55#undef MmSetPageEntrySectionSegment
56#define MmSetPageEntrySectionSegment(S,O,E) do { \
57 DPRINT("SetPageEntrySectionSegment(old,%p,%x,%x)\n",(S),(O)->LowPart,E); \
58 _MmSetPageEntrySectionSegment((S),(O),(E),__FILE__,__LINE__); \
294 ULONG cbFileHeaderOffsetSize = 0;
295 ULONG cbSectionHeadersOffset = 0;
296 ULONG cbSectionHeadersSize;
297 ULONG cbSectionHeadersOffsetSize = 0;
298 ULONG cbOptHeaderSize;
299 ULONG cbHeadersSize = 0;
300 ULONG nSectionAlignment;
301 ULONG nFileAlignment;
310 SIZE_T nPrevVirtualEndOfSegment = 0;
311 ULONG nFileSizeOfHeaders = 0;
316 ASSERT(FileHeaderSize > 0);
318 ASSERT(ImageSectionObject);
320 ASSERT(AllocateSegmentsCb);
326#define DIE(ARGS_) { DPRINT ARGS_; goto l_Return; }
329 pidhDosHeader = FileHeader;
336 DIE((
"Too small to be an MZ executable, size is %lu\n", FileHeaderSize));
340 DIE((
"No MZ signature found, e_magic is %hX\n", pidhDosHeader->
e_magic));
347 DIE((
"Not a Windows executable, e_lfanew is %d\n", pidhDosHeader->
e_lfanew));
350 DIE((
"The DOS stub is too large, e_lfanew is %X\n", pidhDosHeader->
e_lfanew));
352 if(FileHeaderSize < cbFileHeaderOffsetSize)
368 if(FileHeaderSize < cbFileHeaderOffsetSize ||
371 ULONG cbNtHeaderSize;
389 DIE((
"ReadFile failed, status %08X\n", ReturnedStatus));
400 DIE((
"The file doesn't contain the PE file header\n"));
402 pinhNtHeader =
pData;
416 DIE((
"The file isn't a PE executable, Signature is %X\n", pinhNtHeader->
Signature));
421 DIE((
"The full NT header is too large\n"));
424 if(cbReadSize < cbNtHeaderSize)
425 DIE((
"The file doesn't contain the full NT header\n"));
429 ULONG cbOptHeaderOffsetSize = 0;
435 DIE((
"The file isn't a PE executable, Signature is %X\n", pinhNtHeader->
Signature));
438 DIE((
"The DOS stub is too large, e_lfanew is %X\n", pidhDosHeader->
e_lfanew));
446 if(cbOptHeaderOffsetSize > FileHeaderSize)
447 goto l_ReadHeaderFromFile;
457 DIE((
"The optional header doesn't contain the Magic field, SizeOfOptionalHeader is %X\n", cbOptHeaderSize));
461 switch(piohOptHeader->
Magic)
466 DIE((
"Win64 optional header, unsupported\n"));
473 DIE((
"Unrecognized optional header, Magic is %X\n", piohOptHeader->
Magic));
483 DIE((
"Sections aren't page-aligned and the file alignment isn't the same\n"));
486 DIE((
"The section alignment is smaller than the file alignment\n"));
492 DIE((
"The section alignment (%u) and file alignment (%u) aren't both powers of 2\n", nSectionAlignment, nFileAlignment));
503 switch(piohOptHeader->
Magic)
512 ImageSectionObject->ImageInformation.ImageFileSize = piohOptHeader->
SizeOfImage;
515 ImageSectionObject->ImageInformation.MaximumStackSize = piohOptHeader->
SizeOfStackReserve;
518 ImageSectionObject->ImageInformation.CommittedStackSize = piohOptHeader->
SizeOfStackCommit;
522 ImageSectionObject->ImageInformation.SubSystemType = piohOptHeader->
Subsystem;
534 ImageSectionObject->ImageInformation.TransferAddress = (
PVOID) (ImageBase +
539 ImageSectionObject->ImageInformation.ImageContainsCode = piohOptHeader->
SizeOfCode != 0;
541 ImageSectionObject->ImageInformation.ImageContainsCode =
TRUE;
547 ImageSectionObject->ImageInformation.ImageContainsCode =
FALSE;
552 ImageSectionObject->ImageInformation.LoaderFlags = piohOptHeader->
LoaderFlags;
556 ImageSectionObject->ImageInformation.DllCharacteristics = piohOptHeader->
DllCharacteristics;
586 DIE((
"ImageBase exceeds the address space\n"));
592 DIE((
"SizeOfImage exceeds the address space\n"));
594 ImageSectionObject->ImageInformation.ImageFileSize = pioh64OptHeader->
SizeOfImage;
600 DIE((
"SizeOfStackReserve exceeds the address space\n"));
608 DIE((
"SizeOfStackCommit exceeds the address space\n"));
615 ImageSectionObject->ImageInformation.SubSystemType = pioh64OptHeader->
Subsystem;
627 ImageSectionObject->ImageInformation.TransferAddress = (
PVOID) (ImageBase +
632 ImageSectionObject->ImageInformation.ImageContainsCode = pioh64OptHeader->
SizeOfCode != 0;
634 ImageSectionObject->ImageInformation.ImageContainsCode =
TRUE;
640 ImageSectionObject->ImageInformation.ImageContainsCode =
FALSE;
645 ImageSectionObject->ImageInformation.LoaderFlags = pioh64OptHeader->
LoaderFlags;
648 ImageSectionObject->ImageInformation.DllCharacteristics = pioh64OptHeader->
DllCharacteristics;
657 DIE((
"ImageBase is not aligned on a 64KB boundary"));
661 ImageSectionObject->ImageInformation.GpValue = 0;
662 ImageSectionObject->ImageInformation.ZeroBits = 0;
663 ImageSectionObject->BasedAddress = (
PVOID)ImageBase;
681 DIE((
"Offset overflow\n"));
684 DIE((
"Offset overflow\n"));
690 if(!
Intsafe_AddULong32(&cbSectionHeadersOffsetSize, cbSectionHeadersOffset, cbSectionHeadersSize))
691 DIE((
"Section headers too large\n"));
700 DIE((
"The section headers overflow SizeOfHeaders\n"));
704 else if(!
AlignUp(&cbHeadersSize, cbSectionHeadersOffsetSize, nFileAlignment))
705 DIE((
"Overflow aligning the size of headers\n"));
716 if(FileHeaderSize < cbSectionHeadersOffsetSize)
717 pishSectionHeaders =
NULL;
725 pishSectionHeaders = (
PVOID)((
UINT_PTR)FileHeader + cbSectionHeadersOffset);
732 if(FileHeaderSize < cbSectionHeadersOffsetSize ||
738 lnOffset.
QuadPart = cbSectionHeadersOffset;
741 nStatus = ReadFileCb(
File, &lnOffset, cbSectionHeadersSize, &
pData, &
pBuffer, &cbReadSize);
744 DIE((
"ReadFile failed with status %08X\n", nStatus));
753 if(cbReadSize < cbSectionHeadersSize)
754 DIE((
"The file doesn't contain all of the section headers\n"));
756 pishSectionHeaders =
pData;
770 ImageSectionObject->Segments = AllocateSegmentsCb(ImageSectionObject->NrSegments);
772 if(ImageSectionObject->Segments ==
NULL)
773 DIE((
"AllocateSegments failed\n"));
776 pssSegments = ImageSectionObject->Segments;
780 if(!
AlignUp(&nFileSizeOfHeaders, cbHeadersSize, nFileAlignment))
781 DIE((
"Cannot align the size of the section headers\n"));
783 nPrevVirtualEndOfSegment =
ALIGN_UP_BY(cbHeadersSize, nSectionAlignment);
784 if (nPrevVirtualEndOfSegment < cbHeadersSize)
785 DIE((
"Cannot align the size of the section headers\n"));
787 pssSegments[0].
