MiDeleteHotPatchEntry
NTSTATUS __stdcall MiDeleteHotPatchEntry(PVOID P){
_EPROCESS *Process;
VOID **v3;
void *v4;
Process = KeGetCurrentThread()->ApcState.Process;
while( 1 )
{
v3 = (VOID **)*((_QWORD *)P + 7);
if( !v3 )
break;
*((_QWORD *)P + 7) = *v3;
MmUnsecureVirtualMemory(v3[2]);
MiUnmapViewOfSection(Process, v3[1], 0i64);
ExFreePoolWithTag(v3, 0);
}
RtlFreeAnsiString((_UNICODE_STRING *)P + 4);
v4 = (void *)*((_QWORD *)P + 5);
if( v4 )
ExFreePoolWithTag(v4, 0);
return(unsigned int)ExFreePoolWithTag(P, 0);
}Referenced by:
MiDeleteImageHotPatchState
MiHotPatchImage