KeSaveSupervisorState
VOID __stdcall KeSaveSupervisorState(INT64 a1, INT64 a2){
INT64 v2;
unsigned __int64 v4;
if( a1 )
{
v2 = a2;
if( (_DWORD)KiIptMsrMask && (a2 & 0x100) != 0 )
KiSaveIptState((UINT64 *)(KUSER_SHARED_DATA.XState.AllFeatureSize
- (unsigned __int64)KUSER_SHARED_DATA.XState.Size
+ a1
+ 64));
if( ((unsigned __int64)KeFeatureBits & 0x800000) != 0 )
{
if( KUSER_SHARED_DATA.XState.EnabledSupervisorFeatures )
{
v4 = KUSER_SHARED_DATA.XState.EnabledSupervisorFeatures & v2;
*(_QWORD *)(a1 + 8) = KUSER_SHARED_DATA.XState.EnabledSupervisorFeatures & v2;
RtlXSaveS(a1 - 512, v4);
}
}
}
}Referenced by:
IopLiveDumpEndMirroringCallback
IopLiveDumpProcessCorralStateChange
KdEnterDebugger
KeBugCheck2
KiFreezeTargetExecution