Image.FileOffset = 0;
791 pssSegments[0].
Image.VirtualAddress = 0;
792 pssSegments[0].
Image.Characteristics = 0;
800 ASSERT(ImageSectionObject->RefCount > 0);
803 for(
i = 0;
i < ImageSectionObject->NrSegments - 1; ++
i)
805 ULONG nCharacteristics;
809 DIE((
"Image.VirtualAddress[%u] is not aligned\n",
i));
813 DIE((
"Memory gap between section %u and the previous\n",
i));
816 if(pishSectionHeaders[
i].PointerToRawData != 0 && pishSectionHeaders[
i].SizeOfRawData != 0)
823 if(!
IsAligned(pishSectionHeaders[
i].SizeOfRawData, nFileAlignment))
824 DIE((
"SizeOfRawData[%u] is not aligned\n",
i));
831 DIE((
"SizeOfRawData[%u] too large\n",
i));
841 ASSERT(pssSegments[
i].RawLength.QuadPart == 0);
871 if(AlignedLength < pssSegments[
i].
Length.LowPart)
872 DIE((
"Cannot align the virtual size of section %u\n",
i));
876 if(pssSegments[
i].
Length.QuadPart == 0)
877 DIE((
"Virtual size of section %u is null\n",
i));
884 if (nPrevVirtualEndOfSegment < pssSegments[
i].
Image.VirtualAddress)
885 DIE((
"The image is too large\n"));
944 if (SavedSwapEntry != 0)
995MmDereferenceSegmentWithLock(
1024 Segment->FileObject->SectionObjectPointer->DataSectionObject =
NULL;
1039 ASSERT(ImageSectionObject->
FileObject->SectionObjectPointer->ImageSectionObject == ImageSectionObject);
1040 ImageSectionObject->
FileObject->SectionObjectPointer->ImageSectionObject =
NULL;
1046 SectionSegments = ImageSectionObject->
Segments;
1047 for (
i = 0;
i < NrSegments;
i++)
1072 DPRINT1(
"Entry == 0 for MmSharePageEntrySectionSegment\n");
1077 DPRINT1(
"Maximum share count reached\n");
1103 DPRINT1(
"Entry == 0 for MmUnsharePageEntrySectionSegment\n");
1178 if (DestAddress ==
NULL)
1216 if (RangeEnd %
_64K)
1217 RangeEnd +=
_64K - (RangeEnd %
_64K);
1229 if (RangeEnd >
Segment->RawLength.QuadPart)
1230 RangeEnd =
Segment->RawLength.QuadPart;
1234 for ( ; RangeStart < RangeEnd; RangeStart +=
_64K)
1237 ULONG ToReadPageBits = 0;
1240 if (ChunkEnd > RangeEnd)
1241 ChunkEnd = RangeEnd;
1244 for (
LONGLONG ChunkOffset = RangeStart; ChunkOffset < ChunkEnd; ChunkOffset +=
PAGE_SIZE)
1248 CurrentOffset.
QuadPart = ChunkOffset;
1270 ToReadPageBits |= 1UL << ((ChunkOffset - RangeStart) >>
PAGE_SHIFT);
1277 if (ToReadPageBits == 0)
1285 while (ChunkOffset < ChunkEnd)
1294 ToReadPageBits >>= BitSet;
1296 ASSERT(ChunkOffset < ChunkEnd);
1316 while (ChunkOffset < ChunkEnd)
1318 if (ToReadPageBits & 1)
1321 CurrentOffset.
QuadPart = ChunkOffset;
1325 ToReadPageBits >>= 1;
1355 if (
FileOffset.QuadPart > ValidDataLength->QuadPart)
1358 goto AssignPagesToSegment;
1400 while (ChunkOffset < ChunkEnd)
1402 if (ToReadPageBits & 1)
1405 CurrentOffset.
QuadPart = ChunkOffset;
1409 ToReadPageBits >>= 1;
1417AssignPagesToSegment:
1437 ToReadPageBits >>= BitSet;
1483 if (SwapEntry != MM_WAIT_ENTRY)
1606 DPRINT1(
"Removing PAGE_GUARD protection failed : 0x%08x.\n",
Status);
1620 if (SwapEntry == MM_WAIT_ENTRY)
1645 ASSERT(DummyEntry == SwapEntry);
1655 DPRINT1(
"MmReadFromSwapPage failed, status = %x\n",
Status);
1661 ASSERT(DummyEntry == MM_WAIT_ENTRY);
1669 DPRINT(
"MmCreateVirtualMapping failed, not out of memory\n");
1711 DPRINT(
"MmCreateVirtualMappingUnsafe failed, not out of memory\n");
1764 DPRINT1(
"Unable to create virtual mapping\n");
1796 DPRINT1(
"Failed to page data in!\n");
1810 if (SwapEntry == MM_WAIT_ENTRY)
1853 DPRINT1(
"Someone changed ppte entry while we slept (%x vs %x)\n",
Entry, Entry1);
1869 DPRINT1(
"Unable to create virtual mapping\n");
1897 DPRINT1(
"Unable to create virtual mapping\n");
2033 DPRINT(
"Swapping page (Old %x New %x)\n", OldPage, NewPage);
2035 if (!Unmapped || (UnmappedPage != OldPage))
2055 DPRINT1(
"MmCreateVirtualMapping failed, unable to create virtual mapping, not out of memory\n");
2094 *OldProtect =
Region->Protect;
2110 PVOID RegionBaseAddress;
2132 Info->BaseAddress = RegionBaseAddress;
2154 DPRINT(
"MmpDeleteSection(ObjectBody %p)\n", ObjectBody);
2235 sizeof(*PhysSection),
2238 (
PVOID*)&PhysSection);
2241 DPRINT1(
"MmCreatePhysicalMemorySection: failed to create object (0x%lx)\n",
Status);
2270 Segment->Image.FileOffset = 0;
2272 Segment->RawLength = SectionSize;
2273 Segment->Length = SectionSize;
2276 Segment->Image.VirtualAddress = 0;
2277 Segment->Image.Characteristics = 0;
2304 DPRINT(
"Creating Section Object Type\n");
2311 RtlZeroMemory(&ObjectTypeInitializer,
sizeof(ObjectTypeInitializer));
