VfDriverUnloadImage
VOID __stdcall VfDriverUnloadImage(_KLDR_DATA_TABLE_ENTRY *DataTableEntry){
unsigned int SizeOfImage;
void *DllBase;
PVOID *v4;
PVOID *v5;
PVOID *v6;
PVOID *v7;
if( VfIsVerifierEnabled() )
{
SizeOfImage = DataTableEntry->SizeOfImage;
DllBase = DataTableEntry->DllBase;
VfDeadlockDeleteMemoryRange(DllBase, SizeOfImage);
VfRemLockDeleteMemoryRange(DllBase, SizeOfImage);
}
if( ViActiveVerifierThunks )
{
ViThunkRemoveImportEntry(&ViVerifierDriverAddedThunkListHead, DataTableEntry);
v4 = (PVOID *)ViVerifierDriverAddedSpecialThunkListHead;
while( v4 != &ViVerifierDriverAddedSpecialThunkListHead )
{
ViThunkRemoveImportEntry((_LIST_ENTRY *)(v4 + 3), DataTableEntry);
v5 = (PVOID *)*v4;
if( v4[3] == v4 + 3 )
{
if( v5[1] != v4 || (v6 = (PVOID *)v4[1], *v6 != v4) )
__fastfail(3u);
*v6 = v5;
v7 = v4;
v5[1] = v6;
v4 = (PVOID *)*v4;
ExFreePoolWithTag(v7, 0);
--ViVerifierSpecialThunkTables;
}
else
{
v4 = (PVOID *)*v4;
}
}
}
VfTargetDriversRemove(DataTableEntry);
if( (DataTableEntry->Flags & 0x2000000) != 0 )
VfSuspectDriversUnloadCallback(DataTableEntry);
}Referenced by:
No references.