MiActOnPte
NTSTATUS __stdcall MiActOnPte(
_MMVAD *Vad,
_MMPTE *PointerPte,
_MMPTE *ProtoPte,
_MI_PTE_WALK_TYPE OperationType,
UINT64 OperationArgument,
_MI_PARTITION **Partition,
_MMPTE *OriginalPte){
unsigned int v7;
_MMPTE *v8;
_MMPTE *v9;
_EPROCESS *Process;
_MMPTE *v11;
INT64 v12;
UINT64 v13;
INT64 v14;
_MMPFN *v15;
INT64 v16;
_MMPFN *v17;
_MMPFN *v18;
bool v19;
INT64 v20;
unsigned __int64 v21;
UINT8 updated;
_MMSUPPORT_INSTANCE *v24;
__int64 Blink;
char v26;
char v27;
int v28;
_MMPTE v29;
__int64 v30;
unsigned __int64 v31;
int v32;
__int64 v33;
INT64 v34;
char v35;
int v36;
int v37;
char v38;
UINT8 v39;
_MMPFN *v40;
int v41;
UINT64 v42;
_MMPTE v43;
__int64 v44;
unsigned __int64 v45;
unsigned __int64 v46;
int v47;
char v48;
_MMPTE v49;
__int64 v50;
unsigned __int64 v51;
unsigned __int64 v52;
int v53;
int v54;
__int64 v55;
char v56;
INT64 v57;
unsigned __int64 v58;
int v59;
_MI_PARTITION *v60;
_MI_PARTITION *v61;
_SUBSECTION *Subsection;
int v63;
int v64;
INT64 v65;
int v66;
_MMPTE v67;
INT64 v68;
int v69;
UINT64 SpinCount;
INT64 v71;
_MMPTE *v72;
_MMSUPPORT_INSTANCE *Vm;
int v75;
UINT64 ProtectCode;
union {unsigned __int64 Long;volatile unsigned __int64 VolatileLong;_MMPTE_HARDWARE Hard;_MMPTE_PROTOTYPE Proto;_MMPTE_SOFTWARE Soft;_MMPTE_TIMESTAMP TimeStamp;_MMPTE_TRANSITION Trans;_MMPTE_SUBSECTION Subsect;_MMPTE_LIST List;} *v77;
v75 = (int)PointerPte;
v7 = 0;
LODWORD(ProtectCode) = 0;
v8 = *(_MMPTE **)&OperationType;
v9 = ProtoPte;
v77->Long = 0i64;
OriginalPte->u.Long = 0i64;
Process = KeGetCurrentThread()->ApcState.Process;
Vm = &Process->Vm.Instance;
v11 = *(_MMPTE **)&OperationType;
if( !*(_QWORD *)&OperationType )
v11 = ProtoPte;
v72 = v11;
while( 1 )
{
while( 1 )
{
LODWORD(v12) = MI_READ_PTE_LOCK_FREE((INT64)v11);
v71 = v12;
v14 = v12;
if( (v12 & 1) == 0 )
break;
if( !v8 )
{
LODWORD(v21) = MI_READ_PTE_LOCK_FREE((INT64)&v71);
if( (((unsigned __int64)MmGetPfnDb()[(v21 >> 12) & 0xFFFFFFFFFi64].u4._bf_0 >> 50) & 1) != 0 )
{
v15 = &MmGetPfnDb()[(v21 >> 12) & 0xFFFFFFFFFi64];
if( (v15->u4._bf_0 & 0x1000000000i64) != 0 || (__int64)v15->ListEntry.Blink <= 0 )
{
if( MiLocateCloneAddress(Process, (VOID *)(v15->PteLong | 0x8000000000000000ui64)) )
return -1073740748;
}
else
{
if( (_DWORD)OperationArgument == 1 )
return -1073740748;
if( !(_DWORD)OperationArgument )
return 274;
}
LODWORD(SpinCount) = 0;
while( _interlockedbittestandset64((volatile signed __int32 *)&v15->u2, 0x3Fui64) )
{
do
KeYieldProcessorEx(&SpinCount);
while( v15->u2._bf_0 < 0 );
}
if( (Vad->Core.u.LongFlags & 0x70) != 64 || !MiRotatedToFrameBuffer(v9) )
{
LOBYTE(v16) = v71;
LABEL_33:
if( (_DWORD)OperationArgument == 2 )
{
LOBYTE(v7) = v8 == 0i64;
