MiProbeAndLockPrepare
NTSTATUS __stdcall MiProbeAndLockPrepare(
_MI_PROBE_PACKET *Packet,
_MDL *MemoryDescriptorList,
VOID *VirtualAddress,
UINT64 ByteCount,
CHAR AccessMode,
_LOCK_OPERATION Operation,
UINT64 UpdateProcessLockedPages){
_LOCK_OPERATION v8;
char *v10;
__int64 v11;
_MMPTE *PteBase;
unsigned __int64 v13;
unsigned __int64 v14;
__int16 v15;
INT64 MdlFlags;
UINT64 v17;
int v18;
_MI_PROBE_PACKET *v19;
_MI_PROBE_PACKET *v20;
_MMSUPPORT_INSTANCE *SessionVm;
unsigned int v22;
unsigned __int8 v23;
volatile __int32 *v24;
UINT8 v25;
int v26;
unsigned __int8 CurrentIrql;
_MI_PROBE_PACKET v28;
char v29;
_MMSUPPORT_INSTANCE *AnyMultiplexedVm;
__int64 v32;
__int64 v33;
unsigned __int64 v34;
unsigned int v35;
unsigned __int64 v36;
_MMSUPPORT_INSTANCE *v37;
int v38;
_MMVAD_SHORT *v39;
_MMVAD_SHORT *v40;
__int64 LongFlags1;
union {unsigned int LongFlags;_MMVAD_FLAGS VadFlags;_MM_PRIVATE_VAD_FLAGS PrivateVadFlags;_MM_GRAPHICS_VAD_FLAGS GraphicsVadFlags;_MM_SHARED_VAD_FLAGS SharedVadFlags;volatile unsigned int VolatileVadLong;} v42;
unsigned __int64 v43;
unsigned __int64 v44;
NTSTATUS v45;
_MMSUPPORT_INSTANCE *v46;
int v47;
INT64 v48;
_MI_PROBE_PACKET *v49;
INT64 v50;
v8 = Operation;
v10 = (char *)VirtualAddress + (unsigned int)ByteCount;
*((_QWORD *)Packet + 9) = KeGetCurrentThread();
LODWORD(v50) = 0;
*((_QWORD *)Packet + 7) = MemoryDescriptorList;
Packet[22] = v8;
*(_QWORD *)Packet = VirtualAddress;
*((_QWORD *)Packet + 1) = v10;
if( AccessMode && ((unsigned __int64)v10 > 0x7FFFFFFF0000i64 || VirtualAddress >= v10) )
{
++*(&stru_140C4DB30 + 610);
return -1073741819;
}
v11 = MemoryDescriptorList->ByteCount;
*((_QWORD *)Packet + 6) = MemoryDescriptorList + 1;
PteBase = MmGetPteBase();
v13 = ((unsigned __int64)((unsigned __int16)VirtualAddress & 0xFFF) + v11 + 4095) >> 12;
v14 = (unsigned __int64)(v10 - 1);
*((_QWORD *)Packet + 2) = (char *)PteBase + (((unsigned __int64)VirtualAddress >> 9) & 0x7FFFFFFFF8i64);
*((_QWORD *)Packet + 3) = (char *)PteBase + ((v14 >> 9) & 0x7FFFFFFFF8i64);
*((_QWORD *)Packet + 17) = 0xFFFFFFFFFi64;
MdlFlags = (unsigned __int16)MemoryDescriptorList->MdlFlags;
v15 = MdlFlags | 0x80;
LOWORD(MdlFlags) = MdlFlags & 0xFF7F;
if( v8 )
LOWORD(MdlFlags) = v15;
LOWORD(MdlFlags) = MdlFlags | 2;
MemoryDescriptorList->MdlFlags = MdlFlags;
*((_QWORD *)Packet + 15) = 0i64;
*((_QWORD *)Packet + 13) = 0i64;
