VfThunkAdjustExportAddressIfHooked
NTSTATUS __stdcall VfThunkAdjustExportAddressIfHooked(PVOID ExportAddress, UNICODE_STRING *SystemRoutineName){
unsigned __int8 *v4;
v4 = (unsigned __int8 *)ExportAddress;
if( !(unsigned int)ViThunkAdjustExportAddressIfHooked(&v4, SystemRoutineName, (char **)&VfRegularThunks, 48i64)
&& !(unsigned int)ViThunkAdjustExportAddressIfHooked(
&v4,
SystemRoutineName,
(char **)&VfOrderDependentThunks,
56i64)
&& !(unsigned int)ViThunkAdjustExportAddressIfHooked(&v4, SystemRoutineName, (char **)&VfMandatoryThunks, 48i64)
&& !(unsigned int)ViThunkAdjustExportAddressIfHooked(&v4, SystemRoutineName, (char **)&VfPoolThunks, 48i64) )
{
ViThunkAdjustExportAddressIfHooked(&v4, SystemRoutineName, (char **)&VfXdvThunks, 48i64);
}
return(int)v4;
}Referenced by:
VerifierMmGetSystemRoutineAddress