2313 ObjectTypeInitializer.
Length =
sizeof(ObjectTypeInitializer);
2401 if ((UMaximumSize !=
NULL) && (UMaximumSize->
QuadPart != 0))
2510 Segment->Image.FileOffset = 0;
2513 Segment->Image.Characteristics = 0;
2524 Segment->Image.VirtualAddress = 0;
2529 Segment->SegFlags &= ~MM_SEGMENT_INCREATE;
2625 ULONG OffsetAdjustment;
2648 OffsetAdjustment =
FileOffset.u.LowPart - AdjustOffset;
2680 *ReadSize = UsedSize - OffsetAdjustment;
2691# define MmspAssertSegmentsSorted(OBJ_) ((void)0)
2692# define MmspAssertSegmentsNoOverlap(OBJ_) ((void)0)
2693# define MmspAssertSegmentsPageAligned(OBJ_) ((void)0)
2702 for(
i = 1;
i < ImageSectionObject->NrSegments; ++
i )
2704 ASSERT(ImageSectionObject->Segments[
i].Image.VirtualAddress >=
2705 ImageSectionObject->Segments[
i - 1].Image.VirtualAddress);
2718 for(
i = 0;
i < ImageSectionObject->NrSegments; ++
i )
2720 ASSERT(ImageSectionObject->Segments[
i].Length.QuadPart > 0);
2724 ASSERT(ImageSectionObject->Segments[
i].Image.VirtualAddress >=
2725 (ImageSectionObject->Segments[
i - 1].Image.VirtualAddress +
2726 ImageSectionObject->Segments[
i - 1].Length.QuadPart));
2738 for(
i = 0;
i < ImageSectionObject->NrSegments; ++
i )
2740 ASSERT((ImageSectionObject->Segments[
i].Image.VirtualAddress %
PAGE_SIZE) == 0);
2741 ASSERT((ImageSectionObject->Segments[
i].Length.QuadPart %
PAGE_SIZE) == 0);
2755 if (Segment1->
Image.VirtualAddress > Segment2->
Image.VirtualAddress)
2757 else if (Segment1->
Image.VirtualAddress < Segment2->
Image.VirtualAddress)
2778 qsort(ImageSectionObject->Segments,
2779 ImageSectionObject->NrSegments,
2780 sizeof(ImageSectionObject->Segments[0]),
2808 ASSERT(ImageSectionObject->NrSegments >= 1);
2810 for (
i = 0;
i < ImageSectionObject->NrSegments; ++
i )
2812 if(ImageSectionObject->Segments[
i].Length.QuadPart == 0)
2826 if ((ImageSectionObject->Segments[
i - 1].Image.VirtualAddress +
2827 ImageSectionObject->Segments[
i - 1].Length.QuadPart) !=
2828 ImageSectionObject->Segments[
i].Image.VirtualAddress)
2862 EffectiveSegment = &ImageSectionObject->Segments[LastSegment];
2864 for (
i = 0;
i < ImageSectionObject->NrSegments; ++
i )
2881 EffectiveSegment->
Image.VirtualAddress;
2886 if (EffectiveSegment->
Image.FileOffset < VirtualOffset)
2896 EffectiveSegment->
Image.FileOffset -= VirtualOffset;
2911 if (EndOfEffectiveSegment ==
Segment->Image.VirtualAddress)
2915 ASSERT(LastSegment < ImageSectionObject->NrSegments);
2917 EffectiveSegment = &ImageSectionObject->Segments[LastSegment];
2919 if (LastSegment !=
i)
2939 else if (EndOfEffectiveSegment >
Segment->Image.VirtualAddress)
2941 static const ULONG FlagsToProtection[16] =
2961 unsigned ProtectionFlags;
2968 if (
Segment->Image.FileOffset != (EffectiveSegment->
Image.FileOffset +
2982 EffectiveSegment->
Image.VirtualAddress;
2990 ProtectionFlags = 0;
2993 ProtectionFlags |= 1 << 0;
2996 ProtectionFlags |= 1 << 1;
2999 ProtectionFlags |= 1 << 2;
3002 ProtectionFlags |= 1 << 3;
3004 ASSERT(ProtectionFlags < 16);
3005 EffectiveSegment->
Protection = FlagsToProtection[ProtectionFlags];
3023 ImageSectionObject->NrSegments = LastSegment + 1;
3034 PVOID FileHeaderBuffer;
3035 ULONG FileHeaderSize;
3037 ULONG OldNrSegments;
3057 if (FileHeaderSize == 0)
3080 if (ImageSectionObject->Segments)
3083 ImageSectionObject->Segments =
NULL;
3138 OldNrSegments = ImageSectionObject->
NrSegments;
3144 if (ImageSectionObject->
NrSegments < OldNrSegments)
3155 if (Segments ==
NULL)
3160 ImageSectionObject->
Segments = Segments;
3201 DPRINT1(
"Denying section creation due to missing cache initialization\n");
3236grab_image_section_object:
3240 ImageSectionObject =
FileObject->SectionObjectPointer->ImageSectionObject;
3248 ImageSectionObject =
FileObject->SectionObjectPointer->ImageSectionObject;
3251 if (ImageSectionObject ==
NULL)
3259 if (ImageSectionObject ==
NULL)
3270 if (
FileObject->SectionObjectPointer->ImageSectionObject !=
NULL)
3275 goto grab_image_section_object;
3278 FileObject->SectionObjectPointer->ImageSectionObject = ImageSectionObject;
3333 ImageSectionObject->
SegFlags &= ~MM_SEGMENT_INCREATE;
3345 ImageSectionObject->
SegFlags &= ~MM_IMAGE_SECTION_FLUSH_DELETE;
3424 DPRINT1(
"Mapping between 0x%p and 0x%p failed (%X).\n",
3508 if (SavedSwapEntry != 0)
3587 MmDereferenceSegment(
Segment);
3601 PVOID ImageBaseAddress = 0;
3603 DPRINT(
"Opening memory area Process %p BaseAddress %p\n",
3637 SectionSegments = ImageSectionObject->
Segments;
3644 for (
i = 0;
i < NrSegments;
i++)
3646 if (
Segment == &SectionSegments[
i])
3652 if (
i >= NrSegments)
3657 for (
i = 0;
i < NrSegments;
i++)
3660 ((
char*)ImageBaseAddress + (
ULONG_PTR)SectionSegments[
i].
Image.VirtualAddress);
3665 DPRINT1(
"MmUnmapViewOfSegment failed for %p (Process %p) with %lx\n",
3670 DPRINT(
"One mapping less for %p\n", ImageSectionObject->
FileObject->SectionObjectPointer);
3690 DPRINT1(
"MmUnmapViewOfSegment failed for %p (Process %p) with %lx\n",
3702 MmDereferenceSegment(
Segment);
3714 MmDereferenceSegment(
Segment);
3737 MmDereferenceSegment(
Segment);
3791 SectionInformationLength,
3838 switch(SectionInformationClass)
3881 DPRINT1(
"Unimplemented code path\n");
3942 DPRINT1(
"Unknown SectionInformationClass: %d\n", SectionInformationClass);
4021 DPRINT(
"Mapping ARM3 section into %s\n",
Process->ImageFileName);
4068 SectionSegments = ImageSectionObject->
Segments;
4080 for (
i = 0;
i < NrSegments;
i++)
4085 ImageSize =
max(ImageSize, MaxExtent);
4092 ((ImageBase + ImageSize) < ImageSize))
4127 for (
i = 0;
i < NrSegments;
i++)
4130 ((
char*)ImageBase + (
ULONG_PTR)SectionSegments[
i].
Image.VirtualAddress);
4134 &SectionSegments[
i],
4136 SectionSegments[
i].
Length.QuadPart,
4146 SBaseAddress = ((
char*)ImageBase + (
ULONG_PTR)SectionSegments[
i].
