymous_0.LowPart;
}
if( (v8.EntireFlags & 0x10000) != 0 )
goto LABEL_15;
if( MiCopyHeaderIfResident(File, ImagePageFrameNumber[0]) == 1 )
{
v18.QuadPart = 4096i64;
Timeout[1].QuadPart = 4096i64;
}
else
{
if( !v78
&& ((v8.EntireFlags & 0x20) != 0 || (v8._bf_0 & 0x400) != 0 && LowPart <= 0x20000)
&& !File->SectionObjectPointer->DataSectionObject )
{
v12 = ((unsigned __int64)LowPart + 4095) >> 12;
if( v12 > 1 )
{
Mdl = MiCreateMdl(PreferredNode);
v53 = Mdl;
if( Mdl )
{
MiDeleteImageCreationMdls(MemoryDescriptorList);
v53->Process = 0i64;
MemoryDescriptorList = v53;
}
else
{
v12 = 1i64;
}
}
}
v18 = Timeout[1];
if( !Timeout[1].QuadPart )
{
LABEL_15:
v19 = MemoryDescriptorList;
ImageHeaders = MiReadImageHeaders(File, v7, MemoryDescriptorList, Timeout);
if( ImageHeaders < 0 )
{
dword_140C4C958 = 40;
goto LABEL_169;
}
v18 = Timeout[1];
if( Timeout[1].QuadPart != v12 << 12 && Timeout[1].QuadPart < 0x40ui64 )
{
dword_140C4C958 = 41;
LABEL_80:
ImageHeaders = -1073741521;
LABEL_81:
p_ControlArea = 0i64;
LABEL_82:
v54 = (_MI_PARTITION *)PreferredNode;
LABEL_83:
MiDeleteImageCreationMdls(MemoryDescriptorList);
v55 = QuotaCharge;
if( QuotaCharge )
{
_InterlockedExchangeAdd64((volatile signed __int64 *)&v54->Vp.SharedCommit, -(__int64)QuotaCharge);
MiReturnCommit(v54, v55);
v13 = ControlArea;
v7 = (INT64)v87;
}
if( v13 )
{
MiUpdateSystemProtoPtesTree(&v13->u2.SeImageStub->ProtosNode.Node, 0i64);
ExFreePoolWithTag(p_ControlArea[8], 0);
ExFreePoolWithTag(p_ControlArea, 0);
ExFreePoolWithTag(v13, 0);
}
goto LABEL_62;
}
LABEL_17:
if( (v19->MdlFlags & 4) != 0 )
StartVa = (INT64)v19->StartVa;
else
StartVa = (INT64)v19->MappedSystemVa;
BugCheckParameter3 = StartVa;
if( *(_WORD *)StartVa != 23117 )
goto LABEL_80;
v21 = *(unsigned int *)(StartVa + 60);
v84 = v21;
if( (int)v21 + 264 <= (unsigned int)v21 )
{
ImageHeaders = -1073741520;
dword_140C4C958 = 42;
goto LABEL_81;
}
v22.QuadPart = v21 + 264;
v23 = v21;
if( (unsigned __int64)(v21 + 264) > FileSize.QuadPart )
{
ImageHeaders = -1073741520;
dword_140C4C958 = 43;
goto LABEL_81;
}
if( v22.QuadPart > v12 << 12 )
{
v54 = (_MI_PARTITION *)PreferredNode;
v58 = 0x2000i64;
v59 = (PHYSICAL_EXTENTS_DESCRIPTOR *)((FileSize.QuadPart - ((unsigned int)v21 & 0xFFFFF000) + 4095) & 0xFFFFFFFFFFFFF000ui64);
if( (unsigned __int64)v59 < 0x2000 )
v58 = (FileSize.QuadPart - ((unsigned int)v21 & 0xFFFFF000) + 4095) & 0xFFFFFFFFFFFFF000ui64;
v94 = v58;
v60 = MiCreateMdl(PreferredNode);
v83 = v60;
v61 = v60;
if( !v60 )
{
ImageHeaders = -1073741670;
dword_140C4C958 = 44;
p_ControlArea = 0i64;
goto LABEL_83;
}
