55#undef MmSetPageEntrySectionSegment
56#define MmSetPageEntrySectionSegment(S,O,E) \
57 _MmSetPageEntrySectionSegment((S),(O),(E),__FILE__,__LINE__)
292 ULONG cbFileHeaderOffsetSize = 0;
293 ULONG cbSectionHeadersOffset = 0;
294 ULONG cbSectionHeadersSize;
295 ULONG cbSectionHeadersOffsetSize = 0;
296 ULONG cbOptHeaderSize;
297 ULONG cbHeadersSize = 0;
298 ULONG nSectionAlignment;
299 ULONG nFileAlignment;
308 SIZE_T nPrevVirtualEndOfSegment = 0;
309 ULONG nFileSizeOfHeaders = 0;
314 ASSERT(FileHeaderSize > 0);
316 ASSERT(ImageSectionObject);
318 ASSERT(AllocateSegmentsCb);
324#define DIE(ARGS_) { DPRINT ARGS_; goto l_Return; }
327 pidhDosHeader = FileHeader;
334 DIE((
"Too small to be an MZ executable, size is %lu\n", FileHeaderSize));
338 DIE((
"No MZ signature found, e_magic is %hX\n", pidhDosHeader->
e_magic));
345 DIE((
"Not a Windows executable, e_lfanew is %d\n", pidhDosHeader->
e_lfanew));
348 DIE((
"The DOS stub is too large, e_lfanew is %X\n", pidhDosHeader->
e_lfanew));
350 if(FileHeaderSize < cbFileHeaderOffsetSize)
366 if(FileHeaderSize < cbFileHeaderOffsetSize ||
369 ULONG cbNtHeaderSize;
387 DIE((
"ReadFile failed, status %08X\n", ReturnedStatus));
398 DIE((
"The file doesn't contain the PE file header\n"));
400 pinhNtHeader =
pData;
414 DIE((
"The file isn't a PE executable, Signature is %X\n", pinhNtHeader->
Signature));
419 DIE((
"The full NT header is too large\n"));
422 if(cbReadSize < cbNtHeaderSize)
423 DIE((
"The file doesn't contain the full NT header\n"));
427 ULONG cbOptHeaderOffsetSize = 0;
433 DIE((
"The file isn't a PE executable, Signature is %X\n", pinhNtHeader->
Signature));
436 DIE((
"The DOS stub is too large, e_lfanew is %X\n", pidhDosHeader->
e_lfanew));
444 if(cbOptHeaderOffsetSize > FileHeaderSize)
445 goto l_ReadHeaderFromFile;
455 DIE((
"The optional header doesn't contain the Magic field, SizeOfOptionalHeader is %X\n", cbOptHeaderSize));
459 switch(piohOptHeader->
Magic)
464 DIE((
"Win64 optional header, unsupported\n"));
471 DIE((
"Unrecognized optional header, Magic is %X\n", piohOptHeader->
Magic));
481 DIE((
"Sections aren't page-aligned and the file alignment isn't the same\n"));
484 DIE((
"The section alignment is smaller than the file alignment\n"));
490 DIE((
"The section alignment (%u) and file alignment (%u) aren't both powers of 2\n", nSectionAlignment, nFileAlignment));
501 switch(piohOptHeader->
Magic)
510 ImageSectionObject->ImageInformation.ImageFileSize = piohOptHeader->
SizeOfImage;
513 ImageSectionObject->ImageInformation.MaximumStackSize = piohOptHeader->
SizeOfStackReserve;
516 ImageSectionObject->ImageInformation.CommittedStackSize = piohOptHeader->
SizeOfStackCommit;
520 ImageSectionObject->ImageInformation.SubSystemType = piohOptHeader->
Subsystem;
532 ImageSectionObject->ImageInformation.TransferAddress = (
PVOID) (ImageBase +
537 ImageSectionObject->ImageInformation.ImageContainsCode = piohOptHeader->
SizeOfCode != 0;
539 ImageSectionObject->ImageInformation.ImageContainsCode =
TRUE;
545 ImageSectionObject->ImageInformation.ImageContainsCode =
FALSE;
550 ImageSectionObject->ImageInformation.LoaderFlags = piohOptHeader->
LoaderFlags;
554 ImageSectionObject->ImageInformation.DllCharacteristics = piohOptHeader->
DllCharacteristics;
584 DIE((
"ImageBase exceeds the address space\n"));
590 DIE((
"SizeOfImage exceeds the address space\n"));
592 ImageSectionObject->ImageInformation.ImageFileSize = pioh64OptHeader->
SizeOfImage;
598 DIE((
"SizeOfStackReserve exceeds the address space\n"));
606 DIE((
"SizeOfStackCommit exceeds the address space\n"));
613 ImageSectionObject->ImageInformation.SubSystemType = pioh64OptHeader->
Subsystem;
625 ImageSectionObject->ImageInformation.TransferAddress = (
PVOID) (ImageBase +
630 ImageSectionObject->ImageInformation.ImageContainsCode = pioh64OptHeader->
SizeOfCode != 0;
632 ImageSectionObject->ImageInformation.ImageContainsCode =
TRUE;
638 ImageSectionObject->ImageInformation.ImageContainsCode =
FALSE;
643 ImageSectionObject->ImageInformation.LoaderFlags = pioh64OptHeader->
LoaderFlags;
646 ImageSectionObject->ImageInformation.DllCharacteristics = pioh64OptHeader->
DllCharacteristics;
655 DIE((
"ImageBase is not aligned on a 64KB boundary"));
659 ImageSectionObject->ImageInformation.GpValue = 0;
660 ImageSectionObject->ImageInformation.ZeroBits = 0;
661 ImageSectionObject->BasedAddress = (
PVOID)ImageBase;
679 DIE((
"Offset overflow\n"));
682 DIE((
"Offset overflow\n"));
688 if(!
Intsafe_AddULong32(&cbSectionHeadersOffsetSize, cbSectionHeadersOffset, cbSectionHeadersSize))
689 DIE((
"Section headers too large\n"));
698 DIE((
"The section headers overflow SizeOfHeaders\n"));
702 else if(!
AlignUp(&cbHeadersSize, cbSectionHeadersOffsetSize, nFileAlignment))
703 DIE((
"Overflow aligning the size of headers\n"));
714 if(FileHeaderSize < cbSectionHeadersOffsetSize)
715 pishSectionHeaders =
NULL;
723 pishSectionHeaders = (
PVOID)((
UINT_PTR)FileHeader + cbSectionHeadersOffset);
730 if(FileHeaderSize < cbSectionHeadersOffsetSize ||
736 lnOffset.
QuadPart = cbSectionHeadersOffset;
739 nStatus = ReadFileCb(
File, &lnOffset, cbSectionHeadersSize, &
pData, &
pBuffer, &cbReadSize);
742 DIE((
"ReadFile failed with status %08X\n", nStatus));
751 if(cbReadSize < cbSectionHeadersSize)
752 DIE((
"The file doesn't contain all of the section headers\n"));
754 pishSectionHeaders =
pData;
768 ImageSectionObject->Segments = AllocateSegmentsCb(ImageSectionObject->NrSegments);
770 if(ImageSectionObject->Segments ==
NULL)
771 DIE((
"AllocateSegments failed\n"));
774 pssSegments = ImageSectionObject->Segments;
778 if(!
AlignUp(&nFileSizeOfHeaders, cbHeadersSize, nFileAlignment))
779 DIE((
"Cannot align the size of the section headers\n"));
781 nPrevVirtualEndOfSegment =
ALIGN_UP_BY(cbHeadersSize, nSectionAlignment);
782 if (nPrevVirtualEndOfSegment < cbHeadersSize)
783 DIE((
"Cannot align the size of the section headers\n"));
785 pssSegments[0].
Image.FileOffset = 0;
789 pssSegments[0].
Image.VirtualAddress = 0;
790 pssSegments[0].