Image.VirtualAddress);
4159 DPRINT(
"Mapped %p for section pointer %p\n", ImageSectionObject, ImageSectionObject->
FileObject->SectionObjectPointer);
4270 DPRINT1(
"ERROR: File can't be truncated because it has an image section\n");
4282 if ((
Segment->SectionCount == 0) ||
4301 DPRINT1(
"ERROR: File can't be truncated because it has references held to its data section\n");
4306 MmDereferenceSegment(
Segment);
4308 DPRINT(
"FIXME: didn't check for outstanding write probes\n");
4366 case MmFlushForDelete:
4374 case MmFlushForWrite:
4391 if (!ImageSectionObject)
4393 DPRINT(
"No image section object. Accepting\n");
4404 DPRINT(
"Denying. There are mappings open\n");
4431 MmDereferenceSegmentWithLock(&ImageSectionObject->
Segments[0],
OldIrql);
4440 MmDereferenceSegmentWithLock(&ImageSectionObject->
Segments[0],
OldIrql);
4491 DPRINT(
"MmMapViewInSystemSpaceEx() called\n");
4564 DPRINT(
"MmUnmapViewInSystemSpace() called\n");
4662 DPRINT1(
"Page protection is invalid\n");
4672 DPRINT1(
"Large pages cannot be used with an image mapping\n");
4714 DPRINT1(
"Cannot create image maps with writers open on the file!\n");
4720 DPRINT1(
"Creating image map with writers open on the file!\n");
4870 MmDereferenceSegment(
Segment);
4896 MmDereferenceSegment(
Segment);
4913 MmDereferenceSegment(
Segment);
4926 MmDereferenceSegment(
Segment);
4967 MmDereferenceSegment(
Segment);
4987 MmDereferenceSegment(
Segment);
5044 MmDereferenceSegment(
Segment);
5069 Iosb->Information = 0;
5092 MmDereferenceSegment(
Segment);
5119 MmDereferenceSegment(
Segment);
5146 DPRINT(
"Checking segment for file %wZ at offset 0x%I64X.\n", &
Segment->FileObject->FileName,
Offset->QuadPart);
5209 DPRINT(
"Writing page at offset %I64d for file %wZ, Pageout: %s\n",
5252 DPRINT1(
"Failed to allocate a swap page!\n");
NTSTATUS MiMapViewInSystemSpace(_In_ PVOID Section, _In_ PMMSESSION Session, _Outptr_result_bytebuffer_(*ViewSize) PVOID *MappedBase, _Inout_ PSIZE_T ViewSize, _Inout_ PLARGE_INTEGER SectionOffset)
NTSTATUS NTAPI MmCreateArm3Section(OUT PVOID *SectionObject, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN PLARGE_INTEGER InputMaximumSize, IN ULONG SectionPageProtection, IN ULONG AllocationAttributes, IN HANDLE FileHandle OPTIONAL, IN PFILE_OBJECT FileObject OPTIONAL)
VOID NTAPI MiDeleteARM3Section(PVOID ObjectBody)
NTSTATUS NTAPI MmMapViewOfArm3Section(IN PVOID SectionObject, IN PEPROCESS Process, IN OUT PVOID *BaseAddress, IN ULONG_PTR ZeroBits, IN SIZE_T CommitSize, IN OUT PLARGE_INTEGER SectionOffset OPTIONAL, IN OUT PSIZE_T ViewSize, IN SECTION_INHERIT InheritDisposition, IN ULONG AllocationType, IN ULONG Protect)
ACCESS_MASK MmMakeFileAccess[8]
MM_AVL_TABLE MmSectionBasedRoot
ULONG NTAPI MiMakeProtectionMask(IN ULONG Protect)
#define ALIGN_DOWN_BY(size, align)
#define ALIGN_UP_BY(size, align)
#define InterlockedIncrement
#define InterlockedDecrement
#define InterlockedIncrement64(a)
DECLSPEC_NORETURN VOID NTAPI KeBugCheck(ULONG BugCheckCode)
VOID NTAPI CcFlushCache(IN PSECTION_OBJECT_POINTERS SectionObjectPointer, IN OPTIONAL PLARGE_INTEGER FileOffset, IN ULONG Length, OUT OPTIONAL PIO_STATUS_BLOCK IoStatus)
_In_ PFCB _In_ LONGLONG FileOffset
#define _Requires_lock_held_(lock)
#define _Requires_lock_not_held_(lock)
#define _Releases_lock_(lock)
#define _Requires_exclusive_lock_held_(lock)
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
#define STATUS_NOT_SUPPORTED
#define STATUS_NOT_IMPLEMENTED
VOID NTAPI DbgkUnMapViewOfSection(IN PVOID BaseAddress)
#define NT_SUCCESS(StatCode)
#define _IRQL_requires_max_(irql)
#define _IRQL_requires_(irql)
#define ExAllocatePoolWithTag(hernya, size, tag)
#define IsListEmpty(ListHead)
#define KeRaiseIrql(irql, oldIrql)
#define KeWaitForSingleObject(pEvt, foo, a, b, c)
#define KeInitializeEvent(pEvt, foo, foo2)
#define KeLowerIrql(oldIrql)
#define RemoveHeadList(ListHead)
#define KeDelayExecutionThread(mode, foo, t)
#define ExGetPreviousMode
#define InterlockedIncrementUL(Addend)
VOID NTAPI ProbeForWrite(IN PVOID Address, IN SIZE_T Length, IN ULONG Alignment)
#define BooleanFlagOn(F, SF)
IN PFCB IN FAT_FLUSH_TYPE FlushType
_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE FileHandle
_Must_inspect_result_ _In_ USHORT NewSize
@ FileEndOfFileInformation
_Must_inspect_result_ _In_ PDEVICE_OBJECT _In_ PSECTION_OBJECT_POINTERS SectionObjectPointer
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
_Must_inspect_result_ _Out_ PLARGE_INTEGER FileSize
_Must_inspect_result_ _Outptr_ PVOID * SectionObject
#define FSRTL_MOD_WRITE_TOP_LEVEL_IRP
GLint GLint GLint GLint GLint x
GLint GLint GLint GLint GLint GLint y
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint i
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint GLint GLint j
VOID FASTCALL ExAcquireFastMutex(IN PFAST_MUTEX FastMutex)
VOID FASTCALL ExReleaseFastMutex(IN PFAST_MUTEX FastMutex)
#define EXCEPTION_EXECUTE_HANDLER
#define InterlockedDecrement64
unsigned char _BitScanForward(unsigned long *_Index, unsigned long _Mask)
NTSTATUS NTAPI IoPageRead(IN PFILE_OBJECT FileObject, IN PMDL Mdl, IN PLARGE_INTEGER Offset, IN PKEVENT Event, IN PIO_STATUS_BLOCK StatusBlock)
NTSTATUS NTAPI IoSetInformation(IN PFILE_OBJECT FileObject, IN FILE_INFORMATION_CLASS FileInformationClass, IN ULONG Length, IN PVOID FileInformation)
NTSTATUS NTAPI IoSynchronousPageWrite(IN PFILE_OBJECT FileObject, IN PMDL Mdl, IN PLARGE_INTEGER Offset, IN PKEVENT Event, IN PIO_STATUS_BLOCK StatusBlock)
POBJECT_TYPE IoFileObjectType
PFN_NUMBER MmHighestPhysicalPage
FORCEINLINE BOOLEAN MiIsRosSectionObject(IN PSECTION Section)
