MmRemoveSystemCacheFromDump
void __fastcall MmRemoveSystemCacheFromDump(ULONG_PTR BugCheckParameter2){
CHAR *AnyMultiplexedVm;
INT64 v3;
INT64 *v4;
INT64 *SharedVm;
_WORD result[3];
UINT8 result_6;
CHAR *v8;
__int64 v9;
INT64(__fastcall *v10)(INT64, INT64, INT64);
ULONG_PTR v11;
memset((INT64)result, 0i64);
v9 = -1i64;
v10 = MiCrashdumpRemovePte;
v11 = BugCheckParameter2;
AnyMultiplexedVm = MiGetAnyMultiplexedVm(0i64);
v3 = (INT64)AnyMultiplexedVm;
v8 = AnyMultiplexedVm;
if( (KiBugCheckActive & 3) != 0 || (struct _KTHREAD *)qword_140C4E448 == KeGetCurrentThread() )
{
result_6 = 17;
SharedVm = MiGetSharedVm((INT64)AnyMultiplexedVm);
if( !(unsigned int)ExTryAcquireSpinLockExclusiveAtDpcLevel(SharedVm) )
KeBugCheckEx(0x1Au, 0x50000ui64, BugCheckParameter2, 0i64, 0i64);
}
else
{
result[0] = 6;
result_6 = MiLockWorkingSetShared((INT64)AnyMultiplexedVm);
}
MiWalkPageTables((INT64)result);
if( result_6 == 17 )
{
MiCheckProcessShadow();
v4 = MiGetSharedVm(v3);
ExReleaseSpinLockExclusiveFromDpcLevel(v4);
}
else
{
MiUnlockWorkingSetShared(v3, result_6);
}
}Referenced by:
IopLiveDumpRemoveSystemCacheFromDump
MmGetDumpRange