Image.Characteristics = 0;
798 ASSERT(ImageSectionObject->RefCount > 0);
801 for(
i = 0;
i < ImageSectionObject->NrSegments - 1; ++
i)
803 ULONG nCharacteristics;
807 DIE((
"Image.VirtualAddress[%u] is not aligned\n",
i));
811 DIE((
"Memory gap between section %u and the previous\n",
i));
814 if(pishSectionHeaders[
i].PointerToRawData != 0 && pishSectionHeaders[
i].SizeOfRawData != 0)
821 if(!
IsAligned(pishSectionHeaders[
i].SizeOfRawData, nFileAlignment))
822 DIE((
"SizeOfRawData[%u] is not aligned\n",
i));
829 DIE((
"SizeOfRawData[%u] too large\n",
i));
839 ASSERT(pssSegments[
i].RawLength.QuadPart == 0);
869 if(AlignedLength < pssSegments[
i].
Length.LowPart)
870 DIE((
"Cannot align the virtual size of section %u\n",
i));
874 if(pssSegments[
i].
Length.QuadPart == 0)
875 DIE((
"Virtual size of section %u is null\n",
i));
882 if (nPrevVirtualEndOfSegment < pssSegments[
i].
Image.VirtualAddress)
883 DIE((
"The image is too large\n"));
942 if (SavedSwapEntry != 0)
993MmDereferenceSegmentWithLock(
1022 Segment->FileObject->SectionObjectPointer->DataSectionObject =
NULL;
1037 ASSERT(ImageSectionObject->
FileObject->SectionObjectPointer->ImageSectionObject == ImageSectionObject);
1038 ImageSectionObject->
FileObject->SectionObjectPointer->ImageSectionObject =
NULL;
1044 SectionSegments = ImageSectionObject->
Segments;
1045 for (
i = 0;
i < NrSegments;
i++)
1070 DPRINT1(
"Entry == 0 for MmSharePageEntrySectionSegment\n");
1075 DPRINT1(
"Maximum share count reached\n");
1101 DPRINT1(
"Entry == 0 for MmUnsharePageEntrySectionSegment\n");
1176 if (DestAddress ==
NULL)
1214 if (RangeEnd %
_64K)
1215 RangeEnd +=
_64K - (RangeEnd %
_64K);
1227 if (RangeEnd >
Segment->RawLength.QuadPart)
1228 RangeEnd =
Segment->RawLength.QuadPart;
1232 for ( ; RangeStart < RangeEnd; RangeStart +=
_64K)
1235 ULONG ToReadPageBits = 0;
1238 if (ChunkEnd > RangeEnd)
1239 ChunkEnd = RangeEnd;
1242 for (
LONGLONG ChunkOffset = RangeStart; ChunkOffset < ChunkEnd; ChunkOffset +=
PAGE_SIZE)
1246 CurrentOffset.
QuadPart = ChunkOffset;
1270 ToReadPageBits |= 1UL << ((ChunkOffset - RangeStart) >>
PAGE_SHIFT);
1277 DPRINT1(
"Failed to set wait entry for segment %p at offset %I64d\n",
Segment, ChunkOffset);
1279 RollbackOffset.
QuadPart = ChunkOffset;
1280 while (RollbackOffset.
QuadPart > RangeStart)
1296 if (ToReadPageBits == 0)
1304 while (ChunkOffset < ChunkEnd)
1313 ToReadPageBits >>= BitSet;
1315 ASSERT(ChunkOffset < ChunkEnd);
1335 while (ChunkOffset < ChunkEnd)
1337 if (ToReadPageBits & 1)
1340 CurrentOffset.
QuadPart = ChunkOffset;
1344 ToReadPageBits >>= 1;
1374 if (
FileOffset.QuadPart > ValidDataLength->QuadPart)
1377 goto AssignPagesToSegment;
1419 while (ChunkOffset < ChunkEnd)
1421 if (ToReadPageBits & 1)
1424 CurrentOffset.
QuadPart = ChunkOffset;
1428 ToReadPageBits >>= 1;
1436AssignPagesToSegment:
1456 ToReadPageBits >>= BitSet;
1502 if (SwapEntry != MM_WAIT_ENTRY)
1625 DPRINT1(
"Removing PAGE_GUARD protection failed : 0x%08x.\n",
Status);
1639 if (SwapEntry == MM_WAIT_ENTRY)
1664 ASSERT(DummyEntry == SwapEntry);
1674 DPRINT1(
"MmReadFromSwapPage failed, status = %x\n",
Status);
1680 ASSERT(DummyEntry == MM_WAIT_ENTRY);
1688 DPRINT(
"MmCreateVirtualMapping failed, not out of memory\n");
1730 DPRINT(
"MmCreateVirtualMappingUnsafe failed, not out of memory\n");
1783 DPRINT1(
"Unable to create virtual mapping\n");
1815 DPRINT1(
"Failed to page data in!\n");
1829 if (SwapEntry == MM_WAIT_ENTRY)
1872 DPRINT1(
"Someone changed ppte entry while we slept (%x vs %x)\n",
Entry, Entry1);
1888 DPRINT1(
"Unable to create virtual mapping\n");
1916 DPRINT1(
"Unable to create virtual mapping\n");
2052 DPRINT(
"Swapping page (Old %x New %x)\n", OldPage, NewPage);
2054 if (!Unmapped || (UnmappedPage != OldPage))
2074 DPRINT1(
"MmCreateVirtualMapping failed, unable to create virtual mapping, not out of memory\n");
2120 if (OldProtect !=
NULL)
2121 *OldProtect =
Region->Protect;
2137 PVOID RegionBaseAddress;
2159 Info->BaseAddress = RegionBaseAddress;
2181 DPRINT(
"MmpDeleteSection(ObjectBody %p)\n", ObjectBody);
2262 sizeof(*PhysSection),
2265 (
PVOID*)&PhysSection);
2268 DPRINT1(
"MmCreatePhysicalMemorySection: failed to create object (0x%lx)\n",
Status);
2297 Segment->Image.FileOffset = 0;
2299 Segment->RawLength = SectionSize;
2300 Segment->Length = SectionSize;
2303 Segment->Image.VirtualAddress = 0;
2304 Segment->Image.Characteristics = 0;
2331 DPRINT(
"Creating Section Object Type\n");
2338 RtlZeroMemory(&ObjectTypeInitializer,
sizeof(ObjectTypeInitializer));