#define MM_INVALID_PROTECTION
NTSTATUS NTAPI MiRosUnmapViewInSystemSpace(IN PVOID MappedBase)
NTSTATUS NTAPI MiRosUnmapViewOfSection(IN PEPROCESS Process, IN PVOID BaseAddress, IN BOOLEAN SkipDebuggerNotify)
VOID NTAPI MmUnmapLockedPages(IN PVOID BaseAddress, IN PMDL Mdl)
#define ExFreePoolWithTag(_P, _T)
FORCEINLINE PVOID ExAllocatePoolZero(ULONG PoolType, SIZE_T NumberOfBytes, ULONG Tag)
#define InitializeObjectAttributes(p, n, a, r, s)
unsigned __int3264 UINT_PTR
__in UCHAR __in POWER_STATE __in_opt PVOID __in PIO_STATUS_BLOCK IoStatus
#define MM_ALLOCATION_GRANULARITY
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T _Inout_opt_ PLARGE_INTEGER _Inout_ PSIZE_T _In_ SECTION_INHERIT InheritDisposition
_In_ ACCESS_MASK _In_opt_ POBJECT_ATTRIBUTES _In_opt_ PLARGE_INTEGER MaximumSize
_In_ ACCESS_MASK _In_opt_ POBJECT_ATTRIBUTES _In_opt_ PLARGE_INTEGER _In_ ULONG SectionPageProtection
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR ZeroBits
_In_ ACCESS_MASK _In_opt_ POBJECT_ATTRIBUTES _In_opt_ PLARGE_INTEGER _In_ ULONG _In_ ULONG AllocationAttributes
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID * BaseAddress
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T _Inout_opt_ PLARGE_INTEGER _Inout_ PSIZE_T _In_ SECTION_INHERIT _In_ ULONG AllocationType
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T _Inout_opt_ PLARGE_INTEGER SectionOffset
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T CommitSize
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T _Inout_opt_ PLARGE_INTEGER _Inout_ PSIZE_T ViewSize
__kernel_entry _Inout_ _Inout_ PSIZE_T RegionSize
struct _SEGMENT * PSEGMENT
enum _SECTION_INFORMATION_CLASS SECTION_INFORMATION_CLASS
struct _SECTION_IMAGE_INFORMATION * PSECTION_IMAGE_INFORMATION
struct _MMSUPPORT * PMMSUPPORT
struct _MEMORY_BASIC_INFORMATION MEMORY_BASIC_INFORMATION
@ SectionBasicInformation
@ SectionImageInformation
#define PAGE_ROUND_DOWN(x)
#define OBJ_KERNEL_EXCLUSIVE
NTSTATUS NTAPI MmCreateCacheSection(PSECTION *SectionObject, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PLARGE_INTEGER UMaximumSize, ULONG SectionPageProtection, ULONG AllocationAttributes, PFILE_OBJECT FileObject)
VOID NTAPI MmFreePageTablesSectionSegment(PMM_SECTION_SEGMENT Segment, FREE_SECTION_PAGE_FUN FreePage)
_In_ PMEMORY_AREA MemoryArea
NTSTATUS NTAPI MmUnmapViewOfCacheSegment(PMMSUPPORT AddressSpace, PVOID BaseAddress)
NTSTATUS NTAPI _MiMapViewOfSegment(PMMSUPPORT AddressSpace, PMM_SECTION_SEGMENT Segment, PVOID *BaseAddress, SIZE_T ViewSize, ULONG Protect, PLARGE_INTEGER ViewOffset, ULONG AllocationType, const char *file, int line)
_In_ PMEMORY_AREA _In_ PVOID _In_ BOOLEAN Locked
VOID NTAPI MiInitializeSectionPageTable(PMM_SECTION_SEGMENT Segment)
#define _Outptr_result_bytebuffer_(s)
#define SECTION_MAP_EXECUTE
#define SECTION_MAP_WRITE
#define PAGE_EXECUTE_READ
#define SECTION_ALL_ACCESS
NTSYSAPI VOID NTAPI RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString)
enum _SECTION_INHERIT SECTION_INHERIT
#define STANDARD_RIGHTS_READ
#define STANDARD_RIGHTS_WRITE
#define PAGE_EXECUTE_WRITECOPY
#define STANDARD_RIGHTS_EXECUTE
#define PAGE_EXECUTE_READWRITE
#define TYPE_ALIGNMENT(t)
#define RTL_CONTAINS_FIELD(Struct, Size, Field)
#define RTL_SIZEOF_THROUGH_FIELD(type, field)
#define UNREFERENCED_PARAMETER(P)
_In_ ULONG _In_ ULONG Offset
_In_ ULONG _In_ ULONG _In_ ULONG Length
#define IMAGE_SCN_MEM_WRITE
#define IMAGE_NT_OPTIONAL_HDR32_MAGIC
#define IMAGE_SCN_CNT_INITIALIZED_DATA
#define IMAGE_NT_OPTIONAL_HDR64_MAGIC
#define IMAGE_SCN_CNT_CODE
#define IMAGE_SCN_MEM_EXECUTE
#define IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
#define IMAGE_SCN_MEM_READ
#define IMAGE_SCN_CNT_UNINITIALIZED_DATA
#define IMAGE_SCN_MEM_SHARED
NTSTATUS NTAPI MiSimpleRead(PFILE_OBJECT FileObject, PLARGE_INTEGER FileOffset, PVOID Buffer, ULONG Length, BOOLEAN Paging, PIO_STATUS_BLOCK ReadStatus)
NTSTATUS NTAPI FsRtlGetFileSize(IN PFILE_OBJECT FileObject, IN OUT PLARGE_INTEGER FileSize)
_Check_return_ NTSTATUS NTAPI FsRtlAcquireFileForModWriteEx(_In_ PFILE_OBJECT FileObject, _In_ PLARGE_INTEGER EndingOffset, _Outptr_result_maybenull_ PERESOURCE *ResourceToRelease)
Lock a file object before flushing pages to disk. To be called by the Modified Page Writer (MPW)
VOID NTAPI FsRtlReleaseFileForModWrite(_In_ PFILE_OBJECT FileObject, _In_ PERESOURCE ResourceToRelease)
Unlock a file object after flushing pages to disk. To be called by the Modified Page Writer (MPW) aft...
VOID NTAPI FsRtlReleaseFile(IN PFILE_OBJECT FileObject)
VOID NTAPI FsRtlAcquireFileExclusive(IN PFILE_OBJECT FileObject)
NTSTATUS NTAPI FsRtlAcquireToCreateMappedSection(_In_ PFILE_OBJECT FileObject, _In_ ULONG SectionPageProtection)
#define MM_HIGHEST_VAD_ADDRESS
#define MmGetPageEntrySectionSegment(S, O)
#define MI_SET_PROCESS2(x)
FORCEINLINE VOID MmLockAddressSpace(PMMSUPPORT AddressSpace)
VOID NTAPI MmSetPageProtect(struct _EPROCESS *Process, PVOID Address, ULONG flProtect)
VOID NTAPI MiUnmapPageInHyperSpace(IN PEPROCESS Process, IN PVOID Address, IN KIRQL OldIrql)
VOID NTAPI MmGetPageFileMapping(PEPROCESS Process, PVOID Address, SWAPENTRY *SwapEntry)
ULONG NTAPI MmGetPageProtect(struct _EPROCESS *Process, PVOID Address)
#define MmLockSectionSegment(x)
NTSTATUS NTAPI MmCreateMemoryArea(PMMSUPPORT AddressSpace, ULONG Type, PVOID *BaseAddress, SIZE_T Length, ULONG Protection, PMEMORY_AREA *Result, ULONG AllocationFlags, ULONG AllocationGranularity)
#define SHARE_COUNT_FROM_SSE(E)
PVOID NTAPI MiMapPageInHyperSpace(IN PEPROCESS Process, IN PFN_NUMBER Page, IN PKIRQL OldIrql)
