KiShadowProcessorAllocation
INT64 __fastcall KiShadowProcessorAllocation(INT64 a1, CHAR *a2){
int v4;
IMAGE_NT_HEADERS *v6;
_DWORD *v7;
unsigned int v8;
if( !(_BYTE)KiKvaShadow )
return 1i64;
if( (unsigned int)MmCreateShadowMapping(a2, 20480i64) )
{
v4 = 0;
if( !(unsigned int)MmCreateShadowMapping((PVOID)(a1 + 36480), 4096i64) )
goto LABEL_11;
v4 = 1;
if( !*(_DWORD *)(a1 + 36) )
{
v6 = RtlImageNtHeader((PVOID)0x140000000i64);
RtlSectionTableFromVirtualAddress(v6, 0x140000000ui64);
v8 = v7[2];
if( v8 <= v7[4] )
v8 = v7[4];
if( !(unsigned int)MmCreateShadowMapping((PVOID)(0x140000000i64 + (unsigned int)v7[3]), (v8 + 4095) & 0xFFFFF000) )
{
LABEL_11:
MmDeleteShadowMapping(a2, 0x5000ui64);
if( v4 )
MmDeleteShadowMapping((PVOID)(a1 + 36480), 0x1000ui64);
return 0i64;
}
}
return 1i64;
}
return 0i64;
}Referenced by:
KeWriteProtectProcessorState
KiEnableKvaShadowing