2340 ObjectTypeInitializer.
Length =
sizeof(ObjectTypeInitializer);
2426 if ((UMaximumSize !=
NULL) && (UMaximumSize->
QuadPart != 0))
2535 Segment->Image.FileOffset = 0;
2538 Segment->Image.Characteristics = 0;
2549 Segment->Image.VirtualAddress = 0;
2554 Segment->SegFlags &= ~MM_SEGMENT_INCREATE;
2650 ULONG OffsetAdjustment;
2673 OffsetAdjustment =
FileOffset.u.LowPart - AdjustOffset;
2705 *ReadSize = UsedSize - OffsetAdjustment;
2716# define MmspAssertSegmentsSorted(OBJ_) ((void)0)
2717# define MmspAssertSegmentsNoOverlap(OBJ_) ((void)0)
2718# define MmspAssertSegmentsPageAligned(OBJ_) ((void)0)
2727 for(
i = 1;
i < ImageSectionObject->NrSegments; ++
i )
2729 ASSERT(ImageSectionObject->Segments[
i].Image.VirtualAddress >=
2730 ImageSectionObject->Segments[
i - 1].Image.VirtualAddress);
2743 for(
i = 0;
i < ImageSectionObject->NrSegments; ++
i )
2745 ASSERT(ImageSectionObject->Segments[
i].Length.QuadPart > 0);
2749 ASSERT(ImageSectionObject->Segments[
i].Image.VirtualAddress >=
2750 (ImageSectionObject->Segments[
i - 1].Image.VirtualAddress +
2751 ImageSectionObject->Segments[
i - 1].Length.QuadPart));
2763 for(
i = 0;
i < ImageSectionObject->NrSegments; ++
i )
2765 ASSERT((ImageSectionObject->Segments[
i].Image.VirtualAddress %
PAGE_SIZE) == 0);
2766 ASSERT((ImageSectionObject->Segments[
i].Length.QuadPart %
PAGE_SIZE) == 0);
2780 if (Segment1->
Image.VirtualAddress > Segment2->
Image.VirtualAddress)
2782 else if (Segment1->
Image.VirtualAddress < Segment2->
Image.VirtualAddress)
2803 qsort(ImageSectionObject->Segments,
2804 ImageSectionObject->NrSegments,
2805 sizeof(ImageSectionObject->Segments[0]),
2833 ASSERT(ImageSectionObject->NrSegments >= 1);
2835 for (
i = 0;
i < ImageSectionObject->NrSegments; ++
i )
2837 if(ImageSectionObject->Segments[
i].Length.QuadPart == 0)
2851 if ((ImageSectionObject->Segments[
i - 1].Image.VirtualAddress +
2852 ImageSectionObject->Segments[
i - 1].Length.QuadPart) !=
2853 ImageSectionObject->Segments[
i].Image.VirtualAddress)
2887 EffectiveSegment = &ImageSectionObject->Segments[LastSegment];
2889 for (
i = 0;
i < ImageSectionObject->NrSegments; ++
i )
2906 EffectiveSegment->
Image.VirtualAddress;
2911 if (EffectiveSegment->
Image.FileOffset < VirtualOffset)
2921 EffectiveSegment->
Image.FileOffset -= VirtualOffset;
2936 if (EndOfEffectiveSegment ==
Segment->Image.VirtualAddress)
2940 ASSERT(LastSegment < ImageSectionObject->NrSegments);
2942 EffectiveSegment = &ImageSectionObject->Segments[LastSegment];
2944 if (LastSegment !=
i)
2964 else if (EndOfEffectiveSegment >
Segment->Image.VirtualAddress)
2966 static const ULONG FlagsToProtection[16] =
2986 unsigned ProtectionFlags;
2993 if (
Segment->Image.FileOffset != (EffectiveSegment->
Image.FileOffset +
3007 EffectiveSegment->
Image.VirtualAddress;
3015 ProtectionFlags = 0;
3018 ProtectionFlags |= 1 << 0;
3021 ProtectionFlags |= 1 << 1;
3024 ProtectionFlags |= 1 << 2;
3027 ProtectionFlags |= 1 << 3;
3029 ASSERT(ProtectionFlags < 16);
3030 EffectiveSegment->
Protection = FlagsToProtection[ProtectionFlags];
3048 ImageSectionObject->NrSegments = LastSegment + 1;
3059 PVOID FileHeaderBuffer;
3060 ULONG FileHeaderSize;
3062 ULONG OldNrSegments;
3082 if (FileHeaderSize == 0)
3105 if (ImageSectionObject->Segments)
3108 ImageSectionObject->Segments =
NULL;
3163 OldNrSegments = ImageSectionObject->
NrSegments;
3169 if (ImageSectionObject->
NrSegments < OldNrSegments)
3180 if (Segments ==
NULL)
3185 ImageSectionObject->
Segments = Segments;
3226 DPRINT1(
"Denying section creation due to missing cache initialization\n");
3262grab_image_section_object:
3266 ImageSectionObject =
FileObject->SectionObjectPointer->ImageSectionObject;
3274 ImageSectionObject =
FileObject->SectionObjectPointer->ImageSectionObject;
3277 if (ImageSectionObject ==
NULL)
3285 if (ImageSectionObject ==
NULL)
3296 if (
FileObject->SectionObjectPointer->ImageSectionObject !=
NULL)
3301 goto grab_image_section_object;
3304 FileObject->SectionObjectPointer->ImageSectionObject = ImageSectionObject;
3359 ImageSectionObject->
SegFlags &= ~MM_SEGMENT_INCREATE;
3371 ImageSectionObject->
SegFlags &= ~MM_IMAGE_SECTION_FLUSH_DELETE;
3456 DPRINT1(
"Mapping between 0x%p and 0x%p failed (%X).\n",
3540 if (SavedSwapEntry != 0)
3619 MmDereferenceSegment(
Segment);
3634 PVOID ImageBaseAddress = 0;
3636 DPRINT(
"Opening memory area Process %p BaseAddress %p\n",
3669 SectionSegments = ImageSectionObject->
Segments;
3676 for (
i = 0;
i < NrSegments;
i++)
3678 if (
Segment == &SectionSegments[
i])
3684 if (
i >= NrSegments)
3689 for (
i = 0;
i < NrSegments;
i++)
3692 ((
char*)ImageBaseAddress + (
ULONG_PTR)SectionSegments[
i].
Image.VirtualAddress);
3697 DPRINT1(
"MmUnmapViewOfSegment failed for %p (Process %p) with %lx\n",
3702 DPRINT(
"One mapping less for %p\n", ImageSectionObject->
FileObject->SectionObjectPointer);
3722 DPRINT1(
"MmUnmapViewOfSegment failed for %p (Process %p) with %lx\n",
3734 MmDereferenceSegment(
Segment);
3746 MmDereferenceSegment(
Segment);
3769 MmDereferenceSegment(
Segment);
3823 SectionInformationLength,
3870 switch(SectionInformationClass)
3965 DPRINT1(
"Unknown SectionInformationClass: %d\n", SectionInformationClass);
4044 DPRINT(
"Mapping ARM3 section into %s\n",
Process->ImageFileName);
4091 SectionSegments = ImageSectionObject->
Segments;
4103 for (
i = 0;
i < NrSegments;
i++)
4108 ImageSize =
max(ImageSize, MaxExtent);
4115 ((ImageBase + ImageSize) < ImageSize))
4149 for (
i = 0;
i < NrSegments;
i++)
4152 ((
char*)ImageBase + (
ULONG_PTR)SectionSegments[
i].
Image.VirtualAddress);
4156 &SectionSegments[
i],
4158 SectionSegments[
i].
Length.QuadPart,
4168 SBaseAddress = ((
char*)ImageBase + (
ULONG_PTR)SectionSegments[
i].
