Skip to content

Instantly share code, notes, and snippets.

@JustasMasiulis
Last active April 17, 2019 11:01
Show Gist options
  • Save JustasMasiulis/56a92f0557956d9f250b5c9f86cd4318 to your computer and use it in GitHub Desktop.
Save JustasMasiulis/56a92f0557956d9f250b5c9f86cd4318 to your computer and use it in GitHub Desktop.
#define MI_PFN_ELEMENT_TO_INDEX(_Pfn) ((PFN_NUMBER)(((ULONG_PTR)(_Pfn) - (ULONG_PTR)MmPfnDatabase) / sizeof (MMPFN)))
void MiChangePageAttribute(_MMPFN *pfn, MI_PFN_CACHE_ATTRIBUTE cacheAtrribute, bool pfnLocked) {
KIRQL irql;
if(pfnLocked || someThreadPointer == KeGetCurrentThread()) // no idea what it is
irql = 17;
else
irql = MiLockPageInline(pfn);
currCacheAttribute = pfn->u3.e1.CacheAttribute;
if(MiPageCombiningActive(0)) {
MiAbortCombineScan(pfn);
someMask = 0xFB;
}
else
someMask = pfnLocked;
pfn->u3.e1.CacheAttribute = cacheAtrribute;
if(currCacheAttribute != 3 && !(someMask & 4)) {
uint8_t flushStamp = pfn->u2.TbFlushStamp;
KeMemoryBarrier();
uint8_t flushDelta = (KiTbFlushTimeStamp[0] - flushStamp) & 0xF;
if(someMask & 2 || (flushDelta <= 2 && (flushStamp & 1 || flushDelta < 2)))
MiFlushEntireTbDueToAttributeChange();
if(cacheAtrribute != MiCached && currCacheAttribute == 1)
{
++dword_1403D87B4;
KIRQL irql = KeRaiseIrqlToDpcLevel();
MiFlushCacheForAttributeChange(MI_PFN_ELEMENT_TO_INDEX(pfn), 1, cacheAttribute);
KeLowerIrql(irql);
}
}
if (irql != 17) {
_InterlockedAnd64(&pfn->u2.Lock, 0x7FFFFFFFFFFFFFFF); // set Lock bit to 0
KeLowerIrql(irql); // rest IRQL
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment