SmKmVirtualLockCtxMemoryUnlocked
VOID __stdcall SmKmVirtualLockCtxMemoryUnlocked(PVOID BugCheckParameter2, INT64 a2){
unsigned __int64 v3;
unsigned __int64 v4;
_ETHREAD *CurrentThread;
__int64 v6;
unsigned __int64 v7;
UINT64 v8;
unsigned __int64 v9;
_ETHREAD *v10;
unsigned int SessionId;
char v12;
int v13;
unsigned __int64 v14;
bool v15;
__int64 v16;
__int64 v17;
ULONG_PTR BugCheckParameter4;
UINT64 MinimumWorkingSetSize;
UINT64 MaximumWorkingSetSize;
UINT64 PrivateWorkingSetSize;
UINT64 WorkingSetSize;
UINT64 PeakWorkingSetSize[2];
BYTE v24;
int v25;
int v26;
UINT HardEnforcementFlags;
MinimumWorkingSetSize = 0i64;
MaximumWorkingSetSize = 0i64;
_InterlockedExchangeAdd64((volatile signed __int64 *)BugCheckParameter2 + 1, -a2);
v3 = *((_QWORD *)BugCheckParameter2 + 1);
v4 = *((_QWORD *)BugCheckParameter2 + 2);
if( v3 < v4 && (!v3 || v4 - v3 >= 0x800000) )
{
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
ExAcquirePushLockExclusiveEx((UINT64)BugCheckParameter2, 0i64);
v6 = *((_QWORD *)BugCheckParameter2 + 1);
v7 = *((_QWORD *)BugCheckParameter2 + 2) - v6;
if( v7 >= 0x800000 || !v6 && *((_QWORD *)BugCheckParameter2 + 2) )
{
PeakWorkingSetSize[0] = 0i64;
WorkingSetSize = 0i64;
HardEnforcementFlags = 0;
PrivateWorkingSetSize = 0i64;
if( (int)MmQueryWorkingSetInformation(
PeakWorkingSetSize,
&WorkingSetSize,
&PrivateWorkingSetSize,
&MinimumWorkingSetSize,
&MaximumWorkingSetSize,
&HardEnforcementFlags) >= 0 )
{
v8 = MinimumWorkingSetSize;
v9 = v7 & 0xFFFFFFFFFFC00000ui64;
*((_QWORD *)BugCheckParameter2 + 2) -= v9;
if( v8 >= v9 )
{
LODWORD(BugCheckParameter4) = 0;
MinimumWorkingSetSize = v8 - v9;
v24 = 0;
MmAdjustWorkingSetSizeEx(v8 - v9, MaximumWorkingSetSize, 0i64, 0, BugCheckParameter4, &v24);
}
}
}
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)BugCheckParameter2, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)BugCheckParameter2);
v26 = 0;
v10 = (_ETHREAD *)KeGetCurrentThread();
if( (unsigned int)MiGetSystemRegionType((UINT64)BugCheckParameter2) == 1 )
SessionId = MmGetSessionIdEx(*((_QWORD *)v10 + 23));
else
SessionId = -1;
--*((_WORD *)v10 + 243);
v12 = ++*((_BYTE *)v10 + 794);
v13 = (*((char *)v10 + 792) | *((char *)v10 + 870)) ^ 0x3F;
while( 1 )
{
v15 = !_BitScanReverse((unsigned int *)&v16, v13);
v25 = v16;
if( v15 )
goto LABEL_22;
v14 = *((_QWORD *)v10 + 100) + 96 * v16;
v13 &= ~(1 << v16);
if( (*(_BYTE *)(v14 + 26) & 1) != 0
&& (*(_DWORD *)(v14 + 32) & 1) == 0
&& (*(_QWORD *)(v14 + 32) & 0x7FFFFFFFFFFFFFFCi64) == ((unsigned __int64)BugCheckParameter2 & 0x7FFFFFFFFFFFFFFCi64)
&& *(_DWORD *)(v14 + 40) == SessionId )
{
*(_BYTE *)(v14 + 26) &= ~1u;
if( *(_QWORD *)(v14 + 32) )
break;
}
}
if( !v14 )
{
LABEL_22:
if( (*((_DWORD *)v10 + 30) & 0x10000) == 0 )
KeBugCheckEx(0x162u, (ULONG_PTR)v10, (ULONG_PTR)BugCheckParameter2, SessionId, 0i64);
goto LABEL_29;
}
*(_BYTE *)(v14 + 32) |= 2u;
if( *(__int64 *)(v14 + 32) < 0 )
KiAbEntryRemoveFromTree(v14);
v26 = *(_DWORD *)(v14 + 88) & 0x1FFFF;
*(_DWORD *)(v14 + 88) &= 0xFFFE0000;
*(_BYTE *)(v14 + 25) &= ~1u;
*(_QWORD *)(v14 + 32) = 0i64;
v17 = (__int64)(v14 - *((_QWORD *)v10 + 100)) / 96;
if( v12 == 1 )
*((_BYTE *)v10 + 792) |= 1 << v17;
else
_InterlockedOr8((volatile signed __int8 *)v10 + 870, 1 << v17);
LABEL_29:
--*((_BYTE *)v10 + 794);
KiAbThreadRemoveBoosts((ULONG_PTR)v10, (__int64)BugCheckParameter2, (unsigned int *)&v26);
v15 = (*((_WORD *)v10 + 243))++ == 0xFFFF;
if( v15 && *((_ETHREAD **)v10 + 19) != (_ETHREAD *)((char *)v10 + 152) )
KiCheckForKernelApcDelivery();
KeLeaveCriticalRegion();
}
}Referenced by:
SmKmStoreHelperCommandProcess
SmKmVirtualLockCtxLockMemory