MiMapViewOfSection
__int64 __fastcall MiMapViewOfSection(
__int64 a1,
__int64 a2,
unsigned __int64 *a3,
unsigned __int64 a4,
unsigned __int64 *a5,
int a6,
int a7){
__int64 v10;
__int64 v11;
__int64 v12;
_CONTROL_AREA *v13;
__int64 v14;
int v15;
int v16;
int v17;
int v18;
__int64 v19;
unsigned __int64 v20;
unsigned __int64 v21;
unsigned __int64 v22;
__int64 v23;
__int64 v24;
UINT64 v25;
__int64 v26;
unsigned __int64 v27;
int v28;
unsigned __int64 *v29;
unsigned __int64 v30;
UINT64 ProtectionMask;
int v32;
__int16 v33;
UINT64 v34;
_SECTION_INHERIT v35;
int v36;
_SECTION_INHERIT v37;
_ETHREAD *CurrentThread;
__int64 v39;
int v40;
NTSTATUS v41;
int v42;
int v44;
UINT64 v45;
VOID **v46;
int v47;
unsigned __int64 v48;
int v49;
int v50;
_SECTION *Section;
_SECTION *Sectiona;
_SECTION *InheritDisposition;
_SECTION *InheritDispositiona;
UINT64 CommitSize;
UINT64 CommitSizea;
UINT64 v57;
UINT64 v58;
UINT64 AllocationType;
UINT64 ProbeMode;
void *Src;
PVOID *SecureHandle;
ULONG_PTR BugCheckParameter1;
__int64 v64;
UINT64 v65;
VOID **CapturedBase;
unsigned __int64 *v67;
__int64 v68;
_CONTROL_AREA *v69;
UINT64 v70;
ULONG_PTR v71;
__int64 v72;
unsigned __int64 *v73;
_KAPC_STATE ApcState;
v65 = a4;
v67 = a3;
v72 = a2;
v73 = a3;
CapturedBase = (VOID **)a5;
memset(&ApcState, 0, sizeof(ApcState));
ProbeMode = 0i64;
Src = 0i64;
BugCheckParameter1 = *(_QWORD *)(a2 + 88);
v71 = BugCheckParameter1;
LODWORD(SecureHandle) = 0;
v68 = a1;
v13 = MiSectionControlArea((_SECTION *)a1);
v69 = v13;
v14 = *(_QWORD *)v13;
v64 = *(_QWORD *)(a2 + 24);
if( !a7 )
{
if( (unsigned int)(a6 - 1) > 1 )
return 3221225485i64;
if( (*((_DWORD *)v13 + 14) & 0x400) == 0
&& *(_QWORD *)(a2 + 16) >= 0x10000ui64
&& (*(_WORD *)a3 != (_WORD)v12 || *(_WORD *)a5 != (_WORD)v12) )
{
return 3221226016i64;
}
}
if( !a7
&& ((*(_DWORD *)(a2 + 40) & 0x9F2BDFFF) != 0
|| (*(_DWORD *)(a2 + 40) & 0x40000000) != 0 && *(_QWORD *)(v11 + 2240) == v12) )
{
return 3221225485i64;
}
LOBYTE(AllocationType) = 1;
v15 = *(_DWORD *)(a2 + 44);
if( (v15 & 0x40000000) != 0 )
{
if( (v15 & 0xF0) == 0 )
return 3221225485i64;
LOBYTE(AllocationType) = v12;
*(_DWORD *)(a2 + 44) = v15 & 0xBFFFFFFF;
}
if( (*(_DWORD *)(v10 + 56) & 0x20) != 0 )
{
if( *(_QWORD *)(a2 + 80) != v12 && (*(_DWORD *)(a2 + 60) & 0x2000000) == 0 )
return 3221225485i64;
v44 = *(_DWORD *)(a2 + 40);
if( (v44 & 0x2000) != 0 )
return 3221225485i64;
if( (v44 & 0x20000000) != 0
&& (*a5 != v12
|| (MiFlags & 0x40000) != 0
|| (*((_DWORD *)v13 + 14) & 0x20000) != 0
|| !SeSinglePrivilegeCheck(*(_QWORD *)&SeLockMemoryPrivilege, *(_BYTE *)(a2 + 104))) )
{
*(_DWORD *)(a2 + 40) &= ~0x20000000u;