*((_QWORD *)Packet + 14) = 0i64;
if( *(_QWORD *)Packet >= 0x7FFFFFFF0000ui64 )
{
*((_QWORD *)Packet + 10) = 0i64;
MemoryDescriptorList->Process = 0i64;
}
else
{
MdlFlags = *(_QWORD *)(*((_QWORD *)Packet + 9) + 184i64);
*((_QWORD *)Packet + 10) = MdlFlags;
MemoryDescriptorList->Process = (_EPROCESS *)MdlFlags;
if( v8 == (IoModifyAccess|IoWriteAccess) )
{
LODWORD(v39) = MiObtainReferencedVadEx(*(_QWORD *)Packet, 0, &v50);
v40 = v39;
if( !v39 )
return v50;
if( MiVadPureReserve(v39)
|| (LongFlags1 = v40->u1.LongFlags1,
LODWORD(LongFlags1) = LongFlags1 & 0x7FFFFFFF,
(LongFlags1 | ((unsigned __int64)v40->CommitChargeHigh << 31)) >= 0x7FFFFFFFDi64)
|| (v42.LongFlags = (unsigned int)v40->u, (v42.LongFlags & 0x70) == 16)
|| (v42.LongFlags & 0x100000) == 0 && (v42.LongFlags & 0x70) != 32 )
{
MiUnlockAndDereferenceVad(v40);
return -1073741819;
}
v43 = (v40->StartingVpn | ((unsigned __int64)v40->StartingVpnHigh << 32)) << 12;
if( (unsigned __int64)VirtualAddress < v43
|| (v44 = ((v40->EndingVpn | ((unsigned __int64)v40->EndingVpnHigh << 32)) << 12) | 0xFFF,
(unsigned __int64)VirtualAddress > v44)
|| v14 < v43
|| v14 > v44 )
{
MiUnlockAndDereferenceVad(v40);
return -1073741800;
}
LODWORD(v50) = MiChargeFullProcessCommitment(*((_QWORD *)Packet + 10), v13);
v45 = v50;
if( (int)v50 < 0 )
{
MiUnlockAndDereferenceVad(v40);
return v45;
}
*((_QWORD *)Packet + 15) = v40;
*((_QWORD *)Packet + 14) = v13;
}
if( (_DWORD)UpdateProcessLockedPages )
_InterlockedExchangeAdd64((volatile signed __int64 *)(*((_QWORD *)Packet + 10) + 1280i64), v13);
}
v17 = *(_QWORD *)Packet;
*((_QWORD *)Packet + 4) = 0i64;
if( v17 >= 0xFFFF800000000000ui64 )
{
MdlFlags = ((v17 >> 39) & 0x1FF) - 256;
v18 = *((unsigned __int8 *)&stru_140C4DB30 + MdlFlags + 7128);
}
else
{
v18 = 0;
}
if( v17 >= 0x7FFFFFFF0000i64 )
{
if( v18 == 1 )
{
v19 = Packet + 16;
v48 = Packet[16] & 0xFFFFFFF0 | 8;
Packet[16] = v48;
v20 = Packet + 24;
SessionVm = MiGetSessionVm(MdlFlags, v48, v8);
*((_QWORD *)Packet + 12) = SessionVm;
goto LABEL_15;
}
if( v18 == 6 )
{
v19 = Packet + 16;
v20 = Packet + 24;
SessionVm = (_MMSUPPORT_INSTANCE *)((char *)&stru_140C4DB30 + 5264);
v22 = Packet[16] & 0xFFFFFFF0 | 3;
*((_QWORD *)Packet + 12) = (char *)&stru_140C4DB30 + 5264;
}
else
{
if( v18 == 8 )
{
AnyMultiplexedVm = MiGetAnyMultiplexedVm(MiWorkingSetTypeSystemCache, MemoryDescriptorList);