Image.VirtualAddress);
4181 DPRINT(
"Mapped %p for section pointer %p\n", ImageSectionObject, ImageSectionObject->
FileObject->SectionObjectPointer);
4228 DPRINT1(
"Section offset overflows\n");
4239 DPRINT1(
"Section offset and size are larger than section\n");
4251 DPRINT1(
"ViewSize is larger than SIZE_T_MAX\n");
4316 DPRINT1(
"ERROR: File can't be truncated because it has an image section\n");
4328 if ((
Segment->SectionCount == 0) ||
4347 DPRINT1(
"ERROR: File can't be truncated because it has references held to its data section\n");
4352 MmDereferenceSegment(
Segment);
4354 DPRINT(
"FIXME: didn't check for outstanding write probes\n");
4412 case MmFlushForDelete:
4420 case MmFlushForWrite:
4437 if (!ImageSectionObject)
4439 DPRINT(
"No image section object. Accepting\n");
4450 DPRINT(
"Denying. There are mappings open\n");
4477 MmDereferenceSegmentWithLock(&ImageSectionObject->
Segments[0],
OldIrql);
4486 MmDereferenceSegmentWithLock(&ImageSectionObject->
Segments[0],
OldIrql);
4537 DPRINT(
"MmMapViewInSystemSpaceEx() called\n");
4610 DPRINT(
"MmUnmapViewInSystemSpace() called\n");
4689 DPRINT1(
"SEC_LARGE_PAGES is not supported\n");
4716 DPRINT1(
"Page protection is invalid\n");
4726 DPRINT1(
"Large pages cannot be used with an image mapping\n");
4735 HaveFileObject =
TRUE;
4766 DPRINT1(
"Cannot create image maps with writers open on the file!\n");
4772 DPRINT1(
"Creating image map with writers open on the file!\n");
4932 MmDereferenceSegment(
Segment);
4958 MmDereferenceSegment(
Segment);
4975 MmDereferenceSegment(
Segment);
4988 MmDereferenceSegment(
Segment);
5029 MmDereferenceSegment(
Segment);
5049 MmDereferenceSegment(
Segment);
5106 MmDereferenceSegment(
Segment);
5131 Iosb->Information = 0;
5154 MmDereferenceSegment(
Segment);
5181 MmDereferenceSegment(
Segment);
5208 DPRINT(
"Checking segment for file %wZ at offset 0x%I64X.\n", &
Segment->FileObject->FileName,
Offset->QuadPart);
5271 DPRINT(
"Writing page at offset %I64d for file %wZ, Pageout: %s\n",
5314 DPRINT1(
"Failed to allocate a swap page!\n");
NTSTATUS MiMapViewInSystemSpace(_In_ PVOID Section, _In_ PMMSESSION Session, _Outptr_result_bytebuffer_(*ViewSize) PVOID *MappedBase, _Inout_ PSIZE_T ViewSize, _Inout_ PLARGE_INTEGER SectionOffset)
NTSTATUS NTAPI MmCreateArm3Section(OUT PVOID *SectionObject, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN PLARGE_INTEGER InputMaximumSize, IN ULONG SectionPageProtection, IN ULONG AllocationAttributes, IN HANDLE FileHandle OPTIONAL, IN PFILE_OBJECT FileObject OPTIONAL)
VOID NTAPI MiDeleteARM3Section(PVOID ObjectBody)
NTSTATUS NTAPI MmMapViewOfArm3Section(IN PVOID SectionObject, IN PEPROCESS Process, IN OUT PVOID *BaseAddress, IN ULONG_PTR ZeroBits, IN SIZE_T CommitSize, IN OUT PLARGE_INTEGER SectionOffset OPTIONAL, IN OUT PSIZE_T ViewSize, IN SECTION_INHERIT InheritDisposition, IN ULONG AllocationType, IN ULONG Protect)
ACCESS_MASK MmMakeFileAccess[8]
MM_AVL_TABLE MmSectionBasedRoot
ULONG NTAPI MiMakeProtectionMask(IN ULONG Protect)
#define ALIGN_DOWN_BY(size, align)
#define ALIGN_UP_BY(size, align)
_In_ PVOID _In_ ULONG _Out_ PVOID _In_ ULONG _Inout_ PULONG _In_ KPROCESSOR_MODE PreviousMode
#define InterlockedIncrement
#define InterlockedDecrement
#define InterlockedIncrement64(a)
DECLSPEC_NORETURN VOID NTAPI KeBugCheck(ULONG BugCheckCode)
VOID NTAPI CcFlushCache(IN PSECTION_OBJECT_POINTERS SectionObjectPointer, IN OPTIONAL PLARGE_INTEGER FileOffset, IN ULONG Length, OUT OPTIONAL PIO_STATUS_BLOCK IoStatus)
_In_ PFCB _In_ LONGLONG FileOffset
#define _Requires_lock_held_(lock)
#define _Requires_lock_not_held_(lock)
#define _Releases_lock_(lock)
#define _Requires_exclusive_lock_held_(lock)
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
void __cdecl qsort(_Inout_updates_bytes_(_NumOfElements *_SizeOfElements) void *_Base, _In_ size_t _NumOfElements, _In_ size_t _SizeOfElements, _In_ int(__cdecl *_PtFuncCompare)(const void *, const void *))
#define STATUS_NOT_SUPPORTED
#define STATUS_NOT_IMPLEMENTED
VOID NTAPI DbgkUnMapViewOfSection(IN PVOID BaseAddress)
#define NT_SUCCESS(StatCode)
#define _IRQL_requires_max_(irql)
#define _IRQL_requires_(irql)
#define ExAllocatePoolWithTag(hernya, size, tag)
#define IsListEmpty(ListHead)
#define KeRaiseIrql(irql, oldIrql)
#define KeWaitForSingleObject(pEvt, foo, a, b, c)
#define KeInitializeEvent(pEvt, foo, foo2)
#define KeLowerIrql(oldIrql)
#define RemoveHeadList(ListHead)
#define KeDelayExecutionThread(mode, foo, t)
#define ExGetPreviousMode
#define InterlockedIncrementUL(Addend)
VOID NTAPI ProbeForWrite(IN PVOID Address, IN SIZE_T Length, IN ULONG Alignment)
#define BooleanFlagOn(F, SF)
IN PFCB IN FAT_FLUSH_TYPE FlushType
_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE FileHandle
_Must_inspect_result_ _In_ USHORT NewSize
@ FileEndOfFileInformation
_Must_inspect_result_ _In_ PDEVICE_OBJECT _In_ PSECTION_OBJECT_POINTERS SectionObjectPointer
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
_Must_inspect_result_ _Out_ PLARGE_INTEGER FileSize
_Must_inspect_result_ _Outptr_ PVOID * SectionObject
#define FSRTL_MOD_WRITE_TOP_LEVEL_IRP
GLint GLint GLint GLint GLint x
GLint GLint GLint GLint GLint GLint y
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint i
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint GLint GLint j
VOID FASTCALL ExAcquireFastMutex(IN PFAST_MUTEX FastMutex)
VOID FASTCALL ExReleaseFastMutex(IN PFAST_MUTEX FastMutex)
#define EXCEPTION_EXECUTE_HANDLER
#define InterlockedDecrement64
unsigned char _BitScanForward(unsigned long *_Index, unsigned long _Mask)
NTSTATUS NTAPI IoPageRead(IN PFILE_OBJECT FileObject, IN PMDL Mdl, IN PLARGE_INTEGER Offset, IN PKEVENT Event, IN PIO_STATUS_BLOCK StatusBlock)
