MiTerminateWsle
UINT64 __stdcall MiTerminateWsle(
PVOID VirtualAddress,
_MMSUPPORT_INSTANCE *WsInfo,
UINT64 WsPfnIndex,
UINT64 LogAccess){
int v4;
int v6;
BOOL v7;
int v8;
volatile INT64 *v9;
volatile unsigned __int64 v10;
UINT8 v11;
UNICODE_STRING *v12;
__int64 v13;
PVOID v14;
UNICODE_STRING *v16;
int v17;
INT64 v18;
INT64 v19;
UINT64 *v20;
unsigned __int64 *v21;
char v22;
int v23;
INT64 v24;
INT64 v25;
char v26;
UINT64 v28;
_DWORD *v29;
_OWORD a3[2];
v4 = 1;
v29 = (_DWORD *)LogAccess;
v26 = WsPfnIndex;
v6 = 10;
v7 = 1;
v8 = 0;
v9 = (volatile INT64 *)((char *)MmGetPteBase() + (((unsigned __int64)WsInfo >> 9) & 0x7FFFFFFFF8i64));
v10 = *v9;
v11 = MiPteInShadowRange((UINT64)v9);
v12 = (UNICODE_STRING *)((char *)MmGetPfnDb() + 48 * ((v10 >> 12) & 0xFFFFFFFFFi64));
if( WsInfo >= (_MMSUPPORT_INSTANCE *)MmGetPteBase() && WsInfo <= (_MMSUPPORT_INSTANCE *)MmGetPteLimit() )
{
v4 = 0;
LOBYTE(v13) = (LOBYTE(v12->Length) >> 1) & 7;
LABEL_4:
v14 = VirtualAddress;
goto LABEL_5;
}
v6 = 10 - ((v26 & 2) != 0);
v16 = (UNICODE_STRING *)(HIBYTE(*v9) & 0xF);
v13 = (unsigned __int8)((unsigned __int8)v16 | (16 * (((unsigned __int64)*v9 >> 60) & 7)));
LOBYTE(v17) = MI_PFN_IS_PROTO(v12, v16, v11, &v12->Length);
v7 = v17 == 0;
if( (v13 & 0xF) != 8 )
goto LABEL_4;
v14 = VirtualAddress;
MiUnlockWsle((INT64)VirtualAddress, (UINT64)WsInfo, v18);
LOBYTE(v13) = MiGetWsleContents(v19, (UINT64)WsInfo);
LABEL_5:
if( (v26 & 3) == 0 )
{
if( v4 )
{
if( MI_WRITE_INVALID_PTE_TB_FLUSH_NEEDED(v9, ZeroPte) )
v8 = 1;
}
else
{
if( !(unsigned int)MiEvictPageTableLock((INT64)v14, (volatile UINT64 *)v9, ZeroPte, 0) )
{
*v29 = 0;
return 0i64;
}
v8 = 1;
}
}
LODWORD(v25) = v7;
LODWORD(v24) = v6;
MiRemoveWsle((INT64)v14, (UINT64)WsInfo, (UINT8 *)1, v13, v24, v25);
if( v4 )
{
v20 = (UINT64 *)((char *)MmGetPdeBase() + (((unsigned __int64)WsInfo >> 18) & 0x3FFFFFF8));
v28 = *v20;
v21 = (unsigned __int64 *)((char *)MmGetPfnDb() + 48 * ((v28 >> 12) & 0xFFFFFFFFFi64));
if( ((*(_DWORD *)v21 >> 4) & 0x3FF) == 0 )
{
MiCountWslesInPageTable((INT64)v20, (UINT64)WsInfo, a3);
v22 = 8;
while( 1 )
{
v23 = *((_DWORD *)a3 + (unsigned __int8)--v22);
if( v23 )
break;
if( !v22 )
goto LABEL_21;
}
*v21 = *v21 & 0xFFFFFFFFFFFE000Fui64 | (16 * (v23 & 0x3FF | ((unsigned __int64)(v22 & 7) << 10)));
}
}
LABEL_21:
*v29 = v8;
return 1i64;
}Referenced by:
MiDecommitPages
MiDeleteEmptyPageTable
MiRemoveSystemImagePage