#define MM_VIRTMEM_GRANULARITY
NTSTATUS NTAPI MmFreeMemoryArea(PMMSUPPORT AddressSpace, PMEMORY_AREA MemoryArea, PMM_FREE_PAGE_FUNC FreePage, PVOID FreePageContext)
#define MmUnlockSectionSegment(x)
BOOLEAN NTAPI MmIsPageSwapEntry(struct _EPROCESS *Process, PVOID Address)
BOOLEAN NTAPI MmIsDisabledPage(struct _EPROCESS *Process, PVOID Address)
SWAPENTRY NTAPI MmAllocSwapPage(VOID)
PMEMORY_AREA NTAPI MmLocateMemoryAreaByAddress(PMMSUPPORT AddressSpace, PVOID Address)
struct _MM_IMAGE_SECTION_OBJECT * PMM_IMAGE_SECTION_OBJECT
#define SWAPENTRY_FROM_SSE(E)
#define SEC_PHYSICALMEMORY
BOOLEAN NTAPI MmCheckDirtySegment(PMM_SECTION_SEGMENT Segment, PLARGE_INTEGER Offset, BOOLEAN ForceDirty, BOOLEAN PageOut)
#define MEMORY_AREA_OWNED_BY_ARM3
struct _MM_SECTION_SEGMENT MM_SECTION_SEGMENT
NTSTATUS NTAPI MmWriteToSwapPage(SWAPENTRY SwapEntry, PFN_NUMBER Page)
VOID NTAPI MmInitializeRegion(PLIST_ENTRY RegionListHead, SIZE_T Length, ULONG Type, ULONG Protect)
PMM_REGION NTAPI MmFindRegion(PVOID BaseAddress, PLIST_ENTRY RegionListHead, PVOID Address, PVOID *RegionBaseAddress)
#define MA_GetEndingAddress(_MemoryArea)
PFN_NUMBER NTAPI MmGetPfnForProcess(struct _EPROCESS *Process, PVOID Address)
#define MA_GetStartingAddress(_MemoryArea)
FORCEINLINE VOID MmUnlockAddressSpace(PMMSUPPORT AddressSpace)
NTSTATUS NTAPI MmReadFromSwapPage(SWAPENTRY SwapEntry, PFN_NUMBER Page)
VOID NTAPI MmDeletePageFileMapping(struct _EPROCESS *Process, PVOID Address, SWAPENTRY *SwapEntry)
#define MM_SEGMENT_INDELETE
#define PAGE_FLAGS_VALID_FOR_SECTION
#define MM_SEGMENT_INCREATE
NTSTATUS NTAPI MmExtendSection(_In_ PVOID Section, _Inout_ PLARGE_INTEGER NewSize)
FORCEINLINE PEPROCESS MmGetAddressSpaceOwner(IN PMMSUPPORT AddressSpace)
BOOLEAN NTAPI MmIsPagePresent(struct _EPROCESS *Process, PVOID Address)
VOID NTAPI MmFreeSwapPage(SWAPENTRY Entry)
_Out_ PKAPC_STATE ApcState
VOID NTAPI MmSetSavedSwapEntryPage(PFN_NUMBER Page, SWAPENTRY SavedSwapEntry)
NTSTATUS NTAPI MmAlterRegion(PMMSUPPORT AddressSpace, PVOID BaseAddress, PLIST_ENTRY RegionListHead, PVOID StartAddress, SIZE_T Length, ULONG NewType, ULONG NewProtect, PMM_ALTER_REGION_FUNC AlterFunc)
#define PAGE_IS_EXECUTABLE
NTSTATUS NTAPI MmRequestPageMemoryConsumer(ULONG Consumer, BOOLEAN MyWait, PPFN_NUMBER AllocatedPage)
#define MEMORY_AREA_SECTION_VIEW
SWAPENTRY NTAPI MmGetSavedSwapEntryPage(PFN_NUMBER Page)
NTSTATUS NTAPI MmCreatePhysicalMapping(_Inout_opt_ PEPROCESS Process, _In_ PVOID Address, _In_ ULONG flProtect, _In_ PFN_NUMBER Page)
#define MM_IMAGE_SECTION_FLUSH_DELETE
NTSTATUS NTAPI MmCreateVirtualMapping(struct _EPROCESS *Process, PVOID Address, ULONG flProtect, PFN_NUMBER Page)
NTSTATUS NTAPI MmCreatePageFileMapping(struct _EPROCESS *Process, PVOID Address, SWAPENTRY SwapEntry)
VOID NTAPI MmDeleteRmap(PFN_NUMBER Page, struct _EPROCESS *Process, PVOID Address)
struct _MM_SECTION_SEGMENT * PMM_SECTION_SEGMENT
PVOID NTAPI MmFindGap(PMMSUPPORT AddressSpace, SIZE_T Length, ULONG_PTR Granularity, BOOLEAN TopDown)
#define MM_ROUND_DOWN(x, s)
#define MM_IS_WAIT_PTE(E)
#define MM_PHYSICALMEMORY_SEGMENT
#define IS_SWAP_FROM_SSE(E)
NTSTATUS NTAPI MmReleasePageMemoryConsumer(ULONG Consumer, PFN_NUMBER Page)
FORCEINLINE PMMSUPPORT MmGetKernelAddressSpace(VOID)
VOID NTAPI MmInsertRmap(PFN_NUMBER Page, struct _EPROCESS *Process, PVOID Address)
PMEMORY_AREA NTAPI MmLocateMemoryAreaByRegion(PMMSUPPORT AddressSpace, PVOID Address, SIZE_T Length)
#define MM_DATAFILE_SEGMENT
#define STATUS_MM_RESTART_OPERATION
#define PAGE_IS_WRITECOPY
PIRP NTAPI IoGetTopLevelIrp(VOID)
VOID NTAPI IoSetTopLevelIrp(IN PIRP Irp)
const ULONG MmProtectToValue[32]
VOID NTAPI MmDeleteVirtualMapping(IN PEPROCESS Process, IN PVOID Address, OUT PBOOLEAN WasDirty, OUT PPFN_NUMBER Page)
#define STATUS_INVALID_VIEW_SIZE
#define STATUS_INVALID_IMAGE_WIN_64
#define STATUS_MAPPED_ALIGNMENT
#define STATUS_SECTION_PROTECTION
#define STATUS_INVALID_IMAGE_FORMAT
#define STATUS_SECTION_NOT_IMAGE
#define STATUS_NOT_MAPPED_VIEW
#define STATUS_INVALID_IMAGE_NOT_MZ
#define STATUS_INVALID_IMAGE_PROTECT
#define STATUS_FILE_LOCKED_WITH_WRITERS
#define STATUS_INVALID_FILE_FOR_SECTION
#define STATUS_ACCESS_VIOLATION
#define STATUS_MAPPED_FILE_SIZE_ZERO
#define STATUS_INVALID_PARAMETER_6
#define STATUS_IN_PAGE_ERROR
#define STATUS_CONFLICTING_ADDRESSES
#define STATUS_INVALID_PAGE_PROTECTION
#define STATUS_INVALID_INFO_CLASS
#define STATUS_GUARD_PAGE_VIOLATION
#define STATUS_SECTION_NOT_EXTENDED
#define STATUS_IMAGE_NOT_AT_BASE
NTSTATUS NTAPI ObCloseHandle(IN HANDLE Handle, IN KPROCESSOR_MODE AccessMode)
NTSTATUS NTAPI ObInsertObject(IN PVOID Object, IN PACCESS_STATE AccessState OPTIONAL, IN ACCESS_MASK DesiredAccess, IN ULONG ObjectPointerBias, OUT PVOID *NewObject OPTIONAL, OUT PHANDLE Handle)
NTSTATUS NTAPI ObCreateObject(IN KPROCESSOR_MODE ProbeMode OPTIONAL, IN POBJECT_TYPE Type, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN KPROCESSOR_MODE AccessMode, IN OUT PVOID ParseContext OPTIONAL, IN ULONG ObjectSize, IN ULONG PagedPoolCharge OPTIONAL, IN ULONG NonPagedPoolCharge OPTIONAL, OUT PVOID *Object)
NTSTATUS NTAPI ObCreateObjectType(IN PUNICODE_STRING TypeName, IN POBJECT_TYPE_INITIALIZER ObjectTypeInitializer, IN PVOID Reserved, OUT POBJECT_TYPE *ObjectType)
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
#define IMAGE_NT_SIGNATURE
#define IMAGE_DOS_SIGNATURE
struct _IMAGE_SECTION_HEADER IMAGE_SECTION_HEADER
VOID NTAPI KeStackAttachProcess(IN PKPROCESS Process, OUT PRKAPC_STATE ApcState)
VOID NTAPI KeUnstackDetachProcess(IN PRKAPC_STATE ApcState)
#define _SEH2_GetExceptionCode()
#define _SEH2_EXCEPT(...)