v60->Next = MemoryDescriptorList;
v62 = v23 & 0xFFFFF000;
MemoryDescriptorList = v60;
v60->Process = (_EPROCESS *)((v23 & 0xFFFFF000) / 4096i64);
if( (v8.EntireFlags & 0x40000) != 0 )
{
v96 = 0i64;
ImageHeaders = MiAllocateEntireImageFileExtents(File, v59, (_DWORD *)v7, &v96);
if( ImageHeaders < 0 )
{
dword_140C4C958 = 128;
goto LABEL_169;
}
v7 = (INT64)v96;
v61 = v83;
v87 = v96;
}
ImageHeaders = MiReadImageHeaders(File, v7, v61, Timeout);
if( ImageHeaders < 0 )
{
dword_140C4C958 = 45;
goto LABEL_169;
}
v63 = v23 & 0xFFF;
if( Timeout[1].QuadPart != (unsigned int)v94 && Timeout[1].QuadPart < (unsigned __int64)(v63 + 264) )
{
ImageHeaders = -1073741520;
dword_140C4C958 = 46;
goto LABEL_81;
}
v25 = Timeout[1].QuadPart - v63;
v64.QuadPart = v62 + Timeout[1].QuadPart;
v94 = (__int64)v83->MappedSystemVa + v63;
v24 = v94;
Timeout[1] = v64;
StartVa = BugCheckParameter3;
}
else
{
if( v22.QuadPart > (unsigned __int64)v18.QuadPart )
{
ImageHeaders = -1073741520;
dword_140C4C958 = 47;
goto LABEL_81;
}
v24 = StartVa + (unsigned int)v21;
v25 = v18.QuadPart - (unsigned int)v21;
}
ImageHeaders = MiVerifyImageHeader((__int64)v85, v24, StartVa, v25);
if( ImageHeaders )
goto LABEL_169;
v26 = v84;
v27 = v101;
v28 = v85;
*v101 = v84 + 48;
if( v28->DllCharacteristics == 267 )
*v27 = v26 + 52;
LoaderFlags = v28->LoaderFlags;
if( !((LoaderFlags >> 12) + ((LoaderFlags & 0xFFF) != 0)) )
{
ImageHeaders = -1073741701;
dword_140C4C958 = 49;
goto LABEL_81;
}
v30 = *(_OWORD *)(v24 + 4);
*(_DWORD *)&CapturedFileHeader.SizeOfOptionalHeader = *(_DWORD *)(v24 + 20);
v31 = CapturedFileHeader.SizeOfOptionalHeader + 24;
*(_OWORD *)&CapturedFileHeader.Machine = v30;
if( v26 + v31 + 40 * WORD1(v30) <= v26 )
{
ImageHeaders = -1073741701;
dword_140C4C958 = 50;
goto LABEL_81;
}
v32 = v31 + v26;
v33 = (unsigned int)v32;
v34 = 40i64 * WORD1(v30);
v35 = (const INT8 *)(v34 + v32);
AddressOfEntryPoint = v34 + v32;
if( v28->AddressOfEntryPoint >= (unsigned __int64)(v34 + v32) )
AddressOfEntryPoint = v28->AddressOfEntryPoint;
v84 = AddressOfEntryPoint;
if( AddressOfEntryPoint > LoaderFlags )
{
ImageHeaders = -1073741701;
dword_140C4C958 = 48;
goto LABEL_81;
}
if( (unsigned __int64)v35 > Timeout[1].QuadPart )
{
v65 = ((unsigned int)v24 + v31) & 0xFFFi64;
v66 = v34 + v65 == 0;
v67 = (_DWORD *)(v34 + v65);
v101 = v67;
if( v66 || (v68 = ((unsigned __int64)v67 + 4095) & 0xFFFFFFFFFFFFF000ui64, (unsigned __int64)v67 > v68) )
{
ImageHeaders = -1073741701;
dword_140C4C958 = 51;
LABEL_169:
if( ImageHeaders >= 0 )
goto LABEL_62;
LABEL_170:
p_ControlArea = (PVOID *)&v79->ControlArea;
