MiCaptureDirtyBitToPfn
VOID __fastcall MiCaptureDirtyBitToPfn(){
__int64 v0;
unsigned __int8 v1;
__int64 v2;
_MMPTE *v3;
v1 = *(_BYTE *)(v0 + 34);
v2 = v0;
if( (v1 & 0x10) == 0 )
{
v3 = (_MMPTE *)(v0 + 16);
if( (((v3->u.Long & 0x400) == 0) & (unsigned __int8)~(v1 >> 3)) != 0 )
{
MiCapturePageFileInfoInline(v3, 1ui64, 0i64);
v1 = *(_BYTE *)(v2 + 34);
}
*(_BYTE *)(v2 + 34) = v1 | 0x10;
}
}Referenced by:
MiBuildForkPte
MiCompleteSecureProcessFault
MiDeletePteList
MiDeleteValidSystemPage
MiFinishHardFault
MiLockDriverPageRange
MiLockPageAndSetDirty
MiLockPagedAddress
MiMakeOutswappedPageResident
MiResolveProtoCombine
MiResolveTransitionFault
MiScanPagefileSpace
MiSetSystemCodeProtection
MiTrimSystemImagePages
MiUpdateImportRelocationsOnDriverPrivatePages
MiWalkEntireImage
MiWsleFree
MiZeroCfgSystemWideBitmapWorker
MmDbgMarkPfnModifiedWorker
MmProtectPool
MmReplaceImportEntry
MmSetAddressRangeModifiedEx
MmUnmapViewInSystemCache
MmUpdateUserShadowStackValue