MiIncrementAweMapCount
NTSTATUS __fastcall MiIncrementAweMapCount(INT64 a1, INT64 a2, INT64 r8_0, INT64 a4){
_MI_PFN_CACHE_ATTRIBUTE v4;
INT64 v6;
unsigned __int64 v7;
unsigned int v8;
_ETHREAD *CurrentThread;
UINT64 v10;
int v11;
_ETHREAD *v12;
unsigned int SessionId;
unsigned __int8 v14;
int v15;
bool v16;
__int64 v17;
_KLOCK_ENTRY *v18;
CHAR v19;
int v20;
unsigned int v21;
__int64 v22;
unsigned __int64 v23;
_QWORD *v24;
_QWORD *v25;
volatile signed __int64 *v26;
_QWORD *v27;
_QWORD *v28;
_ETHREAD *v29;
unsigned int v30;
unsigned __int8 v31;
int v32;
__int64 v33;
_KLOCK_ENTRY *v34;
int v35;
unsigned int v36;
__int64 v37;
_QWORD *v38;
NTSTATUS result;
__int64 v40;
UINT64 a3;
char v42[12];
__int128 v43;
__int128 v44;
__int64 v45;
_ETHREAD *v46;
_MI_PFN_CACHE_ATTRIBUTE v48;
v48 = (int)r8_0;
v43 = 0i64;
v45 = 0i64;
v44 = 0i64;
v4 = (int)r8_0;
v6 = a1;
while( 1 )
{
while( 1 )
{
v7 = MiLockPageInline((_MMPFN *)a2);
if( (*(_DWORD *)v6 & 1) != 0 && (*(_QWORD *)(a2 + 24) & 0x4000000000000000i64) != 0 )
goto LABEL_76;
v8 = *(unsigned __int8 *)(a2 + 34);
if( (v8 & 0x20) == 0 )
break;
_InterlockedAnd64((volatile signed __int64 *)(a2 + 24), 0x7FFFFFFFFFFFFFFFui64);
__writecr8(v7);
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
DWORD1(v44) = 0;
v45 = (__int64)&v44 + 8;
*((_QWORD *)&v44 + 1) = (char *)&v44 + 8;
*((_QWORD *)&v43 + 1) = a2;
LOWORD(v44) = 263;
BYTE2(v44) = 6;
--CurrentThread->Tcb.SpecialApcDisable;
*(_QWORD *)&v42[4] = CurrentThread;
v10 = v6 + 40;
ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)(v6 + 40), 0i64);
MiLockPageInline((_MMPFN *)a2);
if( (*(_BYTE *)(a2 + 34) & 0x20) != 0 )
{
*(_QWORD *)&v43 = *(_QWORD *)(v6 + 48);
*(_QWORD *)(v6 + 48) = &v43;
v11 = 1;
}
else
{
v11 = 0;
}
_InterlockedAnd64((volatile signed __int64 *)(a2 + 24), 0x7FFFFFFFFFFFFFFFui64);
__writecr8(v7);
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v10, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((_EX_PUSH_LOCK *)v10);
LODWORD(a3) = 0;
v12 = (_ETHREAD *)KeGetCurrentThread();
if( MiGetSystemRegionType(v10) == 1 )
SessionId = MmGetSessionIdEx(v12->Tcb.ApcState.Process);
else
SessionId = -1;
--v12->Tcb.SpecialApcDisable;
v14 = ++v12->Tcb.AbAllocationRegionCount;
v15 = ((char)v12->Tcb.AbEntrySummary | (char)v12->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
v16 = !_BitScanReverse((unsigned int *)&v17, v15);
if( v16 )
goto LABEL_20;
while( 1 )
{
v18 = &v12->Tcb.LockEntries[v17];
v15 &= ~(1 << v17);
if( (v18->AcquiredByte & 1) != 0
&& (v18->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v18->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == (v10 & 0x7FFFFFFFFFFFFFFCi64)
&& v18->LockState.SessionId == SessionId )
{
v18->AcquiredByte &= ~1u;
if( v18->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
break;
}
v16 = !_BitScanReverse((unsigned int *)&v17, v15);
if( v16 )
goto LABEL_20;
}
if( !v18 )
{
LABEL_20:
if( (*(&v12->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, v12, (PVOID)v10, (PVOID)SessionId, 0i64);
}
else
{
v18->CrossThreadReleasableAndBusyByte |= 2u;
if( v18->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v18);
v20 = v18->BoostBitmap.AllFields & 0x1FFFF;
v21 = v18->BoostBitmap.AllFields & 0xFFFE0000;
v18->ThreadLocalFlags &= ~1u;
LODWORD(a3) = v20;
v18->BoostBitmap.AllFields = v21;
v18->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v22 = v18 - v12->Tcb.LockEntries;
if( v14 == 1 )
v12->Tcb.AbEntrySummary |= 1 << v22;
else
_InterlockedOr8((volatile signed __int8 *)&v12->Tcb.AbOrphanedEntrySummary, 1 << v22);
}
--v12->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v12->Tcb, (VOID *)v10, &a3);
v16 = v12->Tcb.SpecialApcDisable++ == -1;
if( v16 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v12->Tcb.ApcState.ApcListHead[0].Flink != &v12->Tcb.152 )
KiCheckForKernelApcDelivery();
KiLeaveGuardedRegionUnsafe(*(__int64 *)&v42[4]);
v4 = v48;