#define _SEH2_YIELD(__stmt)
VOID NTAPI KeBugCheckEx(_In_ ULONG BugCheckCode, _In_ ULONG_PTR BugCheckParameter1, _In_ ULONG_PTR BugCheckParameter2, _In_ ULONG_PTR BugCheckParameter3, _In_ ULONG_PTR BugCheckParameter4)
#define ASSERT_IRQL_LESS(x)
void __cdecl qsort(_Inout_updates_bytes_(_NumOfElements *_SizeOfElements) void *_Base, _In_ size_t _NumOfElements, _In_ size_t _SizeOfElements, _In_ int(__cdecl *_PtFuncCompare)(const void *, const void *))
static GENERIC_MAPPING MmpSectionMapping
NTSTATUS NTAPI MmMapViewInSystemSpace(IN PVOID SectionObject, OUT PVOID *MappedBase, IN OUT PSIZE_T ViewSize)
BOOLEAN NTAPI MmCanFileBeTruncated(_In_ PSECTION_OBJECT_POINTERS SectionObjectPointer, _In_opt_ PLARGE_INTEGER NewFileSize)
static NTSTATUS NTAPI MmCreateDataFileSection(PSECTION *SectionObject, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PLARGE_INTEGER UMaximumSize, ULONG SectionPageProtection, ULONG AllocationAttributes, PFILE_OBJECT FileObject, BOOLEAN GotFileHandle)
VOID NTAPI MmpDeleteSection(PVOID ObjectBody)
static LARGE_INTEGER TinyTime
PMM_IMAGE_SECTION_OBJECT ImageSectionObjectFromSegment(PMM_SECTION_SEGMENT Segment)
NTSTATUS NTAPI ElfFmtCreateSection(IN CONST VOID *FileHeader, IN SIZE_T FileHeaderSize, IN PVOID File, OUT PMM_IMAGE_SECTION_OBJECT ImageSectionObject, OUT PULONG Flags, IN PEXEFMT_CB_READ_FILE ReadFileCb, IN PEXEFMT_CB_ALLOCATE_SEGMENTS AllocateSegmentsCb)
NTSTATUS NTAPI MmMapViewOfSection(IN PVOID SectionObject, IN PEPROCESS Process, IN OUT PVOID *BaseAddress, IN ULONG_PTR ZeroBits, IN SIZE_T CommitSize, IN OUT PLARGE_INTEGER SectionOffset OPTIONAL, IN OUT PSIZE_T ViewSize, IN SECTION_INHERIT InheritDisposition, IN ULONG AllocationType, IN ULONG Protect)
NTSTATUS NTAPI MmMakeSegmentDirty(_In_ PSECTION_OBJECT_POINTERS SectionObjectPointer, _In_ LONGLONG Offset, _In_ ULONG Length)
NTSTATUS NTAPI PeFmtCreateSection(IN CONST VOID *FileHeader, IN SIZE_T FileHeaderSize, IN PVOID File, OUT PMM_IMAGE_SECTION_OBJECT ImageSectionObject, OUT PULONG Flags, IN PEXEFMT_CB_READ_FILE ReadFileCb, IN PEXEFMT_CB_ALLOCATE_SEGMENTS AllocateSegmentsCb)
static PMM_SECTION_SEGMENT NTAPI ExeFmtpAllocateSegments(IN ULONG NrSegments)
ULONG_PTR MmSubsectionBase
static BOOLEAN NTAPI MmspPageAlignSegments(IN OUT PMM_IMAGE_SECTION_OBJECT ImageSectionObject, IN ULONG Flags)
NTSTATUS NTAPI MmNotPresentFaultSectionView(PMMSUPPORT AddressSpace, MEMORY_AREA *MemoryArea, PVOID Address, BOOLEAN Locked)
NTSTATUS MmspWaitForFileLock(PFILE_OBJECT File)
PLARGE_INTEGER BOOLEAN BOOLEAN PageOut
static BOOLEAN NTAPI MmspCheckSegmentBounds(IN OUT PMM_IMAGE_SECTION_OBJECT ImageSectionObject, IN ULONG Flags)
#define MmSetPageEntrySectionSegment(S, O, E)
static ULONG SectionCharacteristicsToProtect[16]
NTSTATUS NTAPI MmCreateSection(OUT PVOID *Section, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN PLARGE_INTEGER MaximumSize, IN ULONG SectionPageProtection, IN ULONG AllocationAttributes, IN HANDLE FileHandle OPTIONAL, IN PFILE_OBJECT FileObject OPTIONAL)
static BOOLEAN MiPurgeImageSegment(PMM_SECTION_SEGMENT Segment)
POBJECT_TYPE MmSectionObjectType
VOID NTAPI _MmUnlockSectionSegment(PMM_SECTION_SEGMENT Segment, const char *file, int line)
static NTSTATUS MmUnmapViewOfSegment(PMMSUPPORT AddressSpace, PVOID BaseAddress)
BOOLEAN NTAPI MmPurgeSegment(_In_ PSECTION_OBJECT_POINTERS SectionObjectPointer, _In_opt_ PLARGE_INTEGER Offset, _In_ ULONG Length)
BOOLEAN NTAPI MmUnsharePageEntrySectionSegment(PMEMORY_AREA MemoryArea, PMM_SECTION_SEGMENT Segment, PLARGE_INTEGER Offset, BOOLEAN Dirty, BOOLEAN PageOut, ULONG_PTR *InEntry)
NTSTATUS NTAPI MmQuerySectionView(PMEMORY_AREA MemoryArea, PVOID Address, PMEMORY_BASIC_INFORMATION Info, PSIZE_T ResultLength)
NTSTATUS NTAPI MmProtectSectionView(PMMSUPPORT AddressSpace, PMEMORY_AREA MemoryArea, PVOID BaseAddress, SIZE_T Length, ULONG Protect, PULONG OldProtect)
VOID NTAPI MmpCloseSection(IN PEPROCESS Process OPTIONAL, IN PVOID Object, IN ACCESS_MASK GrantedAccess, IN ULONG ProcessHandleCount, IN ULONG SystemHandleCount)
NTSTATUS NTAPI MmMapViewInSystemSpaceEx(_In_ PVOID SectionObject, _Outptr_result_bytebuffer_(*ViewSize) PVOID *MappedBase, _Inout_ PSIZE_T ViewSize, _Inout_ PLARGE_INTEGER SectionOffset, _In_ ULONG_PTR Flags)
static VOID NTAPI FreeSegmentPage(PMM_SECTION_SEGMENT Segment, PLARGE_INTEGER Offset)
NTSTATUS NTAPI MiWritePage(PMM_SECTION_SEGMENT Segment, LONGLONG SegOffset, PFN_NUMBER Page)
VOID NTAPI MmpFreePageFileSegment(PMM_SECTION_SEGMENT Segment)
static VOID NTAPI MmspAssertSegmentsPageAligned(IN PMM_IMAGE_SECTION_OBJECT ImageSectionObject)
static VOID NTAPI MmspSortSegments(IN OUT PMM_IMAGE_SECTION_OBJECT ImageSectionObject, IN ULONG Flags)
NTSTATUS NTAPI MmAccessFaultSectionView(PMMSUPPORT AddressSpace, MEMORY_AREA *MemoryArea, PVOID Address, BOOLEAN Locked)
BOOLEAN NTAPI MmFlushImageSection(IN PSECTION_OBJECT_POINTERS SectionObjectPointer, IN MMFLUSH_TYPE FlushType)
static NTSTATUS MiCopyFromUserPage(PFN_NUMBER DestPage, const VOID *SrcAddress)
NTSTATUS NTAPI NtQuerySection(_In_ HANDLE SectionHandle, _In_ SECTION_INFORMATION_CLASS SectionInformationClass, _Out_ PVOID SectionInformation, _In_ SIZE_T SectionInformationLength, _Out_opt_ PSIZE_T ResultLength)
static NTSTATUS NTAPI ExeFmtpReadFile(IN PVOID File, IN PLARGE_INTEGER Offset, IN ULONG Length, OUT PVOID *Data, OUT PVOID *AllocBase, OUT PULONG ReadSize)
NTSTATUS MmCreateImageSection(PSECTION *SectionObject, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PLARGE_INTEGER UMaximumSize, ULONG SectionPageProtection, ULONG AllocationAttributes, PFILE_OBJECT FileObject)
