MiTrimSharedPageFromViews
INT64 __fastcall MiTrimSharedPageFromViews(UINT64 *a1, INT64 a2, CHAR a3, INT64 a4, BYTE *a5){
_ETHREAD *CurrentThread;
__int64 v8;
unsigned int v9;
INT64 v10;
_MMPTE *v11;
UINT64 *v12;
_MMSESSION *v13;
struct _DMA_ADAPTER *v14;
UINT64 v15;
UINT64 v16;
int v17;
UINT64 v18;
UINT64 v19;
__int64 v20;
unsigned __int64 v21;
UINT64 v22;
unsigned int v23;
UINT64 v24;
VOID *v25;
int v26;
_RTL_BALANCED_NODE *i;
unsigned __int64 v28;
INT64 *SystemSpaceViewLockPointer;
__int64 v30;
INT64 v31;
int v32;
MMPTE *v33;
int v34;
INT64 v35;
INT64 SessionVm;
INT64 v37;
int SystemRegionType;
_QWORD *SystemCacheReverseMap;
unsigned __int64 v40;
unsigned __int64 v41;
__int64 v42;
unsigned __int64 v43;
unsigned __int64 v44;
bool v45;
int v46;
RTL_BALANCED_NODE *Address;
int v48;
INT64 v49;
unsigned __int64 v50;
__int64 v51;
_MMPTE *ProtoPteAddress;
_MMPTE *PteBase;
INT64 *v54;
MMPTE *v55;
INT64 *v56;
char v57;
char *v58;
UINT8 v59;
WCHAR *v60;
int v61;
__int16 v62;
INT64 v63;
__int64 v64;
unsigned __int8 v65;
char v66;
INT64 v67;
int v68;
char v69;
__int64 v70;
INT64 v71;
int locked;
INT64 *v73;
VOID *v74;
UINT64 *v75;
struct _DMA_ADAPTER *v76;
UINT64 v78;
__int64 v79;
UINT8 v80;
PADAPTER_OBJECT DmaAdapter;
UINT64 *v82;
UINT64 v83;
UINT64 v84;
unsigned int v85;
unsigned __int64 v86;
MMPTE *v87;
_SUBSECTION *ContainingSubsection;
unsigned __int64 v89;
int v90;
int v91;
int v92;
int v93;
INT64 v94;
PVOID P;
INT64 v96;
_MMSESSION *v97;
VOID *OpaqueSession;
BYTE *v99;
INT64 *v100;
struct _KLOCK_QUEUE_HANDLE LockHandle;
INT64 v102[3];
INT64 v103;
KAPC_STATE ApcState;
int v105;
__int16 v106;
__int64 v107;
__int64 v108;
__int64 v109;
int result;
__int16 result_4;
__int64 v112;
__int64 v113;
__int64 v114;
v99 = a5;
v93 = a2;
v96 = 0i64;
v100 = 0i64;
ContainingSubsection = 0i64;
v94 = a4;
memset(&ApcState, 0, sizeof(ApcState));
memset((INT64)&result, 0i64);
memset((INT64)&v105, 0i64);
memset(&LockHandle, 0, sizeof(LockHandle));
memset((INT64)v102, 0i64);
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v8 = 0i64;
v80 = 17;
v9 = 0;
v79 = (__int64)CurrentThread;
v10 = 0i64;
v85 = 0;
v11 = 0i64;
v87 = 0i64;
if( !a1 )
return v9;
while( 1 )
{
v12 = a1;
OpaqueSession = 0i64;
a1 = (UINT64 *)*a1;
P = v12;
v13 = 0i64;
v82 = a1;
v14 = (struct _DMA_ADAPTER *)v12[1];
v15 = v12[4];
v16 = v12[2];
DmaAdapter = v14;
v89 = v12[3];
v83 = v15;
v97 = 0i64;
