KeChangeEnclavePageProtection
NTSTATUS __fastcall KeChangeEnclavePageProtection(__int64 a1, char a2){
int *v2;
unsigned int v4;
int v5;
int v6;
int v7;
unsigned int v8;
_BYTE v10[80];
v2 = (int *)((unsigned __int64)v10 & 0xFFFFFFFFFFFFFFC0ui64);
if( ((unsigned __int64)KeFeatureBits & 0x80000000000i64) == 0 )
return -1073741637;
memset((VOID *)((unsigned __int64)v10 & 0xFFFFFFFFFFFFFFC0ui64), 0i64, 0x40u);
if( (a2 & 8) != 0 )
{
v4 = 15;
*v2 = 256;
}
else if( a2 >= 0 )
{
v4 = 14;
v5 = a2 & 1;
v6 = *v2;
if( (a2 & 1) != 0 )
v6 = 1;
*v2 = v6;
if( (a2 & 2) != 0 )
*v2 = v5 | 2;
v7 = v5 | 2;
if( (a2 & 2) == 0 )
v7 = a2 & 1;
if( (a2 & 4) != 0 )
*v2 = v7 | 4;
}
else
{
v4 = 15;
*v2 = 1024;
}
do
v8 = KiEncls(v4);
while( v8 == 15 );
return KiEnclsStatus(v8);
}Referenced by:
MiProtectEnclavePages