}
}
else
{
v16 = MmCompatibleProtectionMask[MiMakeProtectionMask(*(_DWORD *)(v10 + 60) & 0xFFF) & 7] | 0x700;
if( (v16 | v17) != v16 )
return 3221225550i64;
v18 = *(_DWORD *)(a2 + 40);
if( (v18 & 0x840000) != 0 || (v18 & 0x20002000) != 0 && (*((_DWORD *)v13 + 14) & 0x400) != 0 )
return 3221225485i64;
}
v19 = *(_QWORD *)(a2 + 24);
v20 = *a5 + v19;
if( v20 < *a5 )
return 3221225503i64;
v21 = *(_QWORD *)(a1 + 48);
if( v20 > v21 && (*(_DWORD *)(a2 + 40) & 0x2000) == 0 )
return 3221225503i64;
if( !v19 )
*(_QWORD *)(a2 + 24) = v21 - *a5;
if( (*((_DWORD *)v13 + 14) & 0x400) != 0 )
{
if( (*(_DWORD *)a5 & 0xFFF) != 0 )
{
if( (*(_DWORD *)(a2 + 72) & 2) != 0 )
return 3221226016i64;
*(_DWORD *)a5 &= 0xFFFFF000;
}
}
else
{
v22 = *(_QWORD *)(a2 + 16);
if( v22 > 0x10000 && *((_QWORD *)v13 + 8) )
v22 = 0x10000i64;
v23 = *(unsigned int *)a5;
v24 = v23 & (v22 - 1);
if( v24 )
{
if( (*(_DWORD *)(a2 + 72) & 2) != 0 )
return 3221226016i64;
*(_DWORD *)a5 = v23 & -(int)v22;
if( (*((_DWORD *)v13 + 14) & 0x20) == 0 )
{
v48 = *(_QWORD *)(a2 + 24);
if( v48 + v24 < v48 )
return 3221225503i64;
*(_QWORD *)(a2 + 24) = v48 + v24;
}
}
}
v25 = *(_QWORD *)(a2 + 24);
if( (__int64)v25 <= 0 )
return 3221225503i64;
v26 = *(_QWORD *)(a2 + 16);
if( ((v26 - 1) & *a3) == 0 )
goto LABEL_24;
if( (*(_DWORD *)(a2 + 72) & 2) != 0 )
return 3221226016i64;
*a3 &= -v26;
v25 = *(_QWORD *)(a2 + 24);
LABEL_24:
*(_QWORD *)(a2 + 32) = v25;
v27 = v25;
if( (v25 & 0xFFF) == 0 )
goto LABEL_25;
v27 = v25 + 4096 - (unsigned int)(v25 & 0xFFF);
if( v27 < v25 )
return 3221225503i64;
*(_QWORD *)(a2 + 24) = v27;
LABEL_25:
v28 = *(_DWORD *)(a2 + 72) & 1;
v29 = a3;
if( !v28 )
v29 = (unsigned __int64 *)a2;
v30 = *(_QWORD *)(a2 + 8);
if( *v29 > v30 )
return 3221225485i64;
if( v30 - *v29 + 1 < v27 )
return(unsigned int)(v28 != 0) - 1073741801;
ProtectionMask = v65;
if( v65 > v25 && (*(_DWORD *)(a2 + 40) & 0x2000) == 0 )
return 3221225485i64;
if( v25 > *(_QWORD *)(a1 + 48) && (*(_DWORD *)(a2 + 40) & 0x2000) == 0 )
return 3221225503i64;
v32 = *(_DWORD *)(a2 + 40);
if( (v32 & 0x2000) != 0 && (*(_DWORD *)(a1 + 60) & 0x44) == 0 )
return 3221225550i64;
if( (v32 & 0x800000) != 0 && ((*(_DWORD *)(a1 + 56) & 0x20) == 0 || (v32 & 0x20000000) != 0)
|| (*(_DWORD *)(a2 + 60) & 0x4000000) != 0
&& ((*((_DWORD *)v13 + 14) & 0x420) != 0
|| (v32 & 0xFFFFDFFF) != 0
|| !v28
|| *a3 != (*a3 & 0xFFFFFFFFFFFFF000ui64)
|| !v64) )
{
return 3221225485i64;
}
v33 = *(_WORD *)(v14 + 12);
v34 = *(unsigned int *)(a2 + 44);
if( v33 < 0 )
{
LODWORD(v34) = v34 & 0xFFFFF9FF | 0x200;
*(_DWORD *)(a2 + 44) = v34;
v33 = *(_WORD *)(v14 + 12);
