MiPrepareDriverPatchState
INT64 __fastcall MiPrepareDriverPatchState(INT64 a1){
__int64 v2;
LODWORD(v2) = MiAllocatePool((struct _SLIST_ENTRY *)0x40);
if( !v2 )
return 3221225626i64;
*(_QWORD *)(a1 + 24) = *(unsigned int *)(a1 + 16);
*(_QWORD *)(a1 + 32) = v2;
*(_DWORD *)(a1 + 56) = 0;
if( (unsigned int)MI_IS_PHYSICAL_ADDRESS(*(PVOID *)(*(_QWORD *)a1 + 48i64)) )
*(_DWORD *)(a1 + 56) = 2;
return 0i64;
}Referenced by:
MiApplyDriverHotPatch
MiLockAndMapEntireDriver
MiUnapplyDriverHotPatch
MmWriteSystemImageTracepoint