MiGetPteMappingPair
CHAR *__fastcall MiGetPteMappingPair(INT64 a1, INT64 a2){
CHAR *result;
unsigned __int8 CurrentIrql;
UINT64 HyperSpace;
if( (_DWORD)a1 != 1 || (result = (CHAR *)MiCreatePteCopyList(2ui64, 2ui64, a2), !*(_DWORD *)(a2 + 4)) )
{
CurrentIrql = KeGetCurrentIrql();
__writecr8(2ui64);
*(_BYTE *)(a2 + 8) = CurrentIrql;
HyperSpace = MiAllocateHyperSpace(2ui64);
*(_DWORD *)a2 = 0;
*(_DWORD *)(a2 + 4) = 2;
result = (char *)MmGetPteBase() + ((HyperSpace >> 9) & 0x7FFFFFFFF8i64);
*(_BYTE *)(a2 + 9) = 1;
*(_QWORD *)(a2 + 16) = result;
}
return result;
}Referenced by:
MiSlowRotateCopy