v92 = 0;
v91 = 0;
if( v14 && v14 != *((struct _DMA_ADAPTER **)KeGetCurrentThread() + 23) )
{
KeAcquireInStackQueuedSpinLock(&WorkerRoutine, &LockHandle);
v92 = MiPrepareAttachThread((INT64)v14, (INT64)&v14[104]);
v17 = v92;
KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
__writecr8(LockHandle.OldIrql);
if( v17 )
{
KeForceAttachProcess(v14);
v11 = v87;
LABEL_6:
v8 = 0i64;
LABEL_7:
v18 = v16 - 4096;
v19 = v83 - 4096;
v20 = 0i64;
v21 = v18 >> 12;
v22 = v18 + 4096;
if( v22 < v89 )
{
while( 1 )
{
v86 = ++v21;
v84 = v19 + 4096;
if( !v10 || (_MMPTE *)((char *)MmGetPdeBase() + ((v22 >> 18) & 0x3FFFFFF8)) == v11 )
{
v33 = v87;
}
else
{
if( HIDWORD(v112) != (_DWORD)v8 )
{
v31 = MiFreeWsleList(v10, (INT64)&result, 0);
v32 = v85;
if( v31 )
v32 = 277;
v85 = v32;
}
MiFlushTbList((__int64)&v105);
if( DmaAdapter )
{
if( v11 )
MiUnlockPageTableInternal(v10, (UINT64)v11);
MiUnlockWorkingSetShared(v10, v80);
}
else
{
MiUnlockSystemVa((INT64)v102);
}
v8 = 0i64;
v33 = 0i64;
v87 = 0i64;
v10 = 0i64;
}
if( !DmaAdapter )
break;
v90 = v8;
if( !v10 )
{
v10 = (INT64)&DmaAdapter[104];
if( (a3 & 1) != 0 )
{
v46 = MiTbFlushType((INT64)&DmaAdapter[104]);
v106 = 0;
v105 = v46;
v107 = 20i64;
v108 = v8;
v109 = v8;
}
v20 = v8;
v80 = MiLockWorkingSetShared(v10);
v8 = 0i64;
}
if( v20
&& v21 >= (*(unsigned int *)(v20 + 24) | ((unsigned __int64)*(unsigned __int8 *)(v20 + 32) << 32))
&& v21 <= (*(unsigned int *)(v20 + 28) | ((unsigned __int64)*(unsigned __int8 *)(v20 + 33) << 32)) )
{
v49 = v94;
}
else
{
Address = MiLocateAddress(v22);
v20 = (__int64)Address;
if( !Address )
goto LABEL_122;
v48 = (int)Address[2].Children[0];
if( (v48 & 0x100000) != 0 )
goto LABEL_122;
v49 = v94;
if( (*(_DWORD *)(v94 + 56) & 0x20) == 0 && (v48 & 0x70) != 0 )
goto LABEL_122;
ContainingSubsection = (_SUBSECTION *)Address[3].Children[0];
if( *(_QWORD *)ContainingSubsection != v94 )
goto LABEL_122;
}
if( (*(_DWORD *)(v49 + 56) & 0x20) != 0 )
{
v50 = *(_QWORD *)(v20 + 80);
if( (unsigned __int64)v99 < v50 )
goto LABEL_122;
v51 = *(unsigned int *)(v20 + 24);
if( (unsigned __int64)v99 >= v50
- 8 * (v51 | ((unsigned __int64)*(unsigned __int8 *)(v20 + 32) << 32))
+ 8
* ((*(unsigned int *)(v20 + 28) | ((unsigned __int64)*(unsigned __int8 *)(v20 + 33) << 32))
+ 1) )
goto LABEL_122;
v22 = ((__int64)&v99[-v50] >> 3 << 12)
+ ((v51 | ((unsigned __int64)*(unsigned __int8 *)(v20 + 32) << 32)) << 12);
}
