VslObtainHotPatchUndoTable
INT64 __stdcall VslObtainHotPatchUndoTable(PVOID Base){
__int64 v1;
unsigned int v2;
__int64 v3;
__int64 v4;
unsigned int v6;
_MDL *PoolWithTag;
INT64 v8;
int v10;
INT64 v11[10];
INT64 result[14];
v3 = v2;
v4 = v1;
memset((INT64)result, 0i64);
memset((INT64)v11, 0i64);
v6 = MmSizeOfMdl(Base, (unsigned int)v3);
PoolWithTag = (_MDL *)ExAllocatePoolWithTag(NonPagedPoolNx, v6, 0x54736D56ui64);
v8 = (INT64)PoolWithTag;
if( !PoolWithTag )
return 3221225626i64;
PoolWithTag->Next = 0i64;
PoolWithTag->Size = 8 * ((((unsigned __int64)(v4 & 0xFFF) + v3 + 4095) >> 12) + 6);
PoolWithTag->MdlFlags = 0;
PoolWithTag->StartVa = (void *)(v4 & 0xFFFFFFFFFFFFF000ui64);
PoolWithTag->ByteOffset = v4 & 0xFFF;
PoolWithTag->ByteCount = v3;
MmProbeAndLockPages(PoolWithTag, 0, IoWriteAccess);
v10 = VslpLockPagesForTransfer((INT64)v11, v8, v6, 1i64, 0);
if( v10 >= 0 )
{
result[1] = (INT64)Base;
result[2] = v11[0];
result[3] = v11[7];
v10 = VslpEnterIumSecureMode(2u, 69, 0i64, (INT64)result);
VslpUnlockPagesForTransfer((INT64 **)v11);
}
if( (*(_BYTE *)(v8 + 10) & 2) != 0 )
MmUnlockPages((_MDL *)v8);
ExFreePoolWithTag((PVOID)v8, 0);
return(unsigned int)v10;
}Referenced by:
MiApplyDriverHotPatch
MiUnapplyDriverHotPatch