NTSTATUS NTAPI IoSetInformation(IN PFILE_OBJECT FileObject, IN FILE_INFORMATION_CLASS FileInformationClass, IN ULONG Length, IN PVOID FileInformation)
NTSTATUS NTAPI IoSynchronousPageWrite(IN PFILE_OBJECT FileObject, IN PMDL Mdl, IN PLARGE_INTEGER Offset, IN PKEVENT Event, IN PIO_STATUS_BLOCK StatusBlock)
POBJECT_TYPE IoFileObjectType
PFN_NUMBER MmHighestPhysicalPage
FORCEINLINE BOOLEAN MiIsRosSectionObject(IN PSECTION Section)
#define MM_INVALID_PROTECTION
NTSTATUS NTAPI MiRosUnmapViewInSystemSpace(IN PVOID MappedBase)
NTSTATUS NTAPI MiRosUnmapViewOfSection(_In_ PEPROCESS Process, _In_ PMEMORY_AREA MemoryArea, _In_ PVOID BaseAddress, _In_ BOOLEAN SkipDebuggerNotify)
VOID NTAPI MmUnmapLockedPages(IN PVOID BaseAddress, IN PMDL Mdl)
#define ExFreePoolWithTag(_P, _T)
FORCEINLINE PVOID ExAllocatePoolZero(ULONG PoolType, SIZE_T NumberOfBytes, ULONG Tag)
#define InitializeObjectAttributes(p, n, a, r, s)
unsigned __int3264 UINT_PTR
__in UCHAR __in POWER_STATE __in_opt PVOID __in PIO_STATUS_BLOCK IoStatus
#define MM_ALLOCATION_GRANULARITY
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T _Inout_opt_ PLARGE_INTEGER _Inout_ PSIZE_T _In_ SECTION_INHERIT InheritDisposition
_In_ ACCESS_MASK _In_opt_ POBJECT_ATTRIBUTES _In_opt_ PLARGE_INTEGER MaximumSize
_In_ ACCESS_MASK _In_opt_ POBJECT_ATTRIBUTES _In_opt_ PLARGE_INTEGER _In_ ULONG SectionPageProtection
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR ZeroBits
_In_ ACCESS_MASK _In_opt_ POBJECT_ATTRIBUTES _In_opt_ PLARGE_INTEGER _In_ ULONG _In_ ULONG AllocationAttributes
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID * BaseAddress
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T _Inout_opt_ PLARGE_INTEGER _Inout_ PSIZE_T _In_ SECTION_INHERIT _In_ ULONG AllocationType
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T _Inout_opt_ PLARGE_INTEGER SectionOffset
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T CommitSize
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T _Inout_opt_ PLARGE_INTEGER _Inout_ PSIZE_T ViewSize
__kernel_entry _Inout_ _Inout_ PSIZE_T RegionSize
struct _SEGMENT * PSEGMENT
enum _SECTION_INFORMATION_CLASS SECTION_INFORMATION_CLASS
struct _SECTION_IMAGE_INFORMATION * PSECTION_IMAGE_INFORMATION
struct _MMSUPPORT * PMMSUPPORT
struct _MEMORY_BASIC_INFORMATION MEMORY_BASIC_INFORMATION
@ SectionBasicInformation
@ SectionImageInformation
#define PAGE_ROUND_DOWN(x)
#define OBJ_KERNEL_EXCLUSIVE
NTSTATUS NTAPI MmCreateCacheSection(PSECTION *SectionObject, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PLARGE_INTEGER UMaximumSize, ULONG SectionPageProtection, ULONG AllocationAttributes, PFILE_OBJECT FileObject)
VOID NTAPI MmFreePageTablesSectionSegment(PMM_SECTION_SEGMENT Segment, FREE_SECTION_PAGE_FUN FreePage)
_In_ PMEMORY_AREA MemoryArea
NTSTATUS NTAPI MmUnmapViewOfCacheSegment(PMMSUPPORT AddressSpace, PVOID BaseAddress)
NTSTATUS NTAPI _MiMapViewOfSegment(PMMSUPPORT AddressSpace, PMM_SECTION_SEGMENT Segment, PVOID *BaseAddress, SIZE_T ViewSize, ULONG Protect, PLARGE_INTEGER ViewOffset, ULONG AllocationType, const char *file, int line)
_In_ PMEMORY_AREA _In_ PVOID _In_ BOOLEAN Locked
VOID NTAPI MiInitializeSectionPageTable(PMM_SECTION_SEGMENT Segment)
#define _Outptr_result_bytebuffer_(s)
#define SECTION_MAP_EXECUTE
#define SECTION_MAP_WRITE
#define PAGE_EXECUTE_READ
#define SECTION_ALL_ACCESS
NTSYSAPI VOID NTAPI RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString)
enum _SECTION_INHERIT SECTION_INHERIT
#define STANDARD_RIGHTS_READ
#define STANDARD_RIGHTS_WRITE
#define PAGE_EXECUTE_WRITECOPY
#define STANDARD_RIGHTS_EXECUTE
#define PAGE_EXECUTE_READWRITE
#define TYPE_ALIGNMENT(t)
#define RTL_CONTAINS_FIELD(Struct, Size, Field)
#define RTL_SIZEOF_THROUGH_FIELD(type, field)
#define UNREFERENCED_PARAMETER(P)
_In_ ULONG _In_ ULONG Offset
_In_ ULONG _In_ ULONG _In_ ULONG Length
#define IMAGE_SCN_MEM_WRITE
#define IMAGE_NT_OPTIONAL_HDR32_MAGIC
#define IMAGE_SCN_CNT_INITIALIZED_DATA
#define IMAGE_NT_OPTIONAL_HDR64_MAGIC
#define IMAGE_SCN_CNT_CODE
#define IMAGE_SCN_MEM_EXECUTE
#define IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
#define IMAGE_SCN_MEM_READ
#define IMAGE_SCN_CNT_UNINITIALIZED_DATA
#define IMAGE_SCN_MEM_SHARED
NTSTATUS NTAPI MiSimpleRead(PFILE_OBJECT FileObject, PLARGE_INTEGER FileOffset, PVOID Buffer, ULONG Length, BOOLEAN Paging, PIO_STATUS_BLOCK ReadStatus)
NTSTATUS NTAPI FsRtlGetFileSize(IN PFILE_OBJECT FileObject, IN OUT PLARGE_INTEGER FileSize)
_Check_return_ NTSTATUS NTAPI FsRtlAcquireFileForModWriteEx(_In_ PFILE_OBJECT FileObject, _In_ PLARGE_INTEGER EndingOffset, _Outptr_result_maybenull_ PERESOURCE *ResourceToRelease)
Lock a file object before flushing pages to disk. To be called by the Modified Page Writer (MPW)
VOID NTAPI FsRtlReleaseFileForModWrite(_In_ PFILE_OBJECT FileObject, _In_ PERESOURCE ResourceToRelease)
Unlock a file object after flushing pages to disk. To be called by the Modified Page Writer (MPW) aft...
VOID NTAPI FsRtlReleaseFile(IN PFILE_OBJECT FileObject)
VOID NTAPI FsRtlAcquireFileExclusive(IN PFILE_OBJECT FileObject)
NTSTATUS NTAPI FsRtlAcquireToCreateMappedSection(_In_ PFILE_OBJECT FileObject, _In_ ULONG SectionPageProtection)
#define MM_HIGHEST_VAD_ADDRESS
#define MmGetPageEntrySectionSegment(S, O)
#define MI_SET_PROCESS2(x)
FORCEINLINE VOID MmLockAddressSpace(PMMSUPPORT AddressSpace)
VOID NTAPI MmSetPageProtect(struct _EPROCESS *Process, PVOID Address, ULONG flProtect)
VOID NTAPI MiUnmapPageInHyperSpace(IN PEPROCESS Process, IN PVOID Address, IN KIRQL OldIrql)
VOID NTAPI MmGetPageFileMapping(PEPROCESS Process, PVOID Address, SWAPENTRY *SwapEntry)
ULONG NTAPI MmGetPageProtect(struct _EPROCESS *Process, PVOID Address)
#define MmLockSectionSegment(x)
NTSTATUS NTAPI MmCreateMemoryArea(PMMSUPPORT AddressSpace, ULONG Type, PVOID *BaseAddress, SIZE_T Length, ULONG Protection, PMEMORY_AREA *Result, ULONG AllocationFlags, ULONG AllocationGranularity)