else
{
ProtoPteAddress = MiGetProtoPteAddress((_MMVAD *)v20, v22 >> 12, 0i64, &ContainingSubsection);
if( !ProtoPteAddress
|| !ContainingSubsection
|| v84 != MiStartingOffset((__int64)ContainingSubsection, (unsigned __int64)ProtoPteAddress, 0xFFFFFFFF) )
{
goto LABEL_122;
}
v8 = 0i64;
}
PteBase = MmGetPteBase();
v54 = (INT64 *)((char *)PteBase + ((v22 >> 9) & 0x7FFFFFFFF8i64));
v55 = (_MMPTE *)((char *)PteBase + (((unsigned __int64)v54 >> 9) & 0x7FFFFFFFF8i64));
if( v33 != v55 )
{
if( v33 )
{
v22 -= 4096i64;
--v21;
v19 = v84 - 4096;
goto LABEL_121;
}
v87 = MiLockLowestValidPageTable(v10, v54, &v100);
v45 = v87 == v55;
LABEL_106:
if( !v45 )
goto LABEL_122;
}
LABEL_107:
v56 = (INT64 *)((char *)MmGetPteBase() + ((v22 >> 9) & 0x7FFFFFFFF8i64));
v96 = MI_READ_PTE_LOCK_FREE((INT64)v56);
v57 = v96;
if( (v96 & 1) != 0 )
{
v58 = (char *)MmGetPfnDb()
+ 48 * (((unsigned __int64)MI_READ_PTE_LOCK_FREE((INT64)&v96) >> 12) & 0xFFFFFFFFFi64);
if( (a3 & 8) == 0 || (v57 & 0x42) == 0 && (v58[34] & 0x10) == 0 )
{
LOBYTE(v61) = MI_PFN_IS_PROTO((UNICODE_STRING *)v58, *((UNICODE_STRING **)v58 + 2), v59, v60);
v8 = 0i64;
if( !v61 )
goto LABEL_145;
v64 = v62 & 0x400;
if( (a3 & 1) != 0 )
{
if( !v64 || (v57 & 0x42) == 0 )
goto LABEL_145;
v65 = MiLockPageInline(v63);
v66 = v58[34];
if( (v66 & 0x10) == 0 )
v58[34] = v66 | 0x10;
_InterlockedAnd64((volatile signed __int64 *)v58 + 3, 0x7FFFFFFFFFFFFFFFui64);
__writecr8(v65);
v96 &= 0xFFFFFFFFFFFFFFBDui64;
MiWriteValidPteNewProtection(v56, v96);
MiInsertTbFlushEntry((INT64)&v105, v22, 1i64, 0i64);
}
else
{
if( !v64 && (*(_DWORD *)(v94 + 56) & 0x80u) != 0 )
goto LABEL_145;
v69 = MiGetWsleContents(v63, v22) & 0xF;
if( *((_DWORD *)P + 11) == 3 && v69 == 9 )
goto LABEL_145;
if( v69 == 8 || (a3 & 0x10) != 0 )
{
if( (a3 & 8) == 0 && v93 != (_DWORD)v8 && (*(_BYTE *)(v10 + 184) & 7) != 2 )
{
LODWORD(v78) = v90;
locked = MiReplaceLockedPage(v10, (UINT64)v58, v22, (unsigned __int8)(a3 & 0x40) << 10, v78);
v8 = 0i64;
if( locked )
goto LABEL_145;
}
LABEL_144:
v85 = 277;
LABEL_145:
v21 = v86;
goto LABEL_120;
}
if( (_DWORD)dword_140C4E568 != (_DWORD)v8 )
{
MI_WSLE_LOG_ACCESS(v10, (UINT64)v56);
LODWORD(v8) = 0;
}
if( HIDWORD(v112) == (_DWORD)v8 )
{
result = MiTbFlushType(v10);
v112 = 20i64;
result_4 = 4;
v113 = v70;
v114 = v70;
}
MiInsertTbFlushEntry((INT64)&result, v22, 1i64, 0i64);
if( HIDWORD(v112) == (_DWORD)v112 )
{
v71 = MiFreeWsleList(v10, (INT64)&result, 0);
v8 = 0i64;
if( v71 )
goto LABEL_144;
goto LABEL_145;
}
}
}
v21 = v86;
}
v8 = 0i64;
LABEL_120:
v19 = v84;
LABEL_121:
v22 += 4096i64;
if( v22 >= v89 )
goto LABEL_122;
v11 = v87;
}
v90 = 1;
if( v10 )
{
LABEL_67:
SystemRegionType = MiGetSystemRegionType(v22);
if( *((_DWORD *)P + 11) )
goto LABEL_107;
if( SystemRegionType != 8 )
goto LABEL_122;
SystemCacheReverseMap = (_QWORD *)MiGetSystemCacheReverseMap(v22);
if( !SystemCacheReverseMap )
goto LABEL_122;
v40 = *(_QWORD *)(MiGetSystemCacheReverseMap(v22) + 24);
v41 = v40 & 0xFFFFFFFFFFFFFFFEui64;
if( (v40 & 1) == 0 )
v41 = v40;
if( v10 != *(_QWORD *)(qword_140C4E388 + 8i64 * (*(_WORD *)(*(_QWORD *)v41 + 60i64) & 0x3FF)) + 7232i64 )
goto LABEL_122;
v42 = SystemCacheReverseMap[2];
if( !v42 )
goto LABEL_122;
v43 = SystemCacheReverseMap[3];
ContainingSubsection = (_SUBSECTION *)v43;
if( (v43 & 1) != 0 )
{
v43 &= ~1ui64;
ContainingSubsection = (_SUBSECTION *)v43;
}
if( *(_QWORD *)v43 != v94 )
{
LABEL_122:
a1 = v82;
goto LABEL_123;
}
v44 = SystemCacheReverseMap[4];
if( (v42 & 3) == 0 )
v44 = 4 * (v44 & 0xFFFFFFFFFFFF0000ui64);
v45 = v44 + (v22 & 0x3FFFF) == v84;
goto LABEL_106;
}
v34 = MiGetSystemRegionType(v22);
switch( v34 )
{
case 8:
v35 = 0i64;
break;
case 1:
SessionVm = MiGetSessionVm();
LABEL_62:
v10 = SessionVm;
if( !SessionVm )
{
LABEL_155:
v30 = v79;
a1 = v82;
goto LABEL_156;
}
if( !(unsigned int)MiSynchronizeSystemVa(SessionVm, v22, v37, 0i64, (INT64)v102) )
goto LABEL_122;
v10 = v103;
if( (a3 & 1) != 0 )
{
v105 = MiTbFlushType(v103);
v107 = 20i64;
v106 = 0;
v108 = 0i64;
v109 = 0i64;
}
v87 = (_MMPTE *)((char *)MmGetPdeBase() + ((v22 >> 18) & 0x3FFFFFF8));
goto LABEL_67;
case 6:
v35 = 2i64;
break;
case 12:
v35 = 1i64;
break;
default:
goto LABEL_155;
}
SessionVm = (INT64)MiGetAnyMultiplexedVm(v35);
goto LABEL_62;
}
LABEL_123:
v14 = DmaAdapter;
goto LABEL_124;
}
goto LABEL_124;
}
v23 = *((_DWORD *)v12 + 11);
if( v23 < 2 )
goto LABEL_7;
v24 = *((unsigned int *)v12 + 10);
if( (_DWORD)v24 == -1 )
{
v13 = &Session;
}
else
{
if( (_DWORD)v24 == -2 )
goto LABEL_18;
LODWORD(v25) = MmGetSessionById(v24);
OpaqueSession = v25;
if( !v25 )
goto LABEL_124;
if( MmAttachSession(v25, &ApcState) < 0 )
{
MmQuitNextSession(OpaqueSession);
OpaqueSession = 0i64;
goto LABEL_124;
}
CurrentThread = (_ETHREAD *)v79;
v23 = *((_DWORD *)P + 11);