updated = MiUpdatePfnPriority(v15, (unsigned int)Partition, v7);
_InterlockedAnd64(&v15->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
v24 = Vm;
if( updated != 0xFF && !v8 )
MiUpdateWsleAge(Vm, v9, updated);
if( (v15->u4._bf_0 & 0x1000000000i64) == 0 )
{
Blink = (__int64)v15->ListEntry.Blink;
if( Blink > 0 && !v8 )
MiDemoteCombinedPte(v24, v9, (_MMPTE *)(Blink | 0x8000000000000000ui64));
}
return 0;
}
v26 = *((_BYTE *)&v15->u3 + 2);
if( (v26 & 8) == 0 )
{
v27 = v26 & 0x10;
if( (_DWORD)OperationArgument == 1 )
{
if( v27 || !v8 && (v16 & 0x42) != 0 )
v7 = -1073740748;
if( !v27 && (*(_DWORD *)(&v15->3 + 1) & 4) == 0 )
*((_BYTE *)&v15->u3 + 2) = v26 | 0x10;
MI_IS_RESET_PTE();
if( v28 )
{
MI_CLEAR_RESET_PTE(&v15->OriginalPte);
_InterlockedAnd64(&v15->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
return v7;
}
else
{
_InterlockedAnd64(&v15->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
return -1073740748;
}
}
else
{
if( v27 )
*((_BYTE *)&v15->u3 + 2) = v26 & 0xEF;
v29.u.Long = MiCapturePageFileInfoInline(&v15->OriginalPte, 1ui64, 1ui64).u.Long;
v77->Long = v29.u.Long;
if( v29.u.Long )
OriginalPte->u.Long = *(unsigned __int64 *)(*(&stru_140C4DB30 + 267)
+ 8 * (((unsigned __int64)v15->u4._bf_0 >> 39) & 0x3FF));
LODWORD(v30) = MiUpdatePageFileHighInPte(
v15->OriginalPte.u.Hard.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0,
1i64);
v31 = v30 & 0xFFFFFFFFFFFFFFFDui64;
LOBYTE(v32) = MiPteInShadowRange((UINT64)&v15->OriginalPte.u.Long);
if( v32 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (v31 & 1) != 0 )
v31 |= 0x8000000000000000ui64;
v15->OriginalPte.u.Long = v31;
_InterlockedAnd64(&v15->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
if( v8 || (v71 & 0x42) == 0 )
return 0;
MiWriteValidPteNewProtection((INT64 *)v9, v71 & 0xFFFFFFFFFFFFFF9Dui64);
v33 = (__int64)(((_QWORD)v9 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16;
if( (unsigned __int8)MiGetVaAge(v34, v33) < 7u )
MiSetVaAgeList(Vm, v33, 1ui64, 1u);
return -1073741791;
}
}
}
_InterlockedAnd64(&v15->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
}
return -1073740748;
}
v15 = MiLockLeafPage(v8, 0i64);
v11 = v72;
if( v15 )
{
LODWORD(v16) = MI_READ_PTE_LOCK_FREE((INT64)v8);
v71 = v16;
if( (v16 & 1) != 0 )
goto LABEL_33;
_InterlockedAnd64(&v15->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
v11 = v72;
}
}
if( (v12 & 0x400) != 0 )
return 0;
if( (v12 & 0x800) == 0 )
break;
if( v8 )
v17 = MiLockLeafPage(v8, 0i64);
else
v17 = MiLockTransitionLeafPage((ULONG_PTR)v9, 0i64);
v18 = v17;
v19 = v17 == 0i64;
v11 = v72;
if( !v19 )
{
if( !v8 || (LODWORD(v20) = MI_READ_PTE_LOCK_FREE((INT64)v8), v71 = v20, (v20 & 1) == 0) )
{
if( (_DWORD)OperationArgument == 2 )
{