BOOLEAN NTAPI MmIsDataSectionResident(_In_ PSECTION_OBJECT_POINTERS SectionObjectPointer, _In_ LONGLONG Offset, _In_ ULONG Length)
NTSTATUS NTAPI MmFlushSegment(_In_ PSECTION_OBJECT_POINTERS SectionObjectPointer, _In_opt_ PLARGE_INTEGER Offset, _In_ ULONG Length, _Out_opt_ PIO_STATUS_BLOCK Iosb)
static VOID NTAPI MmspAssertSegmentsSorted(IN PMM_IMAGE_SECTION_OBJECT ImageSectionObject)
NTSTATUS NTAPI MmInitSectionImplementation(VOID)
static PEXEFMT_LOADER ExeFmtpLoaders[]
static VOID MmAlterViewAttributes(PMMSUPPORT AddressSpace, PVOID BaseAddress, SIZE_T RegionSize, ULONG OldType, ULONG OldProtect, ULONG NewType, ULONG NewProtect)
VOID NTAPI MmSharePageEntrySectionSegment(PMM_SECTION_SEGMENT Segment, PLARGE_INTEGER Offset)
VOID NTAPI _MmLockSectionSegment(PMM_SECTION_SEGMENT Segment, const char *file, int line)
NTSTATUS NTAPI MmMakeDataSectionResident(_In_ PSECTION_OBJECT_POINTERS SectionObjectPointer, _In_ LONGLONG Offset, _In_ ULONG Length, _In_ PLARGE_INTEGER ValidDataLength)
static int __cdecl MmspCompareSegments(const void *x, const void *y)
static VOID NTAPI MmspAssertSegmentsNoOverlap(IN PMM_IMAGE_SECTION_OBJECT ImageSectionObject)
static NTSTATUS NTAPI MmMakeSegmentResident(_In_ PMM_SECTION_SEGMENT Segment, _In_ LONGLONG Offset, _In_ ULONG Length, _In_opt_ PLARGE_INTEGER ValidDataLength, _In_ BOOLEAN SetDirty)
static PMM_SECTION_SEGMENT MiGrabDataSection(PSECTION_OBJECT_POINTERS SectionObjectPointer)
NTSTATUS ExeFmtpCreateImageSection(PFILE_OBJECT FileObject, PMM_IMAGE_SECTION_OBJECT ImageSectionObject)
PLARGE_INTEGER BOOLEAN ForceDirty
static VOID MmFreeSectionPage(PVOID Context, MEMORY_AREA *MemoryArea, PVOID Address, PFN_NUMBER Page, SWAPENTRY SwapEntry, BOOLEAN Dirty)
NTSTATUS NTAPI MmCreatePhysicalMemorySection(VOID)
static NTSTATUS MmMapViewOfSegment(PMMSUPPORT AddressSpace, BOOLEAN AsImage, PMM_SECTION_SEGMENT Segment, PVOID *BaseAddress, SIZE_T ViewSize, ULONG Protect, LONGLONG ViewOffset, ULONG AllocationType)
ULONGLONG AlignUp(IN ULONGLONG Value, IN ULONG Alignment)
#define STATUS_END_OF_FILE
PULONG MinorVersion OPTIONAL
base of all file and directory entries
PMM_SECTION_SEGMENT Segment
ULONG NumberOfMappedViews
struct _MEMORY_AREA::@1805 SectionData
union _MMADDRESS_NODE::@2621 u1
struct _MMADDRESS_NODE * Parent
PCONTROL_AREA ControlArea
ULONG_PTR NumberGenericTableElements
MMADDRESS_NODE BalancedRoot
PMM_SECTION_SEGMENT Segments
SECTION_IMAGE_INFORMATION ImageInformation
struct _MM_SECTION_SEGMENT::@1804 Image
OB_CLOSE_METHOD CloseProcedure
GENERIC_MAPPING GenericMapping
ULONG DefaultPagedPoolCharge
OB_DELETE_METHOD DeleteProcedure
ULONG InitialPageProtection
LARGE_INTEGER SizeOfSection
PSECTION_IMAGE_INFORMATION ImageInformation
static PMEM_HOOK PageTable[TOTAL_PAGES]
#define TAG_MM_SECTION_SEGMENT
#define RTL_CONSTANT_STRING(s)
TW_UINT32 TW_UINT16 TW_UINT16 TW_MEMREF pData
#define FIELD_OFFSET(t, f)
#define RtlCopyMemory(Destination, Source, Length)
#define RtlZeroMemory(Destination, Length)
#define RtlMoveMemory(Destination, Source, Length)
#define CONTAINING_RECORD(address, type, field)
#define STATUS_ACCESS_DENIED
#define STATUS_INVALID_PARAMETER
#define STATUS_UNSUCCESSFUL
#define STATUS_INFO_LENGTH_MISMATCH
#define STATUS_INSUFFICIENT_RESOURCES
_Must_inspect_result_ _In_ WDFCHILDLIST _In_ PWDF_CHILD_LIST_ITERATOR _Out_ WDFDEVICE _Inout_opt_ PWDF_CHILD_RETRIEVE_INFO Info
_Must_inspect_result_ _In_ WDFCOLLECTION _In_ WDFOBJECT Object
_Must_inspect_result_ _In_ WDFDMAENABLER _In_ _In_opt_ PWDF_OBJECT_ATTRIBUTES Attributes
_Must_inspect_result_ _In_ WDFDEVICE _In_ DEVICE_REGISTRY_PROPERTY _In_ ULONG _Out_ PULONG ResultLength
_Must_inspect_result_ _In_ WDFDEVICE _In_ ULONG _In_ ACCESS_MASK DesiredAccess
_In_ WDFREQUEST _In_ WDFFILEOBJECT FileObject
_Must_inspect_result_ _In_ WDFDMATRANSACTION _In_ PFN_WDF_PROGRAM_DMA _In_ WDF_DMA_DIRECTION _In_ PMDL _In_ PVOID VirtualAddress
_In_ WDFDEVICE _In_ PVOID _In_opt_ PMDL Mdl
_In_ WDFMEMORY _Out_opt_ size_t * BufferSize
_Must_inspect_result_ _In_ ULONG Flags
FORCEINLINE VOID ExInitializeFastMutex(_Out_ PFAST_MUTEX FastMutex)
_In_ ULONG _In_ PHYSICAL_ADDRESS _Inout_ PULONG AddressSpace
_In_ PLARGE_INTEGER _Out_ struct _ERESOURCE ** ResourceToRelease
#define FO_CLEANUP_COMPLETE
#define FO_DELETE_ON_CLOSE
_Requires_lock_held_ Interrupt _Releases_lock_ Interrupt _In_ _IRQL_restores_ KIRQL OldIrql
_Must_inspect_result_ _Outptr_result_bytebuffer_ ViewSize PVOID * MappedBase
#define MmInitializeMdl(_MemoryDescriptorList, _BaseVa, _Length)
#define BYTES_TO_PAGES(Size)
_Must_inspect_result_ _In_ ULONG NewProtect
#define MmGetMdlPfnArray(_Mdl)
_In_opt_ PLARGE_INTEGER NewFileSize
#define MDL_MAPPED_TO_SYSTEM_VA
#define ObDereferenceObject
#define ObReferenceObject
#define PsGetCurrentProcess
_Must_inspect_result_ NTSYSAPI PVOID NTAPI RtlEnumerateGenericTable(_In_ PRTL_GENERIC_TABLE Table, _In_ BOOLEAN Restart)
_Must_inspect_result_ NTSYSAPI PVOID NTAPI RtlGetElementGenericTable(_In_ PRTL_GENERIC_TABLE Table, _In_ ULONG I)
NTSYSAPI ULONG NTAPI RtlNumberGenericTableElements(_In_ PRTL_GENERIC_TABLE Table)
_In_ KPROCESSOR_MODE PreviousMode
_In_ PSECURITY_SUBJECT_CONTEXT _In_ BOOLEAN _In_ ACCESS_MASK _In_ ACCESS_MASK _Outptr_opt_ PPRIVILEGE_SET _In_ PGENERIC_MAPPING _In_ KPROCESSOR_MODE _Out_ PACCESS_MASK GrantedAccess
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T _Inout_opt_ PLARGE_INTEGER _Inout_ PSIZE_T _In_ SECTION_INHERIT _In_ ULONG _In_ ULONG Protect