VfThunkApplyDriverAddedThunks
VOID __stdcall VfThunkApplyDriverAddedThunks(_KLDR_DATA_TABLE_ENTRY *DataTableEntry, UINT64 Length, UINT64 Alignment){
void *DllBase;
UINT64 *v4;
UINT64 *v5;
UINT64 v6;
_DRIVER_SPECIFIED_SPECIAL_VERIFIER_THUNKS **AllSpecialTables;
_DRIVER_SPECIFIED_SPECIAL_VERIFIER_THUNKS *v8;
__int64 v9;
int v10;
UINT64 v11;
DllBase = DataTableEntry->DllBase;
LODWORD(v11) = 0;
v4 = (UINT64 *)RtlImageDirectoryEntryToData(DllBase, 1u, 0xCu, &v11);
v5 = v4;
if( v4 )
{
v6 = (unsigned int)v11 >> 3;
AllSpecialTables = ViThunkFindAllSpecialTables(v4, v6);
if( (_DWORD)v6 )
{
do
{
if( !AllSpecialTables )
goto LABEL_8;
v8 = *AllSpecialTables;
LODWORD(v9) = 0;
if( !*AllSpecialTables )
goto LABEL_8;
do
{
v10 = ViThunkReplaceImportEntry((_LIST_ENTRY *)(v8 + 6), v5);
if( v10 == 1 )
break;
v9 = (unsigned int)(v9 + 1);
v8 = AllSpecialTables[v9];
}
while( v8 );
if( !v10 )
LABEL_8:
ViThunkReplaceImportEntry(&ViVerifierDriverAddedThunkListHead, v5);
++v5;
--v6;
}
while( v6 );
}
if( AllSpecialTables )
ExFreePoolWithTag(AllSpecialTables, 0);
}
}Referenced by:
ViDriverReApplyVerifierForAll