MiInitializeKernelCfg
NTSTATUS __stdcall MiInitializeKernelCfg(){
NTSTATUS result;
unsigned __int64 v1;
_MMPTE *v2;
_MMPTE *PteBase;
INT64 v4;
_ETHREAD *CurrentThread;
_KLDR_DATA_TABLE_ENTRY *i;
UINT64 DllBase;
INT64 v8;
INT64 v9;
if( (MiFlags & 0x80000) == 0 )
return 0;
v1 = *(&stru_140C4DB30 + 935);
v2 = MiReservePtes((_MI_SYSTEM_PTE_TYPE *)((char *)&stru_140C4DB30 + 4432), 0x20ui64);
if( !v2 )
return -1073741670;
PteBase = MmGetPteBase();
result = VslInitializeSecureKernelCfg(v1, (__int64)(((_QWORD)v2 << 25) - ((_QWORD)PteBase << 25)) >> 16);
if( result >= 0 )
{
qword_140C4C978 = v1;
qword_140C4C970 = 0x100000000000i64;
LODWORD(v9) = 0;
if( MiMakeZeroedPageTablesEx(
(INT64)PteBase + ((v1 >> 9) & 0x7FFFFFFFF8i64),
(INT64)PteBase + (((v1 + 0x1FFFFFFFFFFi64) >> 9) & 0x7FFFFFFFF8i64),
4ui64,
9i64,
v9) )
{
stru_140C4C980._bf_0 = 0i64;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
ExAcquireResourceExclusiveLite((UINT64)&PsLoadedModuleResource, 1, v4);
for( i = (_KLDR_DATA_TABLE_ENTRY *)PsLoadedModuleList;
i != (_KLDR_DATA_TABLE_ENTRY *)&PsLoadedModuleList;
i = (_KLDR_DATA_TABLE_ENTRY *)i->InLoadOrderLinks.Flink )
{
if( (i->Flags & 0x2000) == 0 )
{
DllBase = (UINT64)i->DllBase;
if( DllBase == PsNtosImageBase )
{
LODWORD(v8) = RtlImageNtHeader(DllBase);
MiMarkKernelImageCfgBits(i, v8);
i->Flags |= 0x2000u;
}
else
{
MiProcessKernelCfgImageLoadConfig(i, 0i64);
MiProcessKernelCfgImage(i, 0, 0i64);
}
}
}
MiProcessKernelCfgAddressTakenImports(PsLoadedModuleList);
ExReleaseResourceLite(&PsLoadedModuleResource);
KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
guard_icall_bitmap = qword_140C4C978 - 0x3FFFE0000000000i64;
return 0;
}
return -1073741670;
}
return result;
}Referenced by:
MiInitSystem