v13 = (_MMSESSION *)(*(_QWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 1368i64) + 192i64);
}
v97 = v13;
LABEL_18:
if( v23 == 3 )
{
v26 = MiGetSystemRegionType(v16);
if( *((_DWORD *)P + 10) == -2 )
{
if( v26 != 1 )
goto LABEL_6;
}
else if( v26 == 1 )
{
goto LABEL_6;
}
}
else if( (a3 & 6) == 0 )
{
--*((_WORD *)CurrentThread + 243);
ExAcquirePushLockSharedEx((UINT64)v13->SystemSpaceViewLockPointer, 0i64);
v8 = 0i64;
for( i = v97->ViewRoot.Root; ; i = i->Children[0] )
{
while( 1 )
{
if( !i )
goto LABEL_34;
v28 = i[3].ParentValue & 0xFFFFFFFFFFFFF000ui64;
if( (_RTL_BALANCED_NODE *)v16 < (_RTL_BALANCED_NODE *)((char *)i[1].Children[1] + v28) )
break;
i = i->Children[1];
}
if( v16 >= v28 )
break;
}
ContainingSubsection = (_SUBSECTION *)i[2].Children[0];
if( *(_QWORD *)ContainingSubsection != v94 || v16 + ((__int64)i[1].Children[0] << 12) - v15 != v28 )
{
LABEL_34:
SystemSpaceViewLockPointer = (INT64 *)v97->SystemSpaceViewLockPointer;
if( _InterlockedCompareExchange64(SystemSpaceViewLockPointer, 0i64, 17i64) != 17 )
ExfReleasePushLockShared(SystemSpaceViewLockPointer);
KeAbPostRelease(SystemSpaceViewLockPointer);
v30 = v79;
KiLeaveGuardedRegionUnsafe(v79);
goto LABEL_125;
}
v91 = 1;
goto LABEL_7;
}
LABEL_124:
v30 = v79;
LABEL_125:
if( v10 )
{
if( HIDWORD(v112) )
{
v67 = MiFreeWsleList(v10, (INT64)&result, 0);
v68 = v85;
if( v67 )
v68 = 277;
v85 = v68;
}
MiFlushTbList((__int64)&v105);
if( v14 )
{
if( v87 )
MiUnlockPageTableInternal(v10, (UINT64)v87);
MiUnlockWorkingSetShared(v10, v80);
}
else
{
MiUnlockSystemVa((INT64)v102);
}
v87 = 0i64;
v10 = 0i64;
}
LABEL_156:
if( v91 == 1 )
{
v73 = (INT64 *)v97->SystemSpaceViewLockPointer;
if( _InterlockedCompareExchange64(v73, 0i64, 17i64) != 17 )
ExfReleasePushLockShared(v73);
KeAbPostRelease(v73);
KiLeaveGuardedRegionUnsafe(v30);
}
v74 = OpaqueSession;
if( OpaqueSession )
{
MmDetachSession(OpaqueSession, &ApcState);
MmQuitNextSession(v74);
}
else if( v92 == 1 )
{
KeForceDetachProcess(&ApcState, 0);
MiAttachThreadDone((_MMSUPPORT_INSTANCE *)&DmaAdapter[104]);
}
if( DmaAdapter )
HalPutDmaAdapter(DmaAdapter);
ExFreePoolWithTag(P, 0);
if( v93 == 1 && (*v99 & 1) == 0 )
break;
v8 = 0i64;
if( !a1 )
return v85;
v11 = v87;
CurrentThread = (_ETHREAD *)v79;
}
while( a1 )
{
v75 = a1;
a1 = (UINT64 *)*a1;
v76 = (struct _DMA_ADAPTER *)v75[1];
if( v76 )
HalPutDmaAdapter(v76);
ExFreePoolWithTag(v75, 0);
}
return 0i64;
}Referenced by:
MiTrimSection