v19 = Packet + 16;
v22 = Packet[16] & 0xFFFFFFF0 | 2;
}
else
{
if( v18 != 5 && v18 != 15 )
{
v20 = Packet + 24;
v49 = Packet + 24;
v19 = Packet + 16;
if( v18 == 12 )
{
SessionVm = MiGetAnyMultiplexedVm(MiWorkingSetTypeSystemViews, MemoryDescriptorList);
v35 = *v19 & 0xFFFFFFF6;
*(_QWORD *)v20 = SessionVm;
v22 = v35 | 6;
*v19 = v22;
goto LABEL_16;
}
v36 = (unsigned int)*v19;
v49 = Packet + 24;
if( v18 == 14 )
{
v37 = MiGetAnyMultiplexedVm(MiWorkingSetTypeKernelStacks, (VOID *)v36);
*(_QWORD *)v20 = v37;
v22 = v38 & 0xFFFFFFF0 | 7;
SessionVm = v37;
*v19 = v22;
goto LABEL_16;
}
v46 = MiGetAnyMultiplexedVm(MiWorkingSetTypeSystemPtes, (VOID *)v36);
*(_QWORD *)v20 = v46;
v22 = v47 & 0xFFFFFFF0 | 5;
SessionVm = v46;
goto LABEL_14;
}
AnyMultiplexedVm = MiGetAnyMultiplexedVm(MiWorkingSetTypeNonPagedPool, MemoryDescriptorList);
v19 = Packet + 16;
v22 = Packet[16] & 0xFFFFFFF0 | 4;
}
v20 = Packet + 24;
SessionVm = AnyMultiplexedVm;
*((_QWORD *)Packet + 12) = AnyMultiplexedVm;
}
}
else
{
v19 = Packet + 16;
v20 = Packet + 24;
SessionVm = (_MMSUPPORT_INSTANCE *)(*((_QWORD *)Packet + 10) + 1664i64);
v22 = Packet[16] & 0xFFFFFFF0 | 1;
*((_QWORD *)Packet + 12) = SessionVm;
}
LABEL_14:
*v19 = v22;
LABEL_15:
v49 = v20;
LABEL_16:
*v19 = v22 & 0xFFFFFFCF;
v23 = SessionVm->Flags._bf_0 & 7;
if( v23 >= 6u )
{
CurrentIrql = KeGetCurrentIrql();
__writecr8(2ui64);
}
else
{
if( v23 == 2 )
v24 = (volatile __int32 *)((char *)&stru_140C4DB30 + 6544);
else
v24 = (volatile __int32 *)&SessionVm[1];
v25 = KeGetCurrentIrql();
__writecr8(2ui64);
_m_prefetchw((const void *)v24);
v26 = *v24 & 0x7FFFFFFF;
if( v26 != _InterlockedCompareExchange(v24, v26 + 1, v26) )
ExpWaitForSpinLockSharedAndAcquire((INT64 *)v24, v25);
if( *((_DWORD *)v24 + 1) )
_InterlockedExchange(v24 + 1, 0);
CurrentIrql = v25;
v20 = v49;
}
v28 = *v19;
v29 = *v19 & 0xF;
*((_BYTE *)Packet + 68) = CurrentIrql;
if( v29 == 1 && *(_QWORD *)(*((_QWORD *)Packet + 10) + 1264i64) )
*v19 = v28 | 0x10;
if( v18 == 8 )
{
LODWORD(v32) = MiGetSystemCacheReverseMap(v17);
v33 = *(_QWORD *)(v32 + 24);
v34 = v33 & 0xFFFFFFFFFFFFFFFEui64;
if( (v33 & 1) == 0 )
v34 = *(_QWORD *)(v32 + 24);
*(_QWORD *)v20 = *(_QWORD *)(*(&stru_140C4DB30 + 267) + 8i64 * (*(_WORD *)(*(_QWORD *)v34 + 60i64) & 0x3FF))
+ 7232i64;
}
return 0;
}Referenced by:
MiProbeAndLockPages
MmProbeAndLockSelectedPages
MmStoreProbeAndLockPages