PsTestProtectedProcessIncompatibility
bool __fastcall PsTestProtectedProcessIncompatibility(UINT64 a1, __int64 a2, __int64 a3){
bool result;
__int64 v4;
__int64 v5;
result = 0;
if( a2 != a3 )
{
LOBYTE(a2) = *(_BYTE *)(a2 + 2170);
if( PspCheckForInvalidAccessByProtection(a1, a2, *(_BYTE *)(a3 + 2170)) )
{
if( !qword_140C1D980 || !(unsigned __int8)qword_140C1D980(v5, v4) )
return 1;
}
}
return result;
}Referenced by:
DbgkCopyProcessDebugPort
DbgkOpenProcessDebugPort
DbgkpSendErrorMessage
NtCreateUserProcess
NtDebugActiveProcess
NtRemoveProcessDebug
PspProcessOpen
PspThreadOpen