}
if( (v33 & 0x4000) != 0 )
{
LODWORD(v34) = v34 & 0xFFFFF9FF | 0x400;
*(_DWORD *)(a2 + 44) = v34;
}
v35 = (unsigned int)MiMakeProtectionMask(v34);
LODWORD(v64) = v35;
if( v35 == -1 )
return 3221225541i64;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v39 = *(_QWORD *)(a2 + 96);
if( (*(_DWORD *)(v39 + 2512) & 0x100) != 0 && (*((_DWORD *)CurrentThread + 324) & 0x40000) == 0 )
{
if( (*(_DWORD *)(a1 + 56) & 0x20) != 0 )
{
*(_DWORD *)(a2 + 40) = v36 & 0xDFFFFFFF;
}
else if( (v35 & 2) != 0 )
{
return MiArbitraryCodeBlocked(v39);
}
}
if( v39 != BugCheckParameter1 )
{
KiStackAttachProcess((_KPROCESS *)BugCheckParameter1, 0i64, &ApcState);
LODWORD(SecureHandle) = 1;
v37 = 0;
}
v40 = *((_DWORD *)v13 + 14);
if( (v40 & 0x400) != 0 )
{
MiMapViewOfPhysicalSection(a2, (INT64)a3, (INT64)a5);
}
else
{
if( (v40 & 0x20) != 0 )
{
ProbeMode = *a3;
Src = (void *)ProbeMode;
v45 = *(_QWORD *)(a2 + 24);
v70 = v45;
while( 1 )
{
LODWORD(InheritDisposition) = v35;
LODWORD(Section) = a6;
v46 = CapturedBase;
v42 = MiMapViewOfImageSection(
v13,
(_EPROCESS *)a2,
(_EPROCESS *)&ProbeMode,
CapturedBase,
(_LARGE_INTEGER *)a1,
(UINT64 *)Section,
InheritDisposition,
v37,
CommitSize,
v57,
AllocationType,
ProbeMode,
(UINT64)Src);
LODWORD(v65) = v42;
v47 = *(_DWORD *)(a2 + 40);
if( (v47 & 0x20000000) == 0 )
break;
*(_DWORD *)(a2 + 40) = v47 & 0xDFFFFFFF;
LODWORD(InheritDispositiona) = v35;
LODWORD(Sectiona) = a6;
v49 = MiMapViewOfImageSection(
v13,
(_EPROCESS *)a2,
(_EPROCESS *)&Src,
v46,
(_LARGE_INTEGER *)a1,
(UINT64 *)Sectiona,
InheritDispositiona,
(_SECTION_INHERIT)0,
CommitSizea,
v58,
AllocationType,
ProbeMode,
(UINT64)Src);
v50 = v49;
if( v42 < 0 )
{
ProbeMode = (UINT64)Src;
v42 = v49;
break;
}
if( v49 >= 0 )
{
memmove((UINT8 *)ProbeMode, (UINT8 *)Src, v45);
if( v50 >= 0 )
{
MiUnmapViewOfSection(BugCheckParameter1, (unsigned __int64)Src, 0, 0);
break;
}
MiUnmapViewOfSection(BugCheckParameter1, ProbeMode, 0, 0);
MiUnmapViewOfSection(BugCheckParameter1, (unsigned __int64)Src, 0, 0);
v37 = 0;
}
else
{
MiUnmapViewOfSection(BugCheckParameter1, ProbeMode, 0, 0);
v37 = 0;
}
}
if( v42 >= 0 )
*v67 = ProbeMode;
goto LABEL_46;
}
LODWORD(Section) = a6;
v41 = MiMapViewOfDataSection(
v13,
(_EPROCESS *)a2,
(PVOID *)a3,
(_LARGE_INTEGER *)a5,
(UINT64 *)a1,
Section,
v35,
ProtectionMask,
(UINT64)&AllocationType,
v57,
AllocationType,
ProbeMode,
(UINT8 *)Src,
SecureHandle);
}
v42 = v41;
LABEL_46:
if( (_DWORD)SecureHandle )
KiUnstackDetachProcess(&ApcState, 0i64);
return(unsigned int)v42;
}Referenced by:
MiMapViewOfSectionExCommon
MmMapSecureViewOfSection
MmMapViewOfSection
NtMapViewOfSection