goto LABEL_82;
}
v83 = MiCreateMdl(PreferredNode);
v69 = v83;
if( !v83 )
{
ImageHeaders = -1073741670;
dword_140C4C958 = 52;
goto LABEL_81;
}
v83->Process = (_EPROCESS *)(v33 >> 12);
v69->Next = MemoryDescriptorList;
MemoryDescriptorList = v69;
if( (v8.EntireFlags & 0x40000) != 0 )
{
BugCheckParameter3 = 0i64;
v70 = (PHYSICAL_EXTENTS_DESCRIPTOR *)v68;
v38 = File;
ImageHeaders = MiAllocateEntireImageFileExtents(
File,
v70,
(_DWORD *)v7,
(unsigned int **)&BugCheckParameter3);
if( ImageHeaders < 0 )
{
dword_140C4C958 = 129;
goto LABEL_169;
}
v7 = BugCheckParameter3;
v69 = v83;
v87 = (unsigned int *)BugCheckParameter3;
}
else
{
v38 = File;
}
ImageHeaders = MiReadImageHeaders(v38, v7, v69, Timeout);
if( ImageHeaders < 0 )
{
dword_140C4C958 = 53;
goto LABEL_169;
}
if( Timeout[1].QuadPart < (unsigned __int64)v101 )
{
ImageHeaders = -1073741701;
dword_140C4C958 = 54;
goto LABEL_81;
}
v28 = v85;
v37 = (_IMAGE_SECTION_HEADER *)((char *)v83->MappedSystemVa + (v33 & 0xFFF));
}
else
{
v37 = (_IMAGE_SECTION_HEADER *)(v24 + v31);
v38 = File;
}
if( v28->SizeOfImage < 0x1000 )
{
if( (v8.EntireFlags & 0x80000) != 0 )
{
ImageHeaders = -1073741701;
MiLogCreateImageFileMapFailure(
v35,
v38,
v28->IATBytes,
CapturedFileHeader.TimeDateStamp,
CreateSectionFlagsa,
(const _GUID *)EndOfFile);
dword_140C4C958 = 55;
goto LABEL_81;
}
if( !MiLegacyImageArchitecture(CapturedFileHeader.Machine) )
{
ImageHeaders = -1073741701;
dword_140C4C958 = 56;
goto LABEL_81;
}
v8.EntireFlags |= 0x200000u;
}
v39 = MiBuildImageControlArea(
CreateSectionFlags.EntireFlags,
v37,
v28,
&CapturedFileHeader,
v8,
&FileSize,
&ControlArea);
v13 = ControlArea;
ImageHeaders = v39;
if( v39 < 0 )
goto LABEL_170;
ControlArea->Segment->u2.ImageInformation->InternalImageInformation.SizeOfHeaders = v84;
v13->u1.Flags._bf_0 ^= (v13->u1.Flags._bf_0 ^ *(_WORD *)PreferredNode) & 0x3FF;
if( (v8._bf_0 & 0x200) != 0 )
v13->Segment->u2.ImageInformation->ExportedImageInformation.ImageFlags |= 0x10u;
v40 = (_MMPFN *)v13->Segment;
v41 = 0;
v42 = MemoryDescriptorList;
v79 = v13->Segment;
if( !Mdl && !MemoryDescriptorList->Next && (v8.EntireFlags & 0x210000) == 0 )
{
v43 = v85->AddressOfEntryPoint;
if( v43 < 0x1000 )
{
if( (v43 & 0x1FF) != 0 )
++v40->OriginalPte.u.Long;
v41 = 1;
}
}
Characteristics = CapturedFileHeader.Characteristics;
if( !v78 )
{
if( (IoIsDeviceEjectable(File->DeviceObject), v48)
|| (Characteristics & 0x400) != 0 && ((unsigned __int8)*(_DWORD *)(v45 + 52) & (unsigned __int8)v46) != 0
|| (Characteristics & v47) != 0 && (*(_DWORD *)(v45 + 52) & 0x10) != 0 )
{
v78 = v46;
}
