IoGetLoadedDriverInfo
NTSTATUS __stdcall IoGetLoadedDriverInfo(UINT8 AtBugCheck, UINT64 *lpDriverCount, UINT64 *lpSizeOfStringData){
PVOID *v3;
int v4;
int i;
int v9;
NTSTATUS result;
v3 = (PVOID *)PsLoadedModuleList;
v4 = 0;
for( i = 0; ; i += v9 + 9 )
{
if( v3 == &PsLoadedModuleList )
{
*(_DWORD *)lpDriverCount = v4;
result = 0;
*(_DWORD *)lpSizeOfStringData = i;
return result;
}
if( AtBugCheck
&& (!KiIsAddressRangeValid((INT64)v3, 160i64)
|| !KiIsAddressRangeValid((INT64)v3[12], *((unsigned __int16 *)v3 + 44))) )
{
break;
}
v9 = *((unsigned __int16 *)v3 + 44);
++v4;
v3 = (PVOID *)*v3;
}
return -1073741823;
}Referenced by:
IoFillTriageDumpBuffer
KeCapturePersistentThreadState