KiSaveIptState
VOID __stdcall KiSaveIptState(UINT64 *a1){
int v1;
UINT64 v2;
UINT64 *v3;
unsigned __int64 v4;
_QWORD *v5;
unsigned int i;
unsigned __int64 v7;
v1 = 0;
if( KiXSaveAreaLength )
{
v2 = __readmsr(0x570u);
*a1 = v2;
v3 = a1 + 1;
if( (v2 & 1) != 0 )
__writemsr(0x570u, v2 - 1);
if( ((unsigned __int8)KiIptMsrMask & 2) != 0 )
{
*v3 = __readmsr(0x560u);
v3 = a1 + 2;
}
if( ((unsigned __int8)KiIptMsrMask & 4) != 0 )
*v3++ = __readmsr(0x561u);
v4 = __readmsr(0x571u);
*v3 = ((unsigned __int64)HIDWORD(v4) << 32) | (unsigned int)v4;
v5 = v3 + 1;
if( ((unsigned __int8)KiIptMsrMask & 0x10) != 0 )
*v5++ = __readmsr(0x572u);
for( i = 1409; i < 0x589; i += 2 )
{
if( !_bittest((const signed __int32 *)&KiIptMsrMask, v1 + 5) )
break;
*v5 = __readmsr(i - 1);
v7 = __readmsr(i);
++v1;
v5[1] = v7;
v5 += 2;
}
}
}Referenced by:
KeSaveIptStateBeforeProcessorGoesOffline
KeSaveSupervisorState
KiSaveThreadIptState