}
Long = v40->OriginalPte.u.Long;
QuotaCharge = Long;
if( Long )
{
v54 = (_MI_PARTITION *)PreferredNode;
if( !MiChargeCommit((_MI_PARTITION *)PreferredNode, Long, 0i64) )
{
p_ControlArea = (PVOID *)&v79->ControlArea;
QuotaCharge = 0i64;
ImageHeaders = -1073741523;
dword_140C4C958 = 57;
goto LABEL_83;
}
_InterlockedExchangeAdd64((volatile signed __int64 *)(PreferredNode + 7624), QuotaCharge);
v13 = ControlArea;
v7 = (INT64)v87;
}
v50.LongFlags = (unsigned int)v13->u;
if( (v50.LongFlags & 0x20000) != 0 && (v8.EntireFlags & 0x200000) == 0 && (v85->SizeOfHeaders & 0x1000000) == 0 )
v13->u.LongFlags = v50.LongFlags | 0x4000000;
if( Mdl )
MiInitializeImageProtos(v13, Mdl, v40);
if( v41 == 1 )
MiInitializeImageHeaderPage(*(UINT64 *)ImagePageFrameNumber, v85->AddressOfEntryPoint);
if( v85->DllCharacteristics == 267 )
v79->SegmentFlags.UChar1 |= 0x40u;
v51 = v78;
if( v78 )
{
v13->u.LongFlags |= 0x800u;
if( (v8.EntireFlags & 0x100080) != 0 )
v13->u.LongFlags |= 0x40000u;
v51 = v78;
}
if( (v8.EntireFlags & 0x10000) == 0 )
goto LABEL_60;
SeImageStub = v13->u2.SeImageStub;
if( !v51 && (MiFlags & 0x2000) == 0 && (v8.EntireFlags & 0x20000) == 0 )
v13->u.LongFlags |= 0x40000000u;
v72 = v8.EntireFlags & 0x40000;
if( v72 )
SeImageStub->u1.ImageFileExtentsUlongPtr |= 1ui64;
if( (v13->u.LongFlags & 0x40000000) != 0 )
{
v13->FilePointer.Value = (unsigned __int64)File;
ImageHeaders = MiInitializeImageExtents(v13);
ObFastReplaceObject(&v13->FilePointer, 0i64, v73);
if( ImageHeaders < 0 )
{
if( ImageHeaders != -1073741800 )
{
dword_140C4C958 = 58;
goto LABEL_169;
}
v13->u.LongFlags &= ~0x40000000u;
}
else
{
MiDeleteImageCreationMdls(MemoryDescriptorList);
v42 = 0i64;
MemoryDescriptorList = 0i64;
}
if( (v13->u.LongFlags & 0x40000000) != 0 )
{
LABEL_60:
v52 = (_MMPFN *)v79;
LABEL_61:
ImageHeaders = 0;
*v99 = v52;
*(_QWORD *)&v100->ImageBase = v42;
LABEL_62:
if( v7 )
MiDeleteImageExtentList((PVOID)v7);
return ImageHeaders;
}
}
v66 = v72 == 0;
v52 = (_MMPFN *)v79;
if( !v66 )
{
TotalNumberOfPtes = v79->TotalNumberOfPtes;
v83 = 0i64;
v75 = (PHYSICAL_EXTENTS_DESCRIPTOR *)(TotalNumberOfPtes << 12);
FileSize.QuadPart = (unsigned int)v75;
ImageHeaders = MiAllocateEntireImageFileExtents(File, v75, (_DWORD *)v7, (unsigned int **)&v83);
if( ImageHeaders < 0 )
{
dword_140C4C958 = 91;
goto LABEL_169;
}
v7 = (INT64)v83;
}
SeImageStub->u1.ImageFileExtentsUlongPtr |= v7;
v7 = 0i64;
goto LABEL_61;
}
}
v19 = MemoryDescriptorList;
goto LABEL_17;
}
dword_140C4C958 = 33;
if( result == -1073741638 )
return -1073741792;
return result;
}Referenced by:
No references.