#define SHARE_COUNT_FROM_SSE(E)
PVOID NTAPI MiMapPageInHyperSpace(IN PEPROCESS Process, IN PFN_NUMBER Page, IN PKIRQL OldIrql)
#define MM_VIRTMEM_GRANULARITY
NTSTATUS NTAPI MmFreeMemoryArea(PMMSUPPORT AddressSpace, PMEMORY_AREA MemoryArea, PMM_FREE_PAGE_FUNC FreePage, PVOID FreePageContext)
#define MmUnlockSectionSegment(x)
BOOLEAN NTAPI MmIsPageSwapEntry(struct _EPROCESS *Process, PVOID Address)
BOOLEAN NTAPI MmIsDisabledPage(struct _EPROCESS *Process, PVOID Address)
SWAPENTRY NTAPI MmAllocSwapPage(VOID)
PMEMORY_AREA NTAPI MmLocateMemoryAreaByAddress(PMMSUPPORT AddressSpace, PVOID Address)
struct _MM_IMAGE_SECTION_OBJECT * PMM_IMAGE_SECTION_OBJECT
#define SWAPENTRY_FROM_SSE(E)
BOOLEAN NTAPI MmCheckDirtySegment(PMM_SECTION_SEGMENT Segment, PLARGE_INTEGER Offset, BOOLEAN ForceDirty, BOOLEAN PageOut)
#define MEMORY_AREA_OWNED_BY_ARM3
struct _MM_SECTION_SEGMENT MM_SECTION_SEGMENT
NTSTATUS NTAPI MmWriteToSwapPage(SWAPENTRY SwapEntry, PFN_NUMBER Page)
VOID NTAPI MmInitializeRegion(PLIST_ENTRY RegionListHead, SIZE_T Length, ULONG Type, ULONG Protect)
PMM_REGION NTAPI MmFindRegion(PVOID BaseAddress, PLIST_ENTRY RegionListHead, PVOID Address, PVOID *RegionBaseAddress)
#define MA_GetEndingAddress(_MemoryArea)
PFN_NUMBER NTAPI MmGetPfnForProcess(struct _EPROCESS *Process, PVOID Address)
#define MA_GetStartingAddress(_MemoryArea)
FORCEINLINE VOID MmUnlockAddressSpace(PMMSUPPORT AddressSpace)
NTSTATUS NTAPI MmReadFromSwapPage(SWAPENTRY SwapEntry, PFN_NUMBER Page)
VOID NTAPI MmDeletePageFileMapping(struct _EPROCESS *Process, PVOID Address, SWAPENTRY *SwapEntry)
#define MM_SEGMENT_INDELETE
#define PAGE_FLAGS_VALID_FOR_SECTION
#define MM_SEGMENT_INCREATE
NTSTATUS NTAPI MmExtendSection(_In_ PVOID Section, _Inout_ PLARGE_INTEGER NewSize)
BOOLEAN NTAPI MmIsAddressRangeFree(_In_ PMMSUPPORT AddressSpace, _In_ PVOID Address, _In_ ULONG_PTR Length)
FORCEINLINE PEPROCESS MmGetAddressSpaceOwner(IN PMMSUPPORT AddressSpace)
BOOLEAN NTAPI MmIsPagePresent(struct _EPROCESS *Process, PVOID Address)
VOID NTAPI MmFreeSwapPage(SWAPENTRY Entry)
_Out_ PKAPC_STATE ApcState
VOID NTAPI MmSetSavedSwapEntryPage(PFN_NUMBER Page, SWAPENTRY SavedSwapEntry)
NTSTATUS NTAPI MmAlterRegion(PMMSUPPORT AddressSpace, PVOID BaseAddress, PLIST_ENTRY RegionListHead, PVOID StartAddress, SIZE_T Length, ULONG NewType, ULONG NewProtect, PMM_ALTER_REGION_FUNC AlterFunc)
#define PAGE_IS_EXECUTABLE
NTSTATUS NTAPI MmRequestPageMemoryConsumer(ULONG Consumer, BOOLEAN MyWait, PPFN_NUMBER AllocatedPage)
#define MEMORY_AREA_SECTION_VIEW
SWAPENTRY NTAPI MmGetSavedSwapEntryPage(PFN_NUMBER Page)
NTSTATUS NTAPI MmCreatePhysicalMapping(_Inout_opt_ PEPROCESS Process, _In_ PVOID Address, _In_ ULONG flProtect, _In_ PFN_NUMBER Page)
#define MM_IMAGE_SECTION_FLUSH_DELETE
#define PAGE_ROUND_DOWN_64(x)
NTSTATUS NTAPI MmCreateVirtualMapping(struct _EPROCESS *Process, PVOID Address, ULONG flProtect, PFN_NUMBER Page)
NTSTATUS NTAPI MmCreatePageFileMapping(struct _EPROCESS *Process, PVOID Address, SWAPENTRY SwapEntry)
VOID NTAPI MmDeleteRmap(PFN_NUMBER Page, struct _EPROCESS *Process, PVOID Address)
struct _MM_SECTION_SEGMENT * PMM_SECTION_SEGMENT
PVOID NTAPI MmFindGap(PMMSUPPORT AddressSpace, SIZE_T Length, ULONG_PTR Granularity, BOOLEAN TopDown)
#define MM_ROUND_DOWN(x, s)
#define MM_IS_WAIT_PTE(E)
#define MM_PHYSICALMEMORY_SEGMENT
#define IS_SWAP_FROM_SSE(E)
NTSTATUS NTAPI MmReleasePageMemoryConsumer(ULONG Consumer, PFN_NUMBER Page)
FORCEINLINE PMMSUPPORT MmGetKernelAddressSpace(VOID)
VOID NTAPI MmInsertRmap(PFN_NUMBER Page, struct _EPROCESS *Process, PVOID Address)
#define MM_DATAFILE_SEGMENT
#define STATUS_MM_RESTART_OPERATION
#define PAGE_IS_WRITECOPY
PIRP NTAPI IoGetTopLevelIrp(VOID)
VOID NTAPI IoSetTopLevelIrp(IN PIRP Irp)
const ULONG MmProtectToValue[32]
VOID NTAPI MmDeleteVirtualMapping(IN PEPROCESS Process, IN PVOID Address, OUT PBOOLEAN WasDirty, OUT PPFN_NUMBER Page)
#define STATUS_INVALID_VIEW_SIZE
#define STATUS_INVALID_IMAGE_WIN_64
#define STATUS_SECTION_PROTECTION
#define STATUS_INVALID_IMAGE_FORMAT
#define STATUS_SECTION_NOT_IMAGE
#define STATUS_NOT_MAPPED_VIEW
#define STATUS_INVALID_IMAGE_NOT_MZ
#define STATUS_INVALID_IMAGE_PROTECT
#define STATUS_FILE_LOCKED_WITH_WRITERS
#define STATUS_INVALID_FILE_FOR_SECTION
#define STATUS_ACCESS_VIOLATION
#define STATUS_MAPPED_FILE_SIZE_ZERO
#define STATUS_INVALID_PARAMETER_6
#define STATUS_IN_PAGE_ERROR
#define STATUS_CONFLICTING_ADDRESSES
#define STATUS_INVALID_PAGE_PROTECTION
#define STATUS_INVALID_INFO_CLASS
#define STATUS_GUARD_PAGE_VIOLATION
#define STATUS_SECTION_NOT_EXTENDED
#define STATUS_IMAGE_NOT_AT_BASE
NTSTATUS NTAPI ObCloseHandle(IN HANDLE Handle, IN KPROCESSOR_MODE AccessMode)
NTSTATUS NTAPI ObInsertObject(IN PVOID Object, IN PACCESS_STATE AccessState OPTIONAL, IN ACCESS_MASK DesiredAccess, IN ULONG ObjectPointerBias, OUT PVOID *NewObject OPTIONAL, OUT PHANDLE Handle)
NTSTATUS NTAPI ObCreateObject(IN KPROCESSOR_MODE ProbeMode OPTIONAL, IN POBJECT_TYPE Type, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN KPROCESSOR_MODE AccessMode, IN OUT PVOID ParseContext OPTIONAL, IN ULONG ObjectSize, IN ULONG PagedPoolCharge OPTIONAL, IN ULONG NonPagedPoolCharge OPTIONAL, OUT PVOID *Object)
NTSTATUS NTAPI ObCreateObjectType(IN PUNICODE_STRING TypeName, IN POBJECT_TYPE_INITIALIZER ObjectTypeInitializer, IN PVOID Reserved, OUT POBJECT_TYPE *ObjectType)
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
#define IMAGE_NT_SIGNATURE
#define IMAGE_DOS_SIGNATURE
struct _IMAGE_SECTION_HEADER IMAGE_SECTION_HEADER
VOID NTAPI KeStackAttachProcess(IN PKPROCESS Process, OUT PRKAPC_STATE ApcState)
VOID NTAPI KeUnstackDetachProcess(IN PRKAPC_STATE ApcState)
#define _SEH2_GetExceptionCode()
#define _SEH2_EXCEPT(...)
