ViIsDriverSuspectForVerifier
UINT64 __stdcall ViIsDriverSuspectForVerifier(_KLDR_DATA_TABLE_ENTRY *DataTableEntry){
_VF_SUSPECT_DRIVER_ENTRY *Flink;
UINT64 result;
_UNICODE_STRING *p_BaseDllName;
Flink = VfSuspectDriversList;
result = 0i64;
if( VfSuspectDriversList != (_VF_SUSPECT_DRIVER_ENTRY *)&VfSuspectDriversList )
{
p_BaseDllName = &DataTableEntry->BaseDllName;
do
{
result = (unsigned __int8)RtlEqualUnicodeString(&Flink->BaseName, p_BaseDllName, 1u);
if( (_BYTE)result )
break;
Flink = (_VF_SUSPECT_DRIVER_ENTRY *)Flink->Links.Flink;
}
while( Flink != (_VF_SUSPECT_DRIVER_ENTRY *)&VfSuspectDriversList );
}
return result;
}Referenced by:
MmIsDriverSuspectForVerifier
VfIsVerificationEnabledForImage
ViThunkApplyThunksCurrentSession