v16 = v11 == 0;
v6 = a1;
if( !v16 )
KeWaitForGate((_KGATE *)&v44, WrVirtualMemory, v19);
}
v23 = *(_QWORD *)(a2 + 24) & 0x3FFFFFFFFFFFFFFFi64;
if( v8 >> 6 == v4 )
goto LABEL_73;
if( *(_WORD *)(a2 + 32) > 2u || v23 != 1 || (*(_QWORD *)(a2 + 24) & 0x4000000000000000i64) != 0 )
goto LABEL_76;
if( *(_QWORD *)(v6 + 8) == 1i64 )
break;
*(_BYTE *)(a2 + 34) = v8 | 0x20;
_InterlockedAnd64((volatile signed __int64 *)(a2 + 24), 0x7FFFFFFFFFFFFFFFui64);
__writecr8(v7);
*(_DWORD *)&v42[4] = MiChangeAwePageAttributes(v6, a2, (unsigned int)v4);
MiLockPageInline((_MMPFN *)a2);
*(_BYTE *)(a2 + 34) &= ~0x20u;
_InterlockedAnd64((volatile signed __int64 *)(a2 + 24), 0x7FFFFFFFFFFFFFFFui64);
__writecr8(v7);
v24 = (_QWORD *)(v6 + 48);
v25 = 0i64;
v46 = (_ETHREAD *)KeGetCurrentThread();
--v46->Tcb.SpecialApcDisable;
v26 = (volatile signed __int64 *)(v6 + 40);
ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)(v6 + 40), 0i64);
v27 = *(_QWORD **)(v6 + 48);
if( v27 )
{
do
{
v28 = (_QWORD *)*v27;
if( v27[1] == a2 )
{
*v27 = v25;
v25 = v27;
*v24 = v28;
}
else
{
v24 = v27;
}
v27 = v28;
}
while( v28 );
}
if( (_InterlockedExchangeAdd64(v26, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((_EX_PUSH_LOCK *)(v6 + 40));
*(_DWORD *)v42 = 0;
v29 = (_ETHREAD *)KeGetCurrentThread();
if( MiGetSystemRegionType(v6 + 40) == 1 )
v30 = MmGetSessionIdEx(v29->Tcb.ApcState.Process);
else
v30 = -1;
--v29->Tcb.SpecialApcDisable;
v31 = ++v29->Tcb.AbAllocationRegionCount;
v32 = ((char)v29->Tcb.AbEntrySummary | (char)v29->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
while( 1 )
{
v16 = !_BitScanReverse((unsigned int *)&v33, v32);
HIDWORD(a3) = v33;
if( v16 )
break;
v34 = &v29->Tcb.LockEntries[v33];
v32 &= ~(1 << v33);
if( (v34->AcquiredByte & 1) != 0
&& (v34->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v34->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == ((unsigned __int64)v26 & 0x7FFFFFFFFFFFFFFCi64)
&& v34->LockState.SessionId == v30 )
{
v34->AcquiredByte &= ~1u;
if( v34->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
{
if( v34 )
{
v34->CrossThreadReleasableAndBusyByte |= 2u;
if( v34->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v34);
v35 = v34->BoostBitmap.AllFields & 0x1FFFF;
v36 = v34->BoostBitmap.AllFields & 0xFFFE0000;
v34->ThreadLocalFlags &= ~1u;
*(_DWORD *)v42 = v35;
v34->BoostBitmap.AllFields = v36;
v34->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v37 = v34 - v29->Tcb.LockEntries;
if( v31 == 1 )
v29->Tcb.AbEntrySummary |= 1 << v37;
else
_InterlockedOr8((volatile signed __int8 *)&v29->Tcb.AbOrphanedEntrySummary, 1 << v37);
goto LABEL_62;
}
break;
}
}
}
if( (*(&v29->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, v29, (PVOID)v26, (PVOID)v30, 0i64);
LABEL_62:
--v29->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v29->Tcb, (VOID *)v26, (UINT64 *)v42);
v16 = v29->Tcb.SpecialApcDisable++ == -1;
if( v16 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v29->Tcb.ApcState.ApcListHead[0].Flink != &v29->Tcb.152 )
KiCheckForKernelApcDelivery();
KiLeaveGuardedRegionUnsafe((__int64)v46);
if( v25 )
{
do
{
v38 = (_QWORD *)*v25;
KeSignalGate((_KGATE *)(v25 + 2), 1i64);
v25 = v38;
}
while( v38 );
}
result = *(_DWORD *)&v42[4];
if( *(int *)&v42[4] < 0 )
return result;
v6 = a1;
v4 = v48;
}
MiChangePageAttribute((_MMPFN *)a2, v4, 1ui64);
LABEL_73:
if( v23 > 1 && (*(_DWORD *)v6 & 1) != 0 || v23 >= 0x3FFFFFFFFFFFFFFFi64 )
{
LABEL_76:
_InterlockedAnd64((volatile signed __int64 *)(a2 + 24), 0x7FFFFFFFFFFFFFFFui64);
result = -1073741800;
goto LABEL_79;
}
v40 = *(_QWORD *)(a2 + 24) ^ (*(_QWORD *)(a2 + 24) ^ (*(_QWORD *)(a2 + 24) + 1i64)) & 0x3FFFFFFFFFFFFFFFi64;
*(_QWORD *)(a2 + 8) = a4;
*(_QWORD *)(a2 + 24) = v40;
_InterlockedAnd64((volatile signed __int64 *)(a2 + 24), 0x7FFFFFFFFFFFFFFFui64);
result = 0;
LABEL_79:
__writecr8(v7);
return result;
}Referenced by:
MiReferenceIncomingPhysicalPages