#define _SEH2_YIELD(__stmt)
VOID NTAPI KeBugCheckEx(_In_ ULONG BugCheckCode, _In_ ULONG_PTR BugCheckParameter1, _In_ ULONG_PTR BugCheckParameter2, _In_ ULONG_PTR BugCheckParameter3, _In_ ULONG_PTR BugCheckParameter4)
#define ASSERT_IRQL_LESS(x)
static GENERIC_MAPPING MmpSectionMapping
NTSTATUS NTAPI MmMapViewInSystemSpace(IN PVOID SectionObject, OUT PVOID *MappedBase, IN OUT PSIZE_T ViewSize)
BOOLEAN NTAPI MmCanFileBeTruncated(_In_ PSECTION_OBJECT_POINTERS SectionObjectPointer, _In_opt_ PLARGE_INTEGER NewFileSize)
static NTSTATUS NTAPI MmCreateDataFileSection(PSECTION *SectionObject, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PLARGE_INTEGER UMaximumSize, ULONG SectionPageProtection, ULONG AllocationAttributes, PFILE_OBJECT FileObject, BOOLEAN GotFileHandle)
VOID NTAPI MmpDeleteSection(PVOID ObjectBody)
static LARGE_INTEGER TinyTime
PMM_IMAGE_SECTION_OBJECT ImageSectionObjectFromSegment(PMM_SECTION_SEGMENT Segment)
NTSTATUS NTAPI ElfFmtCreateSection(IN CONST VOID *FileHeader, IN SIZE_T FileHeaderSize, IN PVOID File, OUT PMM_IMAGE_SECTION_OBJECT ImageSectionObject, OUT PULONG Flags, IN PEXEFMT_CB_READ_FILE ReadFileCb, IN PEXEFMT_CB_ALLOCATE_SEGMENTS AllocateSegmentsCb)
NTSTATUS NTAPI MmMapViewOfSection(IN PVOID SectionObject, IN PEPROCESS Process, IN OUT PVOID *BaseAddress, IN ULONG_PTR ZeroBits, IN SIZE_T CommitSize, IN OUT PLARGE_INTEGER SectionOffset OPTIONAL, IN OUT PSIZE_T ViewSize, IN SECTION_INHERIT InheritDisposition, IN ULONG AllocationType, IN ULONG Protect)
NTSTATUS NTAPI MmMakeSegmentDirty(_In_ PSECTION_OBJECT_POINTERS SectionObjectPointer, _In_ LONGLONG Offset, _In_ ULONG Length)
NTSTATUS NTAPI PeFmtCreateSection(IN CONST VOID *FileHeader, IN SIZE_T FileHeaderSize, IN PVOID File, OUT PMM_IMAGE_SECTION_OBJECT ImageSectionObject, OUT PULONG Flags, IN PEXEFMT_CB_READ_FILE ReadFileCb, IN PEXEFMT_CB_ALLOCATE_SEGMENTS AllocateSegmentsCb)
static PMM_SECTION_SEGMENT NTAPI ExeFmtpAllocateSegments(IN ULONG NrSegments)
ULONG_PTR MmSubsectionBase
static BOOLEAN NTAPI MmspPageAlignSegments(IN OUT PMM_IMAGE_SECTION_OBJECT ImageSectionObject, IN ULONG Flags)
NTSTATUS NTAPI MmNotPresentFaultSectionView(PMMSUPPORT AddressSpace, MEMORY_AREA *MemoryArea, PVOID Address, BOOLEAN Locked)
NTSTATUS MmspWaitForFileLock(PFILE_OBJECT File)
PLARGE_INTEGER BOOLEAN BOOLEAN PageOut
static BOOLEAN NTAPI MmspCheckSegmentBounds(IN OUT PMM_IMAGE_SECTION_OBJECT ImageSectionObject, IN ULONG Flags)
#define MmSetPageEntrySectionSegment(S, O, E)
static ULONG SectionCharacteristicsToProtect[16]
NTSTATUS NTAPI MmCreateSection(OUT PVOID *Section, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN PLARGE_INTEGER MaximumSize, IN ULONG SectionPageProtection, IN ULONG AllocationAttributes, IN HANDLE FileHandle OPTIONAL, IN PFILE_OBJECT FileObject OPTIONAL)
static BOOLEAN MiPurgeImageSegment(PMM_SECTION_SEGMENT Segment)
POBJECT_TYPE MmSectionObjectType
VOID NTAPI _MmUnlockSectionSegment(PMM_SECTION_SEGMENT Segment, const char *file, int line)
static NTSTATUS MmUnmapViewOfSegment(PMMSUPPORT AddressSpace, PVOID BaseAddress)
BOOLEAN NTAPI MmPurgeSegment(_In_ PSECTION_OBJECT_POINTERS SectionObjectPointer, _In_opt_ PLARGE_INTEGER Offset, _In_ ULONG Length)
BOOLEAN NTAPI MmUnsharePageEntrySectionSegment(PMEMORY_AREA MemoryArea, PMM_SECTION_SEGMENT Segment, PLARGE_INTEGER Offset, BOOLEAN Dirty, BOOLEAN PageOut, ULONG_PTR *InEntry)
NTSTATUS NTAPI MmQuerySectionView(PMEMORY_AREA MemoryArea, PVOID Address, PMEMORY_BASIC_INFORMATION Info, PSIZE_T ResultLength)
NTSTATUS NTAPI MmProtectSectionView(PMMSUPPORT AddressSpace, PMEMORY_AREA MemoryArea, PVOID BaseAddress, SIZE_T Length, ULONG Protect, PULONG OldProtect)
VOID NTAPI MmpCloseSection(IN PEPROCESS Process OPTIONAL, IN PVOID Object, IN ACCESS_MASK GrantedAccess, IN ULONG ProcessHandleCount, IN ULONG SystemHandleCount)
NTSTATUS NTAPI MmMapViewInSystemSpaceEx(_In_ PVOID SectionObject, _Outptr_result_bytebuffer_(*ViewSize) PVOID *MappedBase, _Inout_ PSIZE_T ViewSize, _Inout_ PLARGE_INTEGER SectionOffset, _In_ ULONG_PTR Flags)
static VOID NTAPI FreeSegmentPage(PMM_SECTION_SEGMENT Segment, PLARGE_INTEGER Offset)
NTSTATUS NTAPI MiWritePage(PMM_SECTION_SEGMENT Segment, LONGLONG SegOffset, PFN_NUMBER Page)
VOID NTAPI MmpFreePageFileSegment(PMM_SECTION_SEGMENT Segment)
static VOID NTAPI MmspAssertSegmentsPageAligned(IN PMM_IMAGE_SECTION_OBJECT ImageSectionObject)
static VOID NTAPI MmspSortSegments(IN OUT PMM_IMAGE_SECTION_OBJECT ImageSectionObject, IN ULONG Flags)
NTSTATUS NTAPI MmAccessFaultSectionView(PMMSUPPORT AddressSpace, MEMORY_AREA *MemoryArea, PVOID Address, BOOLEAN Locked)
BOOLEAN NTAPI MmFlushImageSection(IN PSECTION_OBJECT_POINTERS SectionObjectPointer, IN MMFLUSH_TYPE FlushType)
static NTSTATUS MiCopyFromUserPage(PFN_NUMBER DestPage, const VOID *SrcAddress)
NTSTATUS NTAPI NtQuerySection(_In_ HANDLE SectionHandle, _In_ SECTION_INFORMATION_CLASS SectionInformationClass, _Out_ PVOID SectionInformation, _In_ SIZE_T SectionInformationLength, _Out_opt_ PSIZE_T ResultLength)
static NTSTATUS NTAPI ExeFmtpReadFile(IN PVOID File, IN PLARGE_INTEGER Offset, IN ULONG Length, OUT PVOID *Data, OUT PVOID *AllocBase, OUT PULONG ReadSize)
NTSTATUS MmCreateImageSection(PSECTION *SectionObject, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PLARGE_INTEGER UMaximumSize, ULONG SectionPageProtection, ULONG AllocationAttributes, PFILE_OBJECT FileObject)