MiUpdatePfnPriority(v18, (unsigned int)Partition, 1ui64);
_InterlockedAnd64(&v18->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
return 0;
}
v35 = *((_BYTE *)&v18->u3 + 2);
if( (v35 & 7) == 2 )
{
if( (_DWORD)OperationArgument != 1 )
{
if( (v35 & 0x28) == 0 )
{
v43.u.Long = MiCapturePageFileInfoInline(&v18->OriginalPte, 1ui64, 1ui64).u.Long;
v77->Long = v43.u.Long;
if( v43.u.Long )
OriginalPte->u.Long = *(unsigned __int64 *)(*(&stru_140C4DB30 + 267)
+ 8 * (((unsigned __int64)v18->u4._bf_0 >> 39) & 0x3FF));
LODWORD(v44) = MiUpdatePageFileHighInPte(
v18->OriginalPte.u.Hard.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0,
1i64);
v45 = v44 & 0xFFFFFFFFFFFFFFFDui64;
v71 = v44 & 0xFFFFFFFFFFFFFFFDui64;
v46 = v44 & 0xFFFFFFFFFFFFFFFDui64;
LOBYTE(v47) = MiPteInShadowRange((UINT64)&v18->OriginalPte.u.Long);
if( v47 )
{
if( (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) == 0 )
{
v18->OriginalPte.u.Long = v45;
goto LABEL_109;
}
if( (v45 & 1) != 0 )
v46 |= 0x8000000000000000ui64;
}
v18->OriginalPte.u.Long = v46;
}
LABEL_109:
_InterlockedAnd64(&v18->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
return v7;
}
MI_IS_RESET_PTE();
v37 = v36;
if( v36 )
MI_CLEAR_RESET_PTE(&v18->OriginalPte);
if( !v37 )
v7 = -1073740748;
if( (*(_DWORD *)(&v18->3 + 1) & 4) != 0 )
goto LABEL_109;
v38 = *((_BYTE *)&v18->u3 + 2) | 0x10;
*((_BYTE *)&v18->u3 + 2) = v38;
if( v18->u3.ReferenceCount )
{
*((_BYTE *)&v18->u3 + 2) = v38 & 0xF8 | 3;
goto LABEL_109;
}
MiUnlinkPageFromList(v18, 0i64);
v40 = v18;
if( !v41 )
{
MiDiscardTransitionPteEx(v18, 0i64);
v7 = -1073740748;
goto LABEL_109;
}
v42 = 8i64;
LABEL_108:
MiInsertPageInList(v40, v42, v39);
goto LABEL_109;
}
if( (v35 & 7) != 3 )
goto LABEL_109;
if( (_DWORD)OperationArgument == 1 )
{
v7 = -1073740748;
goto LABEL_109;
}
if( (v35 & 8) != 0 || (_DWORD)OperationArgument || (v35 & 0x20) != 0 )
goto LABEL_109;
v48 = v35 & 0xEF;
*((_BYTE *)&v18->u3 + 2) = v48;
if( v18->u3.ReferenceCount )
*((_BYTE *)&v18->u3 + 2) = v48 & 0xF8 | 2;
else
MiUnlinkPageFromList(v18, 0i64);
v49.u.Long = MiCapturePageFileInfoInline(&v18->OriginalPte, 1ui64, 1ui64).u.Long;
v77->Long = v49.u.Long;
if( v49.u.Long )
OriginalPte->u.Long = *(unsigned __int64 *)(*(&stru_140C4DB30 + 267)
+ 8 * (((unsigned __int64)v18->u4._bf_0 >> 39) & 0x3FF));
LODWORD(v50) = MiUpdatePageFileHighInPte(
v18->OriginalPte.u.Hard.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0,
1i64);
v51 = v50 & 0xFFFFFFFFFFFFFFFDui64;
v71 = v50 & 0xFFFFFFFFFFFFFFFDui64;
v52 = v50 & 0xFFFFFFFFFFFFFFFDui64;
LOBYTE(v53) = MiPteInShadowRange((UINT64)&v18->OriginalPte.u.Long);
if( v53 )
{
if( (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) == 0 )
{
v18->OriginalPte.u.Long = v51;
LABEL_106:
