IoReplacePartitionUnit
NTSTATUS __stdcall IoReplacePartitionUnit(_DEVICE_OBJECT *TargetPdo, _DEVICE_OBJECT *SparePdo, UINT64 Flags){
unsigned int v4;
_OWORD v7[5];
v4 = Flags;
memset(v7, 0i64, sizeof(v7));
*(_QWORD *)&v7[0] = TargetPdo;
*((_QWORD *)&v7[0] + 1) = SparePdo;
*(_QWORD *)&v7[1] = v4 | 0xC000000100000000ui64;
KeInitializeEvent((INT64)&v7[1] + 8, 0, 0);
if( KeGetCurrentThread()->ApcState.Process == PsInitialSystemProcess )
{
PnpReplacePartitionUnit(v7);
}
else
{
*(_QWORD *)&v7[3] = 0i64;
*(_QWORD *)&v7[4] = PnpReplacePartitionUnit;
*((_QWORD *)&v7[4] + 1) = v7;
ExQueueWorkItem((PWORK_QUEUE_ITEM)&v7[3], DelayedWorkQueue);
KeWaitForSingleObject((UINT64)&v7[1] + 8, 0, 0, 0, 0i64);
}
return DWORD1(v7[1]);
}Referenced by:
NtReplacePartitionUnit