BOOLEAN NTAPI MmIsDataSectionResident(_In_ PSECTION_OBJECT_POINTERS SectionObjectPointer, _In_ LONGLONG Offset, _In_ ULONG Length)
NTSTATUS NTAPI MmFlushSegment(_In_ PSECTION_OBJECT_POINTERS SectionObjectPointer, _In_opt_ PLARGE_INTEGER Offset, _In_ ULONG Length, _Out_opt_ PIO_STATUS_BLOCK Iosb)
static VOID NTAPI MmspAssertSegmentsSorted(IN PMM_IMAGE_SECTION_OBJECT ImageSectionObject)
NTSTATUS NTAPI MmInitSectionImplementation(VOID)
static PEXEFMT_LOADER ExeFmtpLoaders[]
static VOID MmAlterViewAttributes(PMMSUPPORT AddressSpace, PVOID BaseAddress, SIZE_T RegionSize, ULONG OldType, ULONG OldProtect, ULONG NewType, ULONG NewProtect)
VOID NTAPI MmSharePageEntrySectionSegment(PMM_SECTION_SEGMENT Segment, PLARGE_INTEGER Offset)
VOID NTAPI _MmLockSectionSegment(PMM_SECTION_SEGMENT Segment, const char *file, int line)
NTSTATUS NTAPI MmMakeDataSectionResident(_In_ PSECTION_OBJECT_POINTERS SectionObjectPointer, _In_ LONGLONG Offset, _In_ ULONG Length, _In_ PLARGE_INTEGER ValidDataLength)
static int __cdecl MmspCompareSegments(const void *x, const void *y)
static VOID NTAPI MmspAssertSegmentsNoOverlap(IN PMM_IMAGE_SECTION_OBJECT ImageSectionObject)
static NTSTATUS NTAPI MmMakeSegmentResident(_In_ PMM_SECTION_SEGMENT Segment, _In_ LONGLONG Offset, _In_ ULONG Length, _In_opt_ PLARGE_INTEGER ValidDataLength, _In_ BOOLEAN SetDirty)
static PMM_SECTION_SEGMENT MiGrabDataSection(PSECTION_OBJECT_POINTERS SectionObjectPointer)
NTSTATUS ExeFmtpCreateImageSection(PFILE_OBJECT FileObject, PMM_IMAGE_SECTION_OBJECT ImageSectionObject)
PLARGE_INTEGER BOOLEAN ForceDirty
static VOID MmFreeSectionPage(PVOID Context, MEMORY_AREA *MemoryArea, PVOID Address, PFN_NUMBER Page, SWAPENTRY SwapEntry, BOOLEAN Dirty)
NTSTATUS NTAPI MmCreatePhysicalMemorySection(VOID)
static NTSTATUS MmMapViewOfSegment(PMMSUPPORT AddressSpace, BOOLEAN AsImage, PMM_SECTION_SEGMENT Segment, PVOID *BaseAddress, SIZE_T ViewSize, ULONG Protect, LONGLONG ViewOffset, ULONG AllocationType)
ULONGLONG AlignUp(IN ULONGLONG Value, IN ULONG Alignment)
#define STATUS_END_OF_FILE
PULONG MinorVersion OPTIONAL
base of all file and directory entries
PMM_SECTION_SEGMENT Segment
ULONG NumberOfMappedViews
struct _MEMORY_AREA::@1927 SectionData
union _MMADDRESS_NODE::@2796 u1
struct _MMADDRESS_NODE * Parent
PCONTROL_AREA ControlArea
ULONG_PTR NumberGenericTableElements
MMADDRESS_NODE BalancedRoot
PMM_SECTION_SEGMENT Segments
SECTION_IMAGE_INFORMATION ImageInformation
struct _MM_SECTION_SEGMENT::@1926 Image
OB_CLOSE_METHOD CloseProcedure
GENERIC_MAPPING GenericMapping
ULONG DefaultPagedPoolCharge
OB_DELETE_METHOD DeleteProcedure
ULONG InitialPageProtection
LARGE_INTEGER SizeOfSection
PSECTION_IMAGE_INFORMATION ImageInformation
static PMEM_HOOK PageTable[TOTAL_PAGES]
#define TAG_MM_SECTION_SEGMENT
#define RTL_CONSTANT_STRING(s)
TW_UINT32 TW_UINT16 TW_UINT16 TW_MEMREF pData
#define FIELD_OFFSET(t, f)
#define RtlCopyMemory(Destination, Source, Length)
#define RtlZeroMemory(Destination, Length)
#define RtlMoveMemory(Destination, Source, Length)
#define CONTAINING_RECORD(address, type, field)
#define STATUS_ACCESS_DENIED
#define STATUS_UNSUCCESSFUL
#define STATUS_INFO_LENGTH_MISMATCH
#define STATUS_INSUFFICIENT_RESOURCES
_Must_inspect_result_ _In_ WDFCHILDLIST _In_ PWDF_CHILD_LIST_ITERATOR _Out_ WDFDEVICE _Inout_opt_ PWDF_CHILD_RETRIEVE_INFO Info
_Must_inspect_result_ _In_ WDFCOLLECTION _In_ WDFOBJECT Object
_Must_inspect_result_ _In_ WDFDMAENABLER _In_ _In_opt_ PWDF_OBJECT_ATTRIBUTES Attributes
_Must_inspect_result_ _In_ WDFDEVICE _In_ DEVICE_REGISTRY_PROPERTY _In_ ULONG _Out_ PULONG ResultLength
_Must_inspect_result_ _In_ WDFDEVICE _In_ ULONG _In_ ACCESS_MASK DesiredAccess
_In_ WDFREQUEST _In_ WDFFILEOBJECT FileObject
_Must_inspect_result_ _In_ WDFDMATRANSACTION _In_ PFN_WDF_PROGRAM_DMA _In_ WDF_DMA_DIRECTION _In_ PMDL _In_ PVOID VirtualAddress
_In_ WDFDEVICE _In_ PVOID _In_opt_ PMDL Mdl
_In_ WDFMEMORY _Out_opt_ size_t * BufferSize
_Must_inspect_result_ _In_ ULONG Flags
FORCEINLINE VOID ExInitializeFastMutex(_Out_ PFAST_MUTEX FastMutex)
_In_ ULONG _In_ PHYSICAL_ADDRESS _Inout_ PULONG AddressSpace
_In_ PLARGE_INTEGER _Out_ struct _ERESOURCE ** ResourceToRelease
#define FO_CLEANUP_COMPLETE
#define FO_DELETE_ON_CLOSE
_Requires_lock_held_ Interrupt _Releases_lock_ Interrupt _In_ _IRQL_restores_ KIRQL OldIrql
_Must_inspect_result_ _Outptr_result_bytebuffer_ ViewSize PVOID * MappedBase
#define MmInitializeMdl(_MemoryDescriptorList, _BaseVa, _Length)
#define BYTES_TO_PAGES(Size)
_Must_inspect_result_ _In_ ULONG NewProtect
#define MmGetMdlPfnArray(_Mdl)
_In_opt_ PLARGE_INTEGER NewFileSize
#define MDL_MAPPED_TO_SYSTEM_VA
#define ObDereferenceObject
#define ObReferenceObject
#define PsGetCurrentProcess
_Must_inspect_result_ NTSYSAPI PVOID NTAPI RtlEnumerateGenericTable(_In_ PRTL_GENERIC_TABLE Table, _In_ BOOLEAN Restart)
_Must_inspect_result_ NTSYSAPI PVOID NTAPI RtlGetElementGenericTable(_In_ PRTL_GENERIC_TABLE Table, _In_ ULONG I)
NTSYSAPI ULONG NTAPI RtlNumberGenericTableElements(_In_ PRTL_GENERIC_TABLE Table)
_In_ PSECURITY_SUBJECT_CONTEXT _In_ BOOLEAN _In_ ACCESS_MASK _In_ ACCESS_MASK _Outptr_opt_ PPRIVILEGE_SET _In_ PGENERIC_MAPPING _In_ KPROCESSOR_MODE _Out_ PACCESS_MASK GrantedAccess
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T _Inout_opt_ PLARGE_INTEGER _Inout_ PSIZE_T _In_ SECTION_INHERIT _In_ ULONG _In_ ULONG Protect