if( v18->u3.ReferenceCount )
goto LABEL_109;
v42 = 4i64;
v40 = v18;
goto LABEL_108;
}
if( (v51 & 1) != 0 )
v52 |= 0x8000000000000000ui64;
}
v18->OriginalPte.u.Long = v52;
goto LABEL_106;
}
_InterlockedAnd64(&v18->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
v11 = v72;
}
}
v54 = OperationArgument;
if( (_DWORD)OperationArgument == 2 )
return 0;
if( v12 )
{
v60 = *(_MI_PARTITION **)(*(&stru_140C4DB30 + 267) + 8i64 * Process->Vm.Instance.PartitionId);
if( v8 )
{
if( v75 == 1 )
{
MiSharedVaToPartition();
v60 = v61;
}
else if( (Vad->Core.u.LongFlags & 0x100000) != 0 || (Subsection = Vad->Subsection) == 0i64 )
{
v60 = *(_MI_PARTITION **)(*(&stru_140C4DB30 + 267) + 8i64 * Process->Vm.Instance.PartitionId);
}
else
{
v60 = *(_MI_PARTITION **)(*(&stru_140C4DB30 + 267) + 8i64 * (Subsection->ControlArea->u1.Flags._bf_0 & 0x3FF));
}
}
IS_PTE_NOT_DEMAND_ZERO();
if( v63 )
{
if( v54 != 1 )
{
v67.u.Long = MiCapturePageFileInfoInline((_MMPTE *)&v71, 1ui64, 0i64).u.Long;
v77->Long = v67.u.Long;
if( v67.u.Long )
{
OriginalPte->u.Long = (unsigned __int64)v60;
if( !v8 )
{
_InterlockedExchangeAdd64((volatile signed __int64 *)&Process->NumberOfPrivatePages, 0xFFFFFFFFFFFFFFFFui64);
v8 = v9;
}
v68 = v71;
LOBYTE(v69) = MiPteInShadowRange((UINT64)v8);
if( v69 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (v68 & 1) != 0 )
v68 |= 0x8000000000000000ui64;
v8->u.Long = v68;
}
return 0;
}
return -1073740748;
}
if( v54 == 1 )
{
MI_IS_RESET_PTE();
if( !v64 )
return -1073740748;
MI_CLEAR_RESET_PTE((_MMPTE *)&v71);
v57 = v71;
}
else
{
if( (v14 & 2) != 0 )
{
MiReleasePageFileSpace(v60, (_MMPTE)v14, 1ui64);
v14 &= ~2ui64;
}
LODWORD(v65) = MiUpdatePageFileHighInPte(v14, 1i64);
v57 = v65;
v71 = v65;
}
if( v8 )
v9 = v8;
LOBYTE(v66) = MiPteInShadowRange((UINT64)v9);
if( v66 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (v57 & 1) != 0 )
v57 |= 0x8000000000000000ui64;
LABEL_141:
v9->u.Long = v57;
return 0;
}
if( v8 )
return -1073740748;
if( (_DWORD)OperationArgument )
return -1073740748;
v55 = (__int64)(((_QWORD)v9 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16;
if( MiCheckUserVirtualAddress((VOID *)v55, &ProtectCode, Vad, v13) )
return -1073740748;
v56 = ProtectCode;
if( (_DWORD)ProtectCode == 24 )
return -1073740748;
MiUpdatePageTableUseCount((VOID *)v55, 1ui64);
v57 = (32i64 * (v56 & 0x1F)) | MiSwizzleInvalidPte(0x100000000i64) & 0xFFFFFFFFFFFFFC1Fui64;
v71 = v57;
v58 = v57;
LOBYTE(v59) = MiPteInShadowRange((UINT64)v9);
if( !v59 )
goto LABEL_120;
if( (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) == 0 )
goto LABEL_141;
if( (v57 & 1) != 0 )
v58 = v57 | 0x8000000000000000ui64;
LABEL_120:
v9->u.Long = v58;
return 0;